security: second-pass ownership checks + input validation fixes

- medication-profiles/[id]: verify familyId ownership before PATCH/DELETE
- event-templates/[id]: verify familyId ownership before PATCH/DELETE
- notify/push: verify baby.familyId matches session family before push
- events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize
  limit (1–500) and offset (≥0) to prevent NaN/unbounded queries
- v1/summary: fix operator precedence bug in feeds count calculation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/event-templates/[id]/route.ts

@@ -12,6 +12,11 @@ export async function PATCH(
   const { id } = await params;
   const body = await req.json();
 
+  const user = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } });
+  if (!user?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const owned = await prisma.eventTemplate.findFirst({ where: { id, familyId: user.familyId } });
+  if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   const template = await prisma.eventTemplate.update({
     where: { id },
     data: {
@@ -33,6 +38,12 @@ export async function DELETE(
   if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
 
   const { id } = await params;
+
+  const delUser = await prisma.user.findUnique({ where: { id: session.user.id }, select: { familyId: true } });
+  if (!delUser?.familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const delOwned = await prisma.eventTemplate.findFirst({ where: { id, familyId: delUser.familyId } });
+  if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   await prisma.eventTemplate.delete({ where: { id } });
   return new NextResponse(null, { status: 204 });
 }

src/app/api/events/route.ts

@@ -3,6 +3,7 @@ import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
 import { logAudit } from "@/lib/audit";
 import { dispatchWebhook } from "@/lib/webhooks";
+import { ALL_EVENT_TYPES } from "@/lib/event-config";
 
 export async function GET(req: Request) {
   const session = await auth();
@@ -10,9 +11,12 @@ export async function GET(req: Request) {
 
   const { searchParams } = new URL(req.url);
   const babyId = searchParams.get("babyId");
-  const limit = parseInt(searchParams.get("limit") ?? "50");
-  const offset = parseInt(searchParams.get("offset") ?? "0");
+  const limit = Math.max(1, Math.min(parseInt(searchParams.get("limit") ?? "50") || 50, 500));
+  const offset = Math.max(0, parseInt(searchParams.get("offset") ?? "0") || 0);
   const type = searchParams.get("type");
+  if (type && !ALL_EVENT_TYPES.includes(type as never)) {
+    return NextResponse.json({ error: "Type invalide" }, { status: 400 });
+  }
   const dateFrom = searchParams.get("dateFrom");
   const dateTo = searchParams.get("dateTo");
 

src/app/api/medication-profiles/[id]/route.ts

@@ -12,6 +12,11 @@ export async function PATCH(
   const { id } = await params;
   const body = await req.json();
 
+  const familyId = (session.user as { familyId?: string }).familyId;
+  if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const owned = await prisma.medicationProfile.findFirst({ where: { id, familyId } });
+  if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   const profile = await prisma.medicationProfile.update({
     where: { id },
     data: {
@@ -35,6 +40,12 @@ export async function DELETE(
   if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
 
   const { id } = await params;
+
+  const delFamilyId = (session.user as { familyId?: string }).familyId;
+  if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+  const delOwned = await prisma.medicationProfile.findFirst({ where: { id, familyId: delFamilyId } });
+  if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
+
   await prisma.medicationProfile.delete({ where: { id } });
   return new NextResponse(null, { status: 204 });
 }

src/app/api/notify/push/route.ts

@@ -16,6 +16,11 @@ export async function POST(req: Request) {
   });
   if (!baby) return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 });
 
+  const sessionFamilyId = (session.user as { familyId?: string }).familyId;
+  if (!sessionFamilyId || baby.familyId !== sessionFamilyId) {
+    return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 });
+  }
+
   const lastFeed = await prisma.event.findFirst({
     where: { babyId, type: { in: ["BREASTFEED", "BOTTLE"] } },
     orderBy: { startedAt: "desc" },

src/app/api/v1/summary/route.ts

@@ -36,7 +36,7 @@ export async function GET(req: Request) {
   return NextResponse.json({
     date: dayStart.toISOString().slice(0, 10),
     counts,
-    feeds: counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0),
+    feeds: (counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0),
     diapers: (counts.DIAPER_WET ?? 0) + (counts.DIAPER_STOOL ?? 0),
     sleepMinutes: Math.round(sleepMs / 60000),
     lastFeedAt: lastFeed ? lastFeed.startedAt : null,