From 0475e3084de58e7cd1cde55c966cd1d2e84b5f8f Mon Sep 17 00:00:00 2001
From: "Torsten Schulz (local)" <tsschulz@gmx.net>
Date: Wed, 12 Aug 2026 12:03:29 +0200
Subject: [PATCH] lint fehler behoben

---
 server/api/membership/update-status.put.js |  2 --
 server/utils/membership-applications.js    | 31 +++++++++++-----------
 server/utils/push-notifications.js         |  4 +--
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/server/api/membership/update-status.put.js b/server/api/membership/update-status.put.js
index 06ee60f..f4373aa 100755
--- a/server/api/membership/update-status.put.js
+++ b/server/api/membership/update-status.put.js
@@ -42,8 +42,6 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-    const dataDir = getServerDataPath('membership-applications')
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
     const filePath = getServerDataPath('membership-applications', `${id}.json`)
     
diff --git a/server/utils/membership-applications.js b/server/utils/membership-applications.js
index e0bb21a..bf7fbda 100644
--- a/server/utils/membership-applications.js
+++ b/server/utils/membership-applications.js
@@ -46,27 +46,26 @@ async function withIdentityLock(hash, operation) {
 }
 
 async function findMatchingApplication(data) {
-  let files = []
   try {
-    files = await fs.readdir(APPLICATIONS_DIR)
+    const files = await fs.readdir(APPLICATIONS_DIR)
+    const target = identityHash(data)
+    for (const file of files.filter(file => file.endsWith('.json'))) {
+      try {
+        const application = JSON.parse(await fs.readFile(`${APPLICATIONS_DIR}/${file}`, 'utf8'))
+        if (application.identityHash === target) return application
+        if (application.encryptedData) {
+          const personalData = decryptObject(application.encryptedData, encryptionKey())
+          if (identityHash(personalData) === target) return application
+        }
+      } catch (error) {
+        console.warn('Mitgliedschaftsantrag konnte bei der Duplikatprüfung nicht gelesen werden:', { file, message: error.message })
+      }
+    }
+    return null
   } catch (error) {
     if (error?.code !== 'ENOENT') throw error
     return null
   }
-  const target = identityHash(data)
-  for (const file of files.filter(file => file.endsWith('.json'))) {
-    try {
-      const application = JSON.parse(await fs.readFile(`${APPLICATIONS_DIR}/${file}`, 'utf8'))
-      if (application.identityHash === target) return application
-      if (application.encryptedData) {
-        const personalData = decryptObject(application.encryptedData, encryptionKey())
-        if (identityHash(personalData) === target) return application
-      }
-    } catch (error) {
-      console.warn('Mitgliedschaftsantrag konnte bei der Duplikatprüfung nicht gelesen werden:', { file, message: error.message })
-    }
-  }
-  return null
 }
 
 export async function createMembershipApplication(data) {
diff --git a/server/utils/push-notifications.js b/server/utils/push-notifications.js
index c4b489d..8511f7c 100755
--- a/server/utils/push-notifications.js
+++ b/server/utils/push-notifications.js
@@ -102,7 +102,7 @@ export function upsertPushToken(user, { token, platform = 'android', appVersion
   return user
 }
 
-async function sendFcmMessage({ serviceAccount, accessToken, token, title, body, data = {} }) {
+async function sendFcmMessage({ serviceAccount, accessToken, token, data = {} }) {
   const projectId = projectIdFromServiceAccount(serviceAccount)
   if (!projectId) throw new Error('FCM project_id fehlt.')
   const response = await fetch(`https://fcm.googleapis.com/v1/projects/${projectId}/messages:send`, {
@@ -185,7 +185,7 @@ export async function sendPushToUsers({ title, body, data = {}, predicate, bodyF
     const validTokens = []
     for (const entry of tokens) {
       try {
-        await sendFcmMessage({ serviceAccount, accessToken, token: entry.token, title, body: userBody, data: payload })
+        await sendFcmMessage({ serviceAccount, accessToken, token: entry.token, data: payload })
         sent += 1
         validTokens.push(entry)
       } catch (error) {