Verbessere Codequalität und Sicherheit durch Refactoring, Hinzufügen von ESLint-Regeln und Aktualisierung der OSV-Scanner-Konfiguration

server/api/auth/passkeys/login.post.js

@@ -9,9 +9,6 @@ import { getClientIp } from '../../../utils/rate-limit.js'
 
 // Local fallback for Nitro globals when lint/run env doesn't provide them
 const getMethod = globalThis.getMethod ?? ((e) => (e?.req?.method || e?.method || 'GET'))
-const getRequestURL = globalThis.getRequestURL ?? ((e) => {
-  try { return new URL(e?.req?.url, 'http://localhost') } catch { return { href: String(e?.req?.url || ''), pathname: String(e?.req?.url || '').split('?')[0] || '' } }
-})
 
 function findUserByCredentialId(users, credentialId) {
   const cid = String(credentialId || '')

server/api/membership/generate-pdf.post.js

@@ -613,7 +613,6 @@ export default defineEventHandler(async (event) => {
   // E-Mail senden via zentralen Service (pass full path)
   emailResult = await sendMembershipEmailUtil(data, finalPdfPath)
         // Antragsdaten verschlüsselt speichern
-        const encryptionKey = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
         const encryptedData = JSON.stringify(data)
         // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
         // filename is generated from timestamp, not user input, path traversal prevented
@@ -674,7 +673,6 @@ export default defineEventHandler(async (event) => {
   emailResult = await sendMembershipEmailUtil(data, finalPdfPath)
       
       // Antragsdaten verschlüsselt speichern
-      const encryptionKey = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
       const encryptedData = JSON.stringify(data)
       // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
       // filename is generated from timestamp, not user input, path traversal prevented

server/api/newsletter/groups/[id]/posts/list.get.js

@@ -1,6 +1,7 @@
 import fs from 'fs/promises'
 import path from 'path'
 import { getUserFromToken, hasAnyRole } from '../../../../../utils/auth.js'
+import { decryptObject } from '../../../../../utils/encryption.js'
 
 // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
 // filename is always a hardcoded constant (e.g., 'newsletter-posts.json'), never user input

server/api/spielplan/table.get.js

@@ -1,5 +1,4 @@
 import { promises as fs } from 'fs'
-import path from 'path'
 import { getCurrentSeasonSlug, validateSeasonSlug } from '../../utils/spielplan-data.js'
 import { getServerDataPath } from '../../utils/paths.js'
 import { error as loggerError } from '../../utils/logger.js'