Member registration fixed

server/api/membership/applications.get.js

@@ -2,6 +2,7 @@ import fs from 'fs/promises'
 import path from 'path'
 import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
+import { getServerDataPath } from '../../utils/paths.js'
 
 export default defineEventHandler(async (event) => {
   try {
@@ -17,7 +18,7 @@ export default defineEventHandler(async (event) => {
       })
     }
     
-    const dataDir = path.join(process.cwd(), 'server/data/membership-applications')
+    const dataDir = getServerDataPath('membership-applications')
     
     // Prüfen ob Verzeichnis existiert
     try {

server/api/membership/download/[id].get.js

@@ -1,5 +1,6 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { createHmac, timingSafeEqual } from 'crypto'
 import { getUserFromToken } from '../../../utils/auth.js'
 import { getServerDataPath } from '../../../utils/paths.js'
 
@@ -47,7 +48,27 @@ export default defineEventHandler(async (event) => {
       }
     }
     
-    // Prüfen ob es sich um eine aktuelle Session handelt (innerhalb der letzten 24 Stunden)
+    // Native apps cannot reliably reuse the httpOnly browser cookie that is
+    // set when the application is created.  They receive the same short-lived
+    // authorization as a signed response token instead.
+    const signedDownloadToken = getHeader(event, 'x-membership-download-token')
+    if (signedDownloadToken) {
+      try {
+        const [payload, signature] = signedDownloadToken.split('.')
+        const secret = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
+        const expected = createHmac('sha256', secret).update(payload).digest('base64url')
+        const validSignature = signature && timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
+        const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))
+        const tokenAge = Date.now() - Number(decoded.issuedAt)
+        if (validSignature && decoded.fileId === fileId && tokenAge >= 0 && tokenAge < 24 * 60 * 60 * 1000) {
+          isAuthorized = true
+        }
+      } catch (_error) {
+        // Invalid download tokens are treated as unauthorized.
+      }
+    }
+
+    // Browser clients continue to use the httpOnly cookie.
     const downloadToken = getCookie(event, 'download_token')
     
     if (downloadToken) {

server/api/membership/generate-pdf.post.js

@@ -1,11 +1,13 @@
 import { exec } from 'child_process'
 import { promisify } from 'util'
+import { createHmac } from 'crypto'
 import fs from 'fs/promises'
 import path from 'path'
 import { PDFDocument, StandardFonts, rgb } from 'pdf-lib'
 import { getDownloadCookieOptionsWithMaxAge } from '../../utils/cookies.js'
 import { sendMembershipEmail as sendMembershipEmailUtil } from '../../utils/email-service.js'
 import { getProjectPath, getServerDataPath } from '../../utils/paths.js'
+import { createMembershipApplication, removeMembershipApplication } from '../../utils/membership-applications.js'
 
 // const require = createRequire(import.meta.url) // Nicht verwendet
 const execAsync = promisify(exec)
@@ -310,9 +312,18 @@ function getDataPath(filename) {
   return getServerDataPath(filename)
 }
 
+function createMembershipDownloadToken(fileId) {
+  const issuedAt = Date.now()
+  const payload = Buffer.from(JSON.stringify({ fileId, issuedAt })).toString('base64url')
+  const secret = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
+  const signature = createHmac('sha256', secret).update(payload).digest('base64url')
+  return `${payload}.${signature}`
+}
+
 // Use central email service
 
 export default defineEventHandler(async (event) => {
+  let application = null
   try {
     const body = await readBody(event)
     
@@ -338,6 +349,10 @@ export default defineEventHandler(async (event) => {
       ...body,
       isVolljaehrig
     }
+
+    // Persist the pending application before generating files or sending mail.
+    // This also makes repeated taps and concurrent requests idempotently fail.
+    application = await createMembershipApplication(data)
     
     // Eindeutige Datei-ID generieren
     const timestamp = Date.now()
@@ -630,9 +645,11 @@ export default defineEventHandler(async (event) => {
           success: true,
           message: 'Beitrittsformular erfolgreich aus Template erzeugt und E-Mail gesendet.',
           downloadUrl: `/api/membership/download/${filename}.pdf`,
+          downloadToken: createMembershipDownloadToken(`${filename}.pdf`),
           emailSuccess: emailResult.success,
           emailMessage: emailResult.message,
-          usedTemplate: true
+          usedTemplate: true,
+          applicationId: application.id
         }
       }
 
@@ -690,8 +707,10 @@ export default defineEventHandler(async (event) => {
         success: true,
         message: 'Beitrittsformular erfolgreich erstellt und E-Mail gesendet.',
         downloadUrl: `/api/membership/download/${filename}.pdf`,
+        downloadToken: createMembershipDownloadToken(`${filename}.pdf`),
         emailSuccess: emailResult.success,
         emailMessage: emailResult.message,
+        applicationId: application.id
       }
       
     } catch (latexError) {
@@ -726,16 +745,22 @@ export default defineEventHandler(async (event) => {
         success: true,
         message: 'Beitrittsformular erfolgreich erstellt und E-Mail gesendet (Fallback-Lösung).',
         downloadUrl: `/api/membership/download/${fallbackFilename}`,
+        downloadToken: createMembershipDownloadToken(fallbackFilename),
         emailSuccess: emailResult.success,
         emailMessage: emailResult.message,
+        applicationId: application.id
       }
     }
     
   } catch (error) {
+    // A failed generation must not leave a pending application that prevents
+    // the applicant from trying again.
+    await removeMembershipApplication(application?.id)
     console.error('Fehler beim Generieren des PDFs:', error)
+    if (error?.statusCode) throw error
     throw createError({
       statusCode: 500,
       statusMessage: 'Fehler beim Generieren des PDFs'
     })
   }
-})
+})

server/api/membership/update-status.put.js

@@ -1,8 +1,8 @@
 import fs from 'fs/promises'
-import path from 'path'
 import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
 import { saveMember } from '../../utils/members.js'
+import { getServerDataPath } from '../../utils/paths.js'
 
 export default defineEventHandler(async (event) => {
   try {
@@ -43,9 +43,9 @@ export default defineEventHandler(async (event) => {
     }
     
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-    const dataDir = path.join(process.cwd(), 'server/data/membership-applications')
+    const dataDir = getServerDataPath('membership-applications')
     // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-    const filePath = path.join(dataDir, `${id}.json`)
+    const filePath = getServerDataPath('membership-applications', `${id}.json`)
     
     // Antrag laden
     const fileContent = await fs.readFile(filePath, 'utf8')
@@ -67,6 +67,7 @@ export default defineEventHandler(async (event) => {
         const newMember = {
           firstName: decryptedData.vorname,
           lastName: decryptedData.nachname,
+          geburtsdatum: decryptedData.geburtsdatum,
           email: decryptedData.email,
           phone: decryptedData.telefon_privat || decryptedData.telefon_mobil || '',
           address: `${decryptedData.strasse}, ${decryptedData.plz} ${decryptedData.ort}`,