From fa9ac6974e8b9a3af7e84d190b1af91734ab2ca6 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Wed, 13 May 2026 14:05:10 -0400
Subject: [PATCH] Harden Flask dev server auth and escaping
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add hosted domain check to _verify_google_token (mirror Lambda)
- Gate auth on config (client_id presence), not request body — prevents
  bypass by omitting google_id_token when auth is configured
- Add discount percentage clamping to match Lambda handler
- Add </script> escaping to google_client_id_json
---
 src/server/app.py           | 11 +++++++++--
 src/server/generate_form.py |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/server/app.py b/src/server/app.py
index c1b8f72..38b5d61 100644
--- a/src/server/app.py
+++ b/src/server/app.py
@@ -90,6 +90,8 @@ def _verify_google_token(token: str, client_id: str) -> dict | None:
             data = json.loads(resp.read())
         if data.get("aud") != client_id:
             return None
+        if data.get("hd") != "seahavenind.com":
+            return None
         return {"name": data.get("name", ""), "email": data.get("email", "")}
     except Exception:
         return None
@@ -101,9 +103,12 @@ def submit_order():
     if not data:
         return jsonify({"error": "No data received"}), 400
 
+    client_id = _get_google_client_id()
     google_token = data.get("google_id_token")
-    if google_token:
-        client_id = _get_google_client_id()
+
+    if client_id:
+        if not google_token:
+            return jsonify({"error": "Google authentication is required"}), 403
         user_info = _verify_google_token(google_token, client_id)
         if not user_info:
             return jsonify({"error": "Invalid or unauthorized Google account"}), 403
@@ -126,6 +131,8 @@ def submit_order():
     TWO_PLACES = Decimal("0.01")
     bulk_pct = Decimal(str(config.get("bulk_discount_percent", 0)))
     subsidy_pct = Decimal(str(config.get("company_subsidy_percent", 0)))
+    bulk_pct = max(Decimal("0"), min(Decimal("100"), bulk_pct))
+    subsidy_pct = max(Decimal("0"), min(Decimal("100"), subsidy_pct))
     bulk_mult = Decimal("1") - (bulk_pct / Decimal("100"))
     subsidy_mult = Decimal("1") - (subsidy_pct / Decimal("100"))
 
diff --git a/src/server/generate_form.py b/src/server/generate_form.py
index 0635ea0..aa0aab7 100644
--- a/src/server/generate_form.py
+++ b/src/server/generate_form.py
@@ -56,7 +56,7 @@ def generate_form(
     api_key_json = json.dumps(api_key).replace("</", "<\\/")
     has_discount = bulk_discount > 0 or company_subsidy > 0
     use_google_auth = bool(google_client_id)
-    google_client_id_json = json.dumps(google_client_id)
+    google_client_id_json = json.dumps(google_client_id).replace("</", "<\\/")
 
     if use_google_auth:
         auth_section_html = """  <div class="employee-info">