From 8818535207c86074eba39e565321c6ec2ac74abf Mon Sep 17 00:00:00 2001
From: TurtleWolfe <TurtleWolfe@users.noreply.github.com>
Date: Sun, 5 Jul 2026 04:34:58 +0000
Subject: [PATCH] fix(review): security hardening + dead-code cleanup from
 systematic review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security:
- send-payment-email (edge fn): replace the broken auth check
  `authHeader.includes(serviceRoleKey)` — a non-constant-time SUBSTRING match
  that, with an unset key, coerced to `includes("undefined")` and matched any
  header — with a guarded, exact, constant-time Bearer-token comparison. This
  closed an arbitrary-email-send bypass (phishing from the app domain).
  NOTE: this fn is deployed; needs redeploy via the Management API.
- group-service.createGroup: validate every member_id is a well-formed UUID
  before it reaches getConnectedUserIds' PostgREST `.or(...)` interpolation
  (filter-injection guard), matching the validateUUID pattern used across
  connection-service / gdpr-service. Placed after the cheap structural checks
  so their specific errors still surface first.
- SignInForm: remove the fail-OPEN try/catch around checkRateLimit. The wrapper
  is fail-CLOSED by design (returns allowed:false on infra outage to stop brute
  force); the catch silently defeated that on sign-in — the highest-value
  brute-force target — while SignUp/ForgotPassword already call it directly.

XSS defense-in-depth:
- markdown-processor: neutralize dangerous RAW HTML in blog prose
  (<script>/<iframe>/<style>/<object>/<embed>/<form>, on*= handlers,
  javascript: URIs) while PRESERVING the benign structural tags the blog
  authors use (<div>/<span>/<details>/<summary>/<br>). Author-controlled today,
  but makes a fork that renders untrusted markdown safe by default. +6 tests.

Performance:
- SEOAnalysisPanel: memoize seoAnalyzer.analyze(post) so the full-body regex
  analysis doesn't re-run on unrelated re-renders (e.g. the copied toggle).

Dead code:
- delete src/config/blog.config.ts (zero importers repo-wide) and
  src/tests/unit/sync-service.test.ts.backup (stale, no live counterpart);
  remove a commented-out MSW block in src/test/setup.ts.

Tests: full suite 3577 passed / 0 failed (+7). Group-test fixtures updated from
fake ids (member-1, etc.) to valid UUIDs — the ids were never valid and the new
guard correctly rejects them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/components/auth/SignInForm/SignInForm.tsx |  25 +-
 .../SEOAnalysisPanel/SEOAnalysisPanel.tsx     |   6 +-
 src/config/blog.config.ts                     |  85 ---
 src/lib/blog/markdown-processor.test.ts       |  49 ++
 src/lib/blog/markdown-processor.ts            |  45 ++
 src/services/messaging/group-service.ts       |  11 +
 src/test/setup.ts                             |  19 -
 src/tests/unit/sync-service.test.ts.backup    | 598 ------------------
 .../functions/send-payment-email/index.ts     |  35 +-
 .../messaging/group-creation.test.ts          |  58 +-
 .../services/messaging/group-service.test.ts  |  71 ++-
 11 files changed, 237 insertions(+), 765 deletions(-)
 delete mode 100644 src/config/blog.config.ts
 delete mode 100644 src/tests/unit/sync-service.test.ts.backup

diff --git a/src/components/auth/SignInForm/SignInForm.tsx b/src/components/auth/SignInForm/SignInForm.tsx
index 49ca89c2..a59ed879 100644
--- a/src/components/auth/SignInForm/SignInForm.tsx
+++ b/src/components/auth/SignInForm/SignInForm.tsx
@@ -52,24 +52,13 @@ export default function SignInForm({
       return;
     }
 
-    // Check server-side rate limit (REQ-SEC-003)
-    // Fail-open: if rate limit check fails, allow sign-in attempt
-    let rateLimit: {
-      allowed: boolean;
-      remaining: number;
-      locked_until?: string | null;
-    } = {
-      allowed: true,
-      remaining: 5,
-    };
-    try {
-      rateLimit = await checkRateLimit(email, 'sign_in');
-    } catch (rateLimitError) {
-      logger.warn('Rate limit check failed, allowing sign-in attempt', {
-        error: rateLimitError,
-      });
-      // Continue with sign-in (fail-open for UX)
-    }
+    // Check server-side rate limit (REQ-SEC-003). checkRateLimit is
+    // fail-CLOSED by design (it returns allowed:false if the rate-limit
+    // infrastructure is down, to prevent brute force) — matching SignUpForm
+    // and ForgotPasswordForm, which also call it directly. Do NOT wrap it in a
+    // fail-open catch: that would silently disable brute-force protection on a
+    // backend outage, contradicting the wrapper's documented policy.
+    const rateLimit = await checkRateLimit(email, 'sign_in');
 
     if (!rateLimit.allowed) {
       const timeUntilReset = rateLimit.locked_until
diff --git a/src/components/molecular/SEOAnalysisPanel/SEOAnalysisPanel.tsx b/src/components/molecular/SEOAnalysisPanel/SEOAnalysisPanel.tsx
index ee469dfb..b949e4d3 100644
--- a/src/components/molecular/SEOAnalysisPanel/SEOAnalysisPanel.tsx
+++ b/src/components/molecular/SEOAnalysisPanel/SEOAnalysisPanel.tsx
@@ -1,6 +1,6 @@
 'use client';
 
-import React, { useState } from 'react';
+import React, { useState, useMemo } from 'react';
 import type { BlogPost } from '@/types/blog';
 import { seoAnalyzer } from '@/lib/blog/seo-analyzer';
 
@@ -26,7 +26,9 @@ export default function SEOAnalysisPanel({
   onToggle,
 }: SEOAnalysisPanelProps) {
   const [copied, setCopied] = useState(false);
-  const analysis = seoAnalyzer.analyze(post);
+  // analyze() runs regex/split over the full post body — memoize so it doesn't
+  // re-run on unrelated re-renders (e.g. the copied-toggle).
+  const analysis = useMemo(() => seoAnalyzer.analyze(post), [post]);
   const { score, suggestions, strengths, weaknesses } = analysis;
 
   const copyFeedback = () => {
diff --git a/src/config/blog.config.ts b/src/config/blog.config.ts
deleted file mode 100644
index 4644e2c7..00000000
--- a/src/config/blog.config.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-/**
- * Blog System Configuration
- * Central configuration for the blog system including storage limits,
- * sync intervals, and cache settings
- */
-
-export const blogConfig = {
-  // Storage Limits
-  storage: {
-    textLimit: 5 * 1024 * 1024, // 5MB for text content
-    imageLimit: 200 * 1024 * 1024, // 200MB for images
-    maxPostSize: 1024 * 1024, // 1MB per post
-    compressionThreshold: 100 * 1024, // Compress posts larger than 100KB
-  },
-
-  // Sync Configuration
-  sync: {
-    intervalMs: 30000, // Sync every 30 seconds when online
-    batchSize: 10, // Process 10 items per sync batch
-    maxRetries: 3, // Maximum retry attempts for failed syncs
-    retryDelayMs: 5000, // Wait 5 seconds between retries
-    conflictStrategy: 'three-way-merge' as const, // Conflict resolution strategy
-  },
-
-  // Cache Configuration
-  cache: {
-    ttlMs: 7 * 24 * 60 * 60 * 1000, // Cache for 7 days
-    maxEntries: 100, // Maximum cached entries
-    cleanupIntervalMs: 60 * 60 * 1000, // Clean up every hour
-  },
-
-  // Content Processing
-  processing: {
-    tocMinHeadings: 3, // Minimum headings for TOC generation
-    tocMaxDepth: 3, // Maximum heading depth for TOC
-    excerptLength: 160, // Characters for auto-generated excerpts
-    readingWordsPerMinute: 200, // For reading time calculation
-    syntaxHighlightTheme: 'prism-tomorrow', // Prism.js theme
-    maxCodeBlockSize: 10 * 1024, // 10KB max for syntax highlighting
-  },
-
-  // Pagination
-  pagination: {
-    postsPerPage: 10,
-    maxPageButtons: 5, // Maximum pagination buttons to show
-  },
-
-  // Feature Flags
-  features: {
-    enableComments: false, // Comments system not implemented yet
-    enableSearch: true, // Enable search functionality
-    enableRss: true, // Enable RSS feed generation
-    enableSocialSharing: true, // Enable social share buttons
-    enableOfflineEditing: true, // Enable offline editing capabilities
-    enableConflictResolution: true, // Enable conflict resolution UI
-  },
-
-  // SEO Configuration
-  seo: {
-    titleTemplate: '%s | Blog',
-    defaultDescription: 'A modern blog with offline-first capabilities',
-    defaultImage: '/opengraph-image.png',
-    twitterHandle: '@yourtwitterhandle',
-  },
-
-  // Author Registry
-  authors: {
-    registryPath: '/src/data/authors.json',
-    defaultAvatar: '/avatars/default.png',
-    maxBioLength: 500,
-    maxSocialLinks: 10,
-  },
-
-  // Validation
-  validation: {
-    slugPattern: /^[a-z0-9-]+$/,
-    tagPattern: /^[a-z0-9-]+$/,
-    maxTitleLength: 200,
-    maxTags: 10,
-    maxCategories: 5,
-    requiredFrontmatterFields: ['title', 'date', 'author'],
-  },
-};
-
-export type BlogConfig = typeof blogConfig;
diff --git a/src/lib/blog/markdown-processor.test.ts b/src/lib/blog/markdown-processor.test.ts
index 5579df21..bd430fe7 100644
--- a/src/lib/blog/markdown-processor.test.ts
+++ b/src/lib/blog/markdown-processor.test.ts
@@ -276,6 +276,55 @@ describe('MarkdownProcessor code block extraction', () => {
   });
 });
 
+describe('MarkdownProcessor raw-HTML XSS hardening', () => {
+  it('strips <script> tags and their contents', () => {
+    const { html } = process('hello <script>alert(1)</script> world');
+    expect(html).not.toContain('<script');
+    expect(html).not.toContain('alert(1)');
+  });
+
+  it('strips <iframe>, <style>, <object> and <form> sinks', () => {
+    const { html } = process(
+      '<iframe src="evil"></iframe><style>x{}</style><object></object><form></form>'
+    );
+    expect(html).not.toMatch(/<(iframe|style|object|form)\b/i);
+  });
+
+  it('removes inline event-handler attributes', () => {
+    const { html } = process('<img src="x" onerror="alert(1)"> text');
+    expect(html.toLowerCase()).not.toContain('onerror');
+    expect(html).not.toContain('alert(1)');
+  });
+
+  it('neutralizes javascript: URIs in raw href/src', () => {
+    const { html } = process('<a href="javascript:alert(1)">x</a>');
+    expect(html.toLowerCase()).not.toContain('javascript:');
+  });
+
+  it('does NOT strip the benign structural tags the blog authors use', () => {
+    const md =
+      '<div class="note"><span>hi</span></div>\n<details><summary>more</summary>body</details>\nline<br>break';
+    const { html } = process(md);
+    expect(html).toContain('<div');
+    expect(html).toContain('<span>');
+    expect(html).toContain('<details>');
+    expect(html).toContain('<summary>');
+    expect(html).toContain('<br');
+  });
+
+  it('does not corrupt code blocks that contain a literal <script> sample', () => {
+    const { html } = process('```html\n<script>console.log(1)</script>\n```');
+    // A <script> written inside a fenced code block is rendered as an escaped,
+    // syntax-highlighted code sample (protected by the code-block placeholder)
+    // — never as executable HTML. Prism wraps the escaped `&lt;` in token
+    // spans, so assert the invariants that matter: no live <script> leaked,
+    // and the opening bracket was HTML-escaped.
+    expect(html).not.toContain('<script>console.log');
+    expect(html).toContain('&lt;');
+    expect(html).toContain('language-html');
+  });
+});
+
 describe('MarkdownProcessor word count and reading time', () => {
   it('excludes code block contents from word count', () => {
     const noCode = process('one two three four five').metadata.wordCount;
diff --git a/src/lib/blog/markdown-processor.ts b/src/lib/blog/markdown-processor.ts
index f7ee6f78..ca382ee6 100644
--- a/src/lib/blog/markdown-processor.ts
+++ b/src/lib/blog/markdown-processor.ts
@@ -39,6 +39,42 @@ export class MarkdownProcessor {
     return trimmed;
   }
 
+  /**
+   * Neutralize dangerous raw HTML in markdown prose without stripping the
+   * benign structural tags the blog authors rely on (<div>, <span>,
+   * <details>, <summary>, <br>, etc.). This is a targeted denylist, not a
+   * full sanitizer — the blog content is author-controlled at build time, so
+   * the goal is defense-in-depth so a fork that renders untrusted markdown
+   * is not immediately XSS-vulnerable. Removes:
+   *   - <script>/<style>/<iframe>/<object>/<embed>/<form>/<link>/<meta> tags
+   *     (opening, closing, and their contents where they wrap a payload);
+   *   - inline event-handler attributes (onclick=, onerror=, onload=, ...);
+   *   - javascript:/vbscript:/data: URIs inside href/src attributes.
+   */
+  private stripDangerousHtml(input: string): string {
+    let out = input;
+
+    // Drop entire dangerous elements including their contents.
+    out = out.replace(
+      /<(script|style|iframe|object|embed|form|link|meta|base)\b[\s\S]*?<\/\1\s*>/gi,
+      ''
+    );
+    // Drop any leftover self-closing / unclosed dangerous opening tags.
+    out = out.replace(
+      /<\/?(script|style|iframe|object|embed|form|link|meta|base)\b[^>]*>/gi,
+      ''
+    );
+    // Strip inline event-handler attributes (on*=), quoted or unquoted.
+    out = out.replace(/\s+on[a-z]+\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)/gi, '');
+    // Neutralize dangerous URIs in href/src attributes.
+    out = out.replace(
+      /\b(href|src|xlink:href)\s*=\s*("|')?\s*(javascript|vbscript|data)\s*:[^"'>\s]*/gi,
+      '$1="#"'
+    );
+
+    return out;
+  }
+
   constructor(options: MarkdownProcessorOptions = {}) {
     this.options = {
       enableToc: true,
@@ -340,6 +376,15 @@ export class MarkdownProcessor {
       }
     );
 
+    // Neutralize dangerous RAW HTML in the markdown body. Code blocks are
+    // already extracted to placeholders above, so this only touches prose.
+    // The blog intentionally allows benign structural tags (<div>, <span>,
+    // <details>, <summary>, <br>) authored in .md, so we do NOT strip all
+    // HTML — only the script/style/iframe/etc. sinks, event-handler
+    // attributes, and javascript: URIs. This makes a fork that later renders
+    // untrusted markdown safe by default (XSS defense-in-depth).
+    html = this.stripDangerousHtml(html);
+
     // Convert headers (after code blocks to avoid converting # in code)
     // Add IDs to headers for TOC navigation
     html = html.replace(/^###### (.*?)$/gm, (match, text) => {
diff --git a/src/services/messaging/group-service.ts b/src/services/messaging/group-service.ts
index 84631642..872e402e 100644
--- a/src/services/messaging/group-service.ts
+++ b/src/services/messaging/group-service.ts
@@ -15,6 +15,7 @@ import { createClient } from '@/lib/supabase/client';
 import { createMessagingClient } from '@/lib/supabase/messaging-client';
 import { GroupKeyService } from '@/services/messaging/group-key-service';
 import { keyManagementService } from '@/services/messaging/key-service';
+import { validateUUID } from '@/lib/messaging/validation';
 import { createLogger } from '@/lib/logger';
 import type {
   CreateGroupInput,
@@ -104,6 +105,16 @@ export class GroupService {
       );
     }
 
+    // Validation: every member id must be a well-formed UUID BEFORE it is
+    // interpolated into the PostgREST `.or(...)` filter in getConnectedUserIds
+    // (a crafted non-UUID string could otherwise inject filter syntax). Mirrors
+    // the validateUUID guard used across connection-service / gdpr-service.
+    // Runs after the cheap structural checks so their specific errors surface
+    // first; still guaranteed before the id reaches any query.
+    for (const id of member_ids) {
+      validateUUID(id, 'member_ids');
+    }
+
     // Validation: Check name length if provided
     if (name && name.length > GROUP_CONSTRAINTS.MAX_NAME_LENGTH) {
       throw new ValidationError(
diff --git a/src/test/setup.ts b/src/test/setup.ts
index f7bea81f..f772f956 100644
--- a/src/test/setup.ts
+++ b/src/test/setup.ts
@@ -75,22 +75,3 @@ vi.mock('next/navigation', () => ({
   useSearchParams: () => new URLSearchParams(),
   useParams: () => ({}),
 }));
-
-// MSW server setup (uncomment when handlers are created)
-// import { server } from './mocks/server'
-//
-// beforeAll(() => server.listen({ onUnhandledRequest: 'error' }))
-// afterEach(() => server.resetHandlers())
-// afterAll(() => server.close())
-
-// Suppress console errors during tests (optional, comment out for debugging)
-// const originalError = console.error
-// beforeAll(() => {
-//   console.error = (...args: unknown[]) => {
-//     if (typeof args[0] === 'string' && args[0].includes('Warning:')) return
-//     originalError.call(console, ...args)
-//   }
-// })
-// afterAll(() => {
-//   console.error = originalError
-// })
diff --git a/src/tests/unit/sync-service.test.ts.backup b/src/tests/unit/sync-service.test.ts.backup
deleted file mode 100644
index f601da71..00000000
--- a/src/tests/unit/sync-service.test.ts.backup
+++ /dev/null
@@ -1,598 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-
-interface SyncItem {
-  postId: string;
-  version?: number;
-  action?: 'create' | 'update' | 'delete';
-  order?: number;
-  attempts?: number;
-}
-
-interface QueuedItem extends SyncItem {
-  id: string;
-  queued_at: string;
-  status: string;
-}
-
-interface ConflictItem extends SyncItem {
-  id: string;
-  queued_at: string;
-  status: string;
-  conflict: boolean;
-  localVersion: number;
-  remoteVersion: number;
-}
-
-interface SyncResult extends QueuedItem {
-  synced_at: string;
-}
-
-interface SyncError extends Partial<QueuedItem> {
-  error: { message: string } | unknown;
-  status: 'failed';
-}
-
-type ProcessQueueResult = {
-  processed: number;
-  results?: (SyncResult | SyncError)[];
-  error?: string;
-  pending?: number;
-  failed?: number;
-  nextSync?: null;
-};
-
-// Mock sync service implementation
-class MockSyncService {
-  private queue: QueuedItem[] = [];
-  private syncing = false;
-  private conflicts: Map<string, ConflictItem> = new Map();
-  private versions: Map<string, number> = new Map();
-
-  async addToQueue(item: SyncItem) {
-    const queuedItem: QueuedItem = {
-      ...item,
-      id: `queue-${Date.now()}-${Math.random()}`,
-      queued_at: new Date().toISOString(),
-      status: 'pending',
-    };
-    this.queue.push(queuedItem);
-    return queuedItem;
-  }
-
-  async processQueue(): Promise<ProcessQueueResult> {
-    if (this.syncing) {
-      return { processed: 0, error: 'Sync already in progress' };
-    }
-
-    this.syncing = true;
-    const results: (SyncResult | SyncError)[] = [];
-
-    while (this.queue.length > 0) {
-      const item = this.queue.shift();
-      if (!item) continue;
-      try {
-        const result = await this.syncItem(item);
-        results.push(result);
-      } catch (error) {
-        const errorResult: SyncError = {
-          ...item,
-          error: error instanceof Error ? { message: error.message } : error,
-          status: 'failed'
-        };
-        results.push(errorResult);
-      }
-    }
-
-    this.syncing = false;
-    return { processed: results.length, results };
-  }
-
-  private async syncItem(item: QueuedItem): Promise<SyncResult> {
-    // Simulate sync delay
-    await new Promise((resolve) => setTimeout(resolve, 10));
-
-    // Check for conflicts
-    const currentVersion = this.versions.get(item.postId) || 0;
-    if (item.version !== undefined && item.version <= currentVersion) {
-      const conflict: ConflictItem = {
-        ...item,
-        conflict: true,
-        localVersion: item.version,
-        remoteVersion: currentVersion,
-      };
-      this.conflicts.set(item.postId, conflict);
-      throw new Error('Version conflict detected');
-    }
-
-    // Update version
-    const newVersion = (item.version || currentVersion) + 1;
-    this.versions.set(item.postId, newVersion);
-
-    const result: SyncResult = {
-      ...item,
-      status: 'synced',
-      synced_at: new Date().toISOString(),
-      version: this.versions.get(item.postId),
-    };
-    return result;
-  }
-
-  getQueueSize() {
-    return this.queue.length;
-  }
-
-  getConflicts(): ConflictItem[] {
-    return Array.from(this.conflicts.values());
-  }
-
-  clearQueue() {
-    this.queue = [];
-  }
-
-  resetService() {
-    this.queue = [];
-    this.conflicts.clear();
-    this.versions.clear();
-    this.syncing = false;
-  }
-}
-
-describe('Sync Service Unit Tests', () => {
-  let syncService: MockSyncService;
-
-  beforeEach(() => {
-    syncService = new MockSyncService();
-    vi.clearAllMocks();
-  });
-
-  describe('Queue Management', () => {
-    it('should add items to sync queue', async () => {
-      const item = {
-        postId: 'post-123',
-        content: 'Updated content',
-        action: 'update',
-      };
-
-      const queued = await syncService.addToQueue(item);
-
-      expect(queued).toHaveProperty('id');
-      expect(queued).toHaveProperty('queued_at');
-      expect(queued.status).toBe('pending');
-      expect(syncService.getQueueSize()).toBe(1);
-    });
-
-    it('should process queue items in order', async () => {
-      const items = [
-        { postId: 'post-1', order: 1 },
-        { postId: 'post-2', order: 2 },
-        { postId: 'post-3', order: 3 },
-      ];
-
-      for (const item of items) {
-        await syncService.addToQueue(item);
-      }
-
-      const result = await syncService.processQueue();
-
-      expect(result.processed).toBe(3);
-      expect(result.results[0].order).toBe(1);
-      expect(result.results[2].order).toBe(3);
-    });
-
-    it('should handle empty queue', async () => {
-      const result = await syncService.processQueue();
-
-      expect(result.processed).toBe(0);
-      expect(result.results).toHaveLength(0);
-    });
-
-    it('should prevent concurrent sync operations', async () => {
-      await syncService.addToQueue({ postId: 'post-1' });
-      await syncService.addToQueue({ postId: 'post-2' });
-
-      // Start first sync
-      const sync1 = syncService.processQueue();
-
-      // Try to start second sync immediately
-      const sync2 = await syncService.processQueue();
-
-      await sync1; // Wait for first to complete
-
-      expect(sync2).toHaveProperty('error', 'Sync already in progress');
-    });
-
-    it('should clear queue', async () => {
-      await syncService.addToQueue({ postId: 'post-1' });
-      await syncService.addToQueue({ postId: 'post-2' });
-
-      expect(syncService.getQueueSize()).toBe(2);
-
-      syncService.clearQueue();
-
-      expect(syncService.getQueueSize()).toBe(0);
-    });
-  });
-
-  describe('Sync Operations', () => {
-    it('should sync create operations', async () => {
-      const createItem = {
-        action: 'create',
-        postId: 'new-post',
-        content: '# New Post',
-        metadata: { title: 'New Post', author: 'Author' },
-      };
-
-      await syncService.addToQueue(createItem);
-      const result = await syncService.processQueue();
-
-      expect(result.results[0].status).toBe('synced');
-      expect(result.results[0]).toHaveProperty('synced_at');
-      expect(result.results[0].version).toBe(1);
-    });
-
-    it('should sync update operations', async () => {
-      const updateItem = {
-        action: 'update',
-        postId: 'existing-post',
-        content: '# Updated Content',
-        version: 2,
-      };
-
-      await syncService.addToQueue(updateItem);
-      const result = await syncService.processQueue();
-
-      expect(result.results[0].status).toBe('synced');
-      expect(result.results[0].version).toBe(3);
-    });
-
-    it('should sync delete operations', async () => {
-      const deleteItem = {
-        action: 'delete',
-        postId: 'delete-post',
-        version: 5,
-      };
-
-      await syncService.addToQueue(deleteItem);
-      const result = await syncService.processQueue();
-
-      expect(result.results[0].status).toBe('synced');
-      expect(result.results[0].action).toBe('delete');
-    });
-
-    it('should batch sync multiple operations', async () => {
-      const operations = [
-        { action: 'create', postId: 'post-1' },
-        { action: 'update', postId: 'post-2' },
-        { action: 'delete', postId: 'post-3' },
-        { action: 'update', postId: 'post-4' },
-      ];
-
-      for (const op of operations) {
-        await syncService.addToQueue(op);
-      }
-
-      const result = await syncService.processQueue();
-
-      expect(result.processed).toBe(4);
-      expect(result.results.every((r) => r.status === 'synced')).toBe(true);
-    });
-  });
-
-  describe('Conflict Detection', () => {
-    it('should detect version conflicts', async () => {
-      // Set existing version
-      await syncService.addToQueue({ postId: 'post-1', version: 3 });
-      await syncService.processQueue();
-
-      // Try to sync older version
-      await syncService.addToQueue({ postId: 'post-1', version: 2 });
-      const result = await syncService.processQueue();
-
-      expect(result.results[0].status).toBe('failed');
-      expect(result.results[0].error.message).toContain('conflict');
-
-      const conflicts = syncService.getConflicts();
-      expect(conflicts).toHaveLength(1);
-      expect(conflicts[0].postId).toBe('post-1');
-    });
-
-    it('should track conflict details', async () => {
-      // Create initial version
-      await syncService.addToQueue({ postId: 'post-x', version: 5 });
-      await syncService.processQueue();
-
-      // Create conflict
-      await syncService.addToQueue({ postId: 'post-x', version: 4 });
-      await syncService.processQueue();
-
-      const conflicts = syncService.getConflicts();
-      expect(conflicts[0]).toHaveProperty('localVersion', 4);
-      expect(conflicts[0]).toHaveProperty('remoteVersion', 6); // 5 + 1 from first sync
-      expect(conflicts[0]).toHaveProperty('conflict', true);
-    });
-
-    it('should handle multiple conflicts', async () => {
-      // Set up initial versions
-      const posts = ['post-a', 'post-b', 'post-c'];
-      for (const postId of posts) {
-        await syncService.addToQueue({ postId, version: 3 });
-      }
-      await syncService.processQueue();
-
-      // Create conflicts
-      for (const postId of posts) {
-        await syncService.addToQueue({ postId, version: 1 });
-      }
-      await syncService.processQueue();
-
-      const conflicts = syncService.getConflicts();
-      expect(conflicts).toHaveLength(3);
-    });
-  });
-
-  describe('Error Handling', () => {
-    it('should handle sync failures gracefully', async () => {
-      const failItem = {
-        postId: 'fail-post',
-        content: null, // Invalid content
-        version: -1, // Invalid version
-      };
-
-      await syncService.addToQueue(failItem);
-      const result = await syncService.processQueue();
-
-      expect(result.processed).toBe(1);
-      expect(result.results[0].status).toBe('failed');
-    });
-
-    it('should continue processing after individual failures', async () => {
-      const items = [
-        { postId: 'post-1', version: 1 },
-        { postId: 'post-1', version: 0 }, // Will conflict
-        { postId: 'post-2', version: 1 },
-      ];
-
-      for (const item of items) {
-        await syncService.addToQueue(item);
-      }
-
-      const result = await syncService.processQueue();
-
-      expect(result.processed).toBe(3);
-      expect(result.results[0].status).toBe('synced');
-      expect(result.results[1].status).toBe('failed');
-      expect(result.results[2].status).toBe('synced');
-    });
-
-    it('should handle network errors with retry', async () => {
-      let attempts = 0;
-      const maxRetries = 3;
-
-      const syncWithRetry = async (item: unknown): Promise<unknown> => {
-        attempts++;
-        if (attempts < maxRetries) {
-          throw new Error('Network error');
-        }
-        return { ...item, synced: true, attempts };
-      };
-
-      let result;
-      for (let i = 0; i < maxRetries; i++) {
-        try {
-          result = await syncWithRetry({ postId: 'retry-post' });
-          break;
-        } catch (error) {
-          if (i === maxRetries - 1) throw error;
-        }
-      }
-
-      expect(result).toHaveProperty('synced', true);
-      expect(result?.attempts).toBe(3);
-    });
-  });
-
-  describe('Sync State Tracking', () => {
-    it('should track sync progress', async () => {
-      const progressUpdates: unknown[] = [];
-
-      const syncWithProgress = async (items: unknown[]) => {
-        for (let i = 0; i < items.length; i++) {
-          progressUpdates.push({
-            current: i + 1,
-            total: items.length,
-            percentage: Math.round(((i + 1) / items.length) * 100),
-          });
-          // Simulate sync
-          await new Promise((resolve) => setTimeout(resolve, 10));
-        }
-      };
-
-      const items = Array.from({ length: 5 }, (_, i) => ({ id: i }));
-      await syncWithProgress(items);
-
-      expect(progressUpdates).toHaveLength(5);
-      expect(progressUpdates[2].percentage).toBe(60);
-      expect(progressUpdates[4].percentage).toBe(100);
-    });
-
-    it('should maintain sync history', () => {
-      const syncHistory: unknown[] = [];
-
-      const recordSync = (result: unknown) => {
-        syncHistory.push({
-          ...result,
-          timestamp: new Date().toISOString(),
-        });
-      };
-
-      recordSync({ postId: 'post-1', status: 'synced' });
-      recordSync({ postId: 'post-2', status: 'failed' });
-      recordSync({ postId: 'post-3', status: 'synced' });
-
-      const successfulSyncs = syncHistory.filter((s) => s.status === 'synced');
-      const failedSyncs = syncHistory.filter((s) => s.status === 'failed');
-
-      expect(successfulSyncs).toHaveLength(2);
-      expect(failedSyncs).toHaveLength(1);
-    });
-
-    it('should calculate sync statistics', () => {
-      const syncStats = {
-        total: 100,
-        synced: 85,
-        failed: 10,
-        pending: 5,
-      };
-
-      const calculateSuccessRate = (stats: unknown) => {
-        return Math.round((stats.synced / stats.total) * 100);
-      };
-
-      const successRate = calculateSuccessRate(syncStats);
-      expect(successRate).toBe(85);
-    });
-  });
-
-  describe('Optimization Strategies', () => {
-    it('should deduplicate queue items', async () => {
-      const item = { postId: 'post-1', content: 'Content' };
-
-      // Add same item multiple times
-      await syncService.addToQueue(item);
-      await syncService.addToQueue(item);
-      await syncService.addToQueue(item);
-
-      // Should ideally deduplicate, but our mock doesn't
-      // In real implementation, check for duplicates
-      const deduplicate = (queue: unknown[]) => {
-        const seen = new Set();
-        return queue.filter((item) => {
-          const key = `${item.postId}-${item.action}`;
-          if (seen.has(key)) return false;
-          seen.add(key);
-          return true;
-        });
-      };
-
-      expect(syncService.getQueueSize()).toBe(3);
-      // After deduplication would be 1
-    });
-
-    it('should prioritize sync items', () => {
-      const queue = [
-        { postId: 'post-1', priority: 'low' },
-        { postId: 'post-2', priority: 'high' },
-        { postId: 'post-3', priority: 'medium' },
-      ];
-
-      const priorityOrder = { high: 0, medium: 1, low: 2 };
-      const sorted = queue.sort(
-        (a, b) => priorityOrder[a.priority] - priorityOrder[b.priority]
-      );
-
-      expect(sorted[0].priority).toBe('high');
-      expect(sorted[2].priority).toBe('low');
-    });
-
-    it('should batch similar operations', () => {
-      const operations = [
-        { action: 'update', postId: 'post-1' },
-        { action: 'delete', postId: 'post-2' },
-        { action: 'update', postId: 'post-3' },
-        { action: 'update', postId: 'post-4' },
-        { action: 'delete', postId: 'post-5' },
-      ];
-
-      const batched = operations.reduce(
-        (acc: Record<string, typeof operations>, op) => {
-          if (!acc[op.action]) acc[op.action] = [];
-          acc[op.action].push(op);
-          return acc;
-        },
-        {}
-      );
-
-      expect(batched.update).toHaveLength(3);
-      expect(batched.delete).toHaveLength(2);
-    });
-  });
-
-  describe('Offline Queue Persistence', () => {
-    it('should serialize queue for storage', () => {
-      const queue = [
-        { postId: 'post-1', content: 'Content 1' },
-        { postId: 'post-2', content: 'Content 2' },
-      ];
-
-      const serialized = JSON.stringify(queue);
-      const deserialized = JSON.parse(serialized);
-
-      expect(deserialized).toEqual(queue);
-    });
-
-    it('should compress large queue items', () => {
-      const largeContent = 'x'.repeat(10000);
-      const item = { postId: 'large-post', content: largeContent };
-
-      // Simple compression simulation
-      const compress = (str: string) => {
-        return Buffer.from(str).toString('base64').substring(0, 100);
-      };
-
-      const compressed = {
-        ...item,
-        content: compress(item.content),
-        compressed: true,
-      };
-
-      expect(compressed.content.length).toBeLessThan(largeContent.length);
-      expect(compressed.compressed).toBe(true);
-    });
-
-    it('should restore queue after restart', async () => {
-      // Simulate saving queue state
-      const savedQueue = [
-        { postId: 'saved-1', status: 'pending' },
-        { postId: 'saved-2', status: 'pending' },
-      ];
-
-      // Reset service (simulate restart)
-      syncService.resetService();
-
-      // Restore queue
-      for (const item of savedQueue) {
-        await syncService.addToQueue(item);
-      }
-
-      expect(syncService.getQueueSize()).toBe(2);
-    });
-  });
-
-  describe('Sync Scheduling', () => {
-    it('should implement exponential backoff', () => {
-      const calculateBackoff = (attempt: number, baseDelay = 1000) => {
-        return Math.min(baseDelay * Math.pow(2, attempt), 60000);
-      };
-
-      expect(calculateBackoff(0)).toBe(1000); // 1 second
-      expect(calculateBackoff(1)).toBe(2000); // 2 seconds
-      expect(calculateBackoff(2)).toBe(4000); // 4 seconds
-      expect(calculateBackoff(10)).toBe(60000); // Max 60 seconds
-    });
-
-    it('should schedule periodic sync', () => {
-      const syncInterval = 5 * 60 * 1000; // 5 minutes
-      let lastSync = Date.now();
-
-      const shouldSync = () => {
-        return Date.now() - lastSync >= syncInterval;
-      };
-
-      expect(shouldSync()).toBe(false);
-
-      // Simulate time passing
-      lastSync = Date.now() - syncInterval - 1;
-      expect(shouldSync()).toBe(true);
-    });
-  });
-});
diff --git a/supabase/functions/send-payment-email/index.ts b/supabase/functions/send-payment-email/index.ts
index 75bc7978..a82797c8 100644
--- a/supabase/functions/send-payment-email/index.ts
+++ b/supabase/functions/send-payment-email/index.ts
@@ -7,12 +7,45 @@ import {
 
 const resendApiKey = Deno.env.get('RESEND_API_KEY')!;
 
+/**
+ * Constant-time string comparison. Avoids a timing side-channel on the
+ * service-role key and — unlike String.includes — requires an EXACT match
+ * (a substring or an `undefined`-coerced check would let unauthorized
+ * callers through and send arbitrary emails from this domain).
+ */
+function timingSafeEqual(a: string, b: string): boolean {
+  const enc = new TextEncoder();
+  const bufA = enc.encode(a);
+  const bufB = enc.encode(b);
+  // Compare against a fixed-length accumulator so length differences don't
+  // short-circuit (which would itself leak length via timing).
+  let mismatch = bufA.length === bufB.length ? 0 : 1;
+  const len = Math.max(bufA.length, bufB.length);
+  for (let i = 0; i < len; i++) {
+    mismatch |= (bufA[i] ?? 0) ^ (bufB[i] ?? 0);
+  }
+  return mismatch === 0;
+}
+
 serve(async (req) => {
   try {
     const authHeader = req.headers.get('Authorization');
     const serviceRoleKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY');
 
-    if (!authHeader || !authHeader.includes(serviceRoleKey)) {
+    // Require an exact `Bearer <service-role-key>` match. Guard the env var:
+    // if it were unset, any non-constant-time substring check could be
+    // bypassed (e.g. includes(undefined) → includes("undefined")).
+    const bearerPrefix = 'Bearer ';
+    const presentedToken =
+      authHeader && authHeader.startsWith(bearerPrefix)
+        ? authHeader.slice(bearerPrefix.length).trim()
+        : '';
+
+    if (
+      !serviceRoleKey ||
+      !presentedToken ||
+      !timingSafeEqual(presentedToken, serviceRoleKey)
+    ) {
       return new Response(JSON.stringify({ error: 'Unauthorized' }), {
         status: 401,
         headers: { 'Content-Type': 'application/json' },
diff --git a/tests/integration/messaging/group-creation.test.ts b/tests/integration/messaging/group-creation.test.ts
index 3675962b..4d49a6f5 100644
--- a/tests/integration/messaging/group-creation.test.ts
+++ b/tests/integration/messaging/group-creation.test.ts
@@ -17,7 +17,7 @@ vi.mock('@/lib/supabase/client', () => ({
   createClient: vi.fn(() => ({
     auth: {
       getUser: vi.fn(() => ({
-        data: { user: { id: 'owner-user-id' } },
+        data: { user: { id: '77777777-7777-4777-8777-777777777777' } },
         error: null,
       })),
     },
@@ -26,7 +26,7 @@ vi.mock('@/lib/supabase/client', () => ({
         id: 'new-group-id',
         is_group: true,
         group_name: 'Test Group',
-        created_by: 'owner-user-id',
+        created_by: '77777777-7777-4777-8777-777777777777',
         current_key_version: 1,
         created_at: new Date().toISOString(),
       };
@@ -35,7 +35,7 @@ vi.mock('@/lib/supabase/client', () => ({
         {
           id: 'member-1',
           conversation_id: 'new-group-id',
-          user_id: 'owner-user-id',
+          user_id: '77777777-7777-4777-8777-777777777777',
           role: 'owner',
           key_version_joined: 1,
           key_status: 'active',
@@ -43,7 +43,7 @@ vi.mock('@/lib/supabase/client', () => ({
         {
           id: 'member-2',
           conversation_id: 'new-group-id',
-          user_id: 'member-a-id',
+          user_id: '55555555-5555-4555-8555-555555555555',
           role: 'member',
           key_version_joined: 1,
           key_status: 'active',
@@ -51,7 +51,7 @@ vi.mock('@/lib/supabase/client', () => ({
         {
           id: 'member-3',
           conversation_id: 'new-group-id',
-          user_id: 'member-b-id',
+          user_id: '66666666-6666-4666-8666-666666666666',
           role: 'member',
           key_version_joined: 1,
           key_status: 'active',
@@ -106,14 +106,14 @@ vi.mock('@/lib/supabase/client', () => ({
                 data: [
                   {
                     id: 'conn-1',
-                    requester_id: 'owner-user-id',
-                    addressee_id: 'member-a-id',
+                    requester_id: '77777777-7777-4777-8777-777777777777',
+                    addressee_id: '55555555-5555-4555-8555-555555555555',
                     status: 'accepted',
                   },
                   {
                     id: 'conn-2',
-                    requester_id: 'owner-user-id',
-                    addressee_id: 'member-b-id',
+                    requester_id: '77777777-7777-4777-8777-777777777777',
+                    addressee_id: '66666666-6666-4666-8666-666666666666',
                     status: 'accepted',
                   },
                 ],
@@ -134,7 +134,10 @@ vi.mock('@/lib/supabase/client', () => ({
         return {
           select: vi.fn(() => ({
             in: vi.fn(() => ({
-              data: [{ user_id: 'member-a-id' }, { user_id: 'member-b-id' }],
+              data: [
+                { user_id: '55555555-5555-4555-8555-555555555555' },
+                { user_id: '66666666-6666-4666-8666-666666666666' },
+              ],
               error: null,
             })),
           })),
@@ -161,7 +164,7 @@ vi.mock('@/lib/supabase/messaging-client', () => ({
         id: 'new-group-id',
         is_group: true,
         group_name: 'Test Group',
-        created_by: 'owner-user-id',
+        created_by: '77777777-7777-4777-8777-777777777777',
         current_key_version: 1,
         created_at: new Date().toISOString(),
         last_message_at: null,
@@ -171,7 +174,7 @@ vi.mock('@/lib/supabase/messaging-client', () => ({
         {
           id: 'member-1',
           conversation_id: 'new-group-id',
-          user_id: 'owner-user-id',
+          user_id: '77777777-7777-4777-8777-777777777777',
           role: 'owner',
           joined_at: new Date().toISOString(),
           left_at: null,
@@ -183,7 +186,7 @@ vi.mock('@/lib/supabase/messaging-client', () => ({
         {
           id: 'member-2',
           conversation_id: 'new-group-id',
-          user_id: 'member-a-id',
+          user_id: '55555555-5555-4555-8555-555555555555',
           role: 'member',
           joined_at: new Date().toISOString(),
           left_at: null,
@@ -195,7 +198,7 @@ vi.mock('@/lib/supabase/messaging-client', () => ({
         {
           id: 'member-3',
           conversation_id: 'new-group-id',
-          user_id: 'member-b-id',
+          user_id: '66666666-6666-4666-8666-666666666666',
           role: 'member',
           joined_at: new Date().toISOString(),
           left_at: null,
@@ -246,7 +249,10 @@ vi.mock('@/lib/supabase/messaging-client', () => ({
         return {
           select: vi.fn(() => ({
             in: vi.fn(() => ({
-              data: [{ user_id: 'member-a-id' }, { user_id: 'member-b-id' }],
+              data: [
+                { user_id: '55555555-5555-4555-8555-555555555555' },
+                { user_id: '66666666-6666-4666-8666-666666666666' },
+              ],
               error: null,
             })),
           })),
@@ -277,7 +283,11 @@ vi.mock('@/services/messaging/group-key-service', () => ({
     ),
     distributeGroupKey: vi.fn(() =>
       Promise.resolve({
-        successful: ['owner-user-id', 'member-a-id', 'member-b-id'],
+        successful: [
+          '77777777-7777-4777-8777-777777777777',
+          '55555555-5555-4555-8555-555555555555',
+          '66666666-6666-4666-8666-666666666666',
+        ],
         pending: [],
       })
     ),
@@ -332,7 +342,10 @@ describe('Group Creation Integration', () => {
     it('should create a group with valid members', async () => {
       const input = {
         name: 'Test Group',
-        member_ids: ['member-a-id', 'member-b-id'],
+        member_ids: [
+          '55555555-5555-4555-8555-555555555555',
+          '66666666-6666-4666-8666-666666666666',
+        ],
       };
 
       const result = await groupService.createGroup(input);
@@ -369,7 +382,7 @@ describe('Group Creation Integration', () => {
     it('should set creator as owner role', async () => {
       const input = {
         name: 'Owner Test',
-        member_ids: ['member-a-id'],
+        member_ids: ['55555555-5555-4555-8555-555555555555'],
       };
 
       const result = await groupService.createGroup(input);
@@ -381,7 +394,7 @@ describe('Group Creation Integration', () => {
     it('should initialize key_version_joined to 1 for all members', async () => {
       const input = {
         name: 'Key Version Test',
-        member_ids: ['member-a-id'],
+        member_ids: ['55555555-5555-4555-8555-555555555555'],
       };
 
       const result = await groupService.createGroup(input);
@@ -400,7 +413,10 @@ describe('Group Creation Integration', () => {
     it('should set key_status to active for all members on success', async () => {
       const input = {
         name: 'Key Distribution Test',
-        member_ids: ['member-a-id', 'member-b-id'],
+        member_ids: [
+          '55555555-5555-4555-8555-555555555555',
+          '66666666-6666-4666-8666-666666666666',
+        ],
       };
 
       const result = await groupService.createGroup(input);
@@ -413,7 +429,7 @@ describe('Group Creation Integration', () => {
     it('should set conversation.current_key_version to 1', async () => {
       const input = {
         name: 'Initial Key Version',
-        member_ids: ['member-a-id'],
+        member_ids: ['55555555-5555-4555-8555-555555555555'],
       };
 
       const result = await groupService.createGroup(input);
diff --git a/tests/unit/services/messaging/group-service.test.ts b/tests/unit/services/messaging/group-service.test.ts
index 239ef2b9..fb90a3ee 100644
--- a/tests/unit/services/messaging/group-service.test.ts
+++ b/tests/unit/services/messaging/group-service.test.ts
@@ -5,12 +5,16 @@
  */
 
 import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
-import { GROUP_CONSTRAINTS, MembershipError } from '@/types/messaging';
+import {
+  GROUP_CONSTRAINTS,
+  MembershipError,
+  ValidationError,
+} from '@/types/messaging';
 
 // Use vi.hoisted to define mocks that can be referenced in vi.mock
 const { mockGetUser, mockFrom, mockMsgFrom } = vi.hoisted(() => ({
   mockGetUser: vi.fn(() => ({
-    data: { user: { id: 'current-user-id' } },
+    data: { user: { id: '11111111-1111-4111-8111-111111111111' } },
     error: null,
   })),
   mockFrom: vi.fn(),
@@ -40,7 +44,10 @@ vi.mock('@/services/messaging/group-key-service', () => ({
     ),
     distributeGroupKey: vi.fn(() =>
       Promise.resolve({
-        successful: ['current-user-id', 'member-1'],
+        successful: [
+          '11111111-1111-4111-8111-111111111111',
+          '22222222-2222-4222-8222-222222222222',
+        ],
         pending: [],
       })
     ),
@@ -85,8 +92,8 @@ describe('GroupService', () => {
               eq: vi.fn(() => ({
                 data: [
                   {
-                    requester_id: 'current-user-id',
-                    addressee_id: 'member-1',
+                    requester_id: '11111111-1111-4111-8111-111111111111',
+                    addressee_id: '22222222-2222-4222-8222-222222222222',
                     status: 'accepted',
                   },
                 ],
@@ -100,7 +107,7 @@ describe('GroupService', () => {
         return {
           select: vi.fn(() => ({
             in: vi.fn(() => ({
-              data: [{ user_id: 'member-1' }],
+              data: [{ user_id: '22222222-2222-4222-8222-222222222222' }],
               error: null,
             })),
           })),
@@ -121,7 +128,7 @@ describe('GroupService', () => {
                   id: 'new-conv-id',
                   is_group: true,
                   group_name: 'Test Group',
-                  created_by: 'current-user-id',
+                  created_by: '11111111-1111-4111-8111-111111111111',
                   current_key_version: 1,
                   created_at: new Date().toISOString(),
                   last_message_at: null,
@@ -144,7 +151,7 @@ describe('GroupService', () => {
                 {
                   id: 'm1',
                   conversation_id: 'new-conv-id',
-                  user_id: 'current-user-id',
+                  user_id: '11111111-1111-4111-8111-111111111111',
                   role: 'owner',
                   key_version_joined: 1,
                   key_status: 'active',
@@ -156,7 +163,7 @@ describe('GroupService', () => {
                 {
                   id: 'm2',
                   conversation_id: 'new-conv-id',
-                  user_id: 'member-1',
+                  user_id: '22222222-2222-4222-8222-222222222222',
                   role: 'member',
                   key_version_joined: 1,
                   key_status: 'active',
@@ -214,7 +221,9 @@ describe('GroupService', () => {
         });
 
         await expect(
-          service.createGroup({ member_ids: ['user-1'] })
+          service.createGroup({
+            member_ids: ['33333333-3333-4333-8333-333333333333'],
+          })
         ).rejects.toThrow();
       });
 
@@ -238,7 +247,9 @@ describe('GroupService', () => {
         });
 
         await expect(
-          service.createGroup({ member_ids: ['unconnected-user'] })
+          service.createGroup({
+            member_ids: ['44444444-4444-4444-8444-444444444444'],
+          })
         ).rejects.toThrow(MembershipError);
       });
     });
@@ -247,18 +258,18 @@ describe('GroupService', () => {
       it('should set creator as owner', async () => {
         const result = await service.createGroup({
           name: 'Test',
-          member_ids: ['member-1'],
+          member_ids: ['22222222-2222-4222-8222-222222222222'],
         });
 
         const owner = result.members.find((m) => m.role === 'owner');
         expect(owner).toBeDefined();
-        expect(owner?.user_id).toBe('current-user-id');
+        expect(owner?.user_id).toBe('11111111-1111-4111-8111-111111111111');
       });
 
       it('should initialize key_version_joined to 1', async () => {
         const result = await service.createGroup({
           name: 'Test',
-          member_ids: ['member-1'],
+          member_ids: ['22222222-2222-4222-8222-222222222222'],
         });
 
         result.members.forEach((m) => {
@@ -271,7 +282,7 @@ describe('GroupService', () => {
       it('should set is_group to true', async () => {
         const result = await service.createGroup({
           name: 'Test',
-          member_ids: ['member-1'],
+          member_ids: ['22222222-2222-4222-8222-222222222222'],
         });
 
         expect(result.conversation.is_group).toBe(true);
@@ -280,16 +291,18 @@ describe('GroupService', () => {
       it('should set created_by to current user', async () => {
         const result = await service.createGroup({
           name: 'Test',
-          member_ids: ['member-1'],
+          member_ids: ['22222222-2222-4222-8222-222222222222'],
         });
 
-        expect(result.conversation.created_by).toBe('current-user-id');
+        expect(result.conversation.created_by).toBe(
+          '11111111-1111-4111-8111-111111111111'
+        );
       });
 
       it('should set current_key_version to 1', async () => {
         const result = await service.createGroup({
           name: 'Test',
-          member_ids: ['member-1'],
+          member_ids: ['22222222-2222-4222-8222-222222222222'],
         });
 
         expect(result.conversation.current_key_version).toBe(1);
@@ -300,7 +313,10 @@ describe('GroupService', () => {
       it('should prevent duplicate member IDs', async () => {
         await expect(
           service.createGroup({
-            member_ids: ['member-1', 'member-1'],
+            member_ids: [
+              '22222222-2222-4222-8222-222222222222',
+              '22222222-2222-4222-8222-222222222222',
+            ],
           })
         ).rejects.toThrow();
       });
@@ -308,7 +324,7 @@ describe('GroupService', () => {
       it('should prevent adding self as member', async () => {
         await expect(
           service.createGroup({
-            member_ids: ['current-user-id'],
+            member_ids: ['11111111-1111-4111-8111-111111111111'],
           })
         ).rejects.toThrow();
       });
@@ -317,9 +333,22 @@ describe('GroupService', () => {
         const longName = 'A'.repeat(101);
 
         await expect(
-          service.createGroup({ name: longName, member_ids: ['member-1'] })
+          service.createGroup({
+            name: longName,
+            member_ids: ['22222222-2222-4222-8222-222222222222'],
+          })
         ).rejects.toThrow();
       });
+
+      it('should reject a malformed (non-UUID) member id before it reaches any query', async () => {
+        // Guards against PostgREST filter injection via getConnectedUserIds's
+        // .or(...) interpolation — a crafted member id must never reach the DB.
+        await expect(
+          service.createGroup({
+            member_ids: ['not-a-uuid,requester_id.eq.injected'],
+          })
+        ).rejects.toThrow(ValidationError);
+      });
     });
   });