Security-Hardening Runde 16: KRITISCH – Update-Responses sanitisieren

Pentest Runde 15:

20.3 KRITISCH:
PUT /customers/:id gab portalPasswordHash (bcrypt $2a$12$…) im
Response zurück. updateCustomer reichte das rohe Service-Output
ohne sanitize-Aufruf durch.

20.4 HOCH (gleiche Klasse):
PUT-Response leakte portalPasswordResetToken, portalPasswordMustChange,
consentHash, portalTokenInvalidatedAt.

Fix:
- updateCustomer + createCustomer rufen sanitizeCustomer bzw.
  sanitizeCustomerStrict je nach customers:update-Permission.
- updateContract + createContract + createFollowUp + createRenewal
  analog mit sanitizeContract / sanitizeContractStrict je nach
  isCustomerPortal.
- portalPasswordMustChange + portalTokenInvalidatedAt von
  PORTAL_HIDDEN_CUSTOMER_FIELDS zu SENSITIVE_CUSTOMER_FIELDS
  hochgezogen → greift auch in normaler sanitizeCustomer
  (Admin-Sicht).

Live-verifiziert:
- Admin PUT /customers/3 → 0 Leaks von Hash/Token/Expires/MustChange/
  consentHash/TokenInvalidatedAt; portalPasswordEncrypted bleibt
  für Admin sichtbar (UI-Workflow, separater Endpoint mit Audit)
- POST /customers → 0 Leaks
- Portal-User GET /customers/3 → 0 Leaks auch bei
  portalPasswordEncrypted/notes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/controllers/customer.controller.ts

@@ -90,7 +90,14 @@ export async function createCustomer(req: Request, res: Response): Promise<void>
       label: `Kunde ${customer.customerNumber} angelegt (${customer.firstName} ${customer.lastName})`,
       customerId: customer.id,
     });
-    res.status(201).json({ success: true, data: customer } as ApiResponse);
+    // Response sanitisieren (Pentest Runde 15, 20.3/20.4): die Service-
+    // Funktion gibt das rohe DB-Objekt mit portalPasswordHash + Reset-Token
+    // zurück. Ohne sanitize-Aufruf leakte das beim Erstellen + Update.
+    const canSeePasswords = (req as AuthRequest).user?.permissions?.includes('customers:update') ?? false;
+    const sanitized = canSeePasswords
+      ? sanitizeCustomer(customer as any)
+      : sanitizeCustomerStrict(customer as any);
+    res.status(201).json({ success: true, data: sanitized } as ApiResponse);
   } catch (error) {
     res.status(400).json({
       success: false,
@@ -169,7 +176,14 @@ export async function updateCustomer(req: Request, res: Response): Promise<void>
       }
     }
 
-    res.json({ success: true, data: customer } as ApiResponse);
+    // Response sanitisieren – sonst leakt portalPasswordHash +
+    // portalPasswordResetToken + consentHash + portalPasswordMustChange.
+    // Pentest Runde 15 (20.3 KRITISCH, 20.4 HOCH).
+    const canSeePasswords = (req as AuthRequest).user?.permissions?.includes('customers:update') ?? false;
+    const sanitized = canSeePasswords
+      ? sanitizeCustomer(customer as any)
+      : sanitizeCustomerStrict(customer as any);
+    res.json({ success: true, data: sanitized } as ApiResponse);
   } catch (error) {
     console.error('Update customer error:', error);
     res.status(400).json({