Harden authentication, tenant isolation and security boundaries

src/app/dashboard/notdienst/actions.ts

@@ -18,13 +18,13 @@ import { getTargetMonthData } from "@/lib/date-utils";
 const dateKeyPattern = /^\d{4}-\d{2}-\d{2}$/;
 
 const payloadSchema = z.object({
-  childrenIds: z.array(z.string()).min(1),
+  childrenIds: z.array(z.string().min(1).max(64)).min(1).max(20),
   dates: z.array(
     z.string().regex(dateKeyPattern).refine((value) => {
       const date = dateKeyToUtcDate(value);
-      return value === date.toISOString().slice(0, 10);
+      return Number.isFinite(date.getTime()) && value === date.toISOString().slice(0, 10);
     }),
-  ),
+  ).max(31),
 });
 
 function dateKeyToUtcDate(dateKey: string) {