From 3bb7d3066e55328b20aec932e3f25a4e55fa3ed0 Mon Sep 17 00:00:00 2001
From: Saurabh Kumar Bajpai <saurabhkumarbajpaiai@gmail.com>
Date: Sat, 11 Jul 2026 14:30:28 +0530
Subject: [PATCH] fix: secure classroom invite codes

---
 src/app/api/rooms/route.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/app/api/rooms/route.ts b/src/app/api/rooms/route.ts
index 6fd1e7da..b3da979a 100644
--- a/src/app/api/rooms/route.ts
+++ b/src/app/api/rooms/route.ts
@@ -1,3 +1,4 @@
+import { randomBytes } from 'crypto';
 import { NextResponse } from 'next/server';
 import { db } from '@/configs/db';
 import { classroomsTable, membershipsTable, usersTable, organizationsTable, organizationMembershipsTable } from '@/configs/schema';
@@ -130,7 +131,7 @@ export async function POST(req: Request) {
             }
         }
 
-        const inviteCode = Math.random().toString(36).substring(2, 8).toUpperCase();
+        const inviteCode = randomBytes(4).toString('hex').toUpperCase();
 
         // Transactional insert: create room and then add teacher as member atomically
         const newRoom = await db.transaction(async (tx) => {