# Security

## Authentication

MVP:
- email/password
- MFA using TOTP or passkey-capable architecture
- password recovery
- remember-me option
- configurable session expiry
- active session/device management
- revoke one or all sessions

Use secure server-side sessions with:
- HttpOnly
- Secure in production
- appropriate SameSite policy

Never store auth tokens in localStorage.

## Authorization

MVP has Admin role.

Design authorization so future roles can be added without rewriting domain logic.

All authorization is enforced server-side.

## CSRF

Implement an appropriate CSRF defense for cookie-based authentication.

## Input and API security

- Validate all inputs.
- Parameterize database queries through Drizzle.
- Allowlist sort fields.
- Apply pagination.
- Rate-limit sensitive/auth endpoints.
- Use security headers.
- Do not leak private fields through serialization.

## Upload security

- Validate MIME type and file signatures where practical.
- Limit size and dimensions.
- Limit image count.
- Process in controlled jobs.
- Treat filenames as untrusted.
- Do not execute uploaded content.

## Sessions

Suggested fields:
`id, user_id, session_token_hash, created_at, expires_at, last_activity_at, ip_address, user_agent, revoked_at`

## MFA

Suggested fields:
`id, user_id, type, secret_reference, name, is_enabled, created_at, last_used_at`

Secrets must be stored using appropriate secret protection; do not expose raw MFA secrets in logs.

## Security audit log

Separate from inventory activity.

Events include:
- LOGIN_SUCCESS
- LOGIN_FAILURE
- PASSWORD_RESET
- MFA_ENROLLED
- MFA_FAILURE
- SESSION_CREATED
- SESSION_REVOKED
- ACCOUNT_UPDATED

## Secrets

Credentials, API keys, database URLs, and encryption secrets belong in environment/secret management, never in source control.

## Privacy boundary

Private:
- acquisition data
- sale data
- buyer information
- profit
- internal notes
- inventory IDs
- provider observations and errors
- pricing methodology/confidence/history
- activity/audit logs

Public data must be exposed through purpose-built DTOs.