fragginwagon
c728016dec
Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).
96 lines
2.0 KiB
Markdown
96 lines
2.0 KiB
Markdown
# Security
|
|
|
|
## Authentication
|
|
|
|
MVP:
|
|
- email/password
|
|
- MFA using TOTP or passkey-capable architecture
|
|
- password recovery
|
|
- remember-me option
|
|
- configurable session expiry
|
|
- active session/device management
|
|
- revoke one or all sessions
|
|
|
|
Use secure server-side sessions with:
|
|
- HttpOnly
|
|
- Secure in production
|
|
- appropriate SameSite policy
|
|
|
|
Never store auth tokens in localStorage.
|
|
|
|
## Authorization
|
|
|
|
MVP has Admin role.
|
|
|
|
Design authorization so future roles can be added without rewriting domain logic.
|
|
|
|
All authorization is enforced server-side.
|
|
|
|
## CSRF
|
|
|
|
Implement an appropriate CSRF defense for cookie-based authentication.
|
|
|
|
## Input and API security
|
|
|
|
- Validate all inputs.
|
|
- Parameterize database queries through Drizzle.
|
|
- Allowlist sort fields.
|
|
- Apply pagination.
|
|
- Rate-limit sensitive/auth endpoints.
|
|
- Use security headers.
|
|
- Do not leak private fields through serialization.
|
|
|
|
## Upload security
|
|
|
|
- Validate MIME type and file signatures where practical.
|
|
- Limit size and dimensions.
|
|
- Limit image count.
|
|
- Process in controlled jobs.
|
|
- Treat filenames as untrusted.
|
|
- Do not execute uploaded content.
|
|
|
|
## Sessions
|
|
|
|
Suggested fields:
|
|
`id, user_id, session_token_hash, created_at, expires_at, last_activity_at, ip_address, user_agent, revoked_at`
|
|
|
|
## MFA
|
|
|
|
Suggested fields:
|
|
`id, user_id, type, secret_reference, name, is_enabled, created_at, last_used_at`
|
|
|
|
Secrets must be stored using appropriate secret protection; do not expose raw MFA secrets in logs.
|
|
|
|
## Security audit log
|
|
|
|
Separate from inventory activity.
|
|
|
|
Events include:
|
|
- LOGIN_SUCCESS
|
|
- LOGIN_FAILURE
|
|
- PASSWORD_RESET
|
|
- MFA_ENROLLED
|
|
- MFA_FAILURE
|
|
- SESSION_CREATED
|
|
- SESSION_REVOKED
|
|
- ACCOUNT_UPDATED
|
|
|
|
## Secrets
|
|
|
|
Credentials, API keys, database URLs, and encryption secrets belong in environment/secret management, never in source control.
|
|
|
|
## Privacy boundary
|
|
|
|
Private:
|
|
- acquisition data
|
|
- sale data
|
|
- buyer information
|
|
- profit
|
|
- internal notes
|
|
- inventory IDs
|
|
- provider observations and errors
|
|
- pricing methodology/confidence/history
|
|
- activity/audit logs
|
|
|
|
Public data must be exposed through purpose-built DTOs.
|