6290a3a448
states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
(resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
- Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
resources/js/admin/router.tsx, routes/web.php)
27 lines
2.5 KiB
Markdown
27 lines
2.5 KiB
Markdown
# 09 — Security & Compliance
|
|
|
|
- Roles: `super_admin`, `tenant_admin`, `member`; guest upload via signed tokens.
|
|
- Policies: all tenant-owned models gated; Super Admin bypass via explicit ability.
|
|
- Audit: record impersonation and destructive actions with actor, target, reason.
|
|
- Logging: structured, no PII; add request/trace IDs; redact secrets.
|
|
- GDPR: retention settings per tenant; deletion workflows; legal pages managed via CMS-like resource.
|
|
- Rate limits: per-tenant, per-user, per-device; protect upload and admin mutations.
|
|
|
|
## 2025 Hardening Priorities
|
|
|
|
- **Identity & OAuth** — *Owner: Backend Platform*
|
|
Track JWT key rotation via `oauth:rotate-keys`, roll out dual-key support (old/new KID overlap), surface refresh-token revocation tooling, and extend IP/device binding rules for long-lived sessions. See `docs/deployment/oauth-key-rotation.md` for the rotation playbook. Filament now offers a refresh-token console with per-device revocation and audit history.
|
|
- **Guest Join Tokens** — *Owner: Guest Platform*
|
|
Hash stored join tokens, add anomaly metrics (usage spikes, stale tokens), and tighten gallery/photo rate limits with visibility in storage dashboards. Join-token access is now logged to `event_join_token_events` with summaries surfaced in the Event admin modal.
|
|
- **Public API Resilience** — *Owner: Core API*
|
|
Ensure gallery/download endpoints serve signed URLs, expand abuse throttles (token + IP), and document incident response runbooks in ops guides. See `docs/deployment/public-api-incident-playbook.md` for the response checklist.
|
|
- **Media Pipeline & Storage** — *Owner: Media Services*
|
|
Introduce antivirus + EXIF scrubbing workers, stream uploads to disk to avoid buffering, and enforce checksum verification during hot→archive transfers with configurable alerts from `StorageHealthService`.
|
|
- Queue `media-security` (job: `ProcessPhotoSecurityScan`) performs antivirus + EXIF sanitisation per upload; configure via `config/security.php`.
|
|
- **Payments & Webhooks** — *Owner: Billing*
|
|
Align legacy Stripe hooks with checkout sessions, add idempotency locks/signature expiry checks, and plug failed capture notifications into the credit ledger audit trail.
|
|
- **Frontend & CSP** — *Owner: Marketing Frontend*
|
|
Replace unsafe-inline allowances (Stripe/Matomo) with nonce or hashed CSP rules, gate analytics injection behind consent, and localise cookie-banner copy that discloses data sharing.
|
|
|
|
Progress updates belong in `docs/changes/` and roadmap status in `docs/implementation-roadmap.md`.
|