Files

Codex Agent 6290a3a448 Fix tenant event form package selector so it no longer renders empty-value options, handles loading/empty

states, and pulls data from the authenticated /api/v1/tenant/packages endpoint.
    (resources/js/admin/pages/EventFormPage.tsx, resources/js/admin/api.ts)
  - Harden tenant-admin auth flow: prevent PKCE state loss, scope out StrictMode double-processing, add SPA
    routes for /event-admin/login and /event-admin/logout, and tighten token/session clearing semantics (resources/js/admin/auth/{context,tokens}.tsx, resources/js/admin/pages/{AuthCallbackPage,LogoutPage}.tsx,
    resources/js/admin/router.tsx, routes/web.php)

2025-10-19 23:00:47 +02:00

2.5 KiB

Raw Blame History

09 — Security & Compliance

Roles: super_admin, tenant_admin, member; guest upload via signed tokens.
Policies: all tenant-owned models gated; Super Admin bypass via explicit ability.
Audit: record impersonation and destructive actions with actor, target, reason.
Logging: structured, no PII; add request/trace IDs; redact secrets.
GDPR: retention settings per tenant; deletion workflows; legal pages managed via CMS-like resource.
Rate limits: per-tenant, per-user, per-device; protect upload and admin mutations.

2025 Hardening Priorities

Identity & OAuth — Owner: Backend Platform
Track JWT key rotation via oauth:rotate-keys, roll out dual-key support (old/new KID overlap), surface refresh-token revocation tooling, and extend IP/device binding rules for long-lived sessions. See docs/deployment/oauth-key-rotation.md for the rotation playbook. Filament now offers a refresh-token console with per-device revocation and audit history.
Guest Join Tokens — Owner: Guest Platform
Hash stored join tokens, add anomaly metrics (usage spikes, stale tokens), and tighten gallery/photo rate limits with visibility in storage dashboards. Join-token access is now logged to event_join_token_events with summaries surfaced in the Event admin modal.
Public API Resilience — Owner: Core API
Ensure gallery/download endpoints serve signed URLs, expand abuse throttles (token + IP), and document incident response runbooks in ops guides. See docs/deployment/public-api-incident-playbook.md for the response checklist.
Media Pipeline & Storage — Owner: Media Services
Introduce antivirus + EXIF scrubbing workers, stream uploads to disk to avoid buffering, and enforce checksum verification during hot→archive transfers with configurable alerts from StorageHealthService.
- Queue media-security (job: ProcessPhotoSecurityScan) performs antivirus + EXIF sanitisation per upload; configure via config/security.php.
Payments & Webhooks — Owner: Billing
Align legacy Stripe hooks with checkout sessions, add idempotency locks/signature expiry checks, and plug failed capture notifications into the credit ledger audit trail.
Frontend & CSP — Owner: Marketing Frontend
Replace unsafe-inline allowances (Stripe/Matomo) with nonce or hashed CSP rules, gate analytics injection behind consent, and localise cookie-banner copy that discloses data sharing.

Progress updates belong in docs/changes/ and roadmap status in docs/implementation-roadmap.md.

2.5 KiB Raw Blame History

09 — Security & Compliance

2025 Hardening Priorities

2.5 KiB

Raw Blame History