carmanagement/docs/SECURITY_HARDENING_APPLIED.md

Security Hardening Applied

This bundle applies the highest-risk items from the hardened security fix plan to the uploaded apps source.

Applied changes

• Added explicit subscription read/write/full middleware and moved sensitive mutations to write/full checks.
• Hardened backend route authorization for reservations, customers, vehicles, analytics, payments, reviews, complaints, team, companies, offers, notifications, billing, and subscription actions.
• Blocked AGENT access to manager/owner actions including reservation lifecycle transitions, analytics, payments, review replies/reminders, team lists/stats, license image reads, license validation, and complaint mutations.
• Disabled public Swagger/OpenAPI exposure in production unless ENABLE_PUBLIC_API_DOCS=true is explicitly set.
• Added CSRF-style Origin/Referer enforcement for cookie-authenticated browser mutations.
• Added forwarding-header sanitization middleware and stripped spoofable forwarding headers from the dashboard API proxy.
• Changed dashboard redirects to use the configured canonical dashboard URL instead of request-supplied forwarded host headers.
• Blocked anonymous /storage access to reservation photo paths and classified reservation uploads as private storage.
• Tightened image upload limits, file count limits, magic-byte validation, extension consistency, and basic image dimension limits.
• Added a dedicated webhook rate limiter and raw body size limits.
• Hardened AmanPay webhook signature verification so invalid signature length returns false instead of throwing.
• Hardened webhook idempotency by rejecting missing provider event IDs and allowing stale PROCESSING records to retry after a timeout.
• Hardened PayPal capture by binding capture to company, reservation, local pending payment status, provider completion status, amount, and currency.
• Restricted public site/carplace booking flows to ACTIVE/TRIALING companies and AVAILABLE published vehicles.
• Capped public Carplace pagination and metadata size.
• Replaced rank-only admin role checks with explicit role allowlists so SUPPORT no longer implicitly outranks FINANCE.
• Required fresh admin 2FA before replacing an already-enabled admin TOTP setup.
• Started storing admin reset tokens and employee email verification tokens as hashes while preserving legacy raw-token lookup during migration.

Validation performed

The sandbox did not include a usable installed workspace dependency tree, so full npm test / npm run type-check could not be executed from the extracted bundle. A TypeScript syntactic transpile check was run against all changed TypeScript files and passed.

Important remaining work

This patch does not fully complete every item in the hardening plan. The remaining work should be handled before production sign-off:

• Add/expand DB-backed audit logging for every sensitive mutation.
• Add database-backed idempotency for public booking instead of the current process-local cache.
• Add full route authorization matrix tests across unauthenticated, AGENT, MANAGER, OWNER, wrong tenant, suspended, paused, and past-due states.
• Add storage migration scripts to move existing public reservation photos into private storage.
• Finish token migration for review tokens and any remaining invitation/public access tokens if schema support exists.
• Add full payment provider merchant/receiver-account validation if provider config is stored per company.
• Add dependency/lockfile CI gates from the plan.