# Admin Features Audit Report

- **Auditor Role**: Admin Features Auditor
- **Date**: 2026-08-06
- **Repository HEAD**: `715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7`
- **Included Scope**: `backend/src/settings/**/*`, `backend/src/auth/guards/**/*`, administrative DTOs, and root `src/` admin references.
- **Excluded Scope**: `frontend/admin-panel/**` (Confirmed non-auditable placeholder directory).
- **Files Inspected**: `backend/src/settings/settings.controller.ts`, `backend/src/settings/settings.service.ts`, `src/App.tsx`, `backend/src/auth/jwt-auth.guard.ts`.
- **Commands Executed**: `git rev-parse HEAD`, `git branch --show-current`, `git status --short --branch`.
- **Commands Blocked**: None.
- **Audit Limitations**: Evaluated via static code analysis of backend administrative controllers and frontend state.

---

## Domain Overview & Confirmed Strengths
- **NO ACTIVE ADMIN FRONTEND SOURCE WAS FOUND**. The repository does not contain an active standalone frontend application for administration (the `frontend/admin-panel` directory contains only `node_modules/` without source code or `package.json`).
- Backend settings controller (`backend/src/settings/settings.controller.ts`) provides REST endpoints to modify UI dynamic text labels and scientific glossary definitions.

---

## Findings

## ADM-001

### Title
Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints

### Domain
Admin Features

### Category
Authorization & Privilege Escalation

### Severity
HIGH

### Confidence
CONFIRMED

### Status
OPEN

### Affected Application
NestJS Backend (`backend/`)

### Affected Files
- `backend/src/settings/settings.controller.ts`

### Relevant Symbols or Lines
- `backend/src/settings/settings.controller.ts#L27-L46` (`updateUiText`)
- `backend/src/settings/settings.controller.ts#L67-L109` (`upsertScientificTerm`, `deleteScientificTerm`)

### Evidence
In `SettingsController`:
```typescript
@UseGuards(JwtAuthGuard)
@Patch('ui-texts/:key')
updateUiText(...) { ... }
```
The routes apply `@UseGuards(JwtAuthGuard)` but do not enforce a roles guard (e.g. `@Roles('Admin')` or `@UseGuards(RolesGuard)`).

### Problem
Any authenticated user possessing a valid JWT token (including standard pet owners with role `User_PetOwner`) can call `PATCH /api/settings/ui-texts/:key` or `DELETE /api/settings/scientific-terms/:key` to alter public website copy or delete terms.

### Root Cause
Missing custom `RolesGuard` and `@Roles('Admin')` decorator application on administrative settings routes.

### Why It Matters
Enables unauthorized standard users to perform administrative write/delete mutations on system-wide configuration settings.

### User or Business Impact
Defacement of storefront UI texts or destruction of scientific glossary content by non-admin users.

### Technical Impact
Loss of access control boundary between regular pet owner accounts and system administrators.

### Security or Data-Integrity Impact
Vertical privilege escalation vulnerability allowing unprivileged users to act as administrators.

### Recommended Direction
Implement a `RolesGuard` and decorate administrative endpoints with `@Roles('Admin')`.

### Alternative Direction
Segregate administrative routes under an `/api/admin/settings` controller protected by dedicated admin middleware.

### Implementation Complexity
LOW

### Dependencies
User role definition in JWT payload.

### Risks
None.

### Verification Requirements
Submit `PATCH /api/settings/ui-texts/hero_title` using a JWT token belonging to a `User_PetOwner` user and verify backend returns `403 Forbidden`.

### Testing Requirements
Unit test `SettingsController` with non-admin JWT context.

### Acceptance Criteria
Non-admin authenticated requests to settings mutation endpoints are rejected with `403 Forbidden`.

### Notes and Limitations
Schema defines `User.role` default as `"User_PetOwner"`.

---

## Finding Summary
- **CRITICAL**: 0
- **HIGH**: 1
- **MEDIUM**: 0
- **LOW**: 0
- **INFO**: 0

- **CONFIRMED**: 1
- **HIGH_CONFIDENCE**: 0
- **NEEDS_VERIFICATION**: 0
- **SPECULATIVE**: 0

## Completion Statement
Admin Features audit completed. 1 HIGH severity finding confirmed. Missing active admin frontend documented.