parsa/canina
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1c98f1bfa3
canina/docs/audit/phase3.1-change-log.md
parsaaghayi f4cdca4ed1
Some checks failed
Deploy Canina / deploy (push) Failing after 29s
Details
docs(audit): finalize Phase 3 Master Task Backlog and audit planning artifacts
2026-08-06 20:54:44 +03:30

3.7 KiB
Raw Blame History

Phase 3.1 — Master Task Backlog Change Log

  • Audit Phase: Phase 3.1 — Human Review Preparation and Master Backlog Critique
  • Repository HEAD: 715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7

Task Modifications Log

1. TASK-AUTH-001

  • Old Task Specification: "storing JWT access token in localStorage / memory".
  • Change: Updated storage architecture recommendation to strictly warn against localStorage due to XSS vulnerabilities. Recommended storing JWT access token in-memory in Zustand state / Axios request header interceptor, with architectural guidance for HttpOnly cookies in production.
  • Reason: Storing JWT in localStorage allows any client-side XSS script to exfiltrate access tokens.
  • Evidence: src/services/authService.ts line 59, src/services/api.ts line 14.
  • Impact: Hardens storefront authentication state against token theft vulnerabilities.

2. TASK-FIN-001

  • Old Task Specification: "Validate product existence, inventory availability, and stock deduction inside Prisma transaction."
  • Change: Removed inventory availability and stock deduction requirements from core task scope.
  • Reason: Product model in backend/prisma/schema.prisma does not have a stock or inventory column. Adding inventory checking was unsupported scope creep.
  • Evidence: backend/prisma/schema.prisma lines 64-90 (Product model schema).
  • Impact: Keeps TASK-FIN-001 tightly focused on monetary Decimal precision (BE-001) and N+1 query batching (BE-002).

3. DECISION-002

  • Old Classification: Listed as an active blocked item under MASTER-TASK-BACKLOG.md.
  • Change: Reclassified from active backlog blocker to FUTURE_SCOPE and removed from canonical remediation task dependencies.
  • Reason: No verified finding or active implementation task requires live payment gateway provider integration.
  • Evidence: docs/audit/20-verified-findings-index.json (0 findings related to payment gateways).
  • Impact: Prevents unevidenced product requirements from blocking core audit remediation.

4. TASK-VERIFY-001

  • Old Task Specification: "100% of tests pass".
  • Change: Replaced generic text with explicit, behavior-oriented verification assertions across Authentication, Security, Financial, Quality, and Frontend domains.
  • Reason: Generic acceptance criteria fail to specify actual runtime behavior to test.
  • Evidence: docs/audit/phase3.1-backlog-review.md Section 11.
  • Impact: Provides concrete, unambiguous test cases for post-remediation verification.

5. TASK-SEC-001 & TASK-SEC-002

  • Old Task Specification: General secret and CSPRNG assertions.
  • Change: Added explicit minimum length checks (>= 32 chars) and immediate process.exit(1) startup failure requirements for TASK-SEC-001, and rate-limiting / expiration boundaries for TASK-SEC-002.
  • Reason: Hardening defense-in-depth security defaults.
  • Evidence: backend/src/auth/jwt.strategy.ts line 12, backend/src/auth/auth.service.ts line 19.
  • Impact: Ensures fail-closed security behavior in production environments.

6. TASK-BUILD-001 & Execution Waves

  • Old Execution Plan: TASK-BUILD-001 placed in Wave 1 after Wave 0.
  • Change: Formally highlighted TASK-BUILD-001 as the immediate prerequisite for TASK-DEVOPS-001 (CI Pipeline).
  • Reason: CI pipeline execution (npx tsc --noEmit and npm run test) will fail until compiler diagnostic errors and spec assertions are remediated.
  • Evidence: backend/prisma/seed.ts, backend/src/common/metrics.controller.ts, spec files.
  • Impact: Establishes correct dependency order for DevOps pipeline enablement.