canina/docs/audit/08-admin-features-audit.md

Admin Features Audit Report

• Auditor Role: Admin Features Auditor
• Date: 2026-08-06
• Repository HEAD: 715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7
• Included Scope: backend/src/settings/**/*, backend/src/auth/guards/**/*, administrative DTOs, and root src/ admin references.
• Excluded Scope: frontend/admin-panel/** (Confirmed non-auditable placeholder directory).
• Files Inspected: backend/src/settings/settings.controller.ts, backend/src/settings/settings.service.ts, src/App.tsx, backend/src/auth/jwt-auth.guard.ts.
• Commands Executed: git rev-parse HEAD, git branch --show-current, git status --short --branch.
• Commands Blocked: None.
• Audit Limitations: Evaluated via static code analysis of backend administrative controllers and frontend state.

---

Domain Overview & Confirmed Strengths

• NO ACTIVE ADMIN FRONTEND SOURCE WAS FOUND. The repository does not contain an active standalone frontend application for administration (the frontend/admin-panel directory contains only node_modules/ without source code or package.json).
• Backend settings controller (backend/src/settings/settings.controller.ts) provides REST endpoints to modify UI dynamic text labels and scientific glossary definitions.

---

Findings

ADM-001

Title

Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints

Domain

Admin Features

Category

Authorization & Privilege Escalation

Severity

HIGH

Confidence

CONFIRMED

Status

OPEN

Affected Application

NestJS Backend (backend/)

Affected Files

• backend/src/settings/settings.controller.ts

Relevant Symbols or Lines

• backend/src/settings/settings.controller.ts#L27-L46 (updateUiText)
• backend/src/settings/settings.controller.ts#L67-L109 (upsertScientificTerm, deleteScientificTerm)

Evidence

In SettingsController:

@UseGuards(JwtAuthGuard)
@Patch('ui-texts/:key')
updateUiText(...) { ... }

The routes apply @UseGuards(JwtAuthGuard) but do not enforce a roles guard (e.g. @Roles('Admin') or @UseGuards(RolesGuard)).

Problem

Any authenticated user possessing a valid JWT token (including standard pet owners with role User_PetOwner) can call PATCH /api/settings/ui-texts/:key or DELETE /api/settings/scientific-terms/:key to alter public website copy or delete terms.

Root Cause

Missing custom RolesGuard and @Roles('Admin') decorator application on administrative settings routes.

Why It Matters

Enables unauthorized standard users to perform administrative write/delete mutations on system-wide configuration settings.

User or Business Impact

Defacement of storefront UI texts or destruction of scientific glossary content by non-admin users.

Technical Impact

Loss of access control boundary between regular pet owner accounts and system administrators.

Security or Data-Integrity Impact

Vertical privilege escalation vulnerability allowing unprivileged users to act as administrators.

Recommended Direction

Implement a RolesGuard and decorate administrative endpoints with @Roles('Admin').

Alternative Direction

Segregate administrative routes under an /api/admin/settings controller protected by dedicated admin middleware.

Implementation Complexity

LOW

Dependencies

User role definition in JWT payload.

Risks

None.

Verification Requirements

Submit PATCH /api/settings/ui-texts/hero_title using a JWT token belonging to a User_PetOwner user and verify backend returns 403 Forbidden.

Testing Requirements

Unit test SettingsController with non-admin JWT context.

Acceptance Criteria

Non-admin authenticated requests to settings mutation endpoints are rejected with 403 Forbidden.

Notes and Limitations

Schema defines User.role default as "User_PetOwner".

---

Finding Summary

• CRITICAL: 0

• HIGH: 1

• MEDIUM: 0

• LOW: 0

• INFO: 0

• CONFIRMED: 1

• HIGH_CONFIDENCE: 0

• NEEDS_VERIFICATION: 0

• SPECULATIVE: 0

Completion Statement

Admin Features audit completed. 1 HIGH severity finding confirmed. Missing active admin frontend documented.