canina/docs/audit/19-finding-verification-report.md

Raw Finding Verification & Disposition Report

1. Executive Summary & Verification Reconciliation Table

All eleven original raw finding IDs plus newly discovered security/backend findings have received explicit audit dispositions:

Original Finding ID	Original Title	Original Severity	Original Confidence	Disposition	Verified Evidence	Final Title	Final Severity	Final Confidence	Final Status	Resulting Finding IDs	Explanation
ARCH-001	Dual Authentication Flow Contract Mismatch between Frontend and Backend Services	HIGH	CONFIRMED	REVISED	src/store/userStore.ts & backend/src/auth/auth.controller.ts	Disconnected Authentication Protocols Between Storefront Client and Backend OTP API	HIGH	CONFIRMED	OPEN	ARCH-001	Title updated to clarify protocol desynchronization; severity HIGH retained as auth integration is broken.
FE-001	SPA Direct Window Location Manipulation Bypasses Routing State Management	MEDIUM	CONFIRMED	REVISED	src/App.tsx#L92-L100	Absence of Declarative Router Causes SPA State Desynchronization on Direct Links	MEDIUM	HIGH_CONFIDENCE	OPEN	FE-001	Confidence adjusted from CONFIRMED to HIGH_CONFIDENCE as runtime bounce rate claims were unverified static observations.
BE-001	Unsafe Floating Point arithmetic and Non-Atomic Calculation in Order Total Service	HIGH	CONFIRMED	SPLIT	backend/src/orders/orders.service.ts#L10-L23	Floating-Point Conversion in Monetary Order Total Calculations	HIGH	CONFIRMED	OPEN	BE-001, BE-002	Split into BE-001 (monetary precision) and BE-002 (N+1 query bottleneck during order creation).
ADM-001	Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints	HIGH	CONFIRMED	ACCEPTED	backend/src/settings/settings.controller.ts#L27-L109	Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints	HIGH	CONFIRMED	OPEN	ADM-001	Fully verified. Endpoints apply JwtAuthGuard without RolesGuard or @Roles('Admin').
DB-001	Missing Explicit Unique Index Constraint on User Mobile Numbers in Database Schema	MEDIUM	CONFIRMED	REJECTED_FALSE_POSITIVE	backend/prisma/schema.prisma#L15	N/A	N/A	N/A	REJECTED	None	Contradicted by schema (mobile String? @unique exists). Rejected as false positive.
SEC-001	Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration	HIGH	CONFIRMED	ACCEPTED	backend/src/auth/jwt.strategy.ts#L10-L15	Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration	HIGH	CONFIRMED	OPEN	SEC-001	Verified fallback string 'super-secret-key-canina' in JwtStrategy.
SEC-002	Predictable Deterministic Pseudo-Random Generation of One-Time Passwords (OTP)	HIGH	CONFIRMED	SPLIT	backend/src/auth/auth.service.ts#L19	Non-Cryptographic Random Generation of SMS OTP Authentication Codes	HIGH	CONFIRMED	OPEN	SEC-002, SEC-003	Retained SEC-002 for Math.random() PRNG vulnerability and split SEC-003 for plaintext OTP disclosure in response payload.
TS-001	Unsafe Implicit any Types and Loose State Typing in Core Application Component	MEDIUM	CONFIRMED	REVISED	src/App.tsx#L55-L57	Explicit any Type Annotations in Main Application State	LOW	CONFIRMED	OPEN	TS-001	Severity downgraded from MEDIUM to LOW as maintainability defect confined to local component state.
TEST-001	Stale Unit Test Specifications Asserting Obsolete Property Signatures	MEDIUM	CONFIRMED	ACCEPTED	backend/src/*/*.spec.ts	Stale Unit Test Specifications Asserting Obsolete Property Signatures	MEDIUM	CONFIRMED	OPEN	TEST-001	Verified across pets, settings, and users spec files.
DEVOPS-001	Absence of Automated CI/CD Workflow Definitions and Deployment Quality Gates	HIGH	CONFIRMED	REVISED	Entire repo root	Absence of Committed CI/CD Pipeline Workflow Definitions in Repository	MEDIUM	CONFIRMED	OPEN	DEVOPS-001	Severity adjusted from HIGH to MEDIUM; title clarified to repository-visible workflow scope.
DOC-001	Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints	MEDIUM	CONFIRMED	ACCEPTED	swagger.yml vs auth.controller.ts	Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints	MEDIUM	CONFIRMED	OPEN	DOC-001	Verified static file lists /auth/login while backend implements /auth/send-otp.

---

2. Newly Discovered & Split Findings (Canonical IDs)

1. BE-002 (NestJS Backend): Synchronous N+1 Query Lookup in Order Item Processing (backend/src/orders/orders.service.ts#L13-L23) - Severity: MEDIUM, Confidence: CONFIRMED.
2. SEC-003 (Security): Plaintext OTP Disclosure in Public API Response Payload (backend/src/auth/auth.service.ts#L24) - Severity: HIGH, Confidence: CONFIRMED.
3. TS-002 (TypeScript / Quality): Missing Required slug Field in Prisma Product Seed Script (backend/prisma/seed.ts#L54) - Severity: MEDIUM, Confidence: CONFIRMED.
4. TS-003 (TypeScript / Quality): Non-Type-Only Import of Express Response in Decorated Controller (backend/src/common/metrics.controller.ts#L18) - Severity: LOW, Confidence: CONFIRMED.