276 lines
9.7 KiB
JSON
276 lines
9.7 KiB
JSON
{
|
|
"phase": "deep-domain-audit",
|
|
"repositoryHead": "715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7",
|
|
"generatedAt": "2026-08-06T14:56:00Z",
|
|
"executionMode": "ISOLATED_SEQUENTIAL_ROLE_EXECUTION",
|
|
"reports": [
|
|
{
|
|
"domain": "Architecture",
|
|
"reportPath": "docs/audit/05-architectural-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["ARCH-001"]
|
|
},
|
|
{
|
|
"domain": "React / Vite Storefront",
|
|
"reportPath": "docs/audit/06-storefront-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["FE-001"]
|
|
},
|
|
{
|
|
"domain": "NestJS Backend",
|
|
"reportPath": "docs/audit/07-backend-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["BE-001"]
|
|
},
|
|
{
|
|
"domain": "Admin Features",
|
|
"reportPath": "docs/audit/08-admin-features-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["ADM-001"]
|
|
},
|
|
{
|
|
"domain": "Database and Data Integrity",
|
|
"reportPath": "docs/audit/09-database-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["DB-001"]
|
|
},
|
|
{
|
|
"domain": "Security",
|
|
"reportPath": "docs/audit/10-security-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["SEC-001", "SEC-002"]
|
|
},
|
|
{
|
|
"domain": "TypeScript and Code Quality",
|
|
"reportPath": "docs/audit/11-code-quality-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["TS-001"]
|
|
},
|
|
{
|
|
"domain": "Testing and Reliability",
|
|
"reportPath": "docs/audit/12-testing-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["TEST-001"]
|
|
},
|
|
{
|
|
"domain": "DevOps and CI/CD",
|
|
"reportPath": "docs/audit/13-devops-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["DEVOPS-001"]
|
|
},
|
|
{
|
|
"domain": "Documentation",
|
|
"reportPath": "docs/audit/14-documentation-audit.md",
|
|
"status": "completed",
|
|
"findingIds": ["DOC-001"]
|
|
}
|
|
],
|
|
"findings": [
|
|
{
|
|
"id": "ARCH-001",
|
|
"title": "Dual Authentication Flow Contract Mismatch between Frontend and Backend Services",
|
|
"domain": "Architecture",
|
|
"category": "API Contract Alignment / Authentication Architecture",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/) and NestJS Backend (backend/src/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.controller.ts",
|
|
"backend/src/auth/auth.service.ts",
|
|
"src/store/useStore.ts",
|
|
"src/App.tsx"
|
|
],
|
|
"evidenceSummary": "Backend requires SMS OTP auth while frontend relies on mock email/password state.",
|
|
"sourceReport": "docs/audit/05-architectural-audit.md"
|
|
},
|
|
{
|
|
"id": "FE-001",
|
|
"title": "SPA Direct Window Location Manipulation Bypasses Routing State Management",
|
|
"domain": "React / Vite Storefront",
|
|
"category": "Routing Architecture & Client Navigation",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/)",
|
|
"affectedFiles": [
|
|
"src/App.tsx",
|
|
"src/components/Header.tsx"
|
|
],
|
|
"evidenceSummary": "Manual window history calls in App.tsx desynchronize deep links and browser navigation.",
|
|
"sourceReport": "docs/audit/06-storefront-audit.md"
|
|
},
|
|
{
|
|
"id": "BE-001",
|
|
"title": "Unsafe Floating Point arithmetic and Non-Atomic Calculation in Order Total Service",
|
|
"domain": "NestJS Backend",
|
|
"category": "Financial Calculations / Transaction Integrity",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/orders/orders.service.ts"
|
|
],
|
|
"evidenceSummary": "Converts Prisma Decimal to JS Number in loop, causing rounding inaccuracies and N+1 queries.",
|
|
"sourceReport": "docs/audit/07-backend-audit.md"
|
|
},
|
|
{
|
|
"id": "ADM-001",
|
|
"title": "Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints",
|
|
"domain": "Admin Features",
|
|
"category": "Authorization & Privilege Escalation",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/settings/settings.controller.ts"
|
|
],
|
|
"evidenceSummary": "Settings routes use JwtAuthGuard without RolesGuard, allowing any user to edit/delete terms.",
|
|
"sourceReport": "docs/audit/08-admin-features-audit.md"
|
|
},
|
|
{
|
|
"id": "DB-001",
|
|
"title": "Missing Explicit Unique Index Constraint on User Mobile Numbers in Database Schema",
|
|
"domain": "Database and Data Integrity",
|
|
"category": "Data Modeling & Uniqueness Constraints",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "Prisma / PostgreSQL Database (backend/prisma/schema.prisma)",
|
|
"affectedFiles": [
|
|
"backend/prisma/schema.prisma"
|
|
],
|
|
"evidenceSummary": "Nullable mobile field with @unique causes P2002 errors if empty strings are inserted.",
|
|
"sourceReport": "docs/audit/09-database-audit.md"
|
|
},
|
|
{
|
|
"id": "SEC-001",
|
|
"title": "Insecure Default Hardcoded JWT Secret Key Fallback in Production Configuration",
|
|
"domain": "Security",
|
|
"category": "Cryptographic Failures & Hardcoded Credentials",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.module.ts",
|
|
"backend/src/auth/jwt.strategy.ts"
|
|
],
|
|
"evidenceSummary": "jwt.strategy.ts falls back to hardcoded string when JWT_SECRET env var is omitted.",
|
|
"sourceReport": "docs/audit/10-security-audit.md"
|
|
},
|
|
{
|
|
"id": "SEC-002",
|
|
"title": "Predictable Deterministic Pseudo-Random Generation of One-Time Passwords (OTP)",
|
|
"domain": "Security",
|
|
"category": "Identification & Authentication Failures",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/auth/auth.service.ts"
|
|
],
|
|
"evidenceSummary": "Uses Math.random() for 5-digit OTP generation instead of crypto CSPRNG.",
|
|
"sourceReport": "docs/audit/10-security-audit.md"
|
|
},
|
|
{
|
|
"id": "TS-001",
|
|
"title": "Unsafe Implicit any Types and Loose State Typing in Core Application Component",
|
|
"domain": "TypeScript and Code Quality",
|
|
"category": "Type Safety & Code Quality",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "React Storefront (src/)",
|
|
"affectedFiles": [
|
|
"src/App.tsx"
|
|
],
|
|
"evidenceSummary": "App.tsx declares state variables with explicit any, bypassing TypeScript safety.",
|
|
"sourceReport": "docs/audit/11-code-quality-audit.md"
|
|
},
|
|
{
|
|
"id": "TEST-001",
|
|
"title": "Stale Unit Test Specifications Asserting Obsolete Property Signatures",
|
|
"domain": "Testing and Reliability",
|
|
"category": "Test Quality & Suite Rot",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "NestJS Backend (backend/)",
|
|
"affectedFiles": [
|
|
"backend/src/pets/pets.controller.spec.ts",
|
|
"backend/src/settings/settings.controller.spec.ts",
|
|
"backend/src/users/users.controller.spec.ts"
|
|
],
|
|
"evidenceSummary": "Controller spec files assert obsolete result.success property, failing type check compilation.",
|
|
"sourceReport": "docs/audit/12-testing-audit.md"
|
|
},
|
|
{
|
|
"id": "DEVOPS-001",
|
|
"title": "Absence of Automated CI/CD Workflow Definitions and Deployment Quality Gates",
|
|
"domain": "DevOps and CI/CD",
|
|
"category": "Automation & Quality Gates",
|
|
"severity": "HIGH",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "Repository Root (.)",
|
|
"affectedFiles": [
|
|
".github/workflows/"
|
|
],
|
|
"evidenceSummary": "No GitHub Actions or CI configuration present to run lint, test, or build checks automatically.",
|
|
"sourceReport": "docs/audit/13-devops-audit.md"
|
|
},
|
|
{
|
|
"id": "DOC-001",
|
|
"title": "Static Swagger Specification Desynchronization with Active NestJS Auth Endpoints",
|
|
"domain": "Documentation",
|
|
"category": "API Documentation Drift",
|
|
"severity": "MEDIUM",
|
|
"confidence": "CONFIRMED",
|
|
"status": "OPEN",
|
|
"affectedApplication": "Root Documentation (swagger.yml)",
|
|
"affectedFiles": [
|
|
"swagger.yml",
|
|
"backend/src/auth/auth.controller.ts"
|
|
],
|
|
"evidenceSummary": "swagger.yml documents login/register while NestJS controller implements send-otp/verify-otp.",
|
|
"sourceReport": "docs/audit/14-documentation-audit.md"
|
|
}
|
|
],
|
|
"counts": {
|
|
"total": 10,
|
|
"bySeverity": {
|
|
"CRITICAL": 0,
|
|
"HIGH": 6,
|
|
"MEDIUM": 4,
|
|
"LOW": 0,
|
|
"INFO": 0
|
|
},
|
|
"byConfidence": {
|
|
"CONFIRMED": 10,
|
|
"HIGH_CONFIDENCE": 0,
|
|
"NEEDS_VERIFICATION": 0,
|
|
"SPECULATIVE": 0
|
|
},
|
|
"byDomain": {
|
|
"Architecture": 1,
|
|
"React / Vite Storefront": 1,
|
|
"NestJS Backend": 1,
|
|
"Admin Features": 1,
|
|
"Database and Data Integrity": 1,
|
|
"Security": 2,
|
|
"TypeScript and Code Quality": 1,
|
|
"Testing and Reliability": 1,
|
|
"DevOps and CI/CD": 1,
|
|
"Documentation": 1
|
|
}
|
|
},
|
|
"limitations": [
|
|
"Root tsc binary unlinked requiring npm install prior to root type check execution",
|
|
"Static evaluation conducted without connecting to live database engine"
|
|
]
|
|
}
|