123 lines
4.1 KiB
Markdown
123 lines
4.1 KiB
Markdown
# Admin Features Audit Report
|
|
|
|
- **Auditor Role**: Admin Features Auditor
|
|
- **Date**: 2026-08-06
|
|
- **Repository HEAD**: `715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7`
|
|
- **Included Scope**: `backend/src/settings/**/*`, `backend/src/auth/guards/**/*`, administrative DTOs, and root `src/` admin references.
|
|
- **Excluded Scope**: `frontend/admin-panel/**` (Confirmed non-auditable placeholder directory).
|
|
- **Files Inspected**: `backend/src/settings/settings.controller.ts`, `backend/src/settings/settings.service.ts`, `src/App.tsx`, `backend/src/auth/jwt-auth.guard.ts`.
|
|
- **Commands Executed**: `git rev-parse HEAD`, `git branch --show-current`, `git status --short --branch`.
|
|
- **Commands Blocked**: None.
|
|
- **Audit Limitations**: Evaluated via static code analysis of backend administrative controllers and frontend state.
|
|
|
|
---
|
|
|
|
## Domain Overview & Confirmed Strengths
|
|
- **NO ACTIVE ADMIN FRONTEND SOURCE WAS FOUND**. The repository does not contain an active standalone frontend application for administration (the `frontend/admin-panel` directory contains only `node_modules/` without source code or `package.json`).
|
|
- Backend settings controller (`backend/src/settings/settings.controller.ts`) provides REST endpoints to modify UI dynamic text labels and scientific glossary definitions.
|
|
|
|
---
|
|
|
|
## Findings
|
|
|
|
## ADM-001
|
|
|
|
### Title
|
|
Missing Role-Based Access Control (RBAC) Guard on Administrative Settings Endpoints
|
|
|
|
### Domain
|
|
Admin Features
|
|
|
|
### Category
|
|
Authorization & Privilege Escalation
|
|
|
|
### Severity
|
|
HIGH
|
|
|
|
### Confidence
|
|
CONFIRMED
|
|
|
|
### Status
|
|
OPEN
|
|
|
|
### Affected Application
|
|
NestJS Backend (`backend/`)
|
|
|
|
### Affected Files
|
|
- `backend/src/settings/settings.controller.ts`
|
|
|
|
### Relevant Symbols or Lines
|
|
- `backend/src/settings/settings.controller.ts#L27-L46` (`updateUiText`)
|
|
- `backend/src/settings/settings.controller.ts#L67-L109` (`upsertScientificTerm`, `deleteScientificTerm`)
|
|
|
|
### Evidence
|
|
In `SettingsController`:
|
|
```typescript
|
|
@UseGuards(JwtAuthGuard)
|
|
@Patch('ui-texts/:key')
|
|
updateUiText(...) { ... }
|
|
```
|
|
The routes apply `@UseGuards(JwtAuthGuard)` but do not enforce a roles guard (e.g. `@Roles('Admin')` or `@UseGuards(RolesGuard)`).
|
|
|
|
### Problem
|
|
Any authenticated user possessing a valid JWT token (including standard pet owners with role `User_PetOwner`) can call `PATCH /api/settings/ui-texts/:key` or `DELETE /api/settings/scientific-terms/:key` to alter public website copy or delete terms.
|
|
|
|
### Root Cause
|
|
Missing custom `RolesGuard` and `@Roles('Admin')` decorator application on administrative settings routes.
|
|
|
|
### Why It Matters
|
|
Enables unauthorized standard users to perform administrative write/delete mutations on system-wide configuration settings.
|
|
|
|
### User or Business Impact
|
|
Defacement of storefront UI texts or destruction of scientific glossary content by non-admin users.
|
|
|
|
### Technical Impact
|
|
Loss of access control boundary between regular pet owner accounts and system administrators.
|
|
|
|
### Security or Data-Integrity Impact
|
|
Vertical privilege escalation vulnerability allowing unprivileged users to act as administrators.
|
|
|
|
### Recommended Direction
|
|
Implement a `RolesGuard` and decorate administrative endpoints with `@Roles('Admin')`.
|
|
|
|
### Alternative Direction
|
|
Segregate administrative routes under an `/api/admin/settings` controller protected by dedicated admin middleware.
|
|
|
|
### Implementation Complexity
|
|
LOW
|
|
|
|
### Dependencies
|
|
User role definition in JWT payload.
|
|
|
|
### Risks
|
|
None.
|
|
|
|
### Verification Requirements
|
|
Submit `PATCH /api/settings/ui-texts/hero_title` using a JWT token belonging to a `User_PetOwner` user and verify backend returns `403 Forbidden`.
|
|
|
|
### Testing Requirements
|
|
Unit test `SettingsController` with non-admin JWT context.
|
|
|
|
### Acceptance Criteria
|
|
Non-admin authenticated requests to settings mutation endpoints are rejected with `403 Forbidden`.
|
|
|
|
### Notes and Limitations
|
|
Schema defines `User.role` default as `"User_PetOwner"`.
|
|
|
|
---
|
|
|
|
## Finding Summary
|
|
- **CRITICAL**: 0
|
|
- **HIGH**: 1
|
|
- **MEDIUM**: 0
|
|
- **LOW**: 0
|
|
- **INFO**: 0
|
|
|
|
- **CONFIRMED**: 1
|
|
- **HIGH_CONFIDENCE**: 0
|
|
- **NEEDS_VERIFICATION**: 0
|
|
- **SPECULATIVE**: 0
|
|
|
|
## Completion Statement
|
|
Admin Features audit completed. 1 HIGH severity finding confirmed. Missing active admin frontend documented.
|