parity(api,apps): close SEC-02 - orders take the customer from the token
The user declined to defer this to Phase 2, correctly: a public POST /orders with customerId in the body let anyone place an order on any customer's account, and an order lands on that customer's gold debt and ledger. POST /orders is now behind CustomerAuth. OrdersService.createOrder takes the customer id as a separate argument that the controller fills from the token; the body's customerId is ignored and a mismatch is logged. The field stays optional in the DTO and in shared-types only so both apps keep validating while they still send it -- they drop it in Phase 2. The admin builder is unaffected: it legitimately places orders for a chosen customer and passes that id explicitly, behind the admin guard. GET /orders/:id is scoped to the owner. A foreign or nonexistent id both return 404, never 403, so ids stay unenumerable. Operators read through the new GET /orders/admin/:id behind rid order.list, declared before the :id route because Nest matches in declaration order. Both apps' CartView now gates on session.isLoggedIn rather than a remembered customerId, which is no longer a credential. OTP audit (requested): no master code, no bypass, no hardcoded code anywhere; one code path issues a token and only after bcrypt.compare. No SMS provider is wired up -- in development the code is logged once, guarded by NODE_ENV !== 'production'. Fixed while auditing (SEC-11): deliver() persisted the real message text, code included, into SmsMessage.body, which the admin SMS grid lists and full-text searches. Any operator with the sms rid could read live codes, defeating the hashing of codeHash. The stored row is now a redacted audit line. Also logged MON-08: wagePercent/discountPercent/flatRialCharge are still taken from the client on order creation. The reference is worse -- it takes rash_weight from the client too -- so this is already a partial improvement; logged rather than changed, per D4. Tests: auth-smoke.sh now 53 passed, 0 failed, including a spoofed body customerId being ignored in favour of the token. Typecheck clean on api, user-app, user-app-v2 and shared-types. [ref: henza_server ApiMobileController.php:533,536-545,615-632] Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
s.esmaeili
co-authored by
Claude Opus 5
Claude Opus 5
parent
4efe543d62
commit
024e3dd045
@@ -178,6 +178,66 @@ if [ -n "${CODE_LOG:-}" ] && [ -f "$CODE_LOG" ]; then
|
||||
sed -n 's/.*"mobile":"\([^"]*\)".*/\1/p')
|
||||
[ "$who" = "$CUST_PHONE" ] && ok "mobile = $who" \
|
||||
|| bad "mobile = $who (want $CUST_PHONE)"
|
||||
|
||||
# ------------------------------------------------ SEC-02: orders ---
|
||||
# POST /orders was public with customerId in the body, so anyone could
|
||||
# place an order on anyone's account — and an order lands on that
|
||||
# customer's gold debt and ledger.
|
||||
echo "Orders require a customer token:"
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' -X POST "$API/orders" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"customerId":"x","items":[{"productVariantId":"x","quantity":1,"wagePercent":7}]}')
|
||||
[ "$c" = 401 ] && ok "POST orders without a token -> 401" \
|
||||
|| bad "POST orders without a token -> $c (want 401)"
|
||||
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/orders/any-id")
|
||||
[ "$c" = 401 ] && ok "GET orders/:id without a token -> 401" \
|
||||
|| bad "GET orders/:id without a token -> $c (want 401)"
|
||||
|
||||
# A variant to order, and a customer that is NOT the token's owner.
|
||||
VARIANT=$(curl -s "$API/catalog/products" |
|
||||
sed -n 's/.*"variants":\[{"id":"\([^"]*\)".*/\1/p' | head -1)
|
||||
if [ -n "$VARIANT" ]; then
|
||||
echo "The body's customerId must be ignored in favour of the token:"
|
||||
ORD=$(curl -s -X POST "$API/orders" -H "Authorization: Bearer $CTOK" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"customerId\":\"some-other-customer\",\"items\":[{\"productVariantId\":\"$VARIANT\",\"quantity\":1,\"wagePercent\":7}]}")
|
||||
OWNER=$(printf '%s' "$ORD" | sed -n 's/.*"customerId":"\([^"]*\)".*/\1/p')
|
||||
MY_ID=$(curl -s "$API/customer/me" -H "Authorization: Bearer $CTOK" |
|
||||
sed -n 's/^{"id":"\([^"]*\)".*/\1/p')
|
||||
[ -n "$OWNER" ] && [ "$OWNER" = "$MY_ID" ] \
|
||||
&& ok "order landed on the token's customer ($OWNER), not the body's" \
|
||||
|| bad "order landed on '$OWNER', expected '$MY_ID'"
|
||||
|
||||
# orderNumber is unique per order, so it identifies the row we just made
|
||||
# without having to parse nested item ids out of the response.
|
||||
ORDNUM=$(printf '%s' "$ORD" | sed -n 's/.*"orderNumber":"\([^"]*\)".*/\1/p')
|
||||
MYORD=$(curl -s "$API/customer/me/orders" -H "Authorization: Bearer $CTOK" |
|
||||
tr '{' '\n' | grep -F "\"orderNumber\":\"$ORDNUM\"" |
|
||||
sed -n 's/^"id":"\([^"]*\)".*/\1/p' | head -1)
|
||||
if [ -n "$MYORD" ]; then
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/orders/$MYORD" -H "Authorization: Bearer $CTOK")
|
||||
[ "$c" = 200 ] && ok "own order readable -> 200" || bad "own order -> $c (want 200)"
|
||||
fi
|
||||
|
||||
# Someone else's order and a nonexistent one must be indistinguishable,
|
||||
# or the status code itself confirms which ids exist.
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/orders/definitely-not-an-order" \
|
||||
-H "Authorization: Bearer $CTOK")
|
||||
[ "$c" = 404 ] && ok "unknown order id -> 404" || bad "unknown order id -> $c (want 404)"
|
||||
|
||||
echo "Admin order read is admin-only:"
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/orders/admin/any" -H "Authorization: Bearer $CTOK")
|
||||
[ "$c" = 401 ] && ok "customer token on orders/admin/:id -> 401" \
|
||||
|| bad "customer token on orders/admin/:id -> $c (want 401)"
|
||||
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/orders/admin/any" -H "Authorization: Bearer $SUPER")
|
||||
case "$c" in
|
||||
401|403) bad "admin token on orders/admin/:id -> $c (guard rejected an admin)" ;;
|
||||
*) ok "admin token on orders/admin/:id -> $c (through the guard)" ;;
|
||||
esac
|
||||
else
|
||||
printf ' \033[33mSKIP\033[0m no product variant available to order\n'
|
||||
fi
|
||||
else
|
||||
bad "correct code -> $c (want 200)"
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user