Authorised by rulings D7 and T1-T3 in docs/parity/DECISIONS.md. This is the
CLAUDE.md section 3 carve-out: matching the reference here would keep a money
write path open to anonymous callers.
Closed, each behind the rid the legacy vocabulary already had:
GET accounting/customers/:id/balance -> wallet.list
POST accounting/customers/:id/reconcile -> wallet.charge
POST accounting/repayments/gold -> document.create
POST accounting/repayments/rial -> document.create
POST accounting/entries/:id/confirm -> document.list.confirm
PATCH orders/:id/status -> order.list.sts.submit
Four of the accounting routes WRITE to the ledger. The order-status route was
worse in kind: its DTO takes a client-supplied actorAdminUserId, so an
anonymous caller could move any order and pin it on any admin. It had no
caller - the admin panel posts to admin/orders/status.
GET /customers kept its public status (both apps' login still matches the
phone number in the browser) but now selects only id/mobile/isActive/
isArchived. It previously returned every active customer's full name, national
code, both debts, credit limit and the URLs of their identity-document scans.
CustomerSummary narrowed in BOTH user apps in the same commit, per the
v1/v2 parity rule.
Not changed: /uploads stays public per ruling T2. The filename check requested
alongside it passed unchanged - md5(time + name + uuid), no directory listing.
Tests: apps/api/scripts/auth-smoke.sh asserts 401 without a token, 403 with a
low-privilege token (ut 88, 5 unrelated rids) and pass-through for a super
admin on every closed route, plus that the public routes still answer 200 and
that GET /customers exposes only the four login fields. 23 passed, 0 failed
against a live server. Typecheck clean on api, user-app and user-app-v2.
[ref: henza_server/routes/admin.php:12,272; ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 0 gate passed. All rulings recorded in docs/parity/DECISIONS.md and
applied to PROTECTED.md, PROGRESS.md and ISSUES.md. No source code changed.
Urgent investigations requested by the user, all evidence-cited:
- percent trace: the target's implementation is WRONG. `percent` is the
customer's OWN column in the reference (customer_add.php:32), a per-customer
making-charge offset used to shift catalogue filter bounds
(ApiMobileController.php:391-396,76-77). The target reads the referring
agent's wagePercent instead (admin-customers.service.ts:245) and never
writes the field at all. It is NOT part of the price formula -- that extra
percent comes from a global ConfigStatic row (ProductVariant.php:50,183).
Two unrelated `percent` keys exist and must not be confused with it.
- @Public audit: 15 routes across 7 controllers, grouped by risk. Group A is
5 ledger routes (4 writes) that contradict decision D1; group B is 3 order
routes incl. a public status change accepting a client-supplied
actorAdminUserId; group C is 8 reads, of which only the catalogue, pricing,
slider and uploads are legitimately public.
- Login leak: it is in the TARGET. GET /customers is public and returns every
active customer with national ID numbers, debts and ID-document URLs.
passwordHash is correctly excluded. Not possible in the reference.
Also logged 5 customer-module defects found in the deep check the user asked
for (CUST-01..05), including the fullName collapse the user reported.
Skill updated per D12: Step C gains rule C0 (field-by-field matrix, never
page-by-page) and Step E gains rule E0 (mandatory 4-step round-trip test).
[ref: henza_server, henza_admin]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read-only inventory of all 7 projects (3 reference + 4 target) produced by
parallel subagents, every claim cited path:line. No source code changed.
- 00-INVENTORY.md consolidated mapping: stack, backend, admin, user apps
- PROTECTED.md draft protected list (awaiting user confirmation)
- ISSUES.md 26 logged issues (security, money/stock, validation, dead code)
- CHANGELOG.md change log scaffold
- PROGRESS.md resumable state + Q1-Q5 blocking Phase 1
- _inv-*.md 7 raw per-project inventories (8111 lines)
Key finding: the reference is a gold-jewellery B2B/B2C e-commerce system, not a
gold bank. Buy/sell, deposit/withdraw, transfer, KYC levels, payment callbacks,
cron and websockets do not exist in it, so they cannot be parity gaps.
[ref: henza_server, henza_admin, henza_pwa]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
