# SECURITY_CHECKLIST — BANDUNGCRAFT.COM

## Status saat ini (Phase 1–3, mock/localStorage)
- Password di-plaintext di state demo (`accounts.password`). Demo only, tidak pernah ke production. Login admin tidak terpisah dari pelanggan.
- File upload pelanggan (FileUploader) hanya dibatasi format & ukuran client-side; storage sebagai dataUrl di localStorage. Tidak ada scanning server-side.
- Foto referensi semua bisa dilihat siapa pun yang punya URL/code (mock). Belum ada private storage.
- Rate limiting, CSRF, audit log server-side belum ada; activity log hanya di-browser.

## Checklist untuk Phase 4 (Laravel)

- [ ] **Password hashing** — `bcrypt`/`argon2id` via `Hash::make()`, bukan plaintext. Reset token hanya disimpan hashed.
- [ ] **Role permission** — Policy + middleware `can:` per endpoint; Kasir tidak dapat manage produk, Operator hanya production.
- [ ] **CSRF** — `VerifyCsrfToken` aktif; Sanctum token untuk SPA atau cookie CSRF.
- [ ] **XSS** — Blade escape default, validasi output React `dangerouslySetInnerHTML`, CSP header.
- [ ] **SQL Injection** — Eloquent/Query Builder saja; dilarang raw query dari input; force parameter binding.
- [ ] **File upload** — validasi MIME dari magic bytes (`mimes:jpg,jpeg,png,webp`), whitelist, `max:5120`, rename acak, simpan di disk privat (`storage/app/private`), layani via signed URL otorisasi; AV scan bila budget memungkinkan.
- [ ] **MIME & size** — ganda: client + server; tolak executable/double-extension.
- [ ] **Private file storage** — referensi custom, desain STL, mockup, hasil produksi tidak di `public/`; akses via controller cek `custom_orders` ownership/role.
- [ ] **Session security** — `httpOnly`, `Secure`, `SameSite=Lax`, rotasi ID saat login, idle timeout 30 menit admin.
- [ ] **Rate limiting** — login 5/1 menit per IP, submit checkout/custom 10/10 menit, upload 20/jam.
- [ ] **Audit log** — semua write admin ke `activity_logs` (server-side, user_id, IP, URL, payload ringkas).
- [ ] **Authorization** — object-level check: pelanggan hanya lihat order milik email/session yang sama.
- [ ] **Backup strategy** — nightly `mysqldump` + file `storage/app/private`, simpan 7 hari off-server, retensi 30 hari. Test restore.
- [ ] **Headers** — HSTS, X-Content-Type-Options, Referrer-Policy; `.env` tidak pernah di-commit; kredensial di cPanel via environment khusus.

## Aturan uang & imutabilitas (security bisnis)

- [ ] Tolak delete permanen `payments`, `transactions`, `journal_entry_lines` via API (soft-delete + reversal saja).
- [ ] Semua mutasi kritis (checkout, payment, convert quotation) dalam `DB::transaction` + lock row (`SELECT ... FOR UPDATE`) + idempotency key.