rikrdo/mercadodevida
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(F-151): completed feature

Browse Source
This commit is contained in:
chattie
2026-08-21 22:14:29 +02:00
parent c4d0206d5d
commit ef79c54006
9 changed files with 270 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
work/artifacts/F-151/security.json Normal file
View File

@@ -0,0 +1,18 @@
{
"feature_id": "F-151",
"agent": "security",
"stage": "security_gate",
"verdict": "APPROVED",
"reviewed_at": "2026-08-21T20:14:30Z",
"summary": "Aprobado con alcance dev/local. La cookie no-Secure solo se permite para HTTP; bajo HTTPS o proxy x-forwarded-proto=https conserva Secure. El seed exige password explícita si NODE_ENV=production.",
"checks": [
{"item":"Cookie security preserved for HTTPS","ok":true,"evidence":"isSecureRequest returns true for request.protocol=https or x-forwarded-proto=https"},
{"item":"HTTP local login usable","ok":true,"evidence":"Secure=false en HTTP permite sesión admin en LAN sin TLS"},
{"item":"HttpOnly and SameSite preserved","ok":true,"evidence":"setCookie mantiene httpOnly y sameSite=lax"},
{"item":"Admin password hashed","ok":true,"evidence":"seed usa argon2.hash antes de insertar backoffice_users"},
{"item":"Production seed guard","ok":true,"evidence":"NODE_ENV=production sin SEED_ADMIN_PASSWORD lanza error"},
{"item":"No card/PII changes","ok":true,"evidence":"Solo seed dev catalog/backoffice and cookie flag derivation"}
],
"issues": [],
"notes":"La contraseña por defecto del seed debe considerarse solo dev/local. Para despliegue real usar SEED_ADMIN_PASSWORD y cambiar credenciales tras el primer login."
}