30 lines
1.4 KiB
JSON
30 lines
1.4 KiB
JSON
{
|
|
"feature_id": "F-187",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"checks": [
|
|
{ "item": "Cashier list/create/status/delete require admin role", "ok": true },
|
|
{ "item": "Mutation lookup is restricted to pos_cashier targets", "ok": true },
|
|
{ "item": "Every lifecycle input and UUID is schema validated", "ok": true },
|
|
{ "item": "All lifecycle SQL uses bound parameters", "ok": true },
|
|
{ "item": "Deactivation/deletion revokes all live sessions atomically", "ok": true },
|
|
{ "item": "Authenticator independently rejects inactive/deleted users", "ok": true },
|
|
{ "item": "Credential lookup preserves generic anti-enumeration failure", "ok": true },
|
|
{ "item": "Cash-session opening race is serialized by row lock", "ok": true },
|
|
{ "item": "Open-register guard prevents abandoning accountable cash", "ok": true },
|
|
{ "item": "Security audit events record actor/action/target atomically", "ok": true },
|
|
{ "item": "Changed-diff secret scan", "ok": true },
|
|
{ "item": "Backend and admin production dependency audit", "ok": true }
|
|
],
|
|
"dependency_audit": {
|
|
"backend": "0 vulnerabilities",
|
|
"admin": "0 vulnerabilities"
|
|
},
|
|
"issues": [],
|
|
"notes": [
|
|
"Soft deletion intentionally retains cashier email for human-readable historical attribution; this is account removal, not a personal-data erasure workflow.",
|
|
"No user-supplied audit metadata is accepted."
|
|
]
|
|
}
|