17 lines
1.3 KiB
JSON
17 lines
1.3 KiB
JSON
{
|
|
"feature_id": "F-145",
|
|
"agent": "security",
|
|
"stage": "security_gate",
|
|
"verdict": "APPROVED",
|
|
"summary": "Additive DDL migration + isolated DB integration test. No new routes/auth/RBAC. No PAN/CVV/card data stored. provider_ref is a Stripe payment_intent ID (public token, not card data). itest runs against per-run recreated mercadodevida_test DB.",
|
|
"checks": [
|
|
{"item": "No new routes/auth/RBAC", "ok": true, "evidence": "schema migration + itest only; identity/security/reporting routes untouched"},
|
|
{"item": "No card data (PCI-DSS minimum)", "ok": true, "evidence": "provider_ref stores provider reference (e.g. Stripe payment_intent), NOT PAN/CVV. Column provider_ref is nullable text — no card data."},
|
|
{"item": "No SQL injection", "ok": true, "evidence": "migration no user input; itest uses parameterized queries ($1..$10)"},
|
|
{"item": "IDOR / data scope", "ok": true, "evidence": "itest against isolated mercadodevida_test DB (recreated per run); FK constraints prevent orphaned rows"},
|
|
{"item": "Pre-existing boundary note", "ok": true, "evidence": "git diff does not touch security.routes.ts; R1 pre-existing, not introduced by F-145"},
|
|
{"item": "Idempotency safety", "ok": true, "evidence": "createTable IF NOT EXISTS + DO$$ FK guard prevents duplicate-constraint on re-run"}
|
|
],
|
|
"issues": []
|
|
}
|