baya-monorepo/dev/post-phase/hardening/issues.md

# Hardening issue ledger (verified findings)

Every item below was found by one audit agent and **re-confirmed by an independent adversarial
verifier** reading the code (and, for H-01, probing the running dev server). Evidence is file:line at
the time of the audit (2026-07-16) — re-locate if lines drifted, but do not re-litigate the finding.

**This file is the loop's progress state.** When a phase fixes an item, tick it `[x]` and append
`— fixed in <commit>` on the same line. `LOOP-PROMPT.md` reads this file to decide what's left.

---

## Phase 0 — auth gate & session liveness

- [ ] **H-01 (blocker) — the auth gate never executes at runtime.**
  `client/middleware.ts` is correct as written (PUBLIC_PATHS = `['/login']`, redirect on dead token)
  but never runs: live cookie-less `GET /fa/admin` → 200 full HTML, bare `GET /` → 404 (no next-intl
  locale redirect either) — reproduced under Turbopack **and** `--webpack`. Cause: Next.js infers the
  workspace root from a stray `C:\Users\Lenovo\pnpm-lock.yaml` (startup warning names it), so the
  middleware file is never bound. Also: Next 16 deprecates `middleware.ts` for `proxy.ts`, and the
  docs place the file "at the same level as `pages` or `app`" — for this repo that's `client/src/`.
  Fix: pin `turbopack.root` (+ `outputFileTracingRoot`) in `client/next.config.mjs`; migrate the file
  to `src/proxy.ts`; **prove the gate runs with a runtime probe** (curl DoD).

- [ ] **H-02 (blocker) — `isTokenAlive` can never read the real token (JWE).**
  Server: `server/src/Infrastructure/Baya.Infrastructure.Identity/Jwt/JwtService.cs:116-128` —
  `EncryptingCredentials(Aes128KW, Aes128CbcHmacSha256)` ⇒ the access token is a 5-segment JWE.
  Client: `client/src/lib/auth/token.ts:24-38` JSON-parses segment 1 ⇒ always `null` ⇒
  `isTokenAlive` always `false` for real tokens. Consequences: (a) once H-01 is fixed the middleware
  would redirect-loop **logged-in** users; (b) `getServerAuthState` (`client/src/lib/auth/server.ts`)
  seeds `isAuthenticated=false` on every hard reload. The wire already returns
  `accessExpiresAt`/`refreshExpiresAt` (`client/src/services/auth/types.ts:62-66`): persist a
  readable companion expiry cookie in `persistAuthTokens` and check that instead of decoding.

- [ ] **H-03 (high) — anonymous visitor to a private shell = infinite splash, never a login ask.**
  `useMe()` is enabled only when `isAuthenticated`; for a cookie-less session that's permanently
  `false`, so `useRoleHydration()` never leaves `loading` and `RoleGuard`
  (`client/src/components/auth/RoleGuard.tsx:55`) renders `AuthSplash` forever (splash markup
  confirmed in served HTML). Add an explicit `unauthenticated` state → redirect to `/login?next=…`
  with return-URL honored post-login.

## Phase 1 — admin RBAC & staff role scopes (server)

- [ ] **H-04 (blocker) — DynamicPermission RBAC is structurally dead; the whole admin API 403s.**
  `DynamicPermissionService.cs:9` passes only the literal role `"admin"`; the seeded personas hold
  `super_admin`/`finance` (`DemoWorldDefinitions.cs:144-145`, distinct constants `RoleNames.cs:13,17`).
  No RoleClaim is ever seeded, and the only claim writer
  (`RoleManagerService.ChangeRolePermissionsAsync`, `RoleManagerService.cs:145-208`) has **no HTTP
  surface** (the `Features/{Role,Admin}` handlers exist but no controller exposes them). Every
  `[Authorize(ConstantPolicies.DynamicPermission)]` endpoint (all Admin* controllers, PlatformConfig,
  Holidays, Audit, SupportAlerts, Reviews-moderate) 403s for both seeded admins. RUNBOOK.md:115-130 and
  refinement-phase-2-report falsely document these personas as working — fix the docs too.

- [ ] **H-05 (high) — `BookingRoles.Admin` over-grants: Support/Moderation get clinical + financial access.**
  `Features/Bookings/BookingRoles.cs:8-9` bundles Admin/SuperAdmin/Support/Finance/Moderation; used by
  `GetCareInstructionsQuery.Handler.cs:31,37` (encrypted clinical notes),
  `TransitionBookingStatusCommand.Handler.cs:24-25,51-54` (force `Completed` ⇒ arms the payout
  dispute-window), `GetNursePayableBalanceQuery.Handler.cs:22-24` (contradicts its own comment).
  Controllers carry only blanket `[Authorize]` — the handler set IS the boundary. The codebase's own
  convention is narrower (`PatientAccess.cs:17` = [Admin, SuperAdmin]; `StaffRoles.cs:5-13`
  "narrowest fitting scope"). Split into `ClinicalAccess` / `Financial` sets and update the handlers.

## Phase 2 — money-path mock integrity (client)

- [ ] **H-06 (blocker) — refunds mock reads the retired bookings-mock store → real cancel 404s.**
  `services/refunds/apis/mockApi.ts:3,88` imports `mockGetBookingForRefund` from
  `services/bookings/apis/mockApi.ts` whose fixture array (ids ~5001-5005, `:340-345` throws 404
  otherwise) is orphaned since `USE_BOOKINGS_MOCK=false`. Cancel CTA renders for every real booking
  (`bookings/[id]/page.tsx:79-104`) then the preview errors (`bookings/[id]/cancel/page.tsx:50-78`).

- [ ] **H-07 (blocker) — BNPL wizard runs on a disconnected mock store keyed by the real request id.**
  `checkout/page.tsx:213-224` pushes the **real** `requestId` (payment+bookingRequests are real) into
  the BNPL branch; `services/bnpl/apis/mockApi.ts:5-8` hard-imports `bookingRequestsMockApi` +
  `mockInsertConvertedBooking` (raw mock modules, bypassing both domains' seams); store holds only
  fixture ids 1-2 → 404, or on id collision `settle()` (`:260-317`) fabricates a client-side "booking"
  while the real request expires unpaid. `BNPL_ENABLED=true` (`services/payment/constants.ts:23`) has
  no gating. Stopgap: hide/derive the CTA while `USE_BNPL_MOCK && !USE_BOOKING_REQUESTS_MOCK`; any
  surviving mock must resolve requests through the real `bookingRequestsApi` selector.

- [ ] **H-08 (blocker) — verification is 100% mocked while catalog/search are real → invisible nurses.**
  `services/verification/constants.ts:8-9` `USE_VERIFICATION_MOCK=true` gates the WHOLE
  `VerificationApi` (nurse flow + TrustBadge + admin queue, one interface — `types.ts:255-265`).
  The mock's `__mockApproveAll` never flips the real `nurse_profiles.is_verified`
  (`NurseProfile.cs:44-53`, private setter, only the real b6 `VerificationAggregator` calls it), but
  variant activation is real and unconditional (`SetVariantActiveCommand.Handler.cs:15-36`), and the
  search gate requires `IsVerified` (`SearchIndexMaintainer.cs:34,65,94,152`). `PublishGate.tsx:59-68`
  CTA makes no API call at all. Fix: split the seam (nurse half real now — clientApi is 1:1 per the
  registry; admin half stays mocked until REQ-034) and wire/gate the publish UI honestly.

- [ ] **H-09 (high) — nurse earnings fabricated although its endpoints are live.**
  `services/payouts/constants.ts:13` `USE_PAYOUTS_MOCK=true`, but REQ-025 was **delivered** —
  `NursePayoutsController.cs:33-48` serves earnings_balance/earnings/{id}, and
  `payouts/apis/clientApi.ts:163-187` already implements them. The flag is held hostage by the admin
  batch methods (REQ-036, still open). Split the seam per-method (nurse reads real, admin mock).

- [ ] **H-10 (medium) — payment outcome discards the delivered `bookingId`.**
  `services/payment/apis/clientApi.ts:55-75` types the response as `Omit<…,'bookingId'>` and sets
  `bookingId: null` (line 72) although `BookingRequestDto.cs:46-49` carries it (REQ-017 delivered).
  Kills the confirmation deep links (`checkout/return/page.tsx:84`,
  `confirmation/page.tsx:94-110`) and the targeted cache invalidation (`invalidations.ts:17-24`).
  Read it off the wire; drop the stale REQ-017-pending comments.

## Phase 3 — session & error-surface hardening (client)

- [ ] **H-11 (high) — logout/login never clear the query cache → cross-account data leak.**
  `useLogout.ts:22-30` removes only `authKeys.all` (`['auth']`); `useVerifyOtp.ts:25-32` /
  `useSelectRole.ts:19-38` touch only auth keys; `queryClient.ts:17-27` is a tab-lifetime singleton;
  domain keys carry no user id. User B logging in after User A on the same device is served A's cached
  patients/bookings/addresses/tickets until staleTime lapses. Fix: `queryClient.clear()` on logout +
  reset on login.

- [ ] **H-12 (high) — raw stack-trace error boundary; no route-level error pages.**
  `components/common/ErrorBoundary.tsx:35-58` renders hardcoded-English `error.toString()` + full
  component stack, no retry, TODO-only reporting; used at `CustomerLayout.tsx:78` and
  `TopBarAndSideBarLayout.tsx:104` — and sits BELOW RoleGuard/providers, while **no `error.tsx` or
  `global-error.tsx` exists anywhere** under `src/app`. Replace with a branded i18n recovery card
  (mirror `AuthAccountError`), dev-only stack, and add `[locale]` route-level error files.

- [ ] **H-13 (high) — 401/403/5xx/network toasts are hardcoded English.**
  `lib/api/client.ts:57,80,86,91` — four `dispatchToast('…English…')` literals pass through
  `dispatchToast.ts`/`ToastBridge.tsx` verbatim; no keys exist in either messages file. Violates the
  project's golden rule #3 on the fa-default app. Localize via a locale-keyed dictionary (non-React
  call site — the fetch layer already computes the locale).

- [ ] **H-14 (medium) — admin read-only consoles unguarded client-side.**
  `admin/audit/page.tsx:25`, `admin/verification/page.tsx:50`, `admin/tickets/page.tsx:43`,
  `admin/roles/page.tsx:50,121` fetch/render with no `useAdminCapabilities()` check — only the
  sidebar (`AdminLayout.tsx:24-33`) hides them. (Server enforcement exists but is the dead
  DynamicPermission policy — H-04.) Add a `CapabilityGuard` early-return with the non-leaking
  access-denied pattern.

## Phase 4 — contract completion batch (server; Tier B/C REQs)

- [ ] **H-15 (medium) — the deferred REQ set, per the ledger** (`for-backend.md` — re-check each
  status before building; REQ-031's HTTP surface may already exist after Phase 1):
  REQ-019/020/021 customer refunds (cancel command, policy preview + canonical
  `cancellation_policy_code` set, refund-by-booking + decomposition) · REQ-022/023/024 BNPL
  (options/schedule/wallet-installments, eligibility KYC fields) · REQ-026 reviews
  (eligibility/my-review reads — verify what phase 3/4 already delivered) · REQ-027 leftovers
  (`record_access` check; the GET/PUT care_record endpoints already exist —
  `PatientCareRecordsController.cs:44-54`) · REQ-029/030 admin config `updatedAt`/`updatedBy` + audit
  filters · REQ-034 admin verification queue/signed-doc-URL/approve · REQ-035 admin refund
  preview/initiate/approve/reject · REQ-036 admin payout preview/run/retry/record-reference.

- [ ] **H-16a (medium, server half) — partner portal has no identity signal or self-scoped reads.**
  REQ-038: `administersPartnerCenterId` on `MeResult` + a seeded demo partner admin; REQ-032/033:
  `centers/me[/nurses|/bookings|/settlement]` split reads + invoice `totalIrr`. `Me` interface
  (`services/auth/types.ts:79-91`) has no partner field; `resolveRoleDestination`
  (`services/auth/routing.ts:32-47`) has no partner branch.

## Phase 5 — final de-mock & partner reachability (client)

- [ ] **H-16b (medium, client half) — partner routing + portal gate + flip `USE_PARTNER_MOCK`.**
  Add the partner branch to `resolveRoleDestination` off the new `/me` signal; gate the portal at the
  layout level (today `partner/layout.tsx:15` RoleGuard has no `expected`, the mock resolves a
  hardcoded center for ANY caller — `partnerCenter/apis/mockApi.ts:237-243` — and `nurses`/`bookings`
  pages don't even await `useMyPartnerCenter`).

- [ ] **H-17 (medium) — patientRecords id-type mismatch; flip the remaining flags.**
  Client `Medication/RoutineItem/CareTask.id: string` (`patientRecords/types.ts:36,45,53`, mock seeds
  'm1'/'r1'/'t1') vs wire `long Id` (`CarePlanDtos.cs:11-15`) — a naive flip 400s every family-record
  save; new items should omit id (server assigns). Then flip every remaining `USE_*_MOCK` (refunds,
  bnpl, payouts-admin, admin, partnerCenter, verification-admin, patientRecords) as its REQs land;
  delete the orphaned cross-mock helpers; update `mocks-registry.md` + `client/CLAUDE.md`.