SRV-28 — Hardening — security, performance, backup restore test
Security headers and rate limits review, permission test sweep, slow-query and index pass, load test of catalog/search and checkout, restore of a backup into a fresh database.
| Field | Details |
|---|---|
| Task code | SRV-28 |
| Phase | P1 — V1 build & integration |
| Product scope | V1 |
| Status | Done (Mon 19 Oct 2026) |
| Start | Mon 19 Oct 2026 |
| Due | Mon 19 Oct 2026 |
| Responsible | Anis — Full-stack developer |
| Co-responsible | — |
| Effort | 1 person-day(s) planned · 3 from scratch · size S |
| Area · app | Server · server |
| Depends on | WEB-05, WEB-06 |
| Unblocks | QA-01 |
| Milestones | Staging integration complete |
Summary
Security headers and rate limits review, permission test sweep, slow-query and index pass, load test of catalog/search and checkout, restore of a backup into a fresh database.
Description
Before integration testing and acceptance, the platform is hardened against the non-functional requirements (NFR-01…NFR-03, SEC-02, SEC-05, ACL-05; cahier §9, §10). This task reviews security headers and rate limits, runs a systematic permission and scope sweep, checks that no reseller- or delegate-facing response exposes stock quantities, purchase prices or other resellers' data, does a slow-query and index pass, load-tests catalog search/facets, checkout under stock contention and the SSE streams, and restores a production-like backup into a fresh database to prove the backup procedure (SEC-05, NFR-02). Findings are fixed in this task or logged with severity for QA-01. Out of scope: new features.
Subtasks
| # | Subtask | Owner |
|---|---|---|
| 1 | Security headers on api and Next apps (HSTS, CSP, frame-ancestors, nosniff, referrer policy) and cookie flags review | Anis |
| 2 | Rate-limit review: auth, OTP, invitations.resolve, support.whatsapp, exports; lockout behaviour | Anis |
| 3 | Generated permission sweep: every admin procedure × each role against the matrix; scope sweep with cross-reseller and cross-delegate attempts | Anis |
| 4 | Exposure sweep: no quantity, purchasePrice, margin or internal note in reseller/delegate responses (STK-07, ACL-04, SUP-02) | Anis |
| 5 | Dependency and secret scanning (pnpm audit, OSV, gitleaks) and upload hardening (mime sniffing, size limits) | Anis |
| 6 | Slow-query pass with pg_stat_statements, missing indexes, N+1 fixes on list endpoints | Anis |
| 7 | k6 load tests: catalog list/facets/search, cart.checkout with 50 concurrent resellers on scarce stock, 500 SSE connections | Anis |
| 8 | Backup restore drill: restore last nightly dump into a fresh database, run smoke tests, record RPO/RTO | Anis |
| 9 | Monitoring and alerting review: Sentry alerts, queue depth and dead jobs, disk and DB size, uptime | Anis |
Deliverables
- apps/server/test/sweeps/{permissions,scopes,exposure}.test.ts
- load/k6/{catalog,checkout,sse}.js with results recorded in /docs/srs/deployment-and-operations
- Restore drill report (date, duration, RPO/RTO) in the operations runbook
Acceptance criteria
- The permission and scope sweeps pass with zero unexpected allow (ACL-05)
- No reseller or delegate endpoint returns a stock quantity or purchase price (STK-07, ACL-04)
- Catalog list and facets meet p95 under 300 ms server-side at the target load; checkout never oversells under contention (NFR-01)
- A backup is restored into a fresh database and the smoke suite passes on it (SEC-05, NFR-02)
- No high or critical dependency vulnerability remains open
Requirements covered
| Requirement | Title | Release |
|---|---|---|
| NFR-01 | Performance: app opens and search/filter results in under 3 s on a normal mobile connection; API p95 targets | V1 |
| NFR-02 | Availability: supervised service, backups and a tested restore procedure | V1 |
| NFR-03 | Scalability for more resellers, products, orders and zones | V1 |
| SEC-02 | Session expiry, revocation and attempt limiting | V1 |
| SEC-05 | Automatic backups, retention policy and restore tests | V1 |
| ACL-05 | Every API operation enforces permission and scope server-side; UI hides what the user cannot do | V1 |
Test measures
- Automated sweeps in CI
- k6 runs against staging with results compared to targets
- Restore drill executed and timed
Risks
- Staging VPS smaller than production skews load results — run load tests on a production-sized instance or scale results with a documented factor
KPI
- Delivered by Mon 19 Oct 2026 within 1 person-day(s).
- Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
- Zero open critical defects, permission gaps or data-integrity regressions at sign-off.
Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.
SRV-41 — API refinements found while building the back-office
Close the contract and API gaps the back-office pages hit, so the screens work as their specs say instead of through workarounds.
SRV-42 — Store the fields the API defines but the database approximated
Give every V1 field the API reference defines its own column and enforce its rules, instead of approximating it from other data.