# AURA LIVE — Security Implementation

## Authentication & sessions
- Passwords: bcrypt (cost 12). Plaintext never stored, logged, or shown to admins.
- Short-lived access JWTs (15 min) + refresh tokens (30 days) with **rotation on every refresh**; old session rows are revoked. A replayed refresh token revokes ALL user sessions (theft response).
- Sessions stored server-side (`user_sessions`, hashed tokens) with device metadata; expiry from settings.
- Login rate limiting (per identifier+IP, configurable), admin login rate limiting, account suspension/ban checks on every request and socket auth.

## Authorization
- Server-side role checks: `requireAuth` → user; `requireAdmin` → admin JWT + role; `requirePermission('<scope>')` for each admin module; room host/moderator checks (`isRoomModerator`) for seat/kick/mod actions.
- Room privacy: private rooms require invitation or password (hash-verified) — enforced in backend, never the client.

## Money safety (wallet, gifts, payments)
- All wallet mutations run inside MySQL transactions with `SELECT ... FOR UPDATE` (no lost updates / double spending).
- Every balance change writes an auditable `wallet_ledger` row (delta + balance_after).
- Gift prices are read from the DB at send time; client-sent prices are ignored. Duplicate gift submissions are idempotent via `client_request_id` (unique uuid).
- Payments: order amounts come from server-side `coin_packages`; Razorpay checkout signature verified via HMAC-SHA256; webhooks verify `X-Razorpay-Signature` with the webhook secret; `payment_events` unique (provider, event_id) makes webhook processing idempotent; orders are credited exactly once (`credited_at` guard). Orders are NEVER marked paid from a frontend response alone.
- No raw card data touches the server; secrets live only in env vars.

## Input & transport
- Zod validation on every request body; typed query params; consistent error envelope without stack traces (production).
- helmet security headers, CORS restricted to configured app origins, request size limits (2 MB JSON, 8 MB uploads), MIME-whitelisted uploads.
- SQL injection: 100% parameterized queries via mysql2.
- Rate limits: global API limiter + per-user action counters (messages, gifts, posts, rooms).
- HTTPS in production (see DEPLOYMENT.md); Socket.IO requires a valid access token at handshake.

## Moderation & safety
- Report/block flows on users, messages, rooms, posts with an admin review queue.
- Admin actions (suspend, close room, balance adjust, settings change) are recorded in `admin_audit_logs` with target + IP.
- Account deletion workflow (30-day grace) and age gating via configurable minimum age.

## Secrets management
- All secrets via `.env` (never committed). Production boots fail-fast if JWT secrets are defaults.
- Voice provider and payment credentials are server-only — clients receive short-lived tokens / public key ids only.

## Retention controls
- `background_jobs`: session cleanup, stale-room cleanup, deletion processor (honours the 30-day window), verification token expiry.

## Testing
`server/tests/`: unit tests for password hashing, JWT roundtrips, refresh rotation payload, payment HMAC verification (tamper + wrong-secret cases), wallet anti-double-spend math; integration suite (`TEST_DB=1`) covering auth, rooms, voice-token config errors, gift balance debits, payments and admin authorization.