feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

2026-08-31 13:48:54 +05:30
parent 4e21d617ce
commit e91cdbae6e
48 changed files with 3742 additions and 65 deletions
@@ -0,0 +1,48 @@
+[
+  {
+    "bug_id": "IDOR / Missing Auth",
+    "previous_issue": "Unauthenticated client can send messages/turns to any session ID",
+    "current_status_code": 200,
+    "fixed": false,
+    "evidence": "Request to /v1/onboarding/ONB-270B683F/message returned status code 200 (Expected 401/403)"
+  },
+  {
+    "bug_id": "Session Hard Deletion",
+    "previous_issue": "Completed session is hard-deleted from DB, causing misleading 404 error on second call",
+    "current_status_code": 404,
+    "fixed": false,
+    "evidence": "Second call to /complete returned status 404, body: {'detail': 'Onboarding session not found'}"
+  },
+  {
+    "bug_id": "CORS Policy",
+    "previous_issue": "Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true",
+    "current_status_code": 200,
+    "fixed": false,
+    "evidence": "Access-Control-Allow-Origin: '*', Access-Control-Allow-Credentials: 'true'"
+  },
+  {
+    "bug_id": "Age Validation",
+    "previous_issue": "Negative age (age = -50) accepted with 200 OK",
+    "current_status_code": 200,
+    "fixed": false,
+    "evidence": "POST /v1/onboarding/start with age=-50 returned status code 200"
+  },
+  {
+    "bug_id": "Rate Limiting",
+    "previous_issue": "No rate limiting attached to session creation / AI endpoints",
+    "current_status_code": [
+      200,
+      200,
+      200,
+      200,
+      200,
+      200,
+      200,
+      200,
+      200,
+      200
+    ],
+    "fixed": false,
+    "evidence": "Status codes for 10 rapid requests: [200, 200, 200, 200, 200, 200, 200, 200, 200, 200]"
+  }
+]