feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

2026-08-31 13:48:54 +05:30
parent 4e21d617ce
commit e91cdbae6e
48 changed files with 3742 additions and 65 deletions
@@ -0,0 +1,102 @@
+[
+  {
+    "cat": "Authentication",
+    "test": "Missing Token -> 401",
+    "pass": true,
+    "code": 401
+  },
+  {
+    "cat": "Authentication",
+    "test": "Invalid Token -> 401",
+    "pass": true,
+    "code": 401
+  },
+  {
+    "cat": "Authentication",
+    "test": "Valid Token PAT-ALICE -> 200",
+    "pass": true,
+    "code": 200
+  },
+  {
+    "cat": "Authentication",
+    "test": "Valid Token PAT-BOB -> 200",
+    "pass": true,
+    "code": 200
+  },
+  {
+    "cat": "IDOR / Isolation",
+    "test": "Bob messaging Alice Session -> 403",
+    "pass": true,
+    "code": 403,
+    "detail": "{'detail': 'Forbidden: You do not have authorization to access or modify this patient onboarding session.'}"
+  },
+  {
+    "cat": "IDOR / Isolation",
+    "test": "Alice completing Bob Session -> 403",
+    "pass": true,
+    "code": 403,
+    "detail": "{'detail': 'Forbidden: You do not have authorization to complete this onboarding session.'}"
+  },
+  {
+    "cat": "IDOR / Isolation",
+    "test": "Unauthenticated access to Alice Session -> 401",
+    "pass": true,
+    "code": 401
+  },
+  {
+    "cat": "Session Enumeration",
+    "test": "Non-existent (404) vs Unauthorized (403) handling",
+    "pass": true,
+    "code": "404 vs 403"
+  },
+  {
+    "cat": "Completed Session Security",
+    "test": "Bob accessing Alice completed session -> 403",
+    "pass": true,
+    "code": 403
+  },
+  {
+    "cat": "Idempotency",
+    "test": "Alice completing twice -> 200 OK (completed)",
+    "pass": true,
+    "code": 200
+  },
+  {
+    "cat": "Document Security",
+    "test": "Reject executable MIME type -> 400",
+    "pass": true,
+    "code": 400,
+    "detail": "{'detail': 'Unsupported document format: application/x-msdownload. Allowed formats: JPEG, PNG, WEBP, PDF.'}"
+  },
+  {
+    "cat": "Document Security",
+    "test": "Reject >10MB document payload -> 413",
+    "pass": true,
+    "code": 413,
+    "detail": "{'detail': 'File size exceeds maximum allowed limit of 10MB.'}"
+  },
+  {
+    "cat": "Document Security",
+    "test": "Bob uploading doc to Alice session -> 403",
+    "pass": true,
+    "code": 403
+  },
+  {
+    "cat": "AI Security",
+    "test": "Prompt injection override attempt",
+    "pass": true,
+    "code": 200
+  },
+  {
+    "cat": "CORS Security",
+    "test": "Explicit origin & credentials check",
+    "pass": true,
+    "code": 200
+  },
+  {
+    "cat": "Secrets Security",
+    "test": "No hardcoded production keys in config.py",
+    "pass": true,
+    "code": 200
+  }
+]