# BuildMate – Security Overview

Naa’y security measures ang system. Summary sa naa karon ug usa ka fix nga gi-apply.

---

## 1. Authentication

- **Supabase Auth**: Login/register gamit email + password; session ug JWT.
- **Protected routes**: `ProtectedRoute` component – kung wala’y user, redirect to `/login` (e.g. Dashboard, Profile, Settings, My Builds).
- **API auth**: Routes nga nanginahanglan user (e.g. `/api/auth/me`, `/api/auth/profile`) nangayo ug **Bearer token** ug nag-verify sa Supabase (`getUser(token)`). Kung invalid/expired → 401.

---

## 2. Authorization (Admin)

- **Admin layout** (`/admin/*`): Either (a) shared **ADMIN_PASSWORD** (sessionStorage after verify), or (b) logged-in user nga **user_type === 'admin'**. Kung dili admin, redirect to dashboard.
- **Admin API gate**: `POST /api/auth/verify-admin-password` – rate limited by IP (5 attempts, 15 min lockout) para sa shared password.
- **Profile API fix**: Sa **PUT /api/auth/profile**, normal users **dili na** maka-update ug `user_type` (e.g. dili na maka-escalate to admin). Only existing admins can change `user_type` for their profile.

---

## 3. Database (Supabase)

- **Row Level Security (RLS)** enabled on important tables (see `scripts/enable-rls-policies.sql` ug migrations):
  - **builds**: Public read; insert/update/delete only for authenticated user (owner) or admin.
  - **build_components**: Tied to build ownership.
  - **users**: Admin policies for management; users table access controlled.
- RLS ensures bisan ma-bypass ang UI, ang database dili mo-allow unauthorized insert/update/delete based on `auth.uid()` and policies.

---

## 4. Input / Validation

- Auth API routes: Check required fields (e.g. username, email); validate `user_type` in allowed list.
- Admin password: Check type (string) before compare; rate limiting to reduce brute force.

---

## 5. Admin audit log and protected APIs

- **Audit log**: Table `audit_log` stores who did what (user_deleted, build_updated, component_updated, bulk_delete_*, etc.). Only admins can insert and read. See Admin dashboard → **Audit** tab. Run `supabase-audit-log-migration.sql` in Supabase SQL Editor to create the table.
- **Protected APIs**:
  - **POST /api/components/update-price**: Requires **admin** (Bearer token + user_type = admin). Use `requireAdmin(request)` from `lib/api-auth.ts`.
  - **POST /api/purchase/send-email**: Requires **authenticated user** (Bearer token). Allowed only to send to the same user’s email. Purchase page sends `Authorization: Bearer <session.access_token>`.
- **Support send-ticket-email**: Left open so users can submit support tickets; can add `requireAuth` later if you want only logged-in users to submit.

## 6. Recommendations

- **Env / secrets**: Ayaw i-commit `.env.local`; use env vars for `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, etc.
- **HTTPS**: Use HTTPS in production.
- **RLS**: Keep RLS enabled on Supabase; run the RLS policy scripts if you add new tables.

---

*Last updated: audit log + protected APIs (update-price admin-only, purchase send-email auth-only).*