# Security

## Baseline

Security is enforced server-side. Hidden UI controls are never access control.

## Authentication

Administrator authentication will use:

- Secure HTTP-only cookies.
- Argon2id password hashing or an equivalent modern password hashing algorithm.
- Generic login errors.
- Session invalidation.
- Password change support.
- Architecture for future MFA.

## Authorization

Every admin mutation and read of private data must check the current user, role, and permission server-side.

## Input Validation

All server inputs use Zod validation. This includes availability, booking, coupon, contact, login, media upload, iCal, and image-generation endpoints.

## Rate Limiting

Rate limiting is required for:

- Login.
- Contact.
- Availability search.
- Coupon validation.
- Booking creation.
- Guest booking management.
- iCal sync.
- Image generation.

## Uploads

Uploads require:

- MIME-type verification.
- Extension allowlist.
- Safe generated file names.
- Maximum file sizes.
- Image dimension checks.
- Provenance metadata.
- Virus scanning hook where production infrastructure supports it.

## Threat Model

Primary threats:

- Double-booking through race conditions.
- Unauthorized admin access.
- Guest personal data exposure.
- Booking-token leakage.
- SQL injection.
- XSS through editable content.
- CSRF on state-changing requests.
- SSRF through imported URLs or iCal feeds.
- Path traversal in uploads.
- Open redirects after login or booking.
- Secret leakage into browser bundles or logs.
- Abuse of image-generation endpoints.

Mitigations:

- Database constraints and transactions for booking inventory.
- Server-side authorization everywhere.
- No personal guest data in URLs.
- Parameterized queries through Drizzle.
- Sanitized rich text or constrained content fields.
- CSRF protection where cookie-authenticated mutations require it.
- URL allowlists and fetch hardening for iCal imports.
- Safe storage paths and generated names.
- Strict redirect allowlist.
- Redacted logs.
- Administrator-only image generation with audit events and rate limits.

## Secrets

Secrets are read from environment variables only. They must never be committed, printed, returned to the browser, or stored in the database.