07 Security

07. Security Model & Threat Boundaries

Engineering specification for authentication, authorization, data encryption, and security boundaries.

---

🛡️ Threat Model & Security Architecture

PACT OS operates on a Zero-Trust Client security model:

graph TD
    Client[Untrusted Client / Web Browser] -->|HTTPS + Session Cookie| SA[Next.js Server Actions]
    SA -->|1. Validate Payload| Zod[Zod Schema Layer]
    SA -->|2. Verify Identity| Auth[Supabase Auth Engine]
    SA -->|3. Query Database| DB[(PostgreSQL Database)]
    DB -->|4. Enforce Policy| RLS[Row Level Security: auth.uid = user_id]

Loading

---

🔑 Authentication Mechanisms

1. Supabase Session Cookies (@supabase/ssr)

• Authentication tokens (access_token, refresh_token) are managed in HTTP-only, SameSite=Lax encrypted cookies.
• Server Actions derive user identity via supabase.auth.getUser(). Client-submitted user_id parameters in request bodies are ignored.

2. WebAuthn & Passkeys (src/lib/auth/passkeys.ts)

• Supports passwordless authentication using FIDO2/WebAuthn passkeys (Touch ID, Face ID, YubiKey).
• Server generates a 32-byte base64url challenge token stored in database table passkey_credentials.
• Prevents replay attacks by invalidating used challenge tokens upon verification.

---

🔒 Authorization & Row Level Security (RLS)

100% of PostgreSQL tables enforce strict multi-tenant isolation through RLS policies:

• Direct access to foreign user records returns empty result sets (0 rows affected).
• Service role keys are restricted strictly to server-side background cron execution (/api/cron/sweep-deadlines).

---

🔐 Consequence Confidentiality & Payload Masking

Unactivated consequence payloads (such as emergency reflection tasks or financial pledges) remain encrypted/masked in the database until a deadline breach occurs:

• Client queries to consequences table omit sensitive payload details prior to is_activated = true.
• Prevents users from inspecting or tampering with consequences prior to deadline evaluation.

---

💰 Financial Data Safety

• Monetary amounts are represented strictly as bigint integer cents (amount_cents).
• Eliminates IEEE 754 floating-point rounding errors and currency manipulation vulnerabilities.

---

📦 Data Portability & Sanitization (/api/user/export)

User account data exports generate a sanitized archive:

• Included Data: Tasks, goals, habits, focus logs, finance transactions, weekly reviews.
• Sanitized Fields: OAuth access tokens, refresh tokens, password hashes, and session tokens are stripped prior to ZIP compression.

---

🛡️ Automated Security Scanning

PACT OS incorporates automated security gates executed during CI:

• Secret Scanner (scratch/secret-scan.mjs): Scans codebase for leaked API keys, tokens, and credentials.
• Dependency Audit (docs/DEPENDENCY_SECURITY.md): Automated npm audit scans enforcing zero high/critical vulnerabilities.