# Security Overview

Turista's security model combines Laravel's built-in protections, Sanctum tokens, Spatie roles/permissions, policy-based authorization, and additional hardening.

## Authentication

- API clients authenticate with Sanctum bearer tokens.
- Tokens expire after one week by default.
- Login requires a verified account.
- OTP verification is required after registration.

## Authorization

- Routes are protected by role middleware (`super_admin`, `admin`, `owner`, `employee`, `customer`).
- Policies enforce ownership and state checks.
- `super_admin` bypasses all policies via `Gate::before`.
- Owner actions require the owner to be approved (`status = active`).
- Employee actions require the employee to be `active` and scoped to their owner/building.

## Mass assignment

`Model::unguard()` is enabled globally in `AppServiceProvider`. This is an intentional project decision that removes Laravel's default mass-assignment protection. All input must be explicitly whitelisted in Form Requests and controllers.

Removing `Model::unguard()` requires adding `$fillable` or `$guarded` to every model first.

## OTP handling

OTP codes are returned in API responses only in `local` and `testing` environments. In production, OTPs are sent via the configured channel (CoreVerde WhatsApp).

## File uploads

Photo uploads are validated by custom rules (`PhotoFileRules`). Allowed types typically include JPG, JPEG, PNG, and WebP with size and dimension limits.

## Output encoding

API resources return user-supplied strings as-is. Clients must HTML-escape all strings before inserting them into the DOM to prevent stored XSS.

## Security headers

`SecurityHeadersMiddleware` is applied globally and sets:

- `X-Frame-Options: DENY`
- `X-Content-Type-Options: nosniff`
- `Referrer-Policy: strict-origin-when-cross-origin`
- `Strict-Transport-Security`
- `Content-Security-Policy`

## Rate limiting

Public auth endpoints are rate-limited. Additional rate limiting can be configured per route.

## Dependency updates

Run `composer audit` regularly and update dependencies with known vulnerabilities.

## Reporting security issues

Document any new vulnerabilities in the security audit file and prioritize fixes before the next release.