hamed
c2c6ae4d02
- Added a new column `national_code_verified` to the `users` table. - Normalized the `bank_account` field in the `representations` table from a single object to an array of IBANs with a default `verified` status of false. feat(ApiIrService): implement identity verification client for api.ir - Created `ApiIrService` to handle identity verification via api.ir. - Implemented methods for matching national code with mobile and IBAN with national code and birth date. - Added error handling and logging for external API requests.
1 line
18 KiB
JSON
1 line
18 KiB
JSON
{"nodes": [{"id": "users_hamed_pj_my_pj_clinic_pro_clinicpro_docs_security_audit_md", "label": "security-audit.md", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L1"}, {"id": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "label": "Security Audit Report \u2014 ClinicPro Symfony 7", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L1"}, {"id": "docs_security_audit_executive_summary", "label": "Executive Summary", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L10"}, {"id": "docs_security_audit_critical_issues_fixed", "label": "Critical Issues (Fixed)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L19"}, {"id": "docs_security_audit_crit_01_weak_app_secret_committed_to_version_control", "label": "CRIT-01 \u2014 Weak APP_SECRET Committed to Version Control", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L21"}, {"id": "docs_security_audit_crit_02_jwt_passphrase_hardcoded_in_env", "label": "CRIT-02 \u2014 JWT Passphrase Hardcoded in `.env`", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L30"}, {"id": "docs_security_audit_crit_03_payment_gateway_test_credentials_committed", "label": "CRIT-03 \u2014 Payment Gateway Test Credentials Committed", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L36"}, {"id": "docs_security_audit_crit_04_unhandled_exceptions_leaking_stack_traces", "label": "CRIT-04 \u2014 Unhandled Exceptions Leaking Stack Traces", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L42"}, {"id": "docs_security_audit_high_risk_issues_fixed", "label": "High Risk Issues (Fixed)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L52"}, {"id": "docs_security_audit_high_01_password_hasher_bcrypt_instead_of_argon2id", "label": "HIGH-01 \u2014 Password Hasher: `bcrypt` Instead of `argon2id`", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L54"}, {"id": "docs_security_audit_high_02_no_rate_limiting_on_otp_login_endpoints", "label": "HIGH-02 \u2014 No Rate Limiting on OTP/Login Endpoints", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L67"}, {"id": "docs_security_audit_high_03_passwordauthenticator_never_triggered_login_broken_for_staff", "label": "HIGH-03 \u2014 PasswordAuthenticator Never Triggered (Login Broken for Staff)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L78"}, {"id": "docs_security_audit_high_04_payment_callback_ip_whitelist_never_enforced", "label": "HIGH-04 \u2014 Payment Callback IP Whitelist Never Enforced", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L86"}, {"id": "docs_security_audit_high_05_open_redirect_allowed_frontend_hosts_always_empty", "label": "HIGH-05 \u2014 Open Redirect: ALLOWED_FRONTEND_HOSTS Always Empty", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L92"}, {"id": "docs_security_audit_high_06_filevalidatorservice_api_mismatch_in_blogcontroller_upload_bypass", "label": "HIGH-06 \u2014 FileValidatorService API Mismatch in BlogController (Upload Bypass)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L101"}, {"id": "docs_security_audit_high_07_doctorcontroller_upload_skips_size_validation", "label": "HIGH-07 \u2014 DoctorController Upload Skips Size Validation", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L109"}, {"id": "docs_security_audit_high_08_unauthenticated_requests_returning_500_instead_of_401", "label": "HIGH-08 \u2014 Unauthenticated Requests Returning 500 Instead of 401", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L115"}, {"id": "docs_security_audit_high_09_sms_template_crud_open_to_any_authenticated_user_bola_idor", "label": "HIGH-09 \u2014 SMS Template CRUD Open to Any Authenticated User (BOLA/IDOR)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L125"}, {"id": "docs_security_audit_medium_risk_issues_fixed", "label": "Medium Risk Issues (Fixed)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L133"}, {"id": "docs_security_audit_med_01_app_env_dev_in_committed_env", "label": "MED-01 \u2014 `APP_ENV=dev` in Committed `.env`", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L135"}, {"id": "docs_security_audit_med_02_static_analysis_tooling_missing", "label": "MED-02 \u2014 Static Analysis Tooling Missing", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L141"}, {"id": "docs_security_audit_med_03_nelmioapidoc_publicly_accessible", "label": "MED-03 \u2014 NelmioApiDoc Publicly Accessible", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L150"}, {"id": "docs_security_audit_med_04_session_true_for_a_stateless_api", "label": "MED-04 \u2014 `session: true` for a Stateless API", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L155"}, {"id": "docs_security_audit_med_05_session_token_endpoint_has_no_security_purpose", "label": "MED-05 \u2014 `/session/token` Endpoint Has No Security Purpose", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L161"}, {"id": "docs_security_audit_low_risk_issues", "label": "Low Risk Issues", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L168"}, {"id": "docs_security_audit_low_01_hsts_header_missing_preload_directive", "label": "LOW-01 \u2014 HSTS Header Missing `preload` Directive", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L170"}, {"id": "docs_security_audit_low_02_php_expose_php_not_disabled", "label": "LOW-02 \u2014 PHP `expose_php` Not Disabled", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L175"}, {"id": "docs_security_audit_low_03_composer_php_constraint_too_permissive", "label": "LOW-03 \u2014 Composer `php` Constraint Too Permissive", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L179"}, {"id": "docs_security_audit_low_04_payment_amount_hardcoded", "label": "LOW-04 \u2014 Payment Amount Hardcoded", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L184"}, {"id": "docs_security_audit_low_05_database_credentials_in_env_are_insecure_defaults", "label": "LOW-05 \u2014 Database Credentials in `.env` Are Insecure Defaults", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L189"}, {"id": "docs_security_audit_changes_applied", "label": "Changes Applied", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L196"}, {"id": "docs_security_audit_installed_packages", "label": "Installed Packages", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L217"}, {"id": "docs_security_audit_configuration_changes", "label": "Configuration Changes", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L227"}, {"id": "docs_security_audit_config_packages_security_yaml", "label": "`config/packages/security.yaml`", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L229"}, {"id": "docs_security_audit_config_packages_rate_limiter_yaml_new", "label": "`config/packages/rate_limiter.yaml` (new)", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L241"}, {"id": "docs_security_audit_remaining_recommendations", "label": "Remaining Recommendations", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L257"}, {"id": "docs_security_audit_security_score", "label": "Security Score", "file_type": "document", "source_file": "docs/security-audit.md", "source_location": "L303"}], "edges": [{"source": "users_hamed_pj_my_pj_clinic_pro_clinicpro_docs_security_audit_md", "target": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L1", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_executive_summary", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L10", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_critical_issues_fixed", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L19", "weight": 1.0}, {"source": "docs_security_audit_critical_issues_fixed", "target": "docs_security_audit_crit_01_weak_app_secret_committed_to_version_control", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L21", "weight": 1.0}, {"source": "docs_security_audit_critical_issues_fixed", "target": "docs_security_audit_crit_02_jwt_passphrase_hardcoded_in_env", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L30", "weight": 1.0}, {"source": "docs_security_audit_critical_issues_fixed", "target": "docs_security_audit_crit_03_payment_gateway_test_credentials_committed", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L36", "weight": 1.0}, {"source": "docs_security_audit_critical_issues_fixed", "target": "docs_security_audit_crit_04_unhandled_exceptions_leaking_stack_traces", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L42", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_high_risk_issues_fixed", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L52", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_01_password_hasher_bcrypt_instead_of_argon2id", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L54", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_02_no_rate_limiting_on_otp_login_endpoints", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L67", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_03_passwordauthenticator_never_triggered_login_broken_for_staff", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L78", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_04_payment_callback_ip_whitelist_never_enforced", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L86", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_05_open_redirect_allowed_frontend_hosts_always_empty", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L92", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_06_filevalidatorservice_api_mismatch_in_blogcontroller_upload_bypass", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L101", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_07_doctorcontroller_upload_skips_size_validation", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L109", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_08_unauthenticated_requests_returning_500_instead_of_401", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L115", "weight": 1.0}, {"source": "docs_security_audit_high_risk_issues_fixed", "target": "docs_security_audit_high_09_sms_template_crud_open_to_any_authenticated_user_bola_idor", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L125", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_medium_risk_issues_fixed", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L133", "weight": 1.0}, {"source": "docs_security_audit_medium_risk_issues_fixed", "target": "docs_security_audit_med_01_app_env_dev_in_committed_env", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L135", "weight": 1.0}, {"source": "docs_security_audit_medium_risk_issues_fixed", "target": "docs_security_audit_med_02_static_analysis_tooling_missing", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L141", "weight": 1.0}, {"source": "docs_security_audit_medium_risk_issues_fixed", "target": "docs_security_audit_med_03_nelmioapidoc_publicly_accessible", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L150", "weight": 1.0}, {"source": "docs_security_audit_medium_risk_issues_fixed", "target": "docs_security_audit_med_04_session_true_for_a_stateless_api", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L155", "weight": 1.0}, {"source": "docs_security_audit_medium_risk_issues_fixed", "target": "docs_security_audit_med_05_session_token_endpoint_has_no_security_purpose", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L161", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_low_risk_issues", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L168", "weight": 1.0}, {"source": "docs_security_audit_low_risk_issues", "target": "docs_security_audit_low_01_hsts_header_missing_preload_directive", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L170", "weight": 1.0}, {"source": "docs_security_audit_low_risk_issues", "target": "docs_security_audit_low_02_php_expose_php_not_disabled", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L175", "weight": 1.0}, {"source": "docs_security_audit_low_risk_issues", "target": "docs_security_audit_low_03_composer_php_constraint_too_permissive", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L179", "weight": 1.0}, {"source": "docs_security_audit_low_risk_issues", "target": "docs_security_audit_low_04_payment_amount_hardcoded", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L184", "weight": 1.0}, {"source": "docs_security_audit_low_risk_issues", "target": "docs_security_audit_low_05_database_credentials_in_env_are_insecure_defaults", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L189", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_changes_applied", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L196", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_installed_packages", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L217", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_configuration_changes", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L227", "weight": 1.0}, {"source": "docs_security_audit_configuration_changes", "target": "docs_security_audit_config_packages_security_yaml", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L229", "weight": 1.0}, {"source": "docs_security_audit_configuration_changes", "target": "docs_security_audit_config_packages_rate_limiter_yaml_new", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L241", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_remaining_recommendations", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L257", "weight": 1.0}, {"source": "docs_security_audit_security_audit_report_clinicpro_symfony_7", "target": "docs_security_audit_security_score", "relation": "contains", "confidence": "EXTRACTED", "source_file": "docs/security-audit.md", "source_location": "L303", "weight": 1.0}], "input_tokens": 0, "output_tokens": 0} |