| 1 | # Security |
| 2 | |
| 3 | ## Credential Rules |
| 4 | |
| 5 | Do not commit: |
| 6 | |
| 7 | - broker usernames or passwords |
| 8 | - Azure credentials |
| 9 | - API keys |
| 10 | - LLM provider secrets |
| 11 | - database passwords |
| 12 | - private keys or certificates |
| 13 | |
| 14 | Use `.env.example` files only for non-secret configuration shape. Store PRD secrets in Azure Key Vault and expose them to workloads through approved Kubernetes secret mechanisms. |
| 15 | |
| 16 | ## Broker Security |
| 17 | |
| 18 | Broker integration must use provider-supported authentication and session mechanisms. Do not implement browser automation that stores or replays broker credentials. |
| 19 | |
| 20 | Initial broker classes are placeholders only: |
| 21 | |
| 22 | - `IBKRBrokerProvider` |
| 23 | - `ICICIDirectBrokerProvider` |
| 24 | |
| 25 | They must not be treated as working integrations until official/supported API research is complete. |
| 26 | |
| 27 | ## Research Compliance |
| 28 | |
| 29 | Automated research must: |
| 30 | |
| 31 | - respect robots.txt and website terms |
| 32 | - obey rate limits |
| 33 | - use normal HTTP fetching first |
| 34 | - use Playwright only for permitted JavaScript-rendered public pages |
| 35 | - avoid CAPTCHA bypass |
| 36 | - avoid paywall bypass |
| 37 | - avoid authentication bypass |
| 38 | - respect licensing and redistribution restrictions |
| 39 | |
| 40 | ## Application Security Defaults |
| 41 | |
| 42 | - Correlation IDs are propagated through `X-Correlation-Id`. |
| 43 | - Health endpoints are present for orchestration. |
| 44 | - Configuration is environment-driven. |
| 45 | - Source code contains no default production credentials. |
| 46 | - PRD Azure commands validate subscription context before planning or destroying. |
| 47 | |
| 48 | ## Phase 5A Authentication Boundary |
| 49 | |
| 50 | The browser authenticates through `/api/v1/auth/dev/login` only in DEV. The DEV mechanism issues a signed bearer JWT for one of the fixed local identities (`user-a`, `user-b`) so multi-user isolation can be tested without real broker credentials or a production identity provider. PRD disables DEV login and must provide a real authentication configuration and Kubernetes Secret for token validation material before deployment. |
| 51 | |
| 52 | The gateway is the external trust boundary for application APIs. Private `/api/**` routes require `Authorization: Bearer <token>` except intentional auth bootstrap and health routes. The gateway validates the token issuer and signature, derives the durable application user ID from `(issuer, subject)`, and stores the normalized principal as request attributes. It strips all inbound `X-AIP-User-*` headers before forwarding and then adds trusted internal identity headers itself. |
| 53 | |
| 54 | Business services must not trust browser-supplied owner IDs. Portfolio and broker APIs resolve the authenticated principal from trusted gateway headers, provision a service-local `app_users` identity cache, and query private resources by authenticated user ID plus resource ID. Cross-user access is intentionally returned as not found to avoid confirming resource existence. |
| 55 | |
| 56 | The durable external identity key is `(issuer, external_subject)`. Email and display name are profile attributes only and must not be used as the security identity. |
| 57 | |
| 58 | ## Ownership Model |
| 59 | |
| 60 | Private data is user-owned: |
| 61 | |
| 62 | - portfolios |
| 63 | - portfolio positions and holdings through their portfolio |
| 64 | - broker connections and future broker account references |
| 65 | - future preferences, watchlists, alerts, notes, and decisions |
| 66 | |
| 67 | Shared public intelligence remains shared where appropriate: |
| 68 | |
| 69 | - companies and instrument reference data |
| 70 | - public source documents |
| 71 | - public research events |
| 72 | - source provenance |
| 73 | - globally applicable catalyst calculations |
| 74 | |
| 75 | Portfolio research is private because the portfolio membership is private. It can reuse shared company intelligence, but a user must not see another user's portfolio or broker connection because they share the same company. |
| 76 | |
| 77 | ## Broker Credential Boundary |
| 78 | |
| 79 | Phase 5A does not enable real IBKR or ICICI Direct login. Broker connections are user-owned before real providers are enabled. Raw broker passwords, OTPs, MFA codes, plaintext broker secrets, JWTs, and access tokens must not be logged or stored. Future broker credentials must be represented through token or secret references tied to the authenticated user's broker connection. |
| 80 | |
| 81 | ## CORS |
| 82 | |
| 83 | DEV may allow local browser origins such as `http://localhost:13000` and must allow the `Authorization` header. PRD must not add localhost origins and must not use wildcard origins with credentials. |
| 84 | |
| 85 | ## Future Required Controls |
| 86 | |
| 87 | - Secret rotation process. |
| 88 | - Audit logging for broker sessions and recommendation generation. |
| 89 | - Formal threat model before broker connectivity is enabled. |