<?php

/**
 * Vulnerability Assessment Report — KiyoHR
 */

return [
    'findings' => [
        [
            'id' => 'SEC-001',
            'severity' => 'critical',
            'title' => 'Unauthenticated face attendance',
            'status' => 'fixed',
            'files' => ['routes/api.php', 'app/Http/Controllers/Api/MobileCompatController.php'],
            'fix' => 'Requires auth:sanctum; match constrained to authenticated user; throttled',
        ],
        [
            'id' => 'SEC-002',
            'severity' => 'critical',
            'title' => 'two_factor_secret / privilege mass-assignment on User',
            'status' => 'fixed',
            'files' => ['app/Models/User.php'],
            'fix' => 'Privileged attrs removed from fillable; secrets/PII in $hidden',
        ],
        [
            'id' => 'SEC-003',
            'severity' => 'critical',
            'title' => 'API permission middleware fail-open',
            'status' => 'fixed',
            'files' => ['app/Http/Middleware/CheckTenantPermission.php', 'config/tenant_permissions.php'],
            'fix' => 'Fail-closed for api.* named routes; maps added for employees/leaves/attendance/locations/payroll/face',
        ],
        [
            'id' => 'SEC-004',
            'severity' => 'high',
            'title' => 'Leave/Attendance API IDOR',
            'status' => 'fixed',
            'files' => ['Modules/Leave/Http/Controllers/Api/LeaveController.php', 'Modules/Attendance/Http/Controllers/Api/AttendanceController.php', 'app/Policies/LeavePolicy.php'],
        ],
        [
            'id' => 'SEC-005',
            'severity' => 'high',
            'title' => 'PII documents on public disk',
            'status' => 'fixed',
            'files' => ['app/Support/ResolvesPrivateUploads.php', 'Document/Applicant/Leave/Announcement controllers'],
            'fix' => 'Store on local disk; authorized download routes',
        ],
        [
            'id' => 'SEC-006',
            'severity' => 'high',
            'title' => 'Open CORS (*)',
            'status' => 'fixed',
            'files' => ['config/cors.php'],
            'fix' => 'CORS_ALLOWED_ORIGINS env allow-list',
        ],
        [
            'id' => 'SEC-007',
            'severity' => 'high',
            'title' => 'Gate::before grants all policies to role admin',
            'status' => 'fixed',
            'files' => ['app/Providers/AuthServiceProvider.php'],
        ],
        [
            'id' => 'SEC-008',
            'severity' => 'medium',
            'title' => 'Missing security headers',
            'status' => 'fixed',
            'files' => ['app/Http/Middleware/SecurityHeaders.php', 'bootstrap/app.php'],
        ],
        [
            'id' => 'SEC-009',
            'severity' => 'medium',
            'title' => 'No Razorpay server webhook',
            'status' => 'fixed',
            'files' => ['app/Services/RazorpaySubscriptionPaymentService.php', 'routes/api.php'],
        ],
        [
            'id' => 'SEC-010',
            'severity' => 'medium',
            'title' => 'dompdf advisories < 3.1.6',
            'status' => 'remediated',
            'files' => ['composer.json'],
            'fix' => 'Pinned dompdf/dompdf to 3.1.6',
        ],
        [
            'id' => 'SEC-011',
            'severity' => 'medium',
            'title' => 'Email verification not enforced',
            'status' => 'accepted',
            'notes' => 'Documented residual; lead OTP exists for registration',
        ],
        [
            'id' => 'SEC-012',
            'severity' => 'low',
            'title' => 'Unused spatie/laravel-permission package',
            'status' => 'accepted',
            'notes' => 'Remove in follow-up dependency cleanup',
        ],
    ],
    'open_critical' => 0,
    'open_high' => 0,
];