# UCall — Security Audit Checklist
# Phase 1 Backend · Control Plane

## Coverage Areas

### 1. JWT Validation
- [ ] Expired tokens rejected at WS handshake (401)
- [ ] Expired tokens rejected on REST endpoints (401)
- [ ] Tampered signature rejected
- [ ] Wrong algorithm rejected
- [ ] Missing `exp` claim rejected
- [ ] Refresh token cannot be used as access token
- [ ] Access token cannot be used as refresh token
- [ ] Token issued for user A cannot access user B's endpoints

### 2. Application / Client Authentication
- [ ] App registration requires a valid organizational context
- [ ] API keys are hashed at rest (never stored plaintext)
- [ ] App tokens scoped to their registered app_id
- [ ] Cross-app calls blocked if app isolation is configured
- [ ] App suspension prevents further API calls

### 3. Endpoint Ownership
- [ ] WebSocket connection verified against token's user_id
- [ ] Endpoint UUID cannot be spoofed to hijack another user's connection
- [ ] Only registered endpoints can receive call events
- [ ] Endpoint deregistration on disconnect is atomic

### 4. Universal ID Enumeration Protection
- [ ] Sequential ID guessing does not reveal user metadata
- [ ] Rate limit on `/identity/{uid}` resolution endpoint
- [ ] Non-existent UID returns same latency as existing (timing-safe)
- [ ] Verhoeff check digit rejects random 12-digit guesses

### 5. WebSocket Authorization
- [ ] Missing token → HTTP 401 at handshake
- [ ] Missing endpoint_id → HTTP 400 at handshake
- [ ] Token reuse after logout not accepted
- [ ] Rate limit on WS reconnection attempts per IP

### 6. Rate Limits
- [ ] Registration endpoint rate-limited per IP
- [ ] Token refresh rate-limited per user
- [ ] Call invite rate-limited per user
- [ ] Presence heartbeat accepts maximum 1/s per endpoint
- [ ] WS message rate limit enforced (max frames/sec)

### 7. Replay / Idempotency Protection
- [ ] Call invite with duplicate parameters does not create duplicate sessions
- [ ] Presence heartbeat is idempotent (duplicate OK)
- [ ] Registration of same phone is idempotent (same UID returned)
- [ ] JWT replay (same token used twice) is not a bypass vector

### 8. Redis Key Isolation
- [ ] Presence keys namespaced per user/endpoint
- [ ] No cross-user key access possible from application layer
- [ ] Redis key TTLs enforced (no stale presence data)
- [ ] Redis connection uses AUTH if configured in production

### 9. SQL Injection / Input Validation
- [ ] All SQL uses parameterized queries (SQLx enforces this)
- [ ] Universal IDs validated as 12-digit numeric before DB query
- [ ] Phone numbers normalized and validated before storage
- [ ] Free-text fields (display_name) have length limits
- [ ] UUID parsing validated before use in queries

### 10. Secret Handling
- [ ] JWT secret loaded from environment, not hardcoded
- [ ] Database password not logged
- [ ] Redis password not logged
- [ ] Argon2 password hash used for credential storage
- [ ] Secrets not exposed in error responses or stack traces

### 11. Audit Logging
- [ ] All authentication events logged (login, logout, token refresh)
- [ ] All call initiation events logged with caller/callee UIDs
- [ ] Failed authentication attempts logged
- [ ] Admin actions logged
- [ ] Logs do not contain raw tokens or passwords

### 12. Request Size Limits
- [ ] HTTP request body size limited (prevent memory exhaustion)
- [ ] WebSocket message frame size limited
- [ ] SDP offer/answer size validated before relay
- [ ] Maximum call invite payload size enforced

### 13. TLS Configuration
- [ ] TLS required in production (plaintext only in development)
- [ ] TLS 1.2+ enforced, TLS 1.0/1.1 disabled
- [ ] Cipher suite restricted to secure options
- [ ] Certificate validity monitoring in place

### 14. Cross-App Isolation
- [ ] User registered in App A cannot call user in App B (if isolation enabled)
- [ ] App tokens scoped to app namespace
- [ ] Developer portal API keys cannot issue user tokens

## Priority Order for Implementation
1. JWT tamper/expiry (critical path, currently basic)
2. Rate limits (prevent abuse of registration + call signaling)
3. Request size limits (prevent DoS via large payloads)
4. Redis AUTH + key namespace verification
5. Audit log pipeline
6. TLS enforcement policy
7. Cross-app isolation contract finalization