07 — SECURITY BRAIN

Context pack cho JWT · Gateway · RLS · Secrets · Threat model · Production readiness. Snapshot + trỏ canonical. Không in secret. Canonical: backend/SECURITY-CHECKLIST.

Auth Gateway (LIVE)

• Chấp nhận Authorization: Bearer <jwt> (JWT HS256 access + DB session, revocation) hoặc x-bng-api-key (server-to-server). Thứ tự: Bearer → key. Tenant từ credential, không từ client. TenantResolver seam. backend/AUTH-GATEWAY, AUTH-TENANT-CONTEXT.
• Mint session qua ops CLI (mint-session-token), revoke session/key. Chưa có login endpoint/password (Phase 4 Auth GA).

Tenant isolation — 4 lớp (defense-in-depth)

1. Auth/context (TenantResolver, server-side) · 2. Repo filter tenantId · 3. Domain guard TENANT_MISMATCH · 4. RLS (DB). Cross-tenant → 404 (anti-enumeration). travel-os/07-MULTI-TENANT.

RLS (staging ON)

• 8 bảng RLS (tenants/listings/units/availability/prices/reservations/outbox_events/idempotency_keys). Ngoài RLS cố ý: api_keys/users/user_sessions/tenant_memberships (auth resolve trước context) + customers/provisioning (ops). backend/RLS-COVERAGE.
• Role split: app role bng_staging_app (RLS-subject, request path + withTenant) vs maintenance role BYPASSRLS (ops/dispatcher/metrics). backend/RLS-OPERATIONS.
• Request path 100% qua withTenant/runInTx (guard scripts/check-tenant-guard.sh). backend/RLS-READINESS.

Secrets

• Hash sha256 (API key), JWT secret env fail-fast production, secret 0600 VPS, không log/không bundle/không response (verified 0 match). Gate/JWT secret không vào client. Threat: cross-tenant leak, secret leak, token abuse → mitigation ở backend/RLS-RISK-MATRIX.

Threat model & guardrails

• Guardrail bất khả xâm phạm = 0: tenant isolation incidents · secret leak · compliance breaches. RLS fail-closed (thiếu context → 0 rows, không leak). Superuser bypass RLS ⇒ app/dispatcher không dùng superuser (chỉ DDL/migrate). business-os/09-RISK §Security.

Production readiness

• RLS production: runbook + go/no-go + risk matrix sẵn, DR drill bắt buộc trước Go. backend/PRODUCTION-RLS-RUNBOOK, RLS-GO-NOGO-CHECKLIST, RLS-RISK-MATRIX.
• Chưa có: rate-limit gateway production (hiện demo-level), pen test, WAF, audit-immutable log.

Verify tools (read-only)

scripts/verify-rls-readiness.sh (DB metadata) · scripts/check-tenant-guard.sh (static request-path guard). backend/CUTOVER-READINESS.

Current state · risks · next

• State: auth+RLS staging done, no leak. OMS 02.
• Risks: RLS production chưa · rate-limit production chưa · login/password chưa. OMS 05.
• Next: 08-ROADMAP; production RLS chờ production + DR drill.