Security and Safety¶
Controls¶
- JWT/password authentication and Firebase/GCP identity integration are separated from route logic.
- Role dependencies protect citizen, officer, admin, and super-admin operations.
- Chat sessions are fetched with both session ID and current user ID.
- RAG queries derive allowed document roles from the authenticated role before vector search.
- GCP secrets, service accounts, and IAM modules keep deployment credentials out of application source.
- Uploaded documents are parsed and stored through dedicated services.
Risks¶
Default settings include placeholder passwords and a placeholder JWT secret; deployment must override them. File size/type limits, malicious document parsing, CORS origin configuration, SSE abuse, prompt injection, and source-document leakage need continuous hardening.
The RAG system’s role filter is a meaningful defense, but authorization must also be enforced on document listing, uploads, storage keys, and any future retrieval path. Add audit events for case access, role changes, document ingestion, and ATR downloads.
Threat-oriented review¶
| Boundary | Main threat | Required control |
|---|---|---|
| Auth | Stolen or replayed token | Short expiry, rotation, revocation strategy |
| Case APIs | IDOR across users | Ownership and role checks on every query |
| RAG | Restricted chunk in prompt | Filter before similarity result and test every role |
| Uploads | Parser/malware abuse | MIME/size limits, scanning, isolated parsing |
| GCS | Guessed object key | Non-public bucket and signed/authorized downloads |
| LLM | Prompt injection or fabricated answer | Context-only prompt, citations, refusal, monitoring |
| Admin | Privilege escalation | Server-side role policy and audit trail |
The code demonstrates several controls, but the dossier should not treat middleware or frontend route hiding as authorization. The database query and object-storage path must enforce the same policy independently.