Security Architecture

// auth.ts (simplified)
export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    Credentials({
      async authorize(credentials) {
        const user = await db
          .select()
          .from(usersTable)
          .where(eq(usersTable.email, credentials.email))
          .limit(1);

        if (!user[0]) return null;

        const passwordValid = await bcryptjs.compare(
          credentials.password,
          user[0].passwordHash
        );

        if (!passwordValid) return null;
        return user[0];
      },
    }),
  ],
  session: { strategy: "jwt" },
});

// At user creation
const passwordHash = await bcryptjs.hash(plaintextPassword, 12);

// At authentication
const valid = await bcryptjs.compare(plaintextPassword, storedHash);

POST /api/auth/forgot-password  → { email }          → 200 (always)
POST /api/auth/reset-password   → { token, password } → 200 or 400

SuperAdmin > BrokerAdmin > BrokerUser > EmployerAdmin > EmployerUser > Member

async function deleteScheme(
  schemeId: string,
  actor: ActorContext
): Promise<void> {
  requireRole(actor, "BrokerAdmin");           // minimum role
  requireTenant(actor, scheme.employer.brokerId); // tenant isolation
  // proceed with deletion...
}

import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

const ALGORITHM = "aes-256-gcm";
const KEY = Buffer.from(process.env.PPS_ENCRYPTION_KEY!, "hex"); // 32 bytes

export function encryptPps(plaintext: string): string {
  const iv = randomBytes(12); // 96-bit IV for GCM
  const cipher = createCipheriv(ALGORITHM, KEY, iv);
  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
  const authTag = cipher.getAuthTag();
  // Store as: iv(12) + authTag(16) + ciphertext — all base64 encoded
  return Buffer.concat([iv, authTag, encrypted]).toString("base64");
}

export function decryptPps(ciphertext: string): string {
  const buf = Buffer.from(ciphertext, "base64");
  const iv = buf.subarray(0, 12);
  const authTag = buf.subarray(12, 28);
  const encrypted = buf.subarray(28);
  const decipher = createDecipheriv(ALGORITHM, KEY, iv);
  decipher.setAuthTag(authTag);
  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
}

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

// audit_logs table
{
  id:            string,   // CUID2
  actorId:       string,   // users.id of the actor
  actorType:     Role,     // role at time of action
  action:        string,   // e.g. "scheme.created", "member.pps_decrypted"
  entityType:    string,   // e.g. "scheme", "member", "writtenPolicy"
  entityId:      string,   // PK of the affected entity
  previousState: JsonB,    // state before the action (null for creates)
  newState:      JsonB,    // state after the action (null for deletes)
  ipAddress:     string,   // from x-forwarded-for header
  userAgent:     string,   // from user-agent header
  timestamp:     timestamp // server-assigned UTC timestamp
}

// middleware.ts
export async function middleware(request: NextRequest) {
  const session = await auth();
  const isApiRoute = request.nextUrl.pathname.startsWith("/api/");
  const isAuthRoute = request.nextUrl.pathname.startsWith("/api/auth/");
  const isHealthRoute = request.nextUrl.pathname.startsWith("/api/health/");

  if (isApiRoute && !isAuthRoute && !isHealthRoute && !session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
}

const CreateSchemeSchema = z.object({
  employerId: z.string().cuid2(),
  name:       z.string().min(1).max(200),
  type:       z.enum(["DB", "DC", "PRSA", "RAC"]),
});

const parsed = CreateSchemeSchema.safeParse(await req.json());
if (!parsed.success) {
  return NextResponse.json(
    { error: "Validation failed", issues: parsed.error.issues },
    { status: 400 }
  );
}

# .gitignore covers all env files
.env
.env.*
.env.local
.env.production

// auth.ts — development fallback only
if (process.env.NODE_ENV === "production") return null; // guard

const DEV_USERS = [
  { email: "admin@test.ie", password: "admin123", role: "SuperAdmin" },
  { email: "broker@test.ie", password: "broker123", role: "BrokerAdmin" },
];

// next.config.js (headers excerpt)
{
  key: "X-Frame-Options",
  value: "DENY",
},
{
  key: "X-Content-Type-Options",
  value: "nosniff",
},
{
  key: "Referrer-Policy",
  value: "strict-origin-when-cross-origin",
},
{
  key: "Permissions-Policy",
  value: "camera=(), microphone=(), geolocation=()",
},