# Walkthrough — Platform Backend, Permission, Security & Interaction Audit (QA-001B)

We have performed a complete quality assurance, authorization, validation, interaction, and security audit of the **INVEETAIRE** platform. Below is a detailed summary of the implemented security guards, bug fixes, and interaction enhancements.

---

## 🛠️ Changes Implemented

### 1. Permissions & Portal Isolation (Route boundaries)
- **Blocked Unauthorized Routes:** Removed the Guest list routes import from [routes/crew.php](file:///c:/xampp/htdocs/inveetaire/routes/crew.php) to enforce strict boundary checks for the Crew portal.
- **Menu Links Sanitized:** Removed the "Guest List" menu link from the Crew layout [crew.php](file:///c:/xampp/htdocs/inveetaire/app/views/layouts/crew.php) sidebar.
- **Global Crew Login Fix:** Adjusted [WorkspaceMiddleware.php](file:///c:/xampp/htdocs/inveetaire/app/Middleware/WorkspaceMiddleware.php) to allow global Crew users (whose database `workspace_id` is `null`) to adopt the active support session's adopted workspace, preventing immediate post-login 403 blocks.

### 2. Workspace User Management Security (Privilege Escalation Guard)
- **Role Enforcement:** Modified [WorkspaceUserModel.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Workspace/WorkspaceUserModel.php) queries so that workspace queries (`getUsersByWorkspaceId` and `getUserByIdAndWorkspace`) only return users with `role_id = 2` (Couple/Owner).
- **Controller Guards:** Updated [WorkspaceUserController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Workspace/WorkspaceUserController.php) to hardcode and enforce `role_id = 2` unconditionally on both manual workspace user creation (`store`) and editing (`update`) actions.
- **Form Layout updates:** Removed the "Role Selection" dropdown from user [create.php](file:///c:/xampp/htdocs/inveetaire/app/views/workspace/users/create.php) and [edit.php](file:///c:/xampp/htdocs/inveetaire/app/views/workspace/users/edit.php) templates, since Couple accounts are the only manageable workspace users for Couple/Owner credentials.

### 3. PDO Exception Parameter Reuse Fixes
- **Corrected Prepared Queries:** Resolved named parameter reuse inside prepared statements across search queries:
  - [OperationController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Operation/OperationController.php) (guest scanner lookup)
  - [GuestModel.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Guest/GuestModel.php) (guest filters, counts, and event specific queries)
  - [InvitationModel.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Invitation/InvitationModel.php) (wishes filtering and count lookups)
  - [EngagementController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Engagement/EngagementController.php) (RSVP monitoring search)
- All of these queries now correctly bind separate, unique named parameters (`:search1`, `:search2`, `:search3` or `:query1`, `:query2`, `:query3`), resolving the duplicate parameter binding bug.

### 4. Debounced AJAX searches & dynamic updates
- **AJAX Layout:** Created [ajax.php](file:///c:/xampp/htdocs/inveetaire/app/views/layouts/ajax.php) layout template.
- **Dynamic layout selection:** Modified `GuestController`, `OperationController`, and `EngagementController` to automatically render the page using the `ajax` layout when requested via the `ajax=1` query parameter, sending back only the inner HTML.
- **Alpine.js Interceptors:** Integrated debounced dynamic Alpine.js live fetches on:
  - **Guest List Workspace:** [list.php](file:///c:/xampp/htdocs/inveetaire/app/views/guest/list.php)
  - **RSVP Monitoring Center:** [rsvp_center.php](file:///c:/xampp/htdocs/inveetaire/app/views/engagement/rsvp_center.php)
  - **Guest Wishes:** [wishes.php](file:///c:/xampp/htdocs/inveetaire/app/views/engagement/wishes.php)
  - **Event Scanner Search:** [scanner.php](file:///c:/xampp/htdocs/inveetaire/app/views/operation/scanner.php)
- Searching and filtering now dynamically update the view asynchronously with loading indicator animations, keeping address bar URL states up-to-date and bypassing full-page reloads.

### 5. Camera QR scanner & permissions
- **Dedicated scan trigger:** Integrated a "Scan QR via Camera" button into [scanner.php](file:///c:/xampp/htdocs/inveetaire/app/views/operation/scanner.php).
- **Library integration:** Used `html5-qrcode` loaded via CDN inside a clean scanning modal wrapper.
- **Camera Selection & Toggles:** Requests camera access upon click. Defaults to mobile rear-facing camera (`environment`) and falls back to desktop webcam (`user`). If no camera is available or permission is blocked, it displays a user-friendly error box.

### 6. Validation and Input Sanitization
- **Phone Cleaning:** Stripped spaces, dashes, and parentheses from guest phone number inputs in both manual creation, editing, and Excel spreadsheet bulk parsing ([GuestController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Guest/GuestController.php) and [GuestService.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Guest/GuestService.php)).
- **Name Duplicate Guard on Updates:** Added an update-exclusion ID parameter check to unique name checks on edit submissions to prevent name collision duplicates on updates.

---

## 🧪 Verification Results

### 1. Automated Syntax Checks
All edited PHP code files, layout wrappers, and Blade-style PHP template views have been fully linted with the PHP compiler:
```bash
No syntax errors detected in routes/crew.php
No syntax errors detected in app/Middleware/WorkspaceMiddleware.php
No syntax errors detected in app/modules/Workspace/WorkspaceUserModel.php
No syntax errors detected in app/modules/Workspace/WorkspaceUserController.php
No syntax errors detected in app/modules/Guest/GuestModel.php
No syntax errors detected in app/modules/Guest/GuestController.php
No syntax errors detected in app/modules/Guest/GuestService.php
No syntax errors detected in app/modules/Operation/OperationController.php
No syntax errors detected in app/modules/Engagement/EngagementController.php
No syntax errors detected in app/views/layouts/ajax.php
No syntax errors detected in app/views/layouts/crew.php
No syntax errors detected in app/views/workspace/users/create.php
No syntax errors detected in app/views/workspace/users/edit.php
No syntax errors detected in app/views/guest/list.php
No syntax errors detected in app/views/engagement/rsvp_center.php
No syntax errors detected in app/views/engagement/wishes.php
No syntax errors detected in app/views/operation/scanner.php
```

### 2. Boundary Verification
- Standard Crew navigation checks: `/app/crew/guests/*` is no longer a valid URI since Guest routes are excluded.
- Workspace User Isolation: Couple management listings filter out all roles except `2`, preventing any crew or higher level account exposure or escalation.