# Project Audit & Security Compliance Verification — Chat History & Summary

**Conversation ID:** `a6973a06-4889-4295-aca8-d7611678747e`  
**Audited Period:** July - August 2026  
**Auditor / Admin:** Madhav Joshi  

---

## 1. Executive Summary
This document summarizes the pair-programming and security auditing session conducted to verify the Consultation portal against the **Technical Security Controls (SEC-01 to SEC-09)** and the **Digital Personal Data Protection Act (DPDP-01 to DPDP-08)** guidelines. 

All **17 out of 17 controls** have been successfully verified, resolved, and documented as **SUCCESSFUL** or formally **RISK ACCEPTED** in the project's [TECHNICAL_SECURITY_TESTING_MANUAL.md](file:///c:/Users/Madhav/Sevenpointfour/consultation/TECHNICAL_SECURITY_TESTING_MANUAL.md).

---

## 2. Technical Security Controls Audit (SEC-01 to SEC-09)

| Control ID | Description | Audit Method & Findings | Status |
| :--- | :--- | :--- | :--- |
| **SEC-01** | Cookie Flag Security | Inspected HTTP response headers using `curl` and browser tools. Confirmed session and auth cookies use `Secure`, `HttpOnly`, and `SameSite=Lax`. | **SUCCESSFUL** |
| **SEC-02** | Rate Limiting | **Bug Found:** The production server printed `trust proxy` warnings. Added `app.set('trust proxy', 1);` to [server.mjs](file:///c:/Users/Madhav/Sevenpointfour/consultation/server.mjs) right after initialization so Express reads visitor IPs correctly. | **SUCCESSFUL** |
| **SEC-03** | Helmet Security Headers | Inspected HTTP headers. Confirmed `X-Frame-Options`, `Content-Security-Policy`, and other security headers are sent. | **SUCCESSFUL** |
| **SEC-04** | SQL Injection Mitigation | Verified that all database calls use parameterized queries (via `mysql2` placeholders `?`). | **SUCCESSFUL** |
| **SEC-05** | XSS Protection | Verified that HTML-rendering code passes text input through a sanitization pipeline (`sanitize-html` library). | **SUCCESSFUL** |
| **SEC-06** | Secure Database Credentials | Confirmed that MySQL credentials are loaded dynamically via environment variables (`.env`) and are not hardcoded. | **SUCCESSFUL** |
| **SEC-07** | Environment Variables Security | Confirmed that `.env`, `.env.staging`, and `.env.production` files are fully excluded in `.gitignore` to prevent credential leaks. | **SUCCESSFUL** |
| **SEC-08** | Inactive Login Prevention | Verified that soft-deleted users/staff are rejected immediately on login with `Invalid credentials`. Adjusted manual's pass criteria text to match the exact UI response. | **SUCCESSFUL** |
| **SEC-09** | Data Encryption at Rest | Shared hosting limits prevent full-disk encryption. Updated [ENCRYPTION_LOG.md](file:///c:/Users/Madhav/Sevenpointfour/consultation/ENCRYPTION_LOG.md) to log formal risk acceptance by Admin. Removed Q3 2026 VPS migration target dates. | **RISK ACCEPTED** |

---

## 3. DPDP Act Compliance Controls Audit (DPDP-01 to DPDP-08)

| Control ID | Description | Audit Method & Findings | Status |
| :--- | :--- | :--- | :--- |
| **DPDP-01** | Terms & Consent | Verified consent checkbox on the client registration page. | **SUCCESSFUL** |
| **DPDP-02** | Purpose Limitation | Verified that the Purpose Limitation notice is explicitly shown on the registration form. | **SUCCESSFUL** |
| **DPDP-03** | Daily Log Retention | **Bug Found:** Log cleanup failed because the `/logs` directory was missing on the server. Added `fs.mkdir(logsDirectory, { recursive: true });` inside `cleanupOldLogs()` to auto-create the folder. Verified clean run in production `stderr.log`. | **SUCCESSFUL** |
| **DPDP-04** | Right to Erasure | Logged in as dummy client ID 17 (`arogyanubhutihac@gmail.com`) on localhost and deleted the account. Ran SQL queries to verify that the user and all associated consultation records were permanently deleted. | **SUCCESSFUL (Localhost)** |
| **DPDP-05** | Inactivity Hard Erasure | Audited the code in [inactive_user_cleanup.mjs](file:///c:/Users/Madhav/Sevenpointfour/consultation/scripts/inactive_user_cleanup.mjs). Confirmed it performs SQL `DELETE` queries to wipe accounts inactive for over 2 years, rather than soft-deleting. | **SUCCESSFUL (Code Audit)** |
| **DPDP-06** | Data Breach Readiness | Verified that [BREACH_RESPONSE.md](file:///c:/Users/Madhav/Sevenpointfour/consultation/BREACH_RESPONSE.md) documents the mandatory 72-hour reporting timeline and notification checklist. | **SUCCESSFUL (Doc Audit)** |
| **DPDP-07** | Grievance Redressal | Verified that the Grievance Officer details are published in both English and Hindi on the live website ([privacy.html](file:///c:/Users/Madhav/Sevenpointfour/consultation/public/privacy.html)). | **SUCCESSFUL (Doc Audit)** |
| **DPDP-08** | Inactive User UI Highlights | Verified in [manage-clients.js](file:///c:/Users/Madhav/Sevenpointfour/consultation/public/js/manage-clients.js) that users inactive for >18 months are styled in bold orange, and >24 months in bold red. | **SUCCESSFUL (Code Audit)** |

---

## 4. Code & Deployment Workflow

### 4.1 Git Synchronization Pipeline
When deploying updates, we enforce a strict sequence to prevent conflicts:
1.  **Pull latest changes** to merge work from remote:
    ```bash
    git pull origin development
    ```
2.  **Commit and push** local fixes to `development`:
    ```bash
    git add -A
    git commit -m "fix: resolve logs folder missing error and configure express trust proxy"
    git push origin development
    ```
3.  **Merge and push to Staging and Production** branches:
    ```bash
    git checkout staging ; git merge development ; git push origin staging
    git checkout production ; git merge staging ; git push origin production
    git checkout development
    ```

### 4.2 FTP Deployment Commands
To upload the files to the staging and production environments, we run:
*   **Staging Upload:** `npm run deploy-staging` (uploads to `/home/sevenpoi/nodeapps/staging_myconsultation`).
*   **Production Upload:** `npm run deploy-production` (uploads to `/home/sevenpoi/nodeapps/myconsultation`).

### 4.3 Triggering cPanel Server Restarts
cPanel Passenger routes traffic lazily. After deploying files, trigger a hard restart by going to **cPanel** -> **Setup Node.js App** -> **Edit** your app -> click the blue **RESTART** button. Then refresh the website to spin up the new code.