15 — Admin & Application Security #

Defense-in-depth across auth, authorization, secrets, audit, integrity. Both admin (vendor) panel dan user (hotel) panel covered.

1. Authentication #

Password policy #

• Minimum 10 karakter
• Mix: minimal 1 huruf, 1 angka, 1 simbol
• Disallow last 5 password (history)
• Force change setelah 90 days (admin role; opsional untuk user role — owner toggle)
• Lockout: 5 gagal dalam 15 menit → kunci akun 15 menit + alert email + notify admin

2FA / MFA #

• TOTP (Google Authenticator, Authy, dll) — wajib untuk admin & owner & accountant role
• Optional: WebAuthn / passkey (Phase 2)
• Recovery codes 10 buah, single-use, di-encrypt at rest
• Force enrollment saat first login untuk role wajib

Session #

• Stateful session (database driver) untuk panel
• Idle timeout: 30 menit (config per property)
• Absolute timeout: 12 jam
• Single session per user opsional (owner toggle "kick previous session")
• Session fingerprint: bind ke User-Agent + IP class — kalau berubah drastis, force re-auth

Login surface protection #

• Rate limit 10 attempt per IP per menit di endpoint /login
• Captcha (BYOK Turnstile/hCaptcha/reCAPTCHA) setelah 3 gagal
• Honeypot field
• Generic error message ("Invalid credentials") — tidak ungkap apakah email exist
• Login activity log: timestamp, IP, UA, lokasi (GeoIP), success/fail — visible di profil user

2. Authorization (RBAC) #

Layered #

1. Authentication — siapa kamu? (login)
2. Tenancy guard — kamu ngakses tenant yang benar?
3. Property scope — kamu ngakses property yang punya akses?
4. Role permission — kamu boleh lakukan action ini?
5. Resource ownership — kamu owner of resource (kalau applicable, e.g. cashier hanya bisa edit folio shift-nya sendiri)?

Implementation #

• Laravel Gate + Policy per resource (ReservationPolicy, FolioPolicy, dll)
• Middleware permission:fo.reservation.create
• Resource ownership check di policy method ($user->id === $folio->cashier_id)

Threshold-gated actions #

Beberapa action butuh approval (di atas threshold):

• Discount > 20% folio
• Refund > Rp 5jt
• AP payment > Rp 50jt
• Period unlock (accounting)
• Comp room (free of charge)

Workflow: requester submit → manager approve / reject → action executed. Logged di approval_requests.

3. Secret management #

App-level secrets (di .env) #

• APP_KEY (Laravel encryption key)
• DB credentials
• Redis password
• Mail SMTP
• SaaS-mode central JWT signing key
• Telemetry endpoint key

Tenant-managed secrets (BYOK) #

• Payment gateway keys
• AI provider keys
• SMS / WA / Mail provider keys
• OTA channel manager keys
• Coretax PKP credentials

Storage:

• Disimpan di kolom *_encrypted via Crypt::encryptString() (AES-256-CBC w/ HMAC).
• Decrypt hanya at usage point (di service yang execute call).
• Never logged — masking middleware di logger: redact key/secret/token.
• Never returned via API — response selalu masked sk_****abcd.
• Rotasi: UI "regenerate" untuk per-secret.

Code-level secret hygiene #

• Pre-commit hook: gitleaks / trufflehog scan
• CI scan: secret detection
• Dependabot / Renovate untuk vuln deps

4. Audit log #

Model #

audit_logs
├── id, property_id (nullable for global events)
├── user_id, user_type (admin|staff|api)
├── action (string e.g. 'reservation.created', 'user.login', 'secret.rotated')
├── auditable_type, auditable_id (polymorphic)
├── before (json, nullable)
├── after (json, nullable)
├── ip, user_agent, request_id
├── metadata (json — extra context)
└── created_at

What's logged (mandatory) #

• All CRUD on financial entities (folio, journal, payment, AR/AP, COA edit, refund)
• Permission changes, role create/edit
• Secret rotate / view-attempt / decrypt event
• Period close / unlock
• User login / logout / failed login / password reset / 2FA enroll-disable
• Data export (PII downloads)
• Impersonation by admin (vendor side)
• License pairing / revoke
• Setting changes (tax config, integration toggle)

Retention #

• Financial: minimum 10 tahun (UU Pajak)
• Auth / access: 2 tahun
• Other: 1 tahun
• Archive ke cold storage setelah 90 hari (S3 Glacier / R2 archive)

Tamper-evidence #

• Append-only table (no DELETE permission)
• Optional hash chain: entry.hash = sha256(prev_hash + entry_payload) — detect tampering (P2)
• Daily checksum exported ke external storage (S3 versioned bucket)

5. Data protection (UU PDP) #

Lihat juga 08-INDONESIA_COMPLIANCE.md untuk full PDP coverage.

Tagging PII #

Per kolom DB di-tag PII level via comment / migration metadata:

• L1: nama, email, telp (basic)
• L2: KTP, paspor, alamat (sensitive)
• L3: foto identitas, signature digital (highly sensitive)

Access control #

• Role-based: hanya FO + Manager + Owner bisa lihat L2; Manager + Owner bisa export
• Audit: setiap akses L2/L3 logged
• Mask di list view (e.g. KTP 3201****1234), full view butuh klik "show" + reason input

Right to erasure #

Endpoint admin "Forget guest":

• Anonimisasi (replace name/email/phone with hash) di semua tabel
• Tetap simpan reservation history (untuk pajak compliance) tapi dengan PII anonimised
• Catat di dsr_requests (data subject rights — request ID, type, completed_at, performed_by)

Data export (right to portability) #

Endpoint "Download my data" → ZIP berisi JSON profile + reservation history + folio.

Breach notification #

• Internal incident response runbook
• Notify Komdigi (≤ 3 × 24 jam) sesuai UU PDP
• Notify affected guests
• Logged di security_incidents (with severity, scope, mitigation, post-mortem)

6. Network / infra security #

• HTTPS only — HSTS preload (max-age=63072000; includeSubDomains; preload)
• TLS 1.2 minimum, prefer 1.3
• WAF: Cloudflare (recommended) atau ModSecurity self-host
• DDoS: Cloudflare proxy
• Admin panel di subdomain terpisah + IP whitelist guard
• DB tidak expose ke public
• Backup encrypted at rest
• VPN / Bastion untuk SSH admin (jangan password auth — key only)
• Auto-update OS (unattended-upgrades) di VPS yang kita kelola untuk SaaS

7. CSRF, XSS, SQLi, SSRF #

• CSRF: Laravel built-in (@csrf di form, middleware verify)
• XSS: Blade auto-escape; @unsafe rare, code review wajib
• CSP header: default-src 'self'; img-src 'self' data: cdn.example.com; ...
• SQLi: Eloquent / Query Builder — no raw concat user input
• SSRF: outbound HTTP via wrapper class yang validate destination (no localhost, no 169.254.*, no internal CIDR) untuk fitur webhook / image fetch
• File upload: MIME sniff, virus scan (ClamAV optional Phase 2), randomized filename, store outside webroot
• Image processing: intervention/image — guard dimensi max + pixel bomb protection

8. Dependency security #

• Composer audit di CI (composer audit)
• npm audit di CI
• Dependabot / Renovate
• Lock pnpm/composer files committed
• Major bump butuh PR review + smoke test

9. Encryption at rest #

• DB-level: enable encrypted volume (LUKS / cloud provider native)
• Field-level encryption untuk PII L2/L3 (via Laravel Crypt or Eloquent caster)
• Backup files encrypted before push ke S3/R2

10. License & integrity check #

Aplikasi self-check:

• License token verify di tiap request (license middleware)
• File integrity check (hash major core files) — kalau modified manual, log warning + degrade mode
• Tampering detection: LICENSE.txt integrity hashed, check di boot

Detail di 16-LICENSE_PAIRING_DESIGN.md.

11. Penetration testing #

Sebelum public launch:

• Internal pentest checklist OWASP Top 10
• External vendor pentest (third-party) sebelum SaaS general availability
• Bug bounty program post-launch (Phase 2): private invite-only via HackerOne / local researcher

12. Compliance certifications (target jangka panjang) #

• ISO/IEC 27001 (P3) — for enterprise SaaS sales
• SOC 2 Type 1 (P3)
• PCI-DSS — kita tidak handle card data langsung (offload ke PG), tapi compliance tetap dengan SAQ-A
• Bukti UU PDP self-attestation + DPIA dokumen

13. Incident response #

Runbook urutan saat insiden:

1. Detect — alert from monitoring / user report
2. Classify — severity 1-4
3. Contain — isolate affected system, rotate compromised secrets
4. Eradicate — patch root cause
5. Recover — restore service, verify integrity
6. Postmortem — blameless writeup, action items, timeline
7. Notify — affected parties, regulator (kalau PDP scope)

On-call rotation untuk SaaS mode (P2 saat ada ≥3 paying tenants).

14. Threat model summary #

15. Open questions #

1. WebAuthn passkey adoption tier — Phase 2 atau lebih awal?
2. Hardware security key support (YubiKey) untuk owner — niche, P2?
3. SOC 2 timeline — mungkin Phase 3 saat ada >50 paying SaaS tenants?
4. SIEM integration (Splunk/Datadog/Elastic) untuk owner enterprise — opt-in feature?