e17937e8f1
Three StaffUser constants carried plaintext PINs (1234/2345/3456) in auth_controller.dart. Every build shipped every till's credentials, readable by anyone who unzipped the APK. Across 100 deployed devices that is one credential, not a hundred. - Schema v5 adds a staff table. Only a PBKDF2-HMAC-SHA256 hash and a per-user random salt are stored; the PIN itself exists nowhere, including there. 12,000 iterations, tuned so one sign-in is imperceptible while working through all 10,000 four-digit PINs against a stolen database takes ~15 minutes per account instead of milliseconds. - Verification is constant-time. String == returns at the first differing byte, and that timing leaks how much of a guess was right. - StaffUser no longer has a pin field at all, so the credential cannot drift back into memory, into widgets, or into a const declaration. - Weak PINs are refused: under four digits, non-numeric, repeated digits, and sequences. Two staff cannot share a PIN — the till identifies a cashier by PIN alone, so a shared one would attribute bills to whichever row was checked first. - The last admin cannot be demoted or deactivated. A till with no admin cannot be administered, including to appoint one, and recovering means editing the database by hand. - Staff are deactivated, never deleted, so bills already rung keep naming a real person. Seed accounts are now 4821/5093/6274 rather than 1234/2345/3456 — the weak-PIN rule refuses the old ones, and a default the rule itself would reject is not a defensible default. All three are flagged must-change-pin so they get a shop trading on day one without becoming permanent. Store details are now editable data, not compile-time constants. Name, address, GSTIN and phone persist to the database and are read back rather than falling through to the build's constants, which would silently undo a failed save. GSTIN is format-validated including the state code — it prints on every invoice as a legal requirement, so a typo is a compliance problem across hundreds of bills before anyone notices. Tests: 141 -> 160. Includes a test that reads every column of every staff row and asserts no seed PIN appears anywhere in the database. Migration test now asserts v5 and that an upgraded terminal comes up with the staff table present but empty — seeding is the store's job on first open, so an existing shop is never handed accounts it did not create. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
109 lines
2.8 KiB
Dart
109 lines
2.8 KiB
Dart
import 'package:equatable/equatable.dart';
|
|
|
|
/// What a staff member is allowed to do.
|
|
enum StaffRole {
|
|
admin('Admin', 'Full access to every module'),
|
|
manager('Manager', 'Sales, inventory and reports'),
|
|
cashier('Cashier', 'Billing and customers only');
|
|
|
|
const StaffRole(this.label, this.description);
|
|
|
|
final String label;
|
|
final String description;
|
|
|
|
bool get canVoidSale => this != StaffRole.cashier;
|
|
bool get canEditPricing => this == StaffRole.admin;
|
|
bool get canViewReports => this != StaffRole.cashier;
|
|
}
|
|
|
|
/// A person who signs in at the terminal.
|
|
///
|
|
/// Deliberately carries no PIN. It used to, which meant the credential was in
|
|
/// memory, in every widget that held a user, and — because the accounts were
|
|
/// declared as constants — inside the shipped binary. Verification now happens
|
|
/// in `StaffDao` against a stored hash, and nothing above the data layer ever
|
|
/// sees the secret.
|
|
class StaffUser extends Equatable {
|
|
const StaffUser({
|
|
required this.id,
|
|
required this.name,
|
|
required this.role,
|
|
this.mustChangePin = false,
|
|
this.isActive = true,
|
|
});
|
|
|
|
final String id;
|
|
final String name;
|
|
final StaffRole role;
|
|
|
|
/// Set on a seeded or admin-reset account until the person picks their own.
|
|
final bool mustChangePin;
|
|
|
|
/// Deactivated rather than deleted, so bills already rung keep pointing at a
|
|
/// real person.
|
|
final bool isActive;
|
|
|
|
StaffUser copyWith({
|
|
String? name,
|
|
StaffRole? role,
|
|
bool? mustChangePin,
|
|
bool? isActive,
|
|
}) =>
|
|
StaffUser(
|
|
id: id,
|
|
name: name ?? this.name,
|
|
role: role ?? this.role,
|
|
mustChangePin: mustChangePin ?? this.mustChangePin,
|
|
isActive: isActive ?? this.isActive,
|
|
);
|
|
|
|
@override
|
|
List<Object?> get props => [id, name, role, mustChangePin, isActive];
|
|
}
|
|
|
|
/// The registered outlet this terminal belongs to.
|
|
class StoreAccount extends Equatable {
|
|
const StoreAccount({
|
|
required this.id,
|
|
required this.name,
|
|
required this.email,
|
|
required this.address,
|
|
required this.gstin,
|
|
required this.phone,
|
|
required this.staff,
|
|
this.plan = 'Business',
|
|
});
|
|
|
|
final String id;
|
|
final String name;
|
|
final String email;
|
|
final String address;
|
|
final String gstin;
|
|
final String phone;
|
|
final List<StaffUser> staff;
|
|
final String plan;
|
|
|
|
StoreAccount copyWith({
|
|
String? name,
|
|
String? email,
|
|
String? address,
|
|
String? gstin,
|
|
String? phone,
|
|
List<StaffUser>? staff,
|
|
String? plan,
|
|
}) =>
|
|
StoreAccount(
|
|
id: id,
|
|
name: name ?? this.name,
|
|
email: email ?? this.email,
|
|
address: address ?? this.address,
|
|
gstin: gstin ?? this.gstin,
|
|
phone: phone ?? this.phone,
|
|
staff: staff ?? this.staff,
|
|
plan: plan ?? this.plan,
|
|
);
|
|
|
|
@override
|
|
List<Object?> get props => [id, name, email, address, gstin, phone, plan];
|
|
}
|