THREAT: Direct server attack / port scanning
MITIGATION: Zero exposed host ports.
  - All containers on internal Docker bridge network
  - Only cloudflared opens an OUTBOUND connection to Cloudflare
  - No inbound firewall rules needed — nothing listens on host

THREAT: DDoS attack
MITIGATION: Cloudflare edge absorbs all traffic before it reaches server.
  - Cloudflare Magic Transit for L3/L4
  - Cloudflare DDoS protection on all zones (automatic)

THREAT: TLS downgrade / MITM
MITIGATION: Cloudflare enforces TLS 1.3 minimum on all connections.
  - HSTS preload header on all responses
  - Internal Docker traffic stays on private bridge network

THREAT: SQL injection
MITIGATION: All queries via Prisma ORM with parameterised inputs.
  No raw SQL except pgvector operations — those use $executeRaw with 
  typed vector literals, not user input.

THREAT: Input validation attacks
MITIGATION: Zod schemas validate every tRPC input before any logic runs.
  Type-safe throughout — TypeScript strict mode enforced.

THREAT: Authentication bypass
MITIGATION: NextAuth v5 with PKCE for OAuth flows.
  JWT tokens signed with NEXTAUTH_SECRET (256-bit random key).
  All protected tRPC procedures check session before executing.

THREAT: Rate limit abuse / API scraping
MITIGATION: Redis sliding window rate limiter.
  100 req/min globally, 10 req/min on AI endpoints per user.
  Applied at Next.js middleware layer before any DB/AI calls.

THREAT: CSRF attacks
MITIGATION: tRPC uses POST with Content-Type: application/json.
  SameSite=Strict on session cookies.
  NextAuth handles CSRF tokens on auth routes.

ALL payment data is processed exclusively by Stripe.

What Brewhaus stores:
  ✓ Stripe Payment Intent ID (opaque reference)
  ✓ Stripe Customer ID (opaque reference)
  ✓ Stripe Subscription ID (opaque reference)
  ✓ Order total (after completion)

What Brewhaus NEVER stores:
  ✗ Card numbers
  ✗ CVV codes
  ✗ Expiry dates
  ✗ Billing addresses
  ✗ Bank account details

Client-side: Stripe.js + Payment Element handles card collection.
The card data never touches Brewhaus servers.

// Right to access — export all user data
GET /api/user/export
→ Returns JSON of all user data including orders, profile, XP

// Right to deletion — delete account and cascade
DELETE /api/user/account
→ Prisma cascades: user → orders, reviews, badges, profile
→ Stripe: cancel subscription, delete customer
→ Redis: clear session data
→ Confirmation email sent

// Right to rectification — update profile
PUT /api/user/profile
→ Update name, email, preferences

Essential cookies (no consent required):
  - __Secure-next-auth.session-token (auth)
  - brewhaus-cart (cart state, localStorage)

Analytics cookies (require consent):
  - _cf_bm (Cloudflare bot management)
  
No advertising cookies. No third-party tracking.
Brewhaus is ad-free — no data sold or shared with advertisers.

# Run as non-root user
RUN addgroup --system --gid 1001 brewhaus \
 && adduser  --system --uid 1001 brewhaus

USER brewhaus

# Read-only filesystem where possible
# Postgres and Redis bind to internal network only
# Secrets via environment variables, never baked into images

RULE: No secrets in git.
      No secrets in Docker images.
      No secrets in logs.

IMPLEMENTATION:
  - All secrets in .env file (gitignored)
  - Docker Compose reads via env_file or environment
  - NEXTAUTH_SECRET: openssl rand -base64 32
  - DB_PASS: openssl rand -base64 24
  - CF_TUNNEL_TOKEN: from Cloudflare dashboard only

ROTATION POLICY:
  - NEXTAUTH_SECRET: rotate every 90 days
  - DB_PASS: rotate after any suspected breach
  - CF_TUNNEL_TOKEN: rotatable without downtime (delete + recreate tunnel)
  - Stripe keys: rotate via Stripe dashboard, update .env, restart app container

X-Frame-Options:           DENY
X-Content-Type-Options:    nosniff
Referrer-Policy:           strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy:   (see next.config.ts for full policy)