Technical Documentation

Security & RBAC

Quick search…⌘K

Auto Glass implements a Role-Based Access Control (RBAC) model enforced at the API Gateway and re-validated at each service layer. Authentication uses JWT (RS256) tokens with short expiry windows. All data at rest is encrypted with AES-256; all data in transit uses TLS 1.3.

Security Requirement: PCI-DSS compliance mandates that raw card numbers are NEVER processed or stored on Auto Glass servers. All payment data flows directly to Stripe via client-side tokenization. Our servers only ever receive a Stripe PaymentMethod ID.

Role Permissions Matrix

Loading diagram…

Authentication Flow

Loading diagram…

Permission Matrix (Detailed)

Resource	Super Admin	Admin	Dispatcher	Technician	Customer	Insurer
User Management	✅ CRUD	❌	❌	❌	❌	❌
Branch Config	✅ CRUD	📖 Read	❌	❌	❌	❌
Glass Catalog	✅ CRUD	✅ CRUD	📖 Read	📖 Read	❌	❌
Pricing Rules	✅ CRUD	✅ CRUD	❌	❌	❌	❌
All Bookings	✅ CRUD	✅ CRUD	📖 + Assign	Own only	Own only	❌
Work Orders	✅ CRUD	📖 Read	📖 + Reassign	Own + Update	❌	❌
Invoices	✅ CRUD	📖 Read	📖 Read	❌	Own only	Linked only
Insurance Claims	✅ CRUD	📖 Read	❌	❌	Own only	📖 Read
Live GPS Tracking	✅ All	✅ All	✅ All	Own only	❌	❌
Audit Logs	📖 Read	📖 Read	❌	❌	❌	❌
Analytics	✅ Full	✅ Full	📊 Ops only	❌	❌	❌

Security Controls

Control	Implementation
Passwords	`bcrypt` with work factor 12; minimum 10 chars, complexity enforced
JWT Signing	RS256 with 2048-bit RSA keypair; public key published at `/.well-known/jwks.json`
Token Storage	Access token: memory only (no localStorage); Refresh token: HTTP-only Secure cookie
API Rate Limiting	Per-user and per-IP limits enforced at Kong Gateway with Redis counter backend
SQL Injection	100% parameterized queries via `node-postgres`; no raw string concatenation
XSS Prevention	Content-Security-Policy header; React's built-in JSX escaping; no `dangerouslySetInnerHTML` in customer-facing code
CSRF	SameSite=Strict cookies + Origin validation on state-mutating endpoints
Data Encryption at Rest	AWS RDS AES-256 encryption; S3 SSE-S3; Redis AUTH password + TLS
PII Masking	Phone and email partially masked in logs; SSN never stored; DL number encrypted in DB
Audit Trail	All state-mutating API calls logged to append-only `audit_log` table with actor ID + timestamp + diff
Vulnerability Scanning	Trivy container scanning on every build; Snyk SCA on dependencies; OWASP ZAP weekly scan
Penetration Testing	Annual third-party pentest; bug bounty program via HackerOne