Dokumentasi / Audit & Laporan / Laporan Audit Lab (15 Sep)

🔍 Laporan Audit Lab (15 Sep)

30 cek: 9 PASS / 12 PARTIAL / 9 FAIL (Arsip lunas).

Audit & Laporan SAKILA Ecosystem

LAPORAN AUDIT LAB SAKILA vs PRD V5.2

STATUS 16 Sep 2026: 9 FAIL + 8 PARTIAL TUNTAS 100%.
Rincian bukti di Laporan Harian 16 Sep.
Dokumen ini snapshot beku 15 Sep (arsip, jangan diubah).
Tanggal: 15 September 2026 · Target: /var/www/dev + DB lab inv_skd (46 user)
Metode: 3 tim audit paralel (finansial, akses-privasi, omnichannel-Safira-API) + verifikasi silang Lead
Scope: backend Laravel lab SAJA. Flutter mobile (sumber di laptop) dan prod adm.umv.or.id TIDAK disentuh.

Ringkasan: 30 cek → 9 PASS · 12 PARTIAL · 9 FAIL

1. FAIL (wajib ditutup)

# Temuan Bukti
F1 Status transaksi non-kanonis: kolom varchar(255) tanpa constraint, kode menulis paid (tak ada di PRD 03.2) MobileAdminController@approve:374, live: paid=9, verified=1, pending=1
F2 is_verified desync: kolom NOT NULL DEFAULT 0 + accessor kembalikan nilai tersimpan → trx paid/verified baca false Transaction.php:72-78
F3 Lifecycle adjustment lompat: draft→applied langsung, tanpa endpoint approve + tanpa gate finance_manager (staff/super_admin bisa apply) routes/api.php:201-206, MobileWakafAdminController@applyAdjustment:787-791
F4 audit_logs KOSONG — jejak finansial ke activities, tanpa trail CORRECT/APPLIED audit_logs COUNT=0, transaction_adjustments COUNT=0
F5 finance_staff pegang DONATION_ADJUST penuh (PRD: draft-only) role_has_permissions lab
F6 Route mobile/volunteer/* tanpa middleware permission — token siapa pun bisa accept/submit distribusi routes/api.php:171-177
F7 Emergency bypass 02.2 NOL implementasi; sebaliknya super_admin pegang DONATION_ADJUST permanen grep emergency_bypass = 0 hit; route draft pakai role_or_permission:...super_admin...
F8 Envelope {success,message,data,meta} hanya di Inbox; mayoritas controller pakai format sendiri MobileApiController 0x success, MobileAuthController 0x
F9 tests/Feature/SafiraAdversarialTest.php TIDAK ADA (PRD 10.3 wajib) ls tests/Feature nihil

2. PARTIAL penting

  • P1: Guard Eloquent amount over-strict (blokir SEMUA termasuk koreksi pending) vs trigger DB vs PRD 03.3 — tiga sumber beda aturan (source conflict).
  • P2: draftAdjustment tanpa DB::transaction/lock; super_admin boleh draft (langgar SoD).
  • P3: 8 permission legacy (manage_*, view_*) masih menempel di role.
  • P4: internal-chat, asterisk/*, pbx/caller-lookup, voip/lookup-caller minim proteksi (lookup dichos via suffix-8-digit LIKE).
  • P5: Masking NIK ada, masking nomor HP TIDAK ada; controller masih petakan phone mentah.
  • P6: Kolom idempotency (logical_message_id, idempotency_key) hanya di Model, TANPA migrasi DB + tanpa constraint; pre-dispatch check opsional (client key tidak dipersist).
  • P7: Safira satu kelas raksasa (GeminiService), tanpa pola AiService/Provider, timeout 20 dtk (PRD: 5 dtk); knowledge guard level prompt saja.
  • P8: config/broadcasting.php hilang; Firestore mirror degradasi diam-diam tanpa service-account.

3. PASS (fondasi yang sudah benar)

  • Trigger immutability 3 biji aktif + teruji 9/9; guard applied di Model; casts decimal.
  • 14 permission kanonik + middleware route wakaf/inbox/adjustment; blokir attacker 403 teruji 6/6.
  • Enkripsi AES-256 NIK/HP/GPS + blind-index HMAC + GPS fuzzing deterministik 500m–1km.
  • Concurrency lockForUpdate + idempotency 409 di approve/apply.

4. Rekomendasi prioritas (urut)

  1. R1 — Kunci uang: endpoint approveAdjustment/rejectAdjustment khusus finance_manager + status perantara approved; cabut DONATION_ADJUST dari finance_staff & super_admin.
  2. R2 — Selaraskan state: tulis verified (bukan paid), ENUM/CHECK status di DB, sinkron is_verified via model event, alihkan jejak ke audit_logs.
  3. R3 — Kunci distribusi & lookup: middleware DISTRIBUTION_CREATE di volunteer + batasi pbx/voip lookup.
  4. R4 — Idempotency beneran: migrasi kolom + constraint + wajibkan & persist idempotency_key.
  5. R5 — Quality gate Safira: tulis adversarial test (3 case PRD) + pecah provider pattern + timeout 5 dtk.
  6. R6 — Seragamkan envelope API + masking HP + implementasi emergency bypass 4-lapis.

Catatan: temuan di atas kondisi LAB. Prod butuh audit baca-saja tersendiri sebelum deploy apa pun (10-Step Safety Gate PRD 15).