လေ့ကျင့်ခန်း - မိုဘိုင်းလုံခြုံရေး Audit တစ်ခု

function auditMobileAppSetup(setup) {
  const issues = [];

  if (setup.hasPrivilegedSecretBundled) {
    issues.push({
      area: "secrets",
      problem: "A privileged secret is bundled inside the app binary.",
      fix: "Move any call needing this secret to your backend; never ship privileged keys client-side."
    });
  }

  if (setup.requestsAllPermissionsAtLaunch) {
    issues.push({
      area: "permissions",
      problem: "Sensitive permissions are requested all at once at first launch.",
      fix: "Request each permission just-in-time, when the feature that needs it is used."
    });
  }

  if (setup.tokensInPlainStorage) {
    issues.push({
      area: "storage",
      problem: "Access tokens are stored in plain, unencrypted local storage.",
      fix: "Store tokens in platform secure storage (Keychain on iOS, Keystore-backed storage on Android)."
    });
  }

  if (setup.logsAuthTokens) {
    issues.push({
      area: "logging",
      problem: "Debug logs print the full authentication response, including tokens.",
      fix: "Redact sensitive fields before logging, in every build, not just production."
    });
  }

  if (!setup.priceValidatedServerSide) {
    issues.push({
      area: "trust boundary",
      problem: "Price/discount is only checked in the client, with no server re-validation.",
      fix: "Always re-validate price and eligibility on the server before charging."
    });
  }

  return {
    appName: setup.appName || "unnamed app",
    issueCount: issues.length,
    issues,
    verdict: issues.length === 0 ? "PASS - no flagged issues" : "FAIL - see issues"
  };
}

// The flawed QuickCart setup described in this lesson:
const quickCartFlawed = {
  appName: "QuickCart",
  hasPrivilegedSecretBundled: true,
  requestsAllPermissionsAtLaunch: true,
  tokensInPlainStorage: true,
  logsAuthTokens: true,
  priceValidatedServerSide: false
};

// A properly configured app, for contrast:
const quickCartFixed = {
  appName: "QuickCart (fixed)",
  hasPrivilegedSecretBundled: false,
  requestsAllPermissionsAtLaunch: false,
  tokensInPlainStorage: false,
  logsAuthTokens: false,
  priceValidatedServerSide: true
};

console.log(JSON.stringify(auditMobileAppSetup(quickCartFlawed), null, 2));
console.log(JSON.stringify(auditMobileAppSetup(quickCartFixed), null, 2));