Security Playbook

Product Security Strategy

This document outlines the security strategy for the Line Dance Platform (LDP). It includes actionable principles, implemented policies, and future considerations.

RBAC vs ABAC

• Security Roles: USER, ADMIN
• Domain Roles: TEACHER (does not grant global write permissions)
• Ownership/ABAC Patterns: Enforced at the service layer (BOLA).

Non-Negotiables Checklist

• RFC7807 ProblemDetail: Standardized error responses, including 401/403.
• X-Correlation-Id: Header and body field for traceability.
• Field Errors: Only for 400 validation issues.
• BOLA Enforcement: Ownership checks at the service layer.
• Pagination Cap: Maximum size of 100.

Current Implemented Permission Policy

• Public Endpoints: GET /api/** (except GET /api/users/me/** which requires authentication).
• Catalog Writes: POST/PUT/DELETE restricted to ADMIN.
• Location/Venue:
  • POST: Authenticated users (owner set server-side).
  • PUT: Owner or ADMIN (BOLA enforced).
  • DELETE: ADMIN only.

Links to Sub-Docs

• Authentication
• Identity Model
• Data Protection Strategy
• DB Integrity
• Validation Strategy
• Audit Logging
• Mobile Android Security
• DevSecOps CI

ADRs

• ADR-002: Teacher Domain Role
• ADR-003: Deny-by-Default Catalog Policy

Future Work

• Membership tables for venues/events.
• Potential CURATOR/EDITOR roles.
• Testcontainers for integration testing.