🔒 PHASE1-C-1: Security Hardening (Track C) - BLOCKS PHASE 3

[ChandrimaGanguly]

Owner: Noor (Security & Logging Expert)
Duration: 2-3 days (independent, can run parallel to A & B)
Status: Ready to start
CRITICAL: Must be 100% complete before Phase 3 begins

Subtasks (Implementation Order)

Day 1

• PHASE1-C-1.1 - SEC-002: Telegram webhook signature verification
• PHASE1-C-1.2 - SEC-001: CORS hardening

Days 2-3

• PHASE1-C-1.3 - SEC-003: Student database verification (CRITICAL)
• PHASE1-C-1.4 - SEC-004: Admin authentication enforcement
• PHASE1-C-1.5 - SEC-005: Rate limiting (slowapi)
• PHASE1-C-1.6 - SEC-006: Sensitive data sanitization in logs
• PHASE1-C-1.7 - SEC-007: Input length validation
• PHASE1-C-1.8 - SEC-008: Query parameter validation

Days 4-5

• PHASE1-C-1.9 - Security testing and code review

Success Criteria (GO/NO-GO Gate for Phase 3)

• ✅ CORS uses specific domains (not *)
• ✅ All student endpoints verify in database (returns 404 for invalid IDs)
• ✅ All admin endpoints use Depends(verify_admin)
• ✅ Telegram webhook verifies X-Telegram-Bot-Api-Secret-Token header
• ✅ Rate limiting active (100 req/min global, 10 hints/day per student)
• ✅ No secrets in logs (API keys/tokens/IDs all masked)
• ✅ All string inputs have max_length (prevent DOS)
• ✅ Query params have reasonable bounds (page≤1000, grade 6-8, limit≤100)
• ✅ No stack traces in error responses
• ✅ All unit + integration tests pass
• ✅ Code reviewed by Jodha

BLOCKING RELATIONSHIP

Phase 3 Practice Endpoints CANNOT START until this is 100% complete and approved.

This is the critical path blocker identified in PROJECT_PROGRESS.md.

References

• PHASE1_TASKS.md (Agent C, Section 3)
• SECURITY_ROADMAP_INTEGRATION.md (detailed vulnerability mapping)
• AGENT_CHECKLIST.md (Phase 1 Security Work)
• Depends on: PHASE1-B-1 (complete API)
• Blocks: Phase 3 initiation