# Security and endpoint audit

## Result

- 61 unique management API endpoints were mapped and syntax-checked.
- Unknown API routes now return HTTP 404; unauthenticated protected routes return HTTP 401.
- `/api/agent/i18n/:locale` was moved before `/api/agent/:id` so it is no longer interpreted as an agent ID.
- The broken super-admin redirect `/app/agents` was corrected to `/app/agent`.
- Provider endpoint values are validated as HTTP(S), normalized without a trailing slash, and saved to the correct `providerType` model field.
- The documentation consistently reads the normalized `AAS_ENDPOINT` from validated configuration.

## Secrets and authentication

- Removed insecure hard-coded fallback secrets.
- Added minimum 32-character validation for `SECRET_KEY` and `CRYPT_KEY`.
- Added `npm run generate:secrets` using cryptographically secure random bytes.
- New agent tokens and secret keys now use 256-bit random values instead of MD5.
- New passwords are stored with bcrypt; existing plaintext passwords are upgraded at the next successful login.
- Added the missing Agent model fields: `token`, `secretKey`, `role`, `depth`, `lang`, and `showCall`.
- Session cookies now use `httpOnly`, `sameSite=lax`, an explicit lifetime, and `secure` in production.
- Updated Axios and MySQL2, migrated Sequelize 5 to Sequelize 6, and removed unused legacy Socket.IO, request-ip, MD5, and body-parser dependencies. The final audit reports no critical-severity dependency vulnerability.

## Removed from the release

- `node_modules` (restore with `npm install`).
- Old runtime logs.
- An unrelated PHP file manager with hard-coded PIN `2007`. This was a serious server-access risk.

## Deployment values still required

Copy `.env.example` to `.env`, generate secrets, then set the actual database connection, public `AAS_ENDPOINT`, and allowed browser origin. A real production endpoint cannot be inferred safely from source code alone.

## Verification

Run `npm install` and `npm run check`. A full live integration test additionally requires a reachable MySQL database and the real external AAS/provider services.