Awn Awn
Back to Awn
Documentation menu — Security and tenancy
Operate / Security and tenancy
Version
1.0
Last verified
2026-08-09

Security and tenancy

Plugins run inside Laravel; there is no sandbox. Controls:

  • enum allowlists select code/views;
  • tenant models use BelongsToOrganization, guarded ownership, tenant-leading constraints;
  • routes establish context before queries;
  • dashboards enforce auth/resolution/membership/availability/policies;
  • public actions enforce effective state/publication, CSRF, throttle, bounded validation;
  • settings are validated and normalized before storage and again before render;
  • tenant text is escaped and CSS uses safe mappings;
  • caches contain arrays/scalars.

Contact Form baseline: web CSRF, throttle:5,1, bounded fields, prohibited website honeypot, no ownership field, repeated active/published/enabled checks.

Preview is temporary signed and may expose drafts. Drivers receive isPreview, but actions are not automatically disabled.

Purge globally deletes assignments and reverses package migrations. Review cascades, backup, and down() before confirmation. Normal disable/deactivate preserves tables.

Test tenant A/B reads and mutations, guessed IDs, no-context creation, ownership reassignment, auth/membership, unavailable plugin 404s, published/draft behavior, hostile output, portable caches, route middleware, collision blocking, and package-only purge.

The current engine has no encrypted per-tenant credential contract. Do not put secrets in manifests or plain plugin settings.

Donor phone identity is global rather than tenant-owned. OTP codes are hashed, expire, have bounded attempts and resend throttles, and the development log provider refuses production. Never claim guest donations by raw phone equality before DonorPhoneVerified, and never expose cross-organization donor activity to an organization.

Fundraising proofs are sensitive tenant data. Public submissions validate image/PDF MIME and a 5 MB limit, then store under fundraising/proofs on the private local disk. Never place proofs on public, expose their path, or render a direct storage URL. Download requires authenticated organization membership, enabled plugin middleware, tenant scope, and the donation policy.

Donation review writes the decision, reviewer user ID, review timestamp, notes, and verified timestamp. Verified project totals must aggregate only DonationStatus::Verified; pending and rejected records never change public progress. The supporters screen groups donations inside the current organization context and may show only whether an attached global donor identity is verified—not activity from other organizations.

Plugin Super Admin pages are cross-tenant by design. Every route must use auth, super.admin, and installed-mode plugin availability; organization middleware is forbidden. EnsureSuperAdmin establishes tenant bypass before queries. Keep global surfaces read-only by default, show organization identity on every tenant record, paginate results, and never expose tenant-private proofs, credentials, or mutation controls merely because the viewer is a platform operator.