Open Mercato Security: What to Check Before Launch

1. JWT operator action. Affected scope: production upgrades from 0.6.7 to 0.7.0, especially Docker Compose stacks or configurations using a shared or per-audience JWT secret. The operator must act. Prerequisites: inventory the current secrets, how every process receives them, and whether pre-migration sessions must survive. Action: before upgrading, set a strong JWT_SECRET of at least 32 characters in the .env file beside the Compose file because 0.7.0 rejects missing, short, and known example values in production. If a rolling deployment must accept legacy tokens temporarily, set a bounded JWT_LEGACY_GRACE_MINUTES and a valid near-term JWT_LEGACY_CUTOVER_AT; deployments without legacy tokens should disable the grace period. User impact: rotating the secret signs out active sessions, while a legacy token without a valid cutover is rejected. Validation: start the app, worker, scheduler, and CLI in production configuration, verify rejection of an unsafe secret, and test new and permitted legacy tokens on both sides of the cutoff. Recovery limit: restore service with a valid secret and planned reauthentication; a published or weak secret is unsafe to roll back to.

2. User ACL application or script change. Affected scope: clients moving from 0.6.7 to 0.7.0 that call PUT /api/auth/users/acl. The application, integration, or administrative script owner must act. Prerequisites: read the stored override and establish the intended features, organizations, and isSuperAdmin values. Action: treat omitted fields as unchanged and remove an override only by clearing every dimension explicitly. When changing organization scope, restate a non-empty features grant because an organizations-only override without features now returns 400. User impact: a partial edit no longer silently deletes a narrowing ACL and restores the full role, but old payloads can now be rejected. Validation: test omitted-field preservation, explicit override removal, organizations with features, and the negative organizations-only case. Recovery limit: do not retry the old payload or delete the ACL row as a workaround; restore the intended grant and scope explicitly.

3. Passkey MFA operator action for editions configured with the security module. Affected scope: deployments upgrading from 0.6.7 to 0.7.0 that use passkeys. The security operator must act with support from the login client owner. Prerequisites: inventory active passkey methods and prepare an administrative reset path and user communication. Action: the verification client must send a real WebAuthn assertion object as payload.response; the component supplied by Open Mercato already does so. At the v0.7.0 tag, enrollment shortcut issue #5296 was not closed, so treat every passkey stored through that shortcut as potentially hostile, reset affected methods through POST /api/security/users/{id}/mfa/reset, and require browser-ceremony re-enrollment. This is the status at the v0.7.0 tag; check the current issue before assuming it is still open. User impact: a person whose only method is a passkey can be locked out until re-enrollment. Validation: a real assertion must pass, the legacy credentialId plus challenge shape must return 401, and a reset account must complete new enrollment and login. Recovery limit: credential provenance cannot be reconstructed reliably from the stored row, so a query cannot safely identify every shortcut-enrolled record.

4. Global-search operator and module-owner action. Affected scope: applications upgrading from 0.6.7 to 0.7.0 that use GET /api/search/search/global, custom roles, or custom searchable entities. The ACL operator owns role changes and each module owner owns entity configuration. Prerequisites: inventory roles using search.view or search.global and every search.ts configuration with its aclFeatures. Action: grant search.global to intended clients, add per-entity view features to aclFeatures, and run yarn mercato auth sync-role-acls after deployment. The filter fails closed for non-superadmins, so an entity without aclFeatures does not appear in results. User impact: a client with search.view alone can receive 403 from the global endpoint, and results without a valid permission map can disappear. Validation: test allowed and denied roles across global and hybrid search, absence of entities without grants, and visibility after ACL synchronization. Recovery limit: do not restore results by widening the endpoint or disabling the filter; restore them through explicit grants and per-entity mappings.