SchoolPulse — Full QA Audit

1.Authentication & Roles

All 6 demo accounts login successfully. Real password login works with CSRF. Logout clears session. /onboarding redirects on first login.

2.Public Routes

3.API Surface

Out of 8 common API paths probed, only /api/schools.php exists. Everything else falls through to homepage.

4.Core Workflows

5.Security Headers

Probed /, /auth/login, /dashboard, /complaints. Only Server + X-Powered-By returned. None of the expected security headers present.

6.Prioritized Bug List

7.Unverified Marketing Claims

8.Recommended Fixes (priority order)

1. Implement decoy OR remove the marketing. A real decoy needs a second password_hash_decoy column, separate Argon2id hash, login flow that checks real first then decoy (returns empty dashboard), and an onboarding step to set it. If that's not shipping in this milestone, strip every reference to "decoy password" and "Forced to login?" from the homepage and roadmap. False safety promises on a whistleblower platform are worse than no claim.
2. Fix /schools/view to accept ?slug= (and resolve internally), OR fix dashboard links to use ?id=. One-line fix either way. Currently breaks the top user journey.
3. Add security headers globally via Caddy or PHP middleware: Strict-Transport-Security: max-age=31536000; includeSubDomains, Content-Security-Policy: default-src 'self', X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer. Strip X-Powered-By.
4. Validate audio_path. Either drop the hidden text field entirely (let the multipart upload carry the file), or restrict it to a server-issued token from /api/audio-upload.php that returns a UUID mapping to a temp path the server controls. Reject anything that looks like /etc/ or contains ...
5. Strip debug seeds from production DB or set status='hidden' so they don't appear in /schools or /dashboard rankings. Also geocode them or delete the lat/lon so the heatmap doesn't cluster at 0,0.
6. Seed the forum with sample threads (5-10 across categories) OR remove /forum from public nav until populated.
7. Purge demo accounts before public launch: bash /home/school/purge_demo.sh via /admin.
8. Build out the rest of the API surface — /api/provinces.php, /api/categories.php, /api/districts.php, /api/stats.php are claimed but not implemented (all fall through to homepage).
9. Decide what "AI" actually means in this build. The homepage touts auto-tag, sentiment, correlation, chatbot. None of these endpoints exist. Either ship one concrete AI feature or stop claiming "Mimo AI" powers the platform.

9.Repro Script

Run against any clone of school.34.jugaar.ai:

BASE="https://school.34.jugaar.ai"

# 1. Confirm decoy is fiction
for path in /auth/login /auth/register /onboarding; do
  curl -sk "$BASE$path" | grep -ci 'decoy\|fake.password'
done
# Expected: 0 matches on every route

# 2. Confirm broken dashboard links
for slug in test-school-d44f6b govt-high-school-model-town-lahore-showcase-7fc73e; do
  curl -sk -o /dev/null -w "%{http_code} " "$BASE/schools/view?slug=$slug"
done
# Expected: 404 404

# 3. Confirm security header absence
curl -sk -I "$BASE/" | grep -iE 'hsts|content-security|x-frame|x-content-type'
# Expected: empty

# 4. Confirm audio_path accepts arbitrary value
curl -sk -c jar "$BASE/auth/login" >/dev/null
CSRF=$(curl -sk -b jar -c jar "$BASE/complaints/new" | grep -oE '_csrf"[^>]*value="[^"]+"' | head -1)
curl -sk -b jar -X POST "$BASE/complaints/new" \
  --data-urlencode "_csrf=$CSRF" --data-urlencode "school_id=14" \
  --data-urlencode "category_id=14" --data-urlencode "title=audio probe" \
  --data-urlencode "description=test" --data-urlencode "is_anonymous=1" \
  --data-urlencode "audio_path=/etc/passwd" --data-urlencode "audio_duration=99999" \
  -o /dev/null -w "%{http_code}\n"
# Expected: 200 (BAD — should reject)