auth-session-and-safety-boundaries

Add the requireAdmin middleware from adminAuth.ts before the route handler, or use requireOperatorOrAbove for finer-grained RBAC. Log the action via the admin audit logger and cross-reference the admin RBAC matrix instead of writing inline session checks.

Gate the route behind a check that process.env.ENABLE_DEV_AUTH_TOOLS equals '1', returning 404 otherwise. On the client, require both import.meta.env.DEV and VITE_ENABLE_DEV_TOOLS=1 so the tooling is absent in production builds.

Signature verification fails when the parsed JSON body is used instead of the raw request body for signature calculation. Also confirm the WeChat Pay secret or platform certificate is correctly loaded from environment variables, and return 400 with logging on failure.

Check that session cookie settings (domain, path, httpOnly, secure, sameSite) match the frontend origin and HTTPS configuration. Also verify auth middleware ordering in routes.ts and that RBAC role resolution returns the expected role.

Production session cookies must use httpOnly: true, secure: true, and sameSite set to 'lax' or 'strict'. Never relax secure: true for any production codepath, and avoid storing sensitive state in client-accessible cookies.