Skip to main content

Audit Toan Dien Mobile / Backend / Admin

Ngay audit: 2026-05-16

Pham vi:

  • Mobile app Expo/React Native trong mobileApp/
  • Backend Vendure va Golden Lotus plugin trong goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/
  • Admin dashboard Golden Lotus trong goldenlotus-backend/packages/dashboard/src/app/golden-lotus/

Tom tat nhanh​

Du an da tien len ro so voi audit ngay 2026-05-15: mobile da tach feature modules kha tot, backend Golden Lotus plugin co du entity/service/API cho booking, membership, voucher, CMS, notification, campaign, lucky wheel, provider config; admin cung da co workspace rieng cho Golden Lotus va da bo sung UI typed cho Booking policy.

Tuy vay, chua nen coi day la ban production-stable. Co 4 nhom rui ro lon:

  1. Mobile va backend dang lech contract o Booking policy, khien app co the khong nhan cau hinh admin.
  2. Automation booking co cong tac enabled tren admin nhung scheduled job van chay.
  3. QR member/voucher tren mobile hien la pattern tu sinh, khong phai QR/barcode tieu chuan de scanner doc on dinh.
  4. Backend point transfer co confirm mutation nhan bat ky OTP khong rong, nen phai tiep tuc khoa UI cho den khi OTP duoc verify that.

Cap nhat fix 2026-05-16​

Da xu ly cac diem nong sau audit:

  • Mobile doc lotusMobileBootstrap.bookingPolicy top-level dung contract backend.
  • Scheduled booking automation ton trong LotusAutomationSetting.enabled va skip khi setting dang tat.
  • Point transfer shop flow fail-closed va bootstrap khong advertise pointTransfer cho den khi co OTP verifier an toan.
  • Member QR va voucher QR chuyen sang QR code tieu chuan bang react-native-qrcode-svg; voucher QR encode signed payload backend.
  • Notification ARTICLE route sang /article/[slug].
  • Live home dashboard khong con spread mockHomeDashboard vao response live; discounts live de rong den khi co data contract BigFan that.
  • Dashboard full typecheck da pass sau khi generic hoa custom-field/option-group controls va cap script check-types chay voi heap lon.

Ket qua kiem tra​

Khu vucLenh / checkKet qua
Mobilenpm run test:smokePass
Mobile./node_modules/.bin/tsc --noEmitPass
Mobilenpm run lintPass
Mobile i18nSo key en/vi/ru/jaPass, khong thieu/du key
Backend server./node_modules/.bin/tsc -p docker/vendure_backend/apps/server/tsconfig.json --noEmitPass
Dashboard Golden Lotus/Vite./node_modules/.bin/tsc --project packages/dashboard/tsconfig.vite.json --noEmitPass
Dashboard full checknpm --prefix packages/dashboard run check-typesPass sau khi cap script chay voi heap lon
Dashboard full directnode --max-old-space-size=8192 ./node_modules/typescript/bin/tsc --project packages/dashboard/tsconfig.check.json --noEmitPass

Chua chay e2e/backend integration vi can DB/server runtime dung du lieu that.

Findings uu tien cao​

P0 - Booking policy bi lech contract mobile/backend​

Backend schema dinh nghia lotusMobileBootstrap.bookingPolicy la field top-level:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/api/shop-api-extensions.ts:131
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-shop.service.ts:222

Nhung mobile lai query chi features va doc features.bookingPolicy:

  • mobileApp/features/booking/api.ts:17
  • mobileApp/features/booking/api.ts:188
  • mobileApp/features/booking/api.ts:193

Tac dong: admin cap nhat booking policy thanh cong nhung app co kha nang luon fallback ve defaultBookingPolicy. Gio gioi han dat truoc, party size, reminder policy tren app va server co the khong dong bo.

De xuat fix: sua mobile query lay bookingPolicy { maxAdvanceDays maxPartySize lateAutoCancelEnabled lateGraceMinutes reminderMinutesBefore } va map tu data.lotusMobileBootstrap.bookingPolicy. Nen them smoke/unit test cho mapping nay.

P0 - Automation scheduled bo qua cong tac enabled​

Admin co the toggle LotusAutomationSetting.enabled, nhung scheduler goi thang executeBookingAutomation() neu setting ton tai:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-automation.service.ts:62
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-automation.service.ts:86
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-automation.service.ts:92

Trong executeBookingAutomation(), reminder luon duoc gui, chi lateAutoCancelEnabled moi chan auto no-show:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-automation.service.ts:102
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-automation.service.ts:104

Tac dong: tat automation tren admin van co the tiep tuc gui reminder booking. Day la loi hanh vi runtime.

De xuat fix: runScheduledBookingAutomation() phai return/null va cap nhat message khi setting.enabled === false. runNow() co the van cho chay thu cong, nhung UI can noi ro day la manual override.

P0 - Point transfer backend chua verify OTP that​

Mobile van khoa transfer bang alert "coming soon":

  • mobileApp/features/membership/screens/PointScreen.tsx:19

Nhung backend co confirm flow va chi check otpCode la text bat buoc, sau do set otpCodeSupplied: true:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-point-transfer.service.ts:191
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-point-transfer.service.ts:196
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-point-transfer.service.ts:239
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-point-transfer.service.ts:243

Tac dong: neu mutation shop API reach duoc tu client, user co the confirm transfer voi bat ky ma OTP khong rong.

De xuat fix: giu mobile UI disabled, va o backend can tich hop LotusEmailOtpService/SMS OTP rieng cho point transfer truoc khi expose. Nen them idempotency + rate limit + fail count rieng cho transfer.

P1 - QR member/voucher khong phai QR/barcode tieu chuan​

Voucher da lay signed payload tu backend:

  • mobileApp/features/offers/screens/QRVoucherScreen.tsx:19

Nhung UI lai ve barcode/QR bang width va qrOn() tu seed:

  • mobileApp/features/offers/screens/QRVoucherScreen.tsx:37
  • mobileApp/features/offers/screens/QRVoucherScreen.tsx:42
  • mobileApp/features/offers/screens/QRVoucherScreen.tsx:67

Member QR cung tu sinh seed local member:${id}:${rank} va pattern 11x11:

  • mobileApp/features/membership/screens/MemberQrScreen.tsx:15
  • mobileApp/features/membership/screens/MemberQrScreen.tsx:31
  • mobileApp/features/membership/screens/MemberQrScreen.tsx:47

Tac dong: scanner POS/admin khong doc duoc nhu QR/barcode tieu chuan; member QR cung khong co signature backend.

De xuat fix: dung thu vien QR tieu chuan cho payload signed, vi du react-native-qrcode-svg. Them endpoint signed member QR tu backend, tach TTL/secret ro rang.

P1 - Notification ARTICLE dang route sai man hinh​

Mobile da co article route rieng /article/[slug], nhung notification ARTICLE va EVENT deu day sang offer detail:

  • mobileApp/features/notifications/navigation.ts:61
  • mobileApp/features/notifications/navigation.ts:62

Tac dong: bam notification bai viet co the mo sai route hoac loi detail neu id/slug khong ton tai ben offer.

De xuat fix: ARTICLE -> /article/[slug]; EVENT nen co route/event detail ro, hoac quy uoc target la offer event va validate trong backend/admin.

P1 - BigFan/discount tren mobile chua co data contract that​

Tab rank hien label "Big Fan":

  • mobileApp/app/(tabs)/_layout.tsx:140

Home tao bigFanItems tu dashboard.discounts, trong khi live homeApi.getDashboard() van spread mockHomeDashboard, nen discount mock co the lot vao live UI neu backend khong overwrite field:

  • mobileApp/features/home/api.ts:227
  • mobileApp/features/home/mocks.ts:47
  • mobileApp/features/home/screens/HomeScreen.tsx:139
  • mobileApp/features/home/screens/HomeScreen.tsx:177

Tac dong: phan BigFan de hien noi dung fake/cu, khong phan anh membership/social/community that.

De xuat fix: quyet dinh BigFan la gi: membership rank, community event, campaign, hay Facebook CTA. Sau do tao field API rieng, khong reuse mock discount.

Findings backend/security​

P1 - QR secret fallback qua rong​

Backend QR secret fallback ve COOKIE_SECRET, roi ve dev secret:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-mobile-shop.service.ts:1402

Tac dong: moi truong production co the ky QR bang cookie secret neu quen LOTUS_QR_SECRET; dev secret fallback nguy hiem neu deploy sai env.

De xuat fix: production bat buoc co LOTUS_QR_SECRET, va khong fallback sang cookie secret trong production.

P1 - .env.example co gia tri secret trong giong secret that​

File mau dang co SUPERADMIN_PASSWORD=superadmin, COOKIE_SECRET=..., LOTUS_QR_SECRET=...:

  • goldenlotus-backend/docker/.env.example:80
  • goldenlotus-backend/docker/.env.example:81
  • goldenlotus-backend/docker/.env.example:84
  • goldenlotus-backend/docker/.env.example:87

Tac dong: nguoi deploy co the copy thang file mau len production va quen rotate.

De xuat fix: doi tat ca secret/password thanh __CHANGE_ME_*, backend boot production nen fail neu password/secret nam trong denylist gia tri mau.

P2 - OTP env naming dung chung cho login/reset/register​

LotusEmailOtpService dung LOTUS_REGISTER_OTP_TTL_SECONDS, LOTUS_REGISTER_OTP_RESEND_COOLDOWN_SECONDS, LOTUS_REGISTER_OTP_MAX_ATTEMPTS cho ca login/reset:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-email-otp.service.ts:760
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-email-otp.service.ts:764
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-email-otp.service.ts:768

Tac dong: van chay, nhung cau hinh production de hieu sai.

De xuat fix: them env chung LOTUS_OTP_*, giu env cu lam fallback de backward compatible.

P2 - Staff/room resource chua channel-scoped​

Booking da filter theo channel, nhung staff/room co comment de lai can siet:

  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-booking.service.ts:148
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-booking.service.ts:152
  • goldenlotus-backend/docker/vendure_backend/apps/server/src/plugins/golden-lotus/services/lotus-booking.service.ts:163

Tac dong: neu multi-channel/multi-tenant that, resource co the bi dung chung ngoai y muon.

De xuat fix: them ownership/channel/branch constraint cho staff/room/resource query.

Findings admin dashboard​

P1 - Dashboard full typecheck dang fail ngoai module Golden Lotus​

tsconfig.vite.json pass, nhung tsconfig.check.json fail voi nhieu loi TS2322 Control<...> is not assignable to Control<any> trong cac route dashboard core nhu administrators, assets, channels, tax rates, zones, customer address form.

Tac dong: CI neu dung full check se fail; neu khong dung full check thi dang co vung type debt lon.

De xuat fix: tach target CI ro rang:

  • tsconfig.vite.json cho build dashboard hien tai.
  • Mot job rieng fix dan Control generic compatibility trong dashboard core.

P1 - GraphQL wrapper Golden Lotus qua rong type​

Admin Golden Lotus dang cast GraphQL document thanh TypedDocumentNode<LotusGraphqlResult, object> voi Record<string, any>:

  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/lotus-graphql.ts:4
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/lotus-graphql.ts:40
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/lotus-graphql.ts:69

Tac dong: schema drift giua backend/admin rat de lot qua compile.

De xuat fix: generate types cho Golden Lotus operations hoac it nhat tach type theo tung query/mutation quan trong: booking, provider config, CMS, voucher, notification.

P2 - Provider settings generic chi tao moi va toggle enabled​

Booking policy da co UI typed tot:

  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-provider-settings.tsx:158
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-provider-settings.tsx:209

Nhung config provider khac chi tao voi JSON placeholder va list hien tai chi toggle enabled:

  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-provider-settings.tsx:310
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-provider-settings.tsx:343

Tac dong: muon sua API key SMS/Zalo/email/QR payment sau khi tao phai dung API/DB hoac tao config moi.

De xuat fix: them edit modal JSON co validate cho tung provider type, hoac typed forms cho ESMS/email/QR/payment.

P2 - Nhieu list page lay fixed take: 100/300/500 va loc client-side​

Vi du CMS lay 100 record moi loai:

  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-mobile-cms.tsx:53
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-mobile-cms.tsx:77
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-mobile-cms.tsx:100

Booking calendar/list cung co gioi han va loc client-side:

  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-booking-calendar.tsx:63
  • goldenlotus-backend/packages/dashboard/src/app/golden-lotus/routes/lotus-bookings.tsx:496

Tac dong: du lieu lon se mat record, filter/sort khong chinh xac toan cuc.

De xuat fix: them pagination + server filters cho booking, CMS, voucher redemption, notification inbox.

Findings mobile architecture/UX​

P2 - Mock va legacy service van con nam trong luong live​

Mobile co module API moi theo feature, nhung api/services.ts van la legacy service lon, gom mock/fallback/auth/booking. env.useMock mac dinh true neu thieu env:

  • mobileApp/core/config/env.ts:13
  • mobileApp/api/services.ts:159

Home live van spread mockHomeDashboard:

  • mobileApp/features/home/api.ts:227

Tac dong: production build phu thuoc env dung; thieu env co the vo tinh chay mock. Live UI co nguy co hien noi dung mock.

De xuat fix: trong APP_ENV=production, fail-fast neu EXPO_PUBLIC_USE_MOCK=true hoac missing explicit env. Tach auth/session ra khoi api/services.ts, xoa REST fallback khong dung.

P2 - Location personalization la heuristic frontend​

Home xin location va map region theo toa do, sau do match branch theo text ten/city. Cach nay dung duoc demo nhung mong manh neu backend doi ten chi nhanh.

De xuat fix: backend tra ve branch geo/region code, mobile match bang field co cau truc.

P2 - Push notification can production observability​

Push registration bo qua web/mock, dung Expo token va projectId tu env/EAS:

  • mobileApp/features/notifications/useRegisterPushDevice.ts:42
  • mobileApp/features/notifications/useRegisterPushDevice.ts:66
  • mobileApp/features/notifications/useRegisterPushDevice.ts:119

Hien loi chi log trong dev. Production can sentry/logging hoac admin device health de debug token/project id issue.

Trang thai module​

ModuleTrang thaiGhi chu
Auth/PIN/OTPKha day duBackend co email/SMS OTP, mobile da wire login/register/reset; can harden env naming va production provider
BookingChuc nang loi totCan fix booking policy contract + automation enabled
Membership/pointsRead flow totPoint transfer phai giu khoa den khi OTP verify that
VoucherData/API kha day duQR render can doi sang QR tieu chuan
CMS/articles/eventsKha totAdmin can pagination; notification article route sai
NotificationsKha day duCan deep link fix va prod observability
Social/BigFanChua ro san phamSocial API co skeleton/feed/post, BigFan UI chua co data contract
Provider settingsTot hon audit cuBooking policy typed; provider khac can edit forms
Admin typingBuild target passFull typecheck fail, GraphQL type wrapper qua rong
Security/envCo safeguard backend.env.example va QR secret fallback can harden

Roadmap de chot production​

Trong 1 ngay​

  1. Fix mobile booking policy query/map top-level bookingPolicy.
  2. Fix scheduled automation respect setting.enabled.
  3. Doi notification ARTICLE sang /article/[slug].
  4. Khoa/chan backend point transfer confirm neu chua co OTP verifier that.
  5. Doi .env.example secret thanh __CHANGE_ME_*.

Trong 2-3 ngay​

  1. Doi voucher/member QR sang QR tieu chuan, them signed member QR payload.
  2. Bo mock leakage trong live home dashboard, tach BigFan data contract.
  3. Them typed provider edit forms cho ESMS/email/QR/payment.
  4. Them pagination/server filters cho booking/CMS/voucher redemption.
  5. Them regression tests cho booking policy, automation enabled, point transfer OTP.

Truoc khi release rong​

  1. Chot strategy full dashboard typecheck hoac tach CI target.
  2. Generate/admin GraphQL types cho Golden Lotus operations.
  3. Multi-channel resource scoping cho staff/room neu van hanh nhieu channel.
  4. Production observability cho push, OTP, QR redemption, automation job.

Ghi chu worktree​

Truoc khi audit, mobileApp dang clean. goldenlotus-backend dang co nhieu thay doi san co, gom source Golden Lotus, .env.example, service ESMS moi, va nhieu hashed dashboard build assets trong html/assets. Audit nay khong revert hay sua cac thay doi do.