Remote Domain API Audit - 2026-05-16

Target: https://web-golden.azns.vn/

Scope: read-only audit of live dashboard, shop-api, admin-api, and public feature data against Phu luc 01. PSA 06.04.26 App membership.txt. No live mutation was executed.

Summary

Live domain is up and the main GraphQL surfaces are reachable.

• /health returns 200.
• /dashboard/ returns 200 and SPA routes such as /dashboard/golden-lotus/bookings return 200.
• /shop-api exposes the expected mobile feature schema.
• /admin-api exposes the expected Golden Lotus admin schema.
• Personal mobile queries and admin business queries are protected when unauthenticated.

Important production gaps remain:

• Payment gateway / QR payment is not configured: activePaymentMethods returns an empty list.
• Live auth config supports password and email OTP only; social login is disabled and SMS/security OTP is not enabled.
• Public voucher packages include QA/smoke records.
• Active lucky wheel exists, but all prize weights are 0, which is unsafe for a real spin flow.
• Push notification schema is present, including admin test push, but end-to-end delivery still needs a real admin session and valid Expo device token.

Hotfix Deployment Status

Area	Live Result	Status
lotusMobileBootstrap.bookingPolicy top-level	Present with max advance days, max party size, late cancel and reminder settings	OK
features.pointTransfer	false	OK
sendLotusDeviceTestNotification	Present in admin-api mutation schema	OK, needs live token test
Admin automation API	lotusAutomationSettings, updateLotusAutomationSetting, runLotusAutomationNow present	OK schema, auth required
Shop personal notification API	lotusMyNotifications, unread count and mark-read mutations present	OK schema, auth required
Admin customer/device data unauthenticated	Returns FORBIDDEN	OK

Feature Coverage

Feature Group	Live Evidence	Status
Registration/login/forgot password	Vendure auth plus Lotus OTP mutations exist. lotusMobileAuthConfig reports password + OTP enabled.	Partial
Google/Apple/SMS OTP	supportsSocialLogin=false, supportsSecurityOtp=false, methods only password/email OTP.	Gap
Profile update/social contact fields	updateLotusMyProfile and profile queries exist, protected.	Schema OK
Branch list/detail	lotusPublicBranches returns 3 enabled branches.	OK
Promotion/banner/home content	lotusMobileHome returns 3 banners, 3 articles, 2 events.	OK
Service list	lotusSpaServices returns 30 services with prices, duration, category and assets.	OK
Booking	lotusBookingFormOptions returns branches/services/resources; availability returns valid slots for 2026-05-17.	OK
Membership/points/vouchers	Membership/points/voucher APIs exist; public voucher packages return 6 records.	Partial
Voucher production data	Public list contains QA/smoke voucher records.	Gap
Payment gateway / QR payment	activePaymentMethods returns [].	Gap
Notifications/push	Device registration, notification inbox, campaign/provider/admin test push APIs exist.	Needs live send test
SMS/Email/Zalo/Viber/Whatsapp/Kakao providers	Provider config APIs exist but are admin-protected; no provider delivery tested.	Needs admin test
App settings/preferences	Bootstrap and app preferences APIs exist.	OK schema
Lucky wheel	Active wheel exists and is enabled. All prize weights are 0; voucher prizes are not linked to voucher definitions.	Gap
Admin dashboard/modules	Dashboard route and Golden Lotus admin APIs exist for customers, bookings, membership, vouchers, campaigns, providers, automation, content, notifications.	Schema OK

Data Observations

Branches:

• 3 enabled branches are public.

Home:

• 3 banners.
• 3 articles.
• 2 open events.

Services:

• 30 spa services.
• Sample services have VND prices, duration, category, and assets.

Vouchers:

• 6 enabled public voucher packages.
• QA/smoke names are visible publicly, including QA Voucher... and Smoke Voucher.

Lucky wheel:

• Active wheel: DEMO_WELLNESS_WHEEL.
• Prize weights: all 0.
• Voucher prize has no linked voucher definition in the public response.

Booking:

• Branch 5, service 27, date 2026-05-17 returned available 60-minute slots.
• Form options returned 3 branches, 30 services, and enabled resources.

Auth:

• sessionMode=vendure-shop-session.
• Methods: password and email OTP.
• Social login disabled.

Security / Exposure Checks

• Unauthenticated lotusMyProfile returns FORBIDDEN.
• Unauthenticated lotusMyNotifications returns FORBIDDEN.
• Unauthenticated admin customers, lotusCustomerDevices, dashboardMetricSummary, lotusAutomationSettings, and lotusProviderConfigs return FORBIDDEN.
• CORS preflight with arbitrary Origin: https://evil.example did not echo Access-Control-Allow-Origin.
• GraphQL introspection is enabled on both shop-api and admin-api. This is useful for QA, but consider disabling or restricting admin introspection on production.

Priority Fix List

1. Clean production data: remove or disable public QA/smoke voucher packages.
2. Fix lucky wheel data before public rollout: set positive prize weights and link voucher prizes to real voucher definitions.
3. Configure payment methods for gateway/QR payment or hide payment UI until enabled.
4. Decide auth contract: if the feature list still requires Google/Apple/SMS OTP, configure providers and update lotusMobileAuthConfig; otherwise revise the feature list/app copy.
5. Run a real push notification test with an authenticated admin session and a valid Expo push token.
6. Verify automation rows in admin: ensure disabled automations do not run scheduled reminders on live worker.
7. Consider restricting admin-api introspection in production.