security_spec.md

Security Specification for ExamForge

1. Data Invariants

• A student profile cannot have the 'teacher' role without admin approval (if admin existed).
• An Exam can only be published/edited by its creator (teacherId).
• A Student can only see results of their own attempts.
• An Attempt must reference a valid Exam ID.
• Scores cannot be modified after submission.

2. The Dirty Dozen Payloads

1. Identity Spoofing: Attempt to create a student profile with role: 'teacher'.
2. Identity Spoofing: Attempt to read another student's profile settings.
3. Privilege Escalation: Attempt to update an exam created by another teacher.
4. Data Poisoning: Attempt to inject 1MB string into examId.
5. State Shortcut: Attempt to update an Attempt's status from 'completed' back to 'started'.
6. Integrity Violation: Attempt to update an Attempt's score directly from the client after completion.
7. Bypassing Invariants: Attempt to create an Attempt with a non-existent Exam ID.
8. Shadow Field: Attempt to update an Exam with a hidden verified: true field.
9. Query Scraping: Attempt to list all Exam records without a specific filter.
10. Resource Exhaustion: Attempt to create a document ID with 1000 characters.
11. PII Leak: Attempt to read user pin without ownership.
12. Time Spoofing: Attempt to set createdAt to a future date instead of server time.

3. Test Runner (Draft)

The test runner will ensure these payloads return PERMISSION_DENIED.