PR #31 — Kuan Commercial Integrity Hardening

[NomosLudens]

Description

This pull request implements the technical hardening specifications of PR #31 — Kuan Commercial Integrity Hardening on top of the main branch. All security boundaries, temporal operations, and resource isolation protocols have been secured and verified natively with 100% testing coverage.

Key Implementations:

1. Platform Admin Boundaries & Security (src/lib/admin-security.ts):

   • Implemented requirePlatformAdmin and safe redirection validation using process.env.KUAN_PUBLIC_APP_URL.
   • Bound invite creation and Guardian status modifications to the verified Administrator check.

2. Timezones & Calendar Temporal Alignment (src/lib/kuan/calendar.ts):

   • Created a pure, native timezone processing engine with JS offsets (supporting configured timezones or defaulting to America/Sao_Paulo).
   • Integrated a timezone select configuration field inside kuan.config.tsx.
   • Structured exact temporal intervals and conflict detection scoped strictly to confirmed slots within a business_context_id.
   • Refactored .ics calendar export using dynamic offsets, and strictly escaping newline/comma delimiters to conform with CALSCALE:GREGORIAN.

3. Multi-Tenant Resource Ownership Isolation:

   • Injected strict permission filters (assertOwnedClient, assertOwnedAppointment, assertOwnedOrder) across critical endpoints to block potential cross-guardian information leaks.

4. Concurrent State Machine Transition Rules:

   • Protected order and payment transition pathways by locking the query payload state filters (.eq(\"status\", previousStatus)) inside src/lib/kuanyin.functions.ts.

5. Opt-In Client Privacy Consent Layer:

   • Implemented a premium privacy consent checkbox for visitors on g.$guardianId.tsx (opt-out by default).
   • Saved visitor details to localStorage ONLY on positive opt-in.
   • Designed a secure temporary sessionStorage fallback (avoiding persistent device markers while preventing immediate active chat erasure on page reload).
   • Provided an interactive "Limpar dados salvos" button which purges state storage and resets the visitor key utilizing crypto.randomUUID().

6. Binary-Safe Server Architecture (serve.mjs):

   • Upgraded production server request/response routing pipelines to parse bodies natively as Direct Buffers, and stream files utilizing .arrayBuffer(). This guarantees UTF-8 integrity and blocks calendar/attachment binary payload corruption.

7. Validation & Quality Assurance:

   • Authored extensive unit tests for calendar structures, state rules, isolation blocks, and privacy features. All 235 tests pass successfully.
   • Created KUAN_CALENDAR_PRIVACY_RUNTIME_CHECKLIST.md under the QA directory.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	kuan	6308927	Jul 11 2026, 11:01 PM