Harden email-link (uid hashid) access in the member order flow

[kylefritz]

Priority: low — hardening, not an active incident. Found during the 2026-06-11 operational-flow audit (F3).

The member-facing flow (OrdersController, CreditItemsController, EmailPreferencesController, MenusController via UserHashidable) authenticates by a ?uid= hashid that identifies the user and skips authenticate_user!. These links are emailed to members. The security of every per-user action therefore rests on the hashid being unguessable, which depends on HASHID_SALT.

Hardening steps:

• Confirm HASHID_SALT is set to a strong, random secret on Heroku (and is not committed). If unset, hashids fall back to a predictable default.
• Enable config.sign_hashids in config/initializers/hashid.rb.
• Longer term: treat email-link access as a scoped, expiring, single-purpose token (e.g. signed GlobalID / message_verifier) rather than a permanent token that authorizes orders, credit purchases, and preference changes all at once. Consider requiring a real session for credit purchases and order edits.

Context: the token is currently unscoped (one uid authorizes order read/write + email prefs + credit purchase) and never expires.

[kylefritz]

Triage 2026-06-11 — checked the first box's premise: HASHID_SALT is set on Heroku, but the value appears low-entropy (it begins with the app's name rather than looking like random output). Since hashids are obfuscation rather than cryptography, a guessable salt meaningfully weakens the only thing protecting these links.

Two cautions for whoever picks this up:

• Rotating the salt invalidates every previously emailed ?uid= link (and any bookmarked ones). Same for enabling config.sign_hashids — it changes the encoding. Both need a transition plan (e.g. accept old-format hashids read-only for a grace period, or time the cutover right after a weekly menu email so fresh links go out immediately).
• The long-term direction (scoped, expiring signed tokens via message_verifier) makes the salt question moot for new links and is where the real win is.