# DeepAIBots Central Hub - Security & Access Document

## 1. Authentication
- **Provider:** Firebase Authentication is utilized to manage user identities securely.
- **Methods:** Supports Email/Password authentication.
- **Token Management:** Client-side uses Firebase JWTs, validated securely on the backend before executing privileged actions.

## 2. Role-Based Access Control (RBAC)
The application defines three primary scopes of visibility:
1. **Public/Unauthenticated:** Can only view the public storefront and login forms.
2. **Authenticated Client (Enterprise Dashboard):** Can view telemetry, their subscription tier (e.g., 24-Hour Pass, 30-Day Elite, Lifetime VIP), and access core bot functions.
3. **Global Administrator (Admin Control Panel):** Exclusive access granted via specific Firebase UIDs or custom claims. This panel allows manual provisioning, telemetry oversight, and environment routing toggles.

## 3. Webhook Security
- All incoming webhooks (e.g., in `webhook.js`) must be validated using cryptographic signatures provided by the payment gateway (NOWPayments/Stripe).
- Webhook endpoints are immune to replay attacks by tracking processed transaction IDs.

## 4. API Endpoint Hardening
- Serverless functions (e.g., `phantom-provision.js`) strictly verify the `Authorization` header. If the requesting user lacks Admin privileges, the request is instantly rejected with a `403 Forbidden`.
- Rate limiting is enforced at the API Gateway level to prevent DDoS and brute-force attacks on `validate-reset.js`.