Session Handoff — Virtual Restyle Fable-Mode money-path audit (findings only, no fixes shipped)

Where it started

After /prime, Sondra asked for a full Fable-mode money-path audit of Virtual Restyle (live app, virtualrestyle.com, Stripe LIVE), same standard as today's BookifAI / Pain-2-Profit / CEO Dashboard audits. Framing: read-only audit — find the holes, report ranked, STOP for her go before touching the live money app. All verdicts verified against the LIVE Supabase DB (uyloerfniphfxjvnuwmn), not just the repo.

Decisions locked + what shipped

• NOTHING was changed — audit only. No code edited, no migration applied, no fixes shipped. Awaiting her go.
• Live project confirmed: Supabase ref uyloerfniphfxjvnuwmn (org foeliowlfikzqfwyxcst, "digitalbeachgirl's Projects" — her paid org). App code at PROJECTS/Virtual Restyle/app/.

Findings (ranked, most severe first — all verified live)

1. CRITICAL — account takeover via email queue. Three SECURITY DEFINER pgmq-wrapper functions are executable by authenticated (should be service_role only): read_email_batch, enqueue_email, delete_email. The auth_emails queue holds fully-rendered auth emails whose HTML contains the real magic-link / password-reset / signup confirmationUrl with token (see supabase/functions/auth-email-hook/index.ts:246-261). Exploit: any signed-in user runs supabase.rpc('read_email_batch',{queue_name:'auth_emails',batch_size:100,vt:0}) → reads other users' login/reset links → takes over accounts. enqueue_email = send phishing from her verified domain on her Resend bill; delete_email = suppress others' auth emails. Verified: queues auth_emails/transactional_emails exist; all 3 fns has_function_privilege('authenticated', ..., 'EXECUTE') = true.
2. HIGH — free Pro plan. update_user_plan(p_user_id, p_plan, ...) is SECURITY DEFINER, executable by authenticated, and has NO auth.uid() guard (live body: bare UPDATE public.usage SET plan=p_plan WHERE user_id=p_user_id). Exploit: supabase.rpc('update_user_plan',{p_user_id:MY_UID,p_plan:'pro'}) → spend_generation then grants 50 clean stagings/mo (source:'pro', watermark:false), renewing. Sibling toggle_tester_mode IS correctly guarded (good model).
3. MEDIUM — no refund/chargeback clawback. stripe-webhook/index.ts:47 only handles checkout.session.completed; no charge.refunded / charge.dispute.created handler → buyer refunds a credit pack and keeps the credits. (Same hole BookifAI + P2P closed today with a clawback RPC.)
4. MEDIUM — client-side watermark (client-side paywall class). stage-room returns the full CLEAN image + a boolean isWatermarked; watermark burned in-browser at src/components/DownloadWithPresets.tsx:170 (burnComplianceWatermark). Free user reads clean image off the network response / flips the flag → clean unmarked stagings (bounded ~3/mo per free signup) + defeats the MLS "virtually staged" legal marker.
5. LOW — no per-account daily rate cap on stage-room/edit-room (auth-gated + server-side credit spend are fine, but no daily cap; structure-check refund path at stage-room/index.ts:298 is a theoretical refund-abuse loop — harder to force than P2P's).

Verified SAFE (checks confirmed working, live)

• Stripe webhook signature-verified + idempotent (grant_credits keyed on session id, ON CONFLICT DO NOTHING).
• Prices server-side (_shared/billing.ts; client sends only pack10/pack40/pro) — no amount tampering.
• RLS locked live: credits/credit_grants read-own-only no client write; usage has No-direct-insert/update/delete with WITH CHECK (false) + tester-mode trigger guard.
• grant_credits + refund_generation are service_role-only (lockdown migration applied — verified live).
• Storage stagings bucket private; CORS pinned to domain (_shared/cors.ts); admin server-gated to srverva@gmail.com.

The fix (proposed, NOT applied)

• CRITICAL + HIGH share one fix class: a migration doing REVOKE EXECUTE ... FROM PUBLIC, anon, authenticated; GRANT ... TO service_role on 4 functions: update_user_plan, read_email_batch, enqueue_email, delete_email. Safe — every real caller (stripe-webhook, check-subscription, auth-email-hook, process-email-queue) uses the service-role key. Re-verify with has_function_privilege after.
• MEDIUM refund-clawback + server-side watermark = larger, model the BookifAI/P2P clawback RPC + move watermark burn into stage-room server-side.

Key files for next session

• PROJECTS/Virtual Restyle/app/supabase/functions/auth-email-hook/index.ts — CRITICAL: what gets enqueued into auth_emails (magic-link URLs).
• PROJECTS/Virtual Restyle/app/supabase/migrations/20260704120000_credits_and_compliance.sql + 20260704150000_lock_down_rpcs_and_storage.sql — the credit RPCs + existing revokes (the pattern to copy).
• PROJECTS/Virtual Restyle/app/supabase/functions/stripe-webhook/index.ts — where the refund handler would go.
• PROJECTS/Virtual Restyle/app/src/components/DownloadWithPresets.tsx — client-side watermark burn.
• Checklist: reference/fable-mode-money-path-audit.md — the audit standard; log new patterns here when fixes ship.
• Memory files touched: none.

Running state

• Background processes: none
• Dev servers / ports: none
• Open worktrees / branches: none

Verification — how to confirm findings still hold

• mcp__supabase__execute_sql on uyloerfniphfxjvnuwmn: select proname, has_function_privilege('authenticated', p.oid,'EXECUTE') from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname='public' and proname in ('update_user_plan','read_email_batch','enqueue_email','delete_email'); → all should still be true (the holes) until fixed; after fix, all false.
• select queue_name from pgmq.list_queues(); → confirms auth_emails / transactional_emails exist.

Deferred + open questions

• Open: Sondra's go on which fix to ship. Offered: (a) the 4-function revoke (CRITICAL+HIGH, smallest/safest/highest-value), (b) refund-clawback + server-side watermark, (c) save an HTML report + dashboard card first. No answer yet — she called the handoff.
• Deferred: nothing logged to reference/fable-mode-money-path-audit.md Findings Log yet (that doc logs SHIPPED fixes; the new class — "over-granted SECURITY DEFINER infra RPCs leaking auth tokens" — should be added when the revoke ships).
• Deferred: open-questions.md / dashboard NOT updated with this audit (audit-only session; update when a fix ships).

Pick up here

Get Sondra's go, then apply the 4-function REVOKE ... FROM authenticated; GRANT ... TO service_role migration to uyloerfniphfxjvnuwmn (closes the CRITICAL email-queue account-takeover + HIGH free-Pro bypass in one shot), re-verify has_function_privilege = false live, then log it in reference/fable-mode-money-path-audit.md.