# Development Security Credentials
**Generated:** 2025-10-09 18:40:00
**Environment:** Development Only - DO NOT USE IN PRODUCTION

---

## 🔐 Entry Scanner Device Token

**Purpose:** Authenticates entry staff scanners for ticket validation

**Device Details:**
- Device Name: `Dev Main Entrance Scanner`
- Scanner ID: `SCANNER-DEV-001`
- Type: `entry_scanner`
- Status: Active
- Allowed IPs: `127.0.0.1`, `::1`, `192.168.0.0/16`
- Allowed Events: All

**Token:**
```
68937dbcbabdb4b868a43d1b6817ae31dce9cd00b250f8323920e1afffae6037
```

**Usage in API Requests:**
```bash
curl -X POST http://localhost:8000/api/tickets/1/validate \
  -H "Content-Type: application/json" \
  -H "X-Device-Token: 68937dbcbabdb4b868a43d1b6817ae31dce9cd00b250f8323920e1afffae6037" \
  -H "X-Scanner-Id: SCANNER-DEV-001" \
  -d '{"validate_and_mark": false}'
```

**Frontend Environment Variable:**
```env
DEVICE_TOKEN=68937dbcbabdb4b868a43d1b6817ae31dce9cd00b250f8323920e1afffae6037
SCANNER_ID=SCANNER-DEV-001
```

---

## 🚒 Fire Marshal Access Token

**Purpose:** Provides time-limited access to fire marshal safety reports

**Authorized Details:**
- Name: `Inspector John Doe`
- Agency: `City Fire Department - Development`
- Email: `inspector@firesafety.local`
- Phone: `+1-555-0100`
- Status: Active
- Expires: `2025-11-08 18:39:51` (30 days)
- Max Uses: Unlimited

**Token:**
```
f4ab64c5ad8a739e340f48e5b37cf83a8f6c8b1bd732f7bcb48ec2a70c091bef
```

**Usage in API Requests:**
```bash
# As query parameter
curl http://localhost:8000/api/events/1/fire-marshal-report?token=f4ab64c5ad8a739e340f48e5b37cf83a8f6c8b1bd732f7bcb48ec2a70c091bef

# Or as header
curl http://localhost:8000/api/events/1/fire-marshal-report \
  -H "X-Fire-Marshal-Token: f4ab64c5ad8a739e340f48e5b37cf83a8f6c8b1bd732f7bcb48ec2a70c091bef"
```

---

## 👔 Manager Override Credentials

**Purpose:** Allows managers to override ticket validation failures

**Manager Account:**
- User ID: `1`
- Email: `charlie@09-07.xyz`
- Password: *(use existing password)*
- PIN: `1234`
- User Group: `9` (Manager)
- Status: Active

**Usage in Manager Override:**
```bash
curl -X POST http://localhost:8000/api/tickets/1/override \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ADMIN_JWT_TOKEN" \
  -d '{
    "manager_id": 1,
    "pin": "1234",
    "reason": "customer_service",
    "notes": "Testing manager override functionality in development"
  }'
```

**Frontend Usage:**
```typescript
const response = await fetch(`${API_URL}/tickets/${ticketId}/override`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${adminToken}`,
  },
  body: JSON.stringify({
    manager_id: 1,
    pin: '1234',
    reason: 'customer_service',
    notes: 'Customer verified identity via alternate method',
  }),
});
```

---

## 🧪 Testing the Security Features

### 1. Test Ticket Validation (Entry Scanner)
```bash
# Valid ticket validation
curl -X POST http://localhost:8000/api/tickets/1/validate \
  -H "Content-Type: application/json" \
  -H "X-Device-Token: 68937dbcbabdb4b868a43d1b6817ae31dce9cd00b250f8323920e1afffae6037" \
  -H "X-Scanner-Id: SCANNER-DEV-001" \
  -d '{
    "validate_and_mark": false,
    "scanner_location": "Main Entrance"
  }'

# Should return: 200 OK with ticket details
```

### 2. Test Without Authentication (Should Fail)
```bash
# Missing device token
curl -X POST http://localhost:8000/api/tickets/1/validate \
  -H "Content-Type: application/json" \
  -d '{"validate_and_mark": false}'

# Should return: 401 Unauthorized
```

### 3. Test Fire Marshal Report
```bash
# Access fire marshal report
curl http://localhost:8000/api/events/1/fire-marshal-report?token=f4ab64c5ad8a739e340f48e5b37cf83a8f6c8b1bd732f7bcb48ec2a70c091bef

# Should return: 200 OK with PDF or report data
```

### 4. Test Manager Override
```bash
# First, get admin JWT token (use your login endpoint)
# Then use override endpoint

curl -X POST http://localhost:8000/api/tickets/1/override \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d '{
    "manager_id": 1,
    "pin": "1234",
    "reason": "technical_issue",
    "notes": "Scanner malfunction verified - allowing manual entry"
  }'

# Should return: 200 OK with override confirmation
```

### 5. Test Rate Limiting
```bash
# Rapid requests to search endpoint
for i in {1..100}; do
  curl http://localhost:8000/api/seats/search?q=A&event_id=1
done

# Should return: 429 Too Many Requests after ~60 requests
```

---

## 📝 Important Notes

### Security Warnings:
- ⚠️ **DEVELOPMENT ONLY** - These credentials are for testing purposes only
- ⚠️ **DO NOT COMMIT** - This file is in `.gitignore` and should never be committed
- ⚠️ **REGENERATE FOR PRODUCTION** - Generate new tokens before production deployment
- ⚠️ **ROTATE REGULARLY** - Even in development, regenerate tokens periodically

### Credential Management:
- Store tokens in environment variables, never hardcode
- Use different tokens for each environment (dev, staging, production)
- Implement token rotation policies in production
- Monitor token usage via audit logs

### Database Access:
All tokens are stored hashed in the database:
- `device_tokens` table - Entry scanner tokens (SHA256)
- `fire_marshal_tokens` table - Fire marshal tokens (SHA256)
- `users.pin` column - Manager PINs (bcrypt)

### Regenerating Tokens:
```bash
# Deactivate old token
php artisan tinker
>>> DB::table('device_tokens')->where('scanner_id', 'SCANNER-DEV-001')->update(['is_active' => false]);

# Generate new token (see SECURITY_IMPLEMENTATION_GUIDE.md)
```

---

## 🔗 Related Documentation

- `SECURITY_AUDIT_REPORT.md` - Complete vulnerability assessment
- `SECURITY_IMPLEMENTATION_GUIDE.md` - Full implementation guide
- `SECURITY_FIXES_SUMMARY.md` - Executive summary

---

**Generated by:** Claude Code Security Setup
**Date:** 2025-10-09
**Valid Until:** Tokens expire per configuration (Fire Marshal: 30 days, Device: No expiry)