APPROVED — PROCEED WITH THE AUDIT AND FIX PLAN, WITH THESE IMPORTANT CONDITIONS.

Proceed with the fixes described in your analysis.

1. PRODUCT DELETION POLICY

Keep the current safe database behavior for products that are already referenced by orders/deliveries.

If a product is linked to existing orders or delivery records:

• DO NOT forcibly delete it.

• Keep the database referential integrity intact.

• Archive the product instead.

• The admin UI MUST clearly say that the product was archived because it is associated with existing orders.

• Do NOT show a false “Product deleted successfully” message.

• Archived products should NOT appear in the normal/default product list.

• There should still be an explicit way for an authorized admin to view archived products if the existing admin system supports this.

For products that have no dependent records:

• Perform a REAL database deletion.

• Remove the product from the database.

• Make sure it disappears after refresh.

• Make sure it no longer appears in search/filter results.

• Make sure its public product URL no longer resolves to the deleted product.

Do NOT change foreign-key behavior to SetNull just to force deletion.

Do NOT damage historical order or delivery records.

2. SECURITY SECRETS

For CRON_SECRET and TELEGRAM_WEBHOOK_SECRET:

• Make the server REQUIRE these secrets in production.

• If the required secret is missing, the protected endpoint must fail safely instead of becoming publicly accessible.

• Do NOT print actual secret values anywhere.

• Do NOT expose them to client-side code.

• Do NOT commit real secrets to the repository.

• Add/update the appropriate environment variable documentation/example if needed.

• If local development requires placeholder values, clearly mark them as placeholders and never treat them as production secrets.

The important security requirement is:

A missing secret must NEVER disable authentication for a sensitive endpoint.

3. SVG SECURITY

Apply the proposed SVG protection.

However, make sure the solution does not break legitimate image functionality.

Verify that uploaded SVG files cannot execute arbitrary JavaScript when served from the application origin.

Use safe response headers and/or a safer serving strategy as appropriate.

4. JSON-LD

Apply the proposed JSON-LD escaping fix.

Ensure user/admin-controlled product data cannot break out of the JSON-LD script context.

5. REQUESTED UI REMOVALS

Proceed with exactly these requested removals:

Homepage/header navigation

Remove ONLY the Categories navigation entry from the header navigation:

• Desktop

• Mobile

Do NOT delete:

• /categories

• Category database model

• Category management

• Category filtering

• Product category relationships

• Product category tiles

Also leave the footer Categories link untouched.

Admin NavApp management

Remove the Admin Panel UI used to manage NavApps:

• Remove the NavApp management page.

• Remove the NavApp manager component.

• Remove its Admin sidebar/menu entry.

BUT preserve any NavApp backend/shared code that is still required by the storefront.

Do NOT break the existing /products AppNav functionality.

6. SAFE DATA CLEANUP

Proceed with ONLY the cleanup items you classified as SAFE TO DELETE.

Specifically:

• Delete the 41 expired admin sessions.

• Delete the confirmed unreferenced media file and its database record.

DO NOT delete:

• Users/customers

• Orders

• Payments

• Transaction history

• Active sessions

• Published products

• Categories

• Telegram history

• Audit/activity logs

• Notifications

• Prisma migration history

For the 2 archived products:

DO NOT DELETE THEM.

Keep them archived because they are associated with historical orders.

7. MINIMAL-DIFF REQUIREMENT

Use the smallest possible changes.

Do NOT redesign the website.

Do NOT refactor unrelated code.

Do NOT change business logic unless required for the fixes above.

Do NOT modify:

• Telegram bot functionality

• Telegram queue/webhooks except the required security protection

• Payment/order logic

• Authentication

• Product category/filter tiles

• Light/Dark mode

• Existing translations

• Product business logic

• Existing integrations

unless required by a verified bug/security issue.

8. REQUIRED VERIFICATION

After implementation:

Product deletion

Test both cases:

A. Product with NO orders:
→ real database deletion.

B. Product linked to existing orders:
→ safe archive + explicit archive message.

Verify that neither case produces a false success message.

Security

Verify:

• Missing CRON_SECRET cannot expose the cron endpoint.

• Missing TELEGRAM_WEBHOOK_SECRET cannot expose the webhook endpoint.

• Unauthorized admin operations return the correct status.

• IDOR attempts are rejected.

• SVG responses have the intended security protection.

• JSON-LD cannot be broken by controlled product content.

• No server secrets are exposed to client bundles.

Cleanup

Verify that only the explicitly approved safe cleanup items were removed.

9. BEFORE FINISHING

Run:

• npx tsc --noEmit

• lint

• npx next build

• database/schema validation

• relevant tests

• functional verification of the affected routes

Report the actual results.

Do not claim a test passed unless it was actually executed.

Proceed with implementation now.