Salon/docs/risks.md

Risks And Gaps

This file tracks known gaps and risks to address in future iterations.

Security And Auth

• Phone normalization is KSA-focused and minimal; broaden for multi-country use.
• OTP protections are basic; add device fingerprinting and IP throttling if needed.
• OTP provider adapters (Twilio/Unifonic) are scaffolds only; no real SMS/WhatsApp delivery yet.
• Social login is a placeholder.
• USERNAME_FIELD is still email while email can be null; verify admin/login flows.

Booking Integrity

• Availability checks and overlap prevention are now enforced for staff bookings.
• No timezone handling or business hours enforcement.
• No cancellation rules or refund logic.

Payments

• Payment integration is not implemented. Current API only stores records and a Moyasar scaffold exists.
• Webhook handling and payment status reconciliation missing.
• Idempotency handling for payment creation missing.

Data And UX

• Ratings are not recalculated from reviews.
• No image upload or storage strategy for photos.
• No notifications (email/SMS) beyond OTP scaffolding.
• Localization foundations are in progress; full Arabic translation coverage and RTL QA are still pending.

Ops And Compliance

• No audit logs for admin actions.
• No multi-tenant isolation or data export tooling.
• No GDPR/PDPL data retention policies defined.