security: gate dev bypass flags on NODE_ENV, timing-safe OTP compare, rate-limit platform detect

- DEV_SKIP_LEGAL_REVIEW and DEV_SKIP_ADMIN_MFA were bare env checks; new
  devFlagEnabled() helper makes them inert in production builds
- OTP hash comparison now uses crypto.timingSafeEqual in both DB and
  memory modes
- /api/platforms/detect now rate limited (60/hour per IP) to prevent
  platform database enumeration
- npm audit fix for dev-only undici advisories

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: saquibreja7-hash

asmita/package-lock.json

@@ -1,4 +1,5 @@
 import Link from "next/link";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { AppShell } from "@/components/layout/AppShell";
 import { requireSession } from "@/lib/auth/middleware";
 import { getCaseForUser, isUserDeactivated } from "@/lib/case-ops";
@@ -48,7 +49,7 @@ export default async function CasePage({
   if (record && hashUploadEnabled) {
     hashSubmissions = await listHashesForCase(record.id);
   }
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const hasQueuedUrl = record?.urls.some(
     (u) => u.status === "NOTICE_QUEUED" || (skipLegalGate && u.status === "PENDING_REVIEW" && u.platformId),
   ) ?? false;

asmita/src/app/(victim)/case/[caseId]/page.tsx

@@ -1,4 +1,5 @@
 import { redirect } from "next/navigation";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { AppShell } from "@/components/layout/AppShell";
 import { requireSession } from "@/lib/auth/middleware";
 import { getCaseForUser } from "@/lib/case-ops";
@@ -38,7 +39,7 @@ export default async function SignNoticePage({
   });
   if (alreadySigned) redirect(`/case/${caseId}/confirmation`);
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
 
   const url = await db.submittedUrl.findFirst({
     where: {

asmita/src/app/(victim)/case/[caseId]/sign/page.tsx

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { z } from "zod";
 import { createAdminIdentity, getAdminRole, isAdminEmail } from "@/lib/auth/admin-allowlist";
 import { verifyAdminTotp } from "@/lib/auth/admin-mfa";
@@ -28,7 +29,7 @@ export async function POST(request: Request) {
 
   const admin = createAdminIdentity(parsed.data.email);
   const otpOk = await verifyOtp(parsed.data.email, parsed.data.otp);
-  const skipMfa = process.env.DEV_SKIP_ADMIN_MFA === "true";
+  const skipMfa = devFlagEnabled("DEV_SKIP_ADMIN_MFA");
   const mfaOk = skipMfa || verifyAdminTotp({ token: parsed.data.totp });
   if (!otpOk || !mfaOk) {
     logSecurityEvent({

asmita/src/app/api/admin/auth/verify/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { verifyCsrfRequest } from "@/lib/csrf";
 import { requireAdminPermission } from "@/lib/auth/require-admin";
 import { db } from "@/lib/db";
@@ -65,7 +66,7 @@ export async function POST(
     return NextResponse.json({ error: "email_notice_not_supported" }, { status: 409 });
   }
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const template = await db.noticeTemplate.findFirst({
     where: {
       templateType: templateType as never,

asmita/src/app/api/admin/urls/[urlId]/reissue-portal/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { requireSession } from "@/lib/auth/middleware";
 import { getCaseForUser } from "@/lib/case-ops";
 import { db } from "@/lib/db";
@@ -42,7 +43,7 @@ export async function GET(
     return NextResponse.json({ error: "no_hashes" }, { status: 409 });
   }
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const template = await db.noticeTemplate.findFirst({
     where: {
       templateType: "HASH_ADVISORY",

asmita/src/app/api/cases/[caseId]/preview-hash-advisory/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { requireSession } from "@/lib/auth/middleware";
 import { getCaseForUser } from "@/lib/case-ops";
 import { db } from "@/lib/db";
@@ -24,7 +25,7 @@ export async function GET(
   const record = await getCaseForUser(caseId, auth.session.sub);
   if (!record) return NextResponse.json({ error: "not_found" }, { status: 404 });
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
 
   const url = await db.submittedUrl.findFirst({
     where: {

asmita/src/app/api/cases/[caseId]/preview-notice/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { z } from "zod";
 import { verifyCsrfRequest } from "@/lib/csrf";
 import { requireSession } from "@/lib/auth/middleware";
@@ -91,7 +92,7 @@ export async function POST(
     return NextResponse.json({ error: "no_hashes" }, { status: 409 });
   }
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const template = await db.noticeTemplate.findFirst({
     where: {
       templateType: "HASH_ADVISORY",

asmita/src/app/api/cases/[caseId]/sign-hash-advisory/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { z } from "zod";
 import type { UrlStatus } from "@prisma/client";
 import { verifyCsrfRequest } from "@/lib/csrf";
@@ -95,7 +96,7 @@ export async function POST(
   }
 
   const { urlId, name, contact, signature } = parsed.data;
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const allowedStatuses: UrlStatus[] = skipLegalGate
     ? ["NOTICE_QUEUED", "PENDING_REVIEW"]
     : ["NOTICE_QUEUED"];

asmita/src/app/api/cases/[caseId]/sign-notice/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { devFlagEnabled } from "@/lib/dev-flags";
 import { z } from "zod";
 import { verifyCsrfRequest } from "@/lib/csrf";
 import { db } from "@/lib/db";
@@ -75,7 +76,7 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "email_notice_not_supported" }, { status: 409 });
   }
 
-  const skipLegalGate = process.env.DEV_SKIP_LEGAL_REVIEW === "true";
+  const skipLegalGate = devFlagEnabled("DEV_SKIP_LEGAL_REVIEW");
   const template = await db.noticeTemplate.findFirst({
     where: {
       templateType,