□
Authentication
Implement secure sessions, password hashing, email verification, reset flow and optional MFA for platform admins.
Pre-launch checklist
Secure the platform before launch
A tenant-aware schema is a start, not a substitute for access controls.
Required
□
Tenant authorization
Resolve tenant scope from a verified session and validated host/slug. Never trust tenant IDs sent by the browser.
□
Role permissions
Enforce SUPER_ADMIN, BUSINESS_ADMIN, KITCHEN, DELIVERY and CUSTOMER permissions on the server for every action.
□
Order and price integrity
Calculate totals server-side from current product prices; validate availability, quantities, delivery fee and order transitions.
□
Payments
Use a payment provider and verify signed webhooks server-side. Never store card details or trust a client success screen.
□
Privacy and operations
Add audit logs, data retention rules, consent/privacy notices, backups, monitoring and tested restore procedures.
Do not use demo pages or seed credentials as a production login. No production authentication is included in this starter.