[CLAUDE] Phase5.1/3.2: IDOR filter + SLA auto-approve job + admin password warning

IDOR filter ContractsController:
- ListContractsQueryHandler + ICurrentUser: non-admin chi thay HD minh la Drafter hoac role eligible phase hien tai
- GetContractQueryHandler + ICurrentUser: throw ForbiddenException neu truy cap HD khong lien quan
- GetEligiblePhases() internal static trong ListContractsQueryHandler — mirror GetMyInboxQueryHandler.PhaseActorRoles (Drafter/DeptManager → DangSoanThao/DangDamPhan/DangInKy, ProjectManager+PRO+CCM+FIN+ACT+EQU → DangGopY, CostControl → DangKiemTraCCM, Director+AuthorizedSigner → DangTrinhKy, HrAdmin → DangDongDau)

SLA Expiry BackgroundService (Phase 3 iteration 2 partial):
- Infrastructure/HostedServices/SlaExpiryJob MOI: BackgroundService moi 15 phut (delay 30s startup)
- Query Contracts WHERE SlaDeadline < UtcNow AND Phase NOT IN (DaPhatHanh, TuChoi)
- Map phase → next (happy path). Goi IContractWorkflowService.TransitionAsync voi actorUserId=null + Decision=AutoApprove + comment 'AUTO: het SLA phase X (Nh qua han)'
- Try-catch tung contract, 1 fail khong block batch
- Log structured: 'SlaExpiryJob: auto-approved contract {Id} {From} → {To}'
- Package Microsoft.Extensions.Hosting added to Infrastructure
- DI register AddHostedService<SlaExpiryJob>

Admin password warning (Phase 5.1):
- DbInitializer.WarnDefaultAdminPasswordAsync: check CheckPasswordAsync voi AdminPassword default → log WRN '⚠️  Admin user vẫn dùng password mặc định. ĐỔI NGAY trong production!'
- Chain vao InitializeAsync sau cac seed

E2E verified:
- Admin GET /contracts → total 1 (see all)
- Drafter GET /contracts → total 0 (IDOR filter, chua tao HD nao)
- API startup log: '⚠️  Admin user admin@solutionerp.local vẫn dùng password mặc định'
- Build + TS check → pass

Docs:
- STATUS.md: Phase 5.1 hau nhu xong (IDOR + admin warning + SLA job tick), cumulative BE 3900 LOC
- migration-todos.md: tick Phase 5.1 IDOR + admin warning, Phase 3 iter 2 SlaExpiryJob + E2E non-admin + admin warning
- session log 2026-04-21-1730-idor-sla-job.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Application/Contracts/ContractFeatures.cs

@@ -188,7 +188,8 @@ public record ListContractsQuery(
     Guid? SupplierId = null,
     Guid? ProjectId = null) : PagedRequest, IRequest<PagedResult<ContractListItemDto>>;
 
-public class ListContractsQueryHandler(IApplicationDbContext db) : IRequestHandler<ListContractsQuery, PagedResult<ContractListItemDto>>
+public class ListContractsQueryHandler(IApplicationDbContext db, ICurrentUser currentUser)
+    : IRequestHandler<ListContractsQuery, PagedResult<ContractListItemDto>>
 {
     public async Task<PagedResult<ContractListItemDto>> Handle(ListContractsQuery request, CancellationToken ct)
     {
@@ -197,6 +198,14 @@ public class ListContractsQueryHandler(IApplicationDbContext db) : IRequestHandl
                 join p in db.Projects.AsNoTracking() on c.ProjectId equals p.Id
                 select new { c, s, p };
 
+        // IDOR: non-admin chỉ thấy HĐ mình là Drafter hoặc role eligible phase hiện tại
+        if (!currentUser.Roles.Contains(AppRoles.Admin))
+        {
+            var userId = currentUser.UserId;
+            var eligiblePhases = GetEligiblePhases(currentUser.Roles);
+            q = q.Where(x => x.c.DrafterUserId == userId || eligiblePhases.Contains(x.c.Phase));
+        }
+
         if (request.Phase is not null) q = q.Where(x => x.c.Phase == request.Phase);
         if (request.SupplierId is not null) q = q.Where(x => x.c.SupplierId == request.SupplierId);
         if (request.ProjectId is not null) q = q.Where(x => x.c.ProjectId == request.ProjectId);
@@ -224,6 +233,26 @@ public class ListContractsQueryHandler(IApplicationDbContext db) : IRequestHandl
 
         return new PagedResult<ContractListItemDto>(items, total, request.Page, request.PageSize);
     }
+
+    // Mirror GetMyInboxQueryHandler.PhaseActorRoles — shared qua internal static
+    internal static List<ContractPhase> GetEligiblePhases(IReadOnlyList<string> userRoles)
+    {
+        var phases = new HashSet<ContractPhase>();
+        void AddIfAny(string[] required, params ContractPhase[] toAdd)
+        {
+            if (userRoles.Any(r => required.Contains(r)))
+                foreach (var p in toAdd) phases.Add(p);
+        }
+        AddIfAny([AppRoles.Drafter, AppRoles.DeptManager],
+            ContractPhase.DangSoanThao, ContractPhase.DangDamPhan, ContractPhase.DangInKy);
+        AddIfAny([AppRoles.ProjectManager, AppRoles.Procurement, AppRoles.CostControl,
+                  AppRoles.Finance, AppRoles.Accounting, AppRoles.Equipment],
+            ContractPhase.DangGopY);
+        AddIfAny([AppRoles.CostControl], ContractPhase.DangKiemTraCCM);
+        AddIfAny([AppRoles.Director, AppRoles.AuthorizedSigner], ContractPhase.DangTrinhKy);
+        AddIfAny([AppRoles.HrAdmin], ContractPhase.DangDongDau);
+        return phases.ToList();
+    }
 }
 
 // ========== INBOX — HĐ chờ role/tôi xử lý ==========
@@ -281,8 +310,10 @@ public class GetMyInboxQueryHandler(
 
 public record GetContractQuery(Guid Id) : IRequest<ContractDetailDto>;
 
-public class GetContractQueryHandler(IApplicationDbContext db, UserManager<User> userManager)
-    : IRequestHandler<GetContractQuery, ContractDetailDto>
+public class GetContractQueryHandler(
+    IApplicationDbContext db,
+    UserManager<User> userManager,
+    ICurrentUser currentUser) : IRequestHandler<GetContractQuery, ContractDetailDto>
 {
     public async Task<ContractDetailDto> Handle(GetContractQuery request, CancellationToken ct)
     {
@@ -293,6 +324,17 @@ public class GetContractQueryHandler(IApplicationDbContext db, UserManager<User>
             .FirstOrDefaultAsync(x => x.Id == request.Id, ct)
             ?? throw new NotFoundException("Contract", request.Id);
 
+        // IDOR guard: non-admin chỉ xem được HĐ mình là Drafter hoặc role eligible phase hiện tại
+        var isAdmin = currentUser.Roles.Contains(AppRoles.Admin);
+        if (!isAdmin)
+        {
+            var isDrafter = c.DrafterUserId == currentUser.UserId;
+            var eligiblePhases = ListContractsQueryHandler.GetEligiblePhases(currentUser.Roles);
+            var isEligibleByRole = eligiblePhases.Contains(c.Phase);
+            if (!isDrafter && !isEligibleByRole)
+                throw new ForbiddenException("Bạn không có quyền xem HĐ này.");
+        }
+
         var supplier = await db.Suppliers.AsNoTracking().FirstOrDefaultAsync(s => s.Id == c.SupplierId, ct);
         var project = await db.Projects.AsNoTracking().FirstOrDefaultAsync(p => p.Id == c.ProjectId, ct);
         var department = c.DepartmentId is null ? null : await db.Departments.AsNoTracking().FirstOrDefaultAsync(d => d.Id == c.DepartmentId, ct);

src/Backend/SolutionErp.Infrastructure/DependencyInjection.cs

@@ -8,6 +8,7 @@ using SolutionErp.Application.Forms.Services;
 using SolutionErp.Application.Reports.Services;
 using SolutionErp.Domain.Identity;
 using SolutionErp.Infrastructure.Forms;
+using SolutionErp.Infrastructure.HostedServices;
 using SolutionErp.Infrastructure.Identity;
 using SolutionErp.Infrastructure.Persistence;
 using SolutionErp.Infrastructure.Persistence.Interceptors;
@@ -30,6 +31,9 @@ public static class DependencyInjection
         services.AddScoped<IContractWorkflowService, ContractWorkflowService>();
         services.AddScoped<IContractExcelExporter, ContractExcelExporter>();
 
+        // Phase 3 iteration 2 — SLA auto-approve background service
+        services.AddHostedService<SlaExpiryJob>();
+
         services.AddScoped<AuditingInterceptor>();
 
         services.AddDbContext<ApplicationDbContext>((sp, options) =>

src/Backend/SolutionErp.Infrastructure/HostedServices/SlaExpiryJob.cs

@@ -0,0 +1,106 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using SolutionErp.Application.Common.Interfaces;
+using SolutionErp.Application.Contracts.Services;
+using SolutionErp.Domain.Contracts;
+
+namespace SolutionErp.Infrastructure.HostedServices;
+
+// Background service chạy mỗi 15 phút, auto-approve HĐ quá SLA.
+// Xem docs/flows/sla-expiry-flow.md cho spec full.
+// Phase 3 iteration 2 MVP — chưa có notification, chỉ log + ContractApproval với Decision=AutoApprove.
+public class SlaExpiryJob : BackgroundService
+{
+    private readonly IServiceProvider _sp;
+    private readonly ILogger<SlaExpiryJob> _logger;
+    private static readonly TimeSpan Interval = TimeSpan.FromMinutes(15);
+
+    // Map phase → phase tiếp (happy path). Nếu null → không auto-approve (final/TuChoi).
+    private static readonly Dictionary<ContractPhase, ContractPhase?> NextPhase = new()
+    {
+        [ContractPhase.DangSoanThao] = ContractPhase.DangGopY,
+        [ContractPhase.DangGopY] = ContractPhase.DangDamPhan,
+        [ContractPhase.DangDamPhan] = ContractPhase.DangInKy,
+        [ContractPhase.DangInKy] = ContractPhase.DangKiemTraCCM,
+        [ContractPhase.DangKiemTraCCM] = ContractPhase.DangTrinhKy,
+        [ContractPhase.DangTrinhKy] = ContractPhase.DangDongDau,
+        [ContractPhase.DangDongDau] = ContractPhase.DaPhatHanh,
+    };
+
+    public SlaExpiryJob(IServiceProvider sp, ILogger<SlaExpiryJob> logger)
+    {
+        _sp = sp;
+        _logger = logger;
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        // Wait 30s sau khi app start — tránh race với DbInitializer migrate
+        await Task.Delay(TimeSpan.FromSeconds(30), stoppingToken);
+
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                await ProcessAsync(stoppingToken);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "SlaExpiryJob iteration failed");
+            }
+            await Task.Delay(Interval, stoppingToken);
+        }
+    }
+
+    private async Task ProcessAsync(CancellationToken ct)
+    {
+        await using var scope = _sp.CreateAsyncScope();
+        var db = scope.ServiceProvider.GetRequiredService<IApplicationDbContext>();
+        var workflow = scope.ServiceProvider.GetRequiredService<IContractWorkflowService>();
+        var dateTime = scope.ServiceProvider.GetRequiredService<IDateTime>();
+
+        var now = dateTime.UtcNow;
+        var expired = await db.Contracts
+            .Where(c => c.SlaDeadline != null && c.SlaDeadline < now)
+            .Where(c => c.Phase != ContractPhase.DaPhatHanh && c.Phase != ContractPhase.TuChoi)
+            .ToListAsync(ct);
+
+        if (expired.Count == 0)
+        {
+            _logger.LogDebug("SlaExpiryJob: no expired contracts");
+            return;
+        }
+
+        _logger.LogInformation("SlaExpiryJob: {Count} expired contracts", expired.Count);
+
+        foreach (var contract in expired)
+        {
+            if (!NextPhase.TryGetValue(contract.Phase, out var next) || next is null)
+            {
+                _logger.LogWarning("SlaExpiryJob: phase {Phase} không có next, skip contract {Id}", contract.Phase, contract.Id);
+                continue;
+            }
+
+            try
+            {
+                var hoursOver = (int)(now - contract.SlaDeadline!.Value).TotalHours;
+                await workflow.TransitionAsync(
+                    contract,
+                    next.Value,
+                    actorUserId: null,                         // system
+                    actorRoles: new List<string>(),            // system bypass check trong workflow
+                    decision: ApprovalDecision.AutoApprove,
+                    comment: $"[AUTO] Hết SLA phase {contract.Phase} ({hoursOver}h quá hạn). Tự động chuyển sang {next.Value}.",
+                    ct: ct);
+                _logger.LogInformation("SlaExpiryJob: auto-approved contract {Id} {From} → {To}",
+                    contract.Id, contract.Phase, next.Value);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "SlaExpiryJob: failed auto-approve {Id}", contract.Id);
+            }
+        }
+    }
+}

src/Backend/SolutionErp.Infrastructure/Persistence/DbInitializer.cs

@@ -30,6 +30,20 @@ public static class DbInitializer
         await SeedMenuTreeAsync(db, logger);
         await SeedAdminPermissionsAsync(db, roleManager, logger);
         await SeedContractTemplatesAsync(db, logger);
+        await WarnDefaultAdminPasswordAsync(userManager, logger);
+    }
+
+    // Phase 5.1 security: log warning nếu admin vẫn dùng password mặc định sau deploy production.
+    private static async Task WarnDefaultAdminPasswordAsync(UserManager<User> userManager, ILogger logger)
+    {
+        var admin = await userManager.FindByEmailAsync(AdminEmail);
+        if (admin is null) return;
+        if (await userManager.CheckPasswordAsync(admin, AdminPassword))
+        {
+            logger.LogWarning(
+                "⚠️  Admin user '{Email}' vẫn dùng password mặc định. ĐỔI NGAY trong production! " +
+                "Xem docs/guides/security-checklist.md.", AdminEmail);
+        }
     }
 
     private static async Task SeedRolesAsync(RoleManager<Role> roleManager, ILogger logger)

src/Backend/SolutionErp.Infrastructure/SolutionErp.Infrastructure.csproj

@@ -13,6 +13,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.6" />
     <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.17.0" />
   </ItemGroup>