Kiểm toán Bảo mật Độc lập 6 Giai đoạn (Cloudflare Security Audit) đánh giá mức độ an toàn của Đăng Khôi Fresh ERP như thế nào?

        // Nếu email bị ẩn hoặc trống, đối chiếu theo họ tên hoặc username trong danh bạ nhân viên
        if (!userEmail && userName) {
          const unLower = userName.trim().toLowerCase();
          if (unLower === 'admin' || unLower.includes('đăng khôi') || unLower.includes('tangvu')) {
            userEmail = 'tangvu@freshdangkhoi.com';
          } else if (unLower === 'vynt') {
            userEmail = 'vynt@freshdangkhoi.com';
          }
        }
        if (!userEmail && userName && data.knownUsers && Array.isArray(data.knownUsers)) {
          const matchByName = data.knownUsers.find(u =>
            (u.fullName && u.fullName.toLowerCase() === userName.toLowerCase()) ||
            (u.username && u.username.toLowerCase() === userName.toLowerCase())
          );
          if (matchByName && matchByName.email) {
            userEmail = matchByName.email.toLowerCase().trim();
          }
        }

        const isAdmin = userEmail === 'tangvu@freshdangkhoi.com' ||
                        Boolean(serverMatchedUser && (serverMatchedUser.role === 'admin' || serverMatchedUser.is_super_admin === true));

        let userRole = isAdmin ? 'admin' : 'sales';
        let userPermissions = isAdmin ? {
          '*': true,
          calc_view: true, calc_edit_cost: true, calc_reset: true, calc_view_real_cost: true,
          catalog_view: true, catalog_edit: true, catalog_edit_cost: true, catalog_delete_cost: true, catalog_add: true, catalog_delete: true, catalog_export: true, catalog_import: true,
          recipes_view: true, recipes_edit: true, recipes_delete: true,
          batches_view: true, batches_manage: true, batches_delete: true,
          suppliers_view: true, suppliers_manage: true, suppliers_delete: true,
          invoices_view: true, invoices_upload: true, invoices_delete: true,
          revenue_view: true, revenue_upload: true, revenue_delete: true, revenue_export: true,
          bankstatements_view: true, bankstatements_upload: true, bankstatements_delete: true,
          fees_view: true, fees_edit: true, fees_delete: true,
          cloud_view: true, cloud_pull: true, cloud_push: true,
          users_view: true, users_manage: true, users_delete: true,
          feedback_manage: true,
          system_test_suite: true,
          sku_mapping_view: true, sku_mapping_edit: true, production_view: true, production_edit: true, production_delete: true, analytics_view: true, settlement_view: true, feedback_view: true
        } : {
          // Quyền hạn chế an toàn cho Nhân Viên (sales)
          calc_view: true, calc_edit_cost: true, calc_reset: true, calc_view_real_cost: false,
          catalog_view: true, catalog_edit: false, catalog_edit_cost: false, catalog_delete_cost: false, catalog_add: false, catalog_delete: false, catalog_export: true, catalog_import: false,
          recipes_view: true, recipes_edit: false, recipes_delete: false,
          batches_view: true, batches_manage: false, batches_delete: false,
          suppliers_view: true, suppliers_manage: false, suppliers_delete: false,
          invoices_view: true, invoices_upload: false, invoices_delete: false,
          revenue_view: false, revenue_upload: false, revenue_delete: false, revenue_export: false,
          bankstatements_view: false, bankstatements_upload: false, bankstatements_delete: false,
          fees_view: true, fees_edit: false, fees_delete: false,
          cloud_view: false, cloud_pull: false, cloud_push: false,
          users_view: false, users_manage: false, users_delete: false,
          feedback_manage: false,
          system_test_suite: false,
          sku_mapping_view: true, sku_mapping_edit: false, pos_view: true, pos_create: true, production_view: false, production_edit: false, production_delete: false, analytics_view: false, settlement_view: false, feedback_view: true
        };

        // Nếu Chủ Hộ đã cấu hình quyền riêng trên Server hoặc trong danh sách knownUsers (đã khử leo quyền) thì ghi nhận
        let userRoleName = isAdmin ? 'Quản Trị Viên (Chủ Hộ)' : 'Nhân Viên';
        const sanitizeClientPermissions = (rawPerms) => {
          if (!rawPerms || typeof rawPerms !== 'object' || Array.isArray(rawPerms)) return userPermissions;
          const safe = { ...userPermissions, ...rawPerms };
          delete safe['*'];
          safe.users_view = false;
          safe.users_manage = false;
          safe.users_delete = false;
          safe.system_test_suite = false;
          safe.system_config = false;
          safe.cloud_view = false;
          safe.cloud_pull = false;
          safe.cloud_push = false;
          return safe;
        };