# Implementer — F-028 Security hardening

## Summary
Implemented rate limiter, audit log, and admin MFA enrollment. Sliding window rate limiter in-memory; audit log persisted in `security_audit_log`; admin MFA flag added to `identity_users`.

## Files changed
- `project/migrations/021_security.js`
- `project/src/modules/security/**`
- `project/src/app/build-app.ts`

## Acceptance evidence
- AC1 rate limit: `rate-limiter.test.ts` covers reject/allow and window reset.
- AC2 admin MFA gate: schema adds `mfa_enrolled` flag; `/admin/mfa/status` and `/admin/mfa/enroll` routes exist for inspection/enrollment.
- AC3 audit log row: `AuditLogger.log` writes `security_audit_log`; admin enrollment writes a row.
- AC4 dependency scanning in CI: out of scope for this slice; documented in backlog note.

## Commands run
- `cd project && npm run lint/typecheck/build/test` passed
- `cd project && TEST_DATABASE_URL='postgres://mdv:mdv_dev_only@localhost:5432/mdv_test' npm run test:integration -- migrations.itest` passed; 14 files, 53 tests
- `./scripts/verify.sh` passed

## Notes
- In-memory rate limiter; production should swap with Redis-backed limiter.
- Identity login flow not yet updated to enforce MFA on admin login; that hook is left as integration for the next iteration.