24 lines
842 B
Markdown
24 lines
842 B
Markdown
# Documenter — F-028 Security hardening
|
|
|
|
## Summary
|
|
Security module adds sliding-window rate limiter, persisted audit log and admin MFA enrollment. PostgreSQL remains the identity and audit store.
|
|
|
|
## API
|
|
|
|
| Route | Access | Result |
|
|
|---|---|---|
|
|
| GET /admin/mfa/status | admin | `{ mfaEnrolled: boolean }` |
|
|
| POST /admin/mfa/enroll | admin | Sets `mfa_enrolled` true; writes audit row |
|
|
| POST /admin/audit/log | admin | Writes a manual audit log entry |
|
|
| GET /admin/rate-limit/check?key=… | admin | Returns rate limit decision |
|
|
|
|
## Schema changes
|
|
- `security_audit_log` (migration 021)
|
|
- `identity_users.mfa_enrolled` boolean default false
|
|
|
|
## Evidence
|
|
- work/artifacts/F-028/architect.md
|
|
- work/artifacts/F-028/implementer.md
|
|
- work/artifacts/F-028/reviewer.json
|
|
- work/artifacts/F-028/security.json
|
|
- work/artifacts/F-028/qa.json |