Architect — F-028 Security hardening

Feature

F-028 introduces rate limiting, audit log, and admin MFA enrollment gate.

Design

Module boundaries

Create project/src/modules/security/ with domain/application/infrastructure/api/tests. The module owns an in-memory rate limiter and audit log table.

Data model

Add migration 021_security.js:

security_audit_log: id, actor_id uuid nullable, action text, target text, metadata jsonb, created_at.

Behavior

RateLimiter per-key sliding window (in-memory for v1).
AuditLogger.log(actor, action, target, metadata) writes row.
Admin login gate: existing login route checks security_admin_mfa flag; MFA enrollment required for admin login.

API

GET /admin/mfa/status returns whether current admin has MFA enrolled.
POST /admin/mfa/enroll admin-only flips the flag.

Acceptance trace

Rate limit above threshold -> HTTP 429.
Admin login without MFA -> blocked.
Admin mutation -> audit log row.

997 B Raw Blame History