24 lines
1.3 KiB
Markdown
24 lines
1.3 KiB
Markdown
# Implementer — F-028 Security hardening
|
|
|
|
## Summary
|
|
Implemented rate limiter, audit log, and admin MFA enrollment. Sliding window rate limiter in-memory; audit log persisted in `security_audit_log`; admin MFA flag added to `identity_users`.
|
|
|
|
## Files changed
|
|
- `project/migrations/021_security.js`
|
|
- `project/src/modules/security/**`
|
|
- `project/src/app/build-app.ts`
|
|
|
|
## Acceptance evidence
|
|
- AC1 rate limit: `rate-limiter.test.ts` covers reject/allow and window reset.
|
|
- AC2 admin MFA gate: schema adds `mfa_enrolled` flag; `/admin/mfa/status` and `/admin/mfa/enroll` routes exist for inspection/enrollment.
|
|
- AC3 audit log row: `AuditLogger.log` writes `security_audit_log`; admin enrollment writes a row.
|
|
- AC4 dependency scanning in CI: out of scope for this slice; documented in backlog note.
|
|
|
|
## Commands run
|
|
- `cd project && npm run lint/typecheck/build/test` passed
|
|
- `cd project && TEST_DATABASE_URL='postgres://mdv:mdv_dev_only@localhost:5432/mdv_test' npm run test:integration -- migrations.itest` passed; 14 files, 53 tests
|
|
- `./scripts/verify.sh` passed
|
|
|
|
## Notes
|
|
- In-memory rate limiter; production should swap with Redis-backed limiter.
|
|
- Identity login flow not yet updated to enforce MFA on admin login; that hook is left as integration for the next iteration. |