mercadodevida/work/artifacts/F-028/documenter.md

Documenter — F-028 Security hardening

Summary

Security module adds sliding-window rate limiter, persisted audit log and admin MFA enrollment. PostgreSQL remains the identity and audit store.

API

Route	Access	Result
GET /admin/mfa/status	admin	{ mfaEnrolled: boolean }
POST /admin/mfa/enroll	admin	Sets mfa_enrolled true; writes audit row
POST /admin/audit/log	admin	Writes a manual audit log entry
GET /admin/rate-limit/check?key=…	admin	Returns rate limit decision

Schema changes

• security_audit_log (migration 021)
• identity_users.mfa_enrolled boolean default false

Evidence

• work/artifacts/F-028/architect.md
• work/artifacts/F-028/implementer.md
• work/artifacts/F-028/reviewer.json
• work/artifacts/F-028/security.json
• work/artifacts/F-028/qa.json