Feature: Harden Authentication and Account Security Policy

[3m1n3nc3]

Description

Enforce verification, account status, roles, password, JWT, key rotation, and authentication rate limits consistently.

File Location

Auth middleware/services/config, rate limiting, and security docs

Design Reference

API Roadmap Phase 1: Harden Authentication and Account Security Policy.

Dependencies

• Status: Blocked
• Blocked by: Feature: Implement Email Verification and Resend API #77; Feature: Implement Password Recovery and Reset API #78; Feature: Implement Refresh Rotation and Logout API #79; Feature: Decide and Implement Phone OTP Authentication API #80
• Blocks: Feature: Add Identity Profile Wallet Integration Test Suite #94; Phase 1 closure

Tasks

• Define statuses and operations requiring verified email
• Enforce password/PIN policy and upgradable hashing parameters
• Require JWT issuer, audience, algorithm, expiry, key ID, and validated keys
• Resolve authorization against current persisted role where needed
• Add auth/reset/refresh/OTP-specific rate limits
• Test disabled/deleted/unverified users, stale roles, bad claims, rotation, and limits

Acceptance Criteria

• Fallback JWT secrets are impossible outside tests
• Disabled/deleted accounts lose ordinary access
• Verification policy is consistent
• Limits expose stable retry information
• Security tests pass

Verification Evidence

• Attach policy matrix, bad-config proof, and negative/security tests

Difficulty

Advanced