Harden Authentication and Account Security Policy - #139

Merged

3m1n3nc3 merged 7 commits into

learnault:mainfrom

Theophilus131:feat/harden-auth-security-77-78-issue-136

Aug 20, 2026

Commits on Aug 20, 2026

feat(auth): add centralized JWT config with key rotation, no fallback secret
Theophilus131
committed
166c34d
fix(auth): verify JWTs via config/jwt and authorize against persisted role/status
Theophilus131
committed
1589ff9
feat(auth): enforce password strength policy, support upgradable bcrypt cost
Theophilus131
committed
3937037
fix(auth): remove fallback JWT secret, rehash weak password hashes on login
Theophilus131
committed
18d25f4
feat(auth): rate-limit register/reset-password, gate sensitive routes on verified email
Theophilus131
committed
bc036c6
docs(auth): add authentication & account security policy matrix
Theophilus131
committed
bcd2cf9
test(auth): cover JWT rotation, persisted-role authorization, password policy
Theophilus131
committed
39ce15b