3 Commits

Include renames

Author	SHA1	Message	Date
curo1305	c00c1fbaa7	feat(07.2-02): add jti UUID claim to create_access_token ... - Added "jti": str(uuid.uuid4()) to the access token payload in services/auth.py - Promoted Wave 0 xfail stub test_create_access_token_includes_jti_claim to PASS - Added test_create_access_token_jti_is_unique_per_call uniqueness guard - uuid module was already imported at module top — no new imports needed	2026-06-05 19:15:01 +02:00
curo1305	c686d90e1f	test(07.2-01): add JTI claim xfail stub to test_task2_auth_service.py ... - Add test_create_access_token_includes_jti_claim with xfail(strict=False) - Asserts 'jti' key present in decoded payload, parseable as UUID - Wave 1 (Plan 02) will add jti to create_access_token to promote this stub - All 17 existing tests unaffected	2026-06-05 19:06:22 +02:00
curo1305	9fc820d893	feat(02-01): implement services/auth.py full auth service layer and email_tasks.py ... - services/auth.py: Argon2 password hashing (pwdlib), constant-time verify (SEC-06) - JWT create/decode for access tokens and password-reset tokens (typ claim validation, T-02-01) - Refresh token lifecycle: create, rotate, revoke-all with family revocation (AUTH-07, RFC 9700) - Family revocation enqueues send_security_alert_email.delay on token reuse (T-02-02) - TOTP provisioning (pyotp) and verification with Redis replay prevention, valid_window=1 (AUTH-08) - Backup code generation (8-char hex uppercase), storage (Argon2 hashed), constant-time verify (T-02-03) - HIBP k-anonymity check via SHA-1 prefix (T-02-05), fail-open on network error (T-02-06) - Admin bootstrap: idempotent, logs WARNING if env vars missing (D-04/D-05/D-06) - services/email.py: SMTP send + dev stdout fallback (D-01/D-02) - tasks/email_tasks.py: send_reset_email and send_security_alert_email Celery tasks - celery_app.py: add email queue route for tasks.email_tasks.* - TDD tests: 17 tests covering all auth primitives and family revocation	2026-05-22 19:23:42 +02:00