T

saqib mirandClaude Sonnet 5 79bc2ef25b feat(013-auth-hardening): password reset, password strength policy, login rate-limiting

Closes the two gaps 010-identity-auth explicitly deferred (password reset,
login rate-limiting), plus a shared password-strength validator both the
reset-consume endpoint and admin account creation now depend on.

- Password reset: single-use, paired-Redis-key tokens (never in Postgres),
  identical response regardless of account existence, stubbed delivery via
  a structured log line (no email infrastructure exists yet).
- Password strength: one validatePasswordStrength() call site, wired into
  both POST /admin/users and the reset-consume flow.
- Login rate-limiting: checkRateLimit keyed by submitted email, checked
  before any credential verification.

Also fixes tests/helpers/auth.ts's shared loginAs() helper, which reused
two fixed accounts across the whole integration suite via upsert — now
rate-limited per email, that collided across ~30 files sharing one budget.
Each call now gets a unique email; no call sites needed to change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-07 21:22:49 +05:30

.claude/skills

chore: install GitHub Spec Kit tooling

2026-08-21 16:22:13 +05:30

.husky

first commit

2026-08-19 16:29:17 +05:30

.specify

chore: install GitHub Spec Kit tooling

2026-08-21 16:22:13 +05:30

docs

docs: add architect's additions doc (gaps & recommendations)

2026-08-21 17:35:32 +05:30

prisma

feat(011-agent-ticket-queue): link agents to accounts, list assigned tickets

2026-09-07 13:19:13 +05:30

scripts

first commit

2026-08-19 16:29:17 +05:30

specs

feat(013-auth-hardening): password reset, password strength policy, login rate-limiting

2026-09-07 21:22:49 +05:30

src

feat(013-auth-hardening): password reset, password strength policy, login rate-limiting

2026-09-07 21:22:49 +05:30

tests

feat(013-auth-hardening): password reset, password strength policy, login rate-limiting

2026-09-07 21:22:49 +05:30

.dockerignore

first commit

2026-08-19 16:29:17 +05:30

.editorconfig

first commit

2026-08-19 16:29:17 +05:30

.env.example

feat: implement AI support agent (005) — diagnosis, tools, runbooks, verification

2026-09-02 17:44:52 +05:30

.env.test

fix: stop tracking .env files with committed secrets

2026-08-21 16:10:32 +05:30

.gitattributes

first commit

2026-08-19 16:29:17 +05:30

.gitignore

fix: stop tracking .env files with committed secrets

2026-08-21 16:10:32 +05:30

CONTRIBUTING.md

first commit

2026-08-19 16:29:17 +05:30

docker-compose.development.yml

have add tthe port number

2026-09-03 16:40:19 +05:30

docker-compose.prod.yml

first commit

2026-08-19 16:29:17 +05:30

docker-compose.test.yml

have add tthe port number

2026-09-03 16:40:19 +05:30

Dockerfile

update docker dependency issue

2026-08-20 11:27:15 +05:30

eslint.config.js

first commit

2026-08-19 16:29:17 +05:30

lint-staged.config.js

first commit

2026-08-19 16:29:17 +05:30

package-lock.json

feat(010-identity-auth): real staff login, session verification, and role gating

2026-09-07 12:45:37 +05:30

package.json

feat(010-identity-auth): real staff login, session verification, and role gating

2026-09-07 12:45:37 +05:30

prettier.config.js

first commit

2026-08-19 16:29:17 +05:30

README.md

fix

2026-09-03 16:48:27 +05:30

tsconfig.build.json

first commit

2026-08-19 16:29:17 +05:30

tsconfig.json

first commit

2026-08-19 16:29:17 +05:30

vitest.config.ts

feat: implement SLA and escalation (008)

2026-09-03 13:02:05 +05:30

README.md

SupportHub API

Development (Docker)

Start all services: docker compose --env-file .env.development -f docker-compose.development.yml up -d --build
Start only database & cache (for local app development): docker compose --env-file .env.development -f docker-compose.development.yml up -d postgres redis

Test (Docker)

docker compose --env-file .env.test -f docker-compose.test.yml up --build

Production (Docker)

docker compose --env-file .env.prod -f docker-compose.prod.yml up --build -d

Stop / Down

Stop production: docker compose -f docker-compose.prod.yml down
Stop development: docker compose -f docker-compose.development.yml down
Stop development & wipe volumes: docker compose --env-file .env.development -f docker-compose.development.yml down -v

List Containers & Logs

List containers: docker compose --env-file .env.development -f docker-compose.development.yml ps
Follow logs: docker compose --env-file .env.development -f docker-compose.development.yml logs -f

Local Development (Host)

Start database & cache in Docker:

docker compose --env-file .env.development -f docker-compose.development.yml up -d postgres redis

Start API server in watch mode:
```
npm run dev
```

Database Migrations & Prisma

Generate Prisma Client:
```
npm run prisma:generate
```

Run / Apply Dev Migrations:

npx dotenv-cli -e .env.development -- npm run prisma:migrate

Deploy Migrations (Production/CI):

npx dotenv-cli -e .env.development -- npm run prisma:deploy

Push Schema directly (Sync schema without migration files):
```
npx dotenv-cli -e .env.development -- npx prisma db push
```

Database Seeding

Seed Database (Roles, Products, Categories, Hierarchy & Demo data):
```
npx dotenv-cli -e .env.development -- npm run prisma:seed
```