Naser Mansour
0f9d12c3cf
Adds docs/tasks/ (16 epics + 102 stories converted to task/subtask files with statuses.md as the new status source of truth) and docs/ux-design.md (retrospective design-system reference), and points CLAUDE.md at them. docs/prd.md and docs/architecture.md are kept as BMAD wrote them; the legacy docs/stories/, docs/epics/, docs/qa/gates/ and .bmad-core/ stay in place as historical/traceability records, superseded but not deleted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
---
|
|
id: 1-2
|
|
title: 1-2 Authentication & Role System
|
|
status: Done
|
|
date: 2026-09-27
|
|
parent: 1
|
|
---
|
|
|
|
## Description
|
|
|
|
As an admin, I want a secure authentication system with Admin/Client roles, So that only authorized users can access the platform with appropriate permissions. Full implementation history: docs/stories/story-1.2-authentication-role-system.md
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Fortify configured with custom Volt views
|
|
- [ ] Login page with bilingual support (Arabic/English)
|
|
- [ ] Session timeout after 2 hours of inactivity
|
|
- [ ] Rate limiting on login attempts (5 attempts per minute)
|
|
- [ ] Admin role with full access to all features
|
|
- [ ] Client role with restricted access (own data only)
|
|
- [ ] Registration feature DISABLED (admin creates all accounts)
|
|
- [ ] CSRF protection enabled on all forms
|
|
- [ ] Password hashing using bcrypt
|
|
- [ ] Custom middleware for admin authorization
|
|
- [ ] Secure session configuration
|
|
- [ ] Remember me functionality (optional)
|
|
- [ ] Login redirects to appropriate dashboard:
|
|
- [ ] Logout clears session properly and redirects to login page
|
|
- [ ] Admin middleware protects admin-only routes (return 403 for unauthorized)
|
|
- [ ] Failed login attempts logged to `admin_logs` table
|
|
- [ ] Deactivated users cannot log in
|
|
- [ ] Login form validates inputs properly
|
|
- [ ] Error messages are clear and bilingual
|
|
- [ ] All test scenarios in "Testing" section pass
|
|
- [ ] No security vulnerabilities
|