Naser Mansour
0f9d12c3cf
Adds docs/tasks/ (16 epics + 102 stories converted to task/subtask files with statuses.md as the new status source of truth) and docs/ux-design.md (retrospective design-system reference), and points CLAUDE.md at them. docs/prd.md and docs/architecture.md are kept as BMAD wrote them; the legacy docs/stories/, docs/epics/, docs/qa/gates/ and .bmad-core/ stay in place as historical/traceability records, superseded but not deleted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1.4 KiB
1.4 KiB
id, title, status, date, parent
| id | title | status | date | parent |
|---|---|---|---|---|
| 1-2 | 1-2 Authentication & Role System | Done | 2026-09-27 | 1 |
Description
As an admin, I want a secure authentication system with Admin/Client roles, So that only authorized users can access the platform with appropriate permissions. Full implementation history: docs/stories/story-1.2-authentication-role-system.md
Acceptance Criteria
- Fortify configured with custom Volt views
- Login page with bilingual support (Arabic/English)
- Session timeout after 2 hours of inactivity
- Rate limiting on login attempts (5 attempts per minute)
- Admin role with full access to all features
- Client role with restricted access (own data only)
- Registration feature DISABLED (admin creates all accounts)
- CSRF protection enabled on all forms
- Password hashing using bcrypt
- Custom middleware for admin authorization
- Secure session configuration
- Remember me functionality (optional)
- Login redirects to appropriate dashboard:
- Logout clears session properly and redirects to login page
- Admin middleware protects admin-only routes (return 403 for unauthorized)
- Failed login attempts logged to
admin_logstable - Deactivated users cannot log in
- Login form validates inputs properly
- Error messages are clear and bilingual
- All test scenarios in "Testing" section pass
- No security vulnerabilities