mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-17 23:49:40 +02:00
f7df8e97aa
1. SecurityEventsService: Centralized audit logging for all auth events (login, register, logout, password changes, API key operations, SSO token exchange, etc.). Fire-and-forget pattern ensures auth flows are never blocked by logging failures. 2. AccountLockoutService: Locks accounts after 5 failed login attempts within 15 minutes. 30-minute lockout duration. Fails open on DB errors. Clears attempts on successful login. Email-not-verified does not count as a failed attempt. 3. API Key validation endpoint secured with rate limiting (10 req/min per IP via ThrottlerGuard) and audit logging. Key prefixes logged for forensics, never full keys. New schema: auth.login_attempts table for tracking failed logins. 174 tests passing across all auth and security modules. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
12 lines
364 B
TypeScript
12 lines
364 B
TypeScript
import { Module } from '@nestjs/common';
|
|
import { ApiKeysController } from './api-keys.controller';
|
|
import { ApiKeysService } from './api-keys.service';
|
|
import { SecurityModule } from '../security';
|
|
|
|
@Module({
|
|
imports: [SecurityModule],
|
|
controllers: [ApiKeysController],
|
|
providers: [ApiKeysService],
|
|
exports: [ApiKeysService],
|
|
})
|
|
export class ApiKeysModule {}
|