Till JS f7df8e97aa feat(auth): add audit logging, account lockout, and API key rate limiting ... 1. SecurityEventsService: Centralized audit logging for all auth events (login, register, logout, password changes, API key operations, SSO token exchange, etc.). Fire-and-forget pattern ensures auth flows are never blocked by logging failures. 2. AccountLockoutService: Locks accounts after 5 failed login attempts within 15 minutes. 30-minute lockout duration. Fails open on DB errors. Clears attempts on successful login. Email-not-verified does not count as a failed attempt. 3. API Key validation endpoint secured with rate limiting (10 req/min per IP via ThrottlerGuard) and audit logging. Key prefixes logged for forensics, never full keys. New schema: auth.login_attempts table for tracking failed logins. 174 tests passing across all auth and security modules. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-03-19 22:09:58 +01:00
..
account-lockout.service.ts	feat(auth): add audit logging, account lockout, and API key rate limiting	2026-03-19 22:09:58 +01:00
index.ts	feat(auth): add audit logging, account lockout, and API key rate limiting	2026-03-19 22:09:58 +01:00
security-events.service.ts	feat(auth): add audit logging, account lockout, and API key rate limiting	2026-03-19 22:09:58 +01:00
security-events.spec.ts	feat(auth): add audit logging, account lockout, and API key rate limiting	2026-03-19 22:09:58 +01:00
security.module.ts	feat(auth): add audit logging, account lockout, and API key rate limiting	2026-03-19 22:09:58 +01:00