AcadeNice/corentin_wakdo
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
corentin_wakdo/docs/domaines/auth.md
Imugiii f7caf2d50c
All checks were successful
CI / secret-scan (pull_request) Successful in 9s
Details
CI / php-lint (pull_request) Successful in 21s
Details
CI / static-tests (pull_request) Successful in 44s
Details
CI / js-tests (pull_request) Successful in 17s
Details
CI / auto-merge (pull_request) Successful in 5s
Details
docs(domaines): documentation par domaine fonctionnel (7 fiches) 
docs/domaines/ : une fiche par domaine livre (perimetre / ce qui est livre / regles
metier RG-T* / decisions -> ADR / tables), + index.

auth, catalogue, stock-recettes, users, rbac, stats, borne. Commande = P4 (schema pret,
non documentee ici). Troisieme et derniere PR du jeu de documentation socle.
2026-06-17 13:53:56 +00:00

1.4 KiB
Raw Blame History

Domaine — Authentification & sessions

Perimetre

Connexion back-office, deconnexion, reinitialisation de mot de passe, garde de session, PIN d'action sensible. Pas d'auth cote borne (front public).

Ce qui est livre

  • App\Auth\AuthService (login 12.1 / logout 12.2), PasswordResetService (12.3).
  • SessionManager (seul a toucher $_SESSION/cookie, mode test memoire), SessionGuard (RG-6/RG-T02 : idle 4h, absolu 10h, is_active), Csrf (jeton synchroniseur).
  • PasswordHasher (argon2id + leurre de timing), PinVerifier, PinThrottle, ThrottlePolicy (backoff degressif).
  • Controleurs AuthController, PasswordResetController, ProfileController (set-PIN self-service), MeController (/api/me).

Regles metier

  • RG-6 / RG-T02 : session valide (idle + absolu + compte actif) sinon 302 /login.
  • RG-8 / RG-9 : throttle login par compte + par IP (login_throttle), backoff degressif.
  • RG-T13 : PIN d'action sensible (voir users, rbac, stock).
  • Anti-enumeration : reponses neutres (reset, login) ; leurre de timing argon2id.

Decisions

ADR-0001 (from scratch), ADR-0004 (PIN), ADR-0005 (throttle PIN).

Tables

user, login_throttle, pin_throttle, audit_log (login + pin.failed). Detail : docs/merise/mlt.md section 12 + 22.