feat: Authentication & Authorization with JWT and RBAC (Sprint 9)

[fregataa]

Overview

Implement JWT-based authentication and role-based access control (RBAC) for the config-server.

Goals

• Implement secure JWT-based authentication
• Set up RBAC with defined roles (admin, operator, viewer)
• Support API key authentication for CLI
• Secure all sensitive API endpoints

Tasks

1. Authentication Infrastructure

• Design authentication strategy (JWT)
• Create user model and database schema
• Implement password hashing (bcrypt)
• Create authentication service
• Implement JWT token generation
• Implement JWT token validation

2. Authentication API

• POST /api/v1/auth/register
• POST /api/v1/auth/login
• POST /api/v1/auth/logout
• POST /api/v1/auth/refresh
• GET /api/v1/auth/me

3. Authorization (RBAC)

• Design RBAC model (roles: admin, operator, viewer)
• Create role and permission tables
• Implement authorization middleware
• Apply middleware to sensitive endpoints
• Implement resource-level permissions

4. API Key Authentication

• Create API key model
• Implement API key generation
• Implement API key validation middleware
• Add API key management endpoints
• Update CLI to support API keys

5. CLI Integration

• Add login command to CLI
• Store tokens securely in config
• Add token refresh logic
• Update all CLI commands to use auth

6. Testing & Documentation

• Write authentication tests
• Write authorization tests
• Update API documentation
• Write authentication guide
• Document security best practices

Deliverables

• JWT-based authentication system
• RBAC with 3 roles (admin, operator, viewer)
• API key support for CLI
• Secured API endpoints
• Authentication documentation

Success Criteria

• Users can register and login
• Token-based authentication works
• RBAC enforces permissions correctly
• CLI supports authentication
• Tests cover auth flows

Security Considerations

• Password complexity requirements
• Token expiration and refresh
• Secure token storage
• Rate limiting on auth endpoints
• Audit logging for auth events

Notes

• Consider OAuth2 for future web UI
• Prepare for multi-tenancy in future