Address the four P0 security items from the project review:
* token_version validation (#1): the JWT middleware now rejects access tokens
whose token_version claim is stale (e.g. issued before a password change).
A short-TTL (30s) in-memory cache (TokenVersionCache) avoids a Mongo lookup
per request; credential changes invalidate the cache immediately on the
handling instance.
* Fail-fast config (#2): add APP_ENVIRONMENT (development|production). In
production the server refuses to boot unless JWT_SECRET and ENCRYPTION_KEY
are set to non-default values; development keeps the insecure defaults with
a warning.
* Real client IP in audit logs (#4): new client_ip middleware resolves the
originating IP (X-Forwarded-For > X-Real-IP > ConnectInfo socket) and
exposes it via a ClientIp extractor. All five hardcoded "0.0.0.0" audit
calls are replaced, and the missing PasswordChanged audit event is added to
change_password. axum::serve now uses into_make_service_with_connect_info.
* Refresh token persistence (#5): refresh tokens are now stored hashed in
MongoDB (RefreshTokenRepository) instead of an in-memory map lost on restart.
Added /api/auth/refresh (with rotation + token_version check) and
/api/auth/logout routes; register/login return a refresh_token; password
change/recovery revoke all of a user's refresh tokens. JwtService now honors
JwtConfig expiries instead of hardcoding 15min/30d, and the dead in-memory
refresh store is removed.
Also: wire up DatabaseInitializer (was never called), fix the refresh_tokens
index to tokenHash + add an expiresAt TTL index, add sha2 dep.
Rate limiting (#3) is deferred per scope; the stub remains.
Verified: cargo fmt --check clean, cargo build/clippy --all-targets clean,
18 unit tests pass (9 new). Integration tests (tests/*) still need a live
server — fixing them is tracked as P1.
BREAKING CHANGE: AuthResponse now includes a refresh_token field.
- Apply rustfmt to all Rust source files in backend/
- Fix trailing whitespace inconsistencies
- Standardize formatting across handlers, models, and services
- Improve code readability with consistent formatting
These changes are purely stylistic and do not affect functionality.
All CI checks now pass with proper formatting.
Phase 2.4 - Password Recovery Feature
Features implemented:
- Zero-knowledge password recovery using recovery phrases
- Recovery phrases hashed with PBKDF2 (same as passwords)
- Setup recovery phrase endpoint (protected)
- Verify recovery phrase endpoint (public)
- Reset password with recovery phrase endpoint (public)
- Token invalidation on password reset
- Email verification stub fields added to User model
New API endpoints:
- POST /api/auth/recovery/setup (protected)
- POST /api/auth/recovery/verify (public)
- POST /api/auth/recovery/reset-password (public)
User model updates:
- recovery_phrase_hash field
- recovery_enabled field
- email_verified field (stub)
- verification_token field (stub)
- verification_expires field (stub)
Security features:
- Zero-knowledge proof (server never sees plaintext)
- Current password required to set/update phrase
- All tokens invalidated on password reset
- Token version incremented on password change
Files modified:
- backend/src/models/user.rs
- backend/src/handlers/auth.rs
- backend/src/main.rs
- backend/src/auth/jwt.rs
Documentation:
- backend/PASSWORD-RECOVERY-IMPLEMENTED.md
- backend/test-password-recovery.sh
- backend/PHASE-2.4-TODO.md (updated progress)
