feat: implement secutiry check todo

Author: fiqrikm18

.env.example

@@ -19,3 +19,8 @@ RATE_LIMIT="100/minute"
 CORS_ALLOW_ORIGINS=http://localhost:3000
 CORS_ALLOW_METHODS=*
 CORS_ALLOW_HEADERS=*
+SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; frame-ancestors 'none'
+IDEMPOTENCY_TTL_SECONDS=86400
+ACCOUNT_LOCKOUT_MAX_ATTEMPTS=5
+ACCOUNT_LOCKOUT_WINDOW_MINUTES=15
+ACCOUNT_LOCKOUT_DURATION_MINUTES=15

Makefile

@@ -10,7 +10,7 @@ COMPOSE_FILE := docker-compose.yml
 
 .DEFAULT_GOAL := help
 
-.PHONY: help install run test lint import-check check migrate downgrade revision db-up db-down db-logs clean
+.PHONY: help install run test lint import-check security-scan check migrate downgrade revision db-up db-down db-logs clean
 
 help:
 	@echo "[make:help] Available commands:"
@@ -19,6 +19,7 @@ help:
 	@echo "  [make:test]          Run pytest"
 	@echo "  [make:lint]          Run Ruff checks"
 	@echo "  [make:import-check]  Verify src.main imports"
+	@echo "  [make:security-scan] Run dependency vulnerability scan with pip-audit"
 	@echo "  [make:check]         Run tests, lint, and import check"
 	@echo "  [make:migrate]       Apply Alembic migrations"
 	@echo "  [make:downgrade]     Roll back one Alembic migration"
@@ -48,6 +49,14 @@ import-check:
 	@echo "[make:import-check] Verifying src.main imports"
 	@PYTHONDONTWRITEBYTECODE=1 $(PYTHON) -c "import src.main; print('import ok')"
 
+security-scan:
+	@echo "[make:security-scan] Running dependency vulnerability scan"
+	@if ! command -v pip-audit >/dev/null 2>&1; then \
+		echo "[make:security-scan] pip-audit is not installed. Install it with: pip install pip-audit"; \
+		exit 1; \
+	fi
+	@pip-audit
+
 check: test lint import-check
 	@echo "[make:check] All checks completed"
 

README.md

@@ -490,40 +490,40 @@ Legend: `Implemented` means code exists in the repository. `Partial` means code
 | Refresh Token Rotation | Required | Implemented | Refresh flow revokes the old refresh token and persists a new token. |
 | RBAC + Permissions | Required | Implemented | Casbin-backed role and permission checks are wired through route dependencies. |
 | Rate Limiting (Redis-backed) | Required | Implemented | Redis-backed limiter reads the configured `RATE_LIMIT` value. |
-| Security Headers Middleware | Required | Not Implemented | Add headers such as `X-Content-Type-Options`, `X-Frame-Options` or CSP `frame-ancestors`, `Referrer-Policy`, and production CSP. |
+| Security Headers Middleware | Required | Implemented | Adds `X-Content-Type-Options`, `X-Frame-Options`, CSP `frame-ancestors`, `Referrer-Policy`, and `Permissions-Policy`. |
 | CORS Configuration | Required | Implemented | CORS origins, methods, and headers are environment-driven through settings. |
-| Request ID Middleware | Required | Not Implemented | Add request/correlation ID generation and response header propagation. |
-| Audit Logging | Required | Not Implemented | Add audit events for sensitive auth, user, role, permission, and todo mutations. |
-| Structured Logging | Required | Not Implemented | Add structured application logs with request ID, method, path, status, latency, and user context when available. |
+| Request ID Middleware | Required | Implemented | Generates or propagates `X-Request-ID` and stores it on request state. |
+| Audit Logging | Required | Implemented | Adds global endpoint audit logging, domain audit events, and separate persisted error traces. |
+| Structured Logging | Required | Implemented | Logs request ID, method, path, status, latency, and user context when available. |
 | Global Exception Handling | Required | Implemented | Domain exceptions are registered explicitly and `Exception` is used only as the fallback handler. |
 | Input Validation | Required | Implemented | Pydantic schemas and application validation functions are used across user and todo flows. |
 | Password Hashing (Argon2 or bcrypt) | Required | Implemented | User auth service uses bcrypt hashing. |
-| Account Lockout | Required | Not Implemented | Add failed-login tracking and temporary lockout or throttling by account. |
+| Account Lockout | Required | Implemented | Tracks failed logins and temporarily locks accounts after configured thresholds. |
 | Token Revocation | Required | Implemented | Refresh tokens are revoked on rotation/logout, and access tokens are denylisted in Redis until expiry. |
 | OpenAPI Authentication | Required | Implemented | Swagger OAuth2 auth is configured, and docs/OpenAPI endpoints are disabled when `APP_ENV=production`. |
 | Health Check Endpoint | Required | Implemented | `/health` endpoint returns service health. |
-| Readiness/Liveness Endpoints | Required | Not Implemented | Add separate readiness and liveness endpoints for deployment orchestration. |
+| Readiness/Liveness Endpoints | Required | Implemented | Adds `/live` and `/ready` operational endpoints. |
 | Request Size Limiting | Required | Implemented | `LimitRequestSizeMiddleware` rejects oversized write requests. |
-| Idempotency Support (for applicable POST endpoints) | Optional but valuable | Not Implemented | Consider idempotency keys for retry-safe create/payment-like workflows. |
+| Idempotency Support (for applicable POST endpoints) | Optional but valuable | Implemented | Supports `Idempotency-Key` replay caching for POST responses. |
 | Database Migrations | Required | Implemented | Alembic is configured with migration commands in the README and Makefile. |
 | Dependency Injection | Required | Implemented | FastAPI dependencies wire repositories, handlers, auth, authorization, and database sessions. |
 | Configuration via Environment Variables | Required | Implemented | Pydantic settings read `.env` and reject the default secret key in production. |
 
 ### Next Implementation Checklist
 
 - [x] Fix and verify rate limit configuration wiring.
-- [ ] Add security headers middleware.
-- [ ] Add request ID middleware.
-- [ ] Add structured request logging.
-- [ ] Add audit logging for sensitive actions.
-- [ ] Add account lockout or equivalent failed-login protection.
+- [x] Add security headers middleware.
+- [x] Add request ID middleware.
+- [x] Add structured request logging.
+- [x] Add audit logging for sensitive actions.
+- [x] Add account lockout or equivalent failed-login protection.
 - [x] Disable or authenticate `/docs`, `/redoc`, and `/openapi.json` in production.
-- [ ] Add readiness and liveness endpoints.
+- [x] Add readiness and liveness endpoints.
 - [x] Add production config validation for secrets and unsafe defaults.
 - [x] Harden CORS through environment-driven allowed origins, methods, and headers.
-- [ ] Review exception responses to avoid leaking token parsing details or internal exception messages.
-- [ ] Add automated tests for request size limits, rate limiting, auth failures, authorization failures, CORS, security headers, and request IDs.
-- [ ] Add dependency vulnerability scanning to local or CI checks, for example `pip-audit` or an equivalent Poetry-compatible scanner.
+- [x] Review exception responses to avoid leaking token parsing details or internal exception messages.
+- [x] Add automated tests for request size limits, rate limiting, auth failures, authorization failures, CORS, security headers, and request IDs.
+- [x] Add dependency vulnerability scanning to local or CI checks, for example `pip-audit` or an equivalent Poetry-compatible scanner.
 
 ## Known Notes
 

alembic/env.py

@@ -23,6 +23,15 @@
     UserHasRoleModel,  # noqa: F401
 )
 from src.core.config.setting import get_settings
+from src.core.security.infrastructure.models.audit_log_model import (
+    AuditLogModel,  # noqa: F401
+)
+from src.core.security.infrastructure.models.error_trace_model import (
+    ErrorTraceModel,  # noqa: F401
+)
+from src.core.security.infrastructure.models.login_attempt_model import (
+    LoginAttemptModel,  # noqa: F401
+)
 from src.modules.todo.infrastructure.models.todo_model import TodoModel  # noqa: F401
 from src.modules.user.infrastructure.models.refresh_token_model import (
     RefreshTokenModel,  # noqa: F401

alembic/versions/b2f4c7d9a1e0_add_security_audit_and_login_attempts.py

@@ -0,0 +1,111 @@
+"""add security audit and login attempts
+
+Revision ID: b2f4c7d9a1e0
+Revises: aa90557ef712
+Create Date: 2026-06-19 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "b2f4c7d9a1e0"
+down_revision: Union[str, Sequence[str], None] = "aa90557ef712"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "audit_logs",
+        sa.Column("action", sa.String(length=120), nullable=False),
+        sa.Column("actor_id", sa.String(length=64), nullable=True),
+        sa.Column("resource_type", sa.String(length=80), nullable=True),
+        sa.Column("resource_id", sa.String(length=64), nullable=True),
+        sa.Column("request_id", sa.String(length=120), nullable=True),
+        sa.Column("meta", sa.JSON(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_audit_logs_action", "audit_logs", ["action"], unique=False)
+    op.create_index("ix_audit_logs_actor_id", "audit_logs", ["actor_id"], unique=False)
+    op.create_index(
+        "ix_audit_logs_created_at", "audit_logs", ["created_at"], unique=False
+    )
+    op.create_index(
+        "ix_audit_logs_request_id", "audit_logs", ["request_id"], unique=False
+    )
+
+    op.create_table(
+        "login_attempts",
+        sa.Column("email", sa.String(length=255), nullable=False),
+        sa.Column("occurred_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("locked_until", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_login_attempts_email", "login_attempts", ["email"], unique=False)
+    op.create_index(
+        "ix_login_attempts_locked_until",
+        "login_attempts",
+        ["locked_until"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_login_attempts_occurred_at",
+        "login_attempts",
+        ["occurred_at"],
+        unique=False,
+    )
+
+    op.create_table(
+        "error_traces",
+        sa.Column("error_type", sa.String(length=120), nullable=False),
+        sa.Column("message", sa.Text(), nullable=False),
+        sa.Column("traceback", sa.Text(), nullable=False),
+        sa.Column("method", sa.String(length=12), nullable=False),
+        sa.Column("path", sa.String(length=500), nullable=False),
+        sa.Column("actor_id", sa.String(length=64), nullable=True),
+        sa.Column("request_id", sa.String(length=120), nullable=True),
+        sa.Column("meta", sa.JSON(), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("id", sa.Uuid(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        "ix_error_traces_actor_id", "error_traces", ["actor_id"], unique=False
+    )
+    op.create_index(
+        "ix_error_traces_created_at", "error_traces", ["created_at"], unique=False
+    )
+    op.create_index(
+        "ix_error_traces_error_type", "error_traces", ["error_type"], unique=False
+    )
+    op.create_index("ix_error_traces_path", "error_traces", ["path"], unique=False)
+    op.create_index(
+        "ix_error_traces_request_id", "error_traces", ["request_id"], unique=False
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_error_traces_request_id", table_name="error_traces")
+    op.drop_index("ix_error_traces_path", table_name="error_traces")
+    op.drop_index("ix_error_traces_error_type", table_name="error_traces")
+    op.drop_index("ix_error_traces_created_at", table_name="error_traces")
+    op.drop_index("ix_error_traces_actor_id", table_name="error_traces")
+    op.drop_table("error_traces")
+
+    op.drop_index("ix_login_attempts_occurred_at", table_name="login_attempts")
+    op.drop_index("ix_login_attempts_locked_until", table_name="login_attempts")
+    op.drop_index("ix_login_attempts_email", table_name="login_attempts")
+    op.drop_table("login_attempts")
+
+    op.drop_index("ix_audit_logs_request_id", table_name="audit_logs")
+    op.drop_index("ix_audit_logs_created_at", table_name="audit_logs")
+    op.drop_index("ix_audit_logs_actor_id", table_name="audit_logs")
+    op.drop_index("ix_audit_logs_action", table_name="audit_logs")
+    op.drop_table("audit_logs")

src/core/bootstrap/middleware.py

@@ -2,8 +2,13 @@
 from fastapi.middleware.cors import CORSMiddleware
 
 from src.core.config.setting import get_settings
-from src.core.middleware.request_size import LimitRequestSizeMiddleware
 from src.core.middleware.auth import AuthenticationMiddleware
+from src.core.middleware.audit_logging import AuditLoggingMiddleware
+from src.core.middleware.idempotency import IdempotencyMiddleware
+from src.core.middleware.request_id import RequestIDMiddleware
+from src.core.middleware.request_size import LimitRequestSizeMiddleware
+from src.core.middleware.security_headers import SecurityHeadersMiddleware
+from src.core.middleware.structured_logging import StructuredLoggingMiddleware
 
 settings = get_settings()
 
@@ -13,11 +18,16 @@ def register_middleware(app: FastAPI):
         LimitRequestSizeMiddleware,
         max_upload_size=settings.MAX_REQUEST_SIZE_MB,
     )
+    app.add_middleware(SecurityHeadersMiddleware)
     app.add_middleware(
         CORSMiddleware,
         allow_origins=settings.cors_allow_origins,
         allow_credentials=True,
         allow_methods=settings.cors_allow_methods,
         allow_headers=settings.cors_allow_headers,
     )
+    app.add_middleware(IdempotencyMiddleware)
+    app.add_middleware(StructuredLoggingMiddleware)
+    app.add_middleware(AuditLoggingMiddleware)
     app.add_middleware(AuthenticationMiddleware)
+    app.add_middleware(RequestIDMiddleware)

src/core/config/setting.py

@@ -35,6 +35,20 @@ class Settings(BaseSettings):
     )
     CORS_ALLOW_METHODS: str = Field(alias="CORS_ALLOW_METHODS", default="*")
     CORS_ALLOW_HEADERS: str = Field(alias="CORS_ALLOW_HEADERS", default="*")
+    SECURITY_CONTENT_SECURITY_POLICY: str = Field(
+        alias="SECURITY_CONTENT_SECURITY_POLICY",
+        default="default-src 'self'; frame-ancestors 'none'",
+    )
+    IDEMPOTENCY_TTL_SECONDS: int = Field(alias="IDEMPOTENCY_TTL_SECONDS", default=86400)
+    ACCOUNT_LOCKOUT_MAX_ATTEMPTS: int = Field(
+        alias="ACCOUNT_LOCKOUT_MAX_ATTEMPTS", default=5
+    )
+    ACCOUNT_LOCKOUT_WINDOW_MINUTES: int = Field(
+        alias="ACCOUNT_LOCKOUT_WINDOW_MINUTES", default=15
+    )
+    ACCOUNT_LOCKOUT_DURATION_MINUTES: int = Field(
+        alias="ACCOUNT_LOCKOUT_DURATION_MINUTES", default=15
+    )
     MAX_REQUEST_SIZE_MB: int = Field(
         alias="MAX_REQUEST_SIZE_MB", default=5 * 1024 * 1024
     )