Orchestrata Ultimate / RTM / 099-security-auth-framework
RTM: 099-security-auth-framework
Requirement to symbol to test rows for 099-security-auth-framework: Security & Auth Framework.
At a glance
| Item | Value |
|---|---|
| Requirement IDs | 171 |
Traced from src/ |
0 (0.0%) |
| Untraced | 171 |
Cited from tests/ |
0 (0.0%) |
Traced in src/ but not cited from tests/ |
0 |
Reading this matrix
This matrix lists each of the 171 requirement IDs of spec 099-security-auth-framework with the src/ symbols that cite it and the tests that cite it. 0 of them (0.0%) have at least one citing symbol and 171 have none.
0 requirements are also cited from tests/, and 0 are traced in code but never named by a test. A test citation is a @traces on a test function; it shows intent to cover, not that the test runs or reaches the symbol.
Rows showing none in the symbols column are the gaps to close first. The densest untraced groups are REQ-099-* (171).
Requirement to symbols to tests
| Requirement | Symbols in src/ |
Tests citing it |
|---|---|---|
REQ-099-001 The system SHALL allow a CLI user to authenticate with an API key. The key SHALL be... |
none | none |
REQ-099-002 The system SHALL allow a security admin to enable multi-factor authentication. MFA... |
none | none |
REQ-099-003 Login SHALL create a session carrying a JWT, the session SHALL expire after 24 hours,... |
none | none |
REQ-099-004 A security officer SHALL be able to revoke all active sessions and invalidate all API... |
none | none |
REQ-099-005 The system SHALL represent a User conforming to the schema above: id, email,... |
none | none |
REQ-099-006 The system SHALL represent an API Key conforming to the schema above: id, user_id,... |
none | none |
REQ-099-007 The system SHALL represent a Session conforming to the schema above: id, user_id,... |
none | none |
REQ-099-008 The system SHALL represent an MFA setup conforming to the schema above: secret... |
none | none |
REQ-099-009 The system MUST support API key authentication for CLI and programmatic access. |
none | none |
REQ-099-010 The system MUST support OAuth 2.0 authentication for web UI access. |
none | none |
REQ-099-011 The system MUST support session-based authentication with JWT tokens. |
none | none |
REQ-099-012 The system MUST support MFA using TOTP (Time-based One-Time Password). |
none | none |
REQ-099-013 The system MUST support MFA using SMS backup codes. |
none | none |
REQ-099-014 The system MUST validate all authentication tokens before allowing access. |
none | none |
REQ-099-015 The system MUST expire authentication tokens after configurable duration. |
none | none |
REQ-099-016 The system MUST query PAM++ for all authorization decisions. |
none | none |
REQ-099-017 The system MUST enforce RBAC (Role-Based Access Control) across all resources. |
none | none |
REQ-099-018 The system MUST support permission levels: global, project, resource, and action. |
none | none |
REQ-099-019 The system MUST deny access by default when no explicit allow policy exists. |
none | none |
REQ-099-020 The system MUST provide fine-grained permission control at the resource level. |
none | none |
REQ-099-021 The system MUST create sessions upon successful authentication. |
none | none |
REQ-099-022 The system MUST invalidate sessions on logout. |
none | none |
REQ-099-023 The system MUST enforce session expiry (24 hours default). |
none | none |
REQ-099-024 The system MUST support refresh tokens valid for 7 days. |
none | none |
REQ-099-025 The system MUST invalidate all sessions during security incidents. |
none | none |
REQ-099-026 The system MUST hash API keys with bcrypt before storage. |
none | none |
REQ-099-027 The system MUST support token revocation with immediate effect. |
none | none |
REQ-099-028 The system MUST maintain token blacklist in Redis. |
none | none |
REQ-099-029 The system MUST encrypt sensitive data fields with AES-256-GCM. |
none | none |
REQ-099-030 The system MUST support automatic key rotation (monthly for DEKs). |
none | none |
REQ-099-031 The system MUST enforce per-user rate limits. |
none | none |
REQ-099-032 The system MUST implement stricter limits on authentication endpoints. |
none | none |
REQ-099-033 The system MUST block accounts after 5 failed login attempts. |
none | none |
REQ-099-034 The system MUST implement progressive login delays. |
none | none |
REQ-099-035 The system MUST log all authentication events. |
none | none |
REQ-099-036 The system MUST log all authorization decisions. |
none | none |
REQ-099-037 The system MUST implement tamper-resistant audit logs using hash chains. |
none | none |
REQ-099-038 The system MUST maintain audit logs for 7 years. |
none | none |
REQ-099-039 The system MUST provide audit log verification capabilities. |
none | none |
REQ-099-040 The system MUST enforce password policies (12+ chars, complexity). |
none | none |
REQ-099-041 The system MUST detect common passwords and reject them. |
none | none |
REQ-099-042 The system MUST lock accounts after threshold failed attempts. |
none | none |
REQ-099-043 The system MUST support emergency token revocation. |
none | none |
REQ-099-044 The system MUST encrypt password hashes in storage. |
none | none |
REQ-099-045 The system MUST generate unique TOTP secrets for each user. |
none | none |
REQ-099-046 The system MUST generate backup codes for MFA recovery. |
none | none |
REQ-099-047 The system MUST prevent backup code reuse. |
none | none |
REQ-099-048 The system MUST require MFA verification after sensitive operations. |
none | none |
REQ-099-049 The system SHALL detect each of the conditions ERR-001 through ERR-030 listed above... |
none | none |
REQ-099-050 Revoked tokens SHALL be stored in Redis under the key revoked:{token_hash}, where... |
none | none |
REQ-099-051 Invalidating all sessions for a user SHALL delete every session held in that user's... |
none | none |
REQ-099-052 TOTP setup SHALL generate a random base32 secret, SHALL return a provisioning QR code... |
none | none |
REQ-099-053 The system SHALL generate 10 backup codes, each of 8 numeric digits, and SHALL accept... |
none | none |
REQ-099-054 After 5 failed login attempts the account SHALL be locked for 1800 seconds (30... |
none | none |
REQ-099-055 Authorization decisions SHALL be requested from PAM++ as `can_perform(user, action,... |
none | none |
REQ-099-056 The system SHALL expose POST /api/v1/auth/login, accepting { email, password } and... |
none | none |
REQ-099-057 The system SHALL expose POST /api/v1/auth/refresh, accepting { refresh_token } and... |
none | none |
REQ-099-058 The system SHALL expose POST /api/v1/auth/logout, accepting { token } and... |
none | none |
REQ-099-059 The system SHALL expose POST /api/v1/auth/api-keys, accepting `{ name, permissions,... |
none | none |
REQ-099-060 The system SHALL expose POST /api/v1/auth/mfa/setup, accepting { method } of... |
none | none |
REQ-099-061 The system SHALL expose POST /api/v1/auth/mfa/verify, accepting { code } and... |
none | none |
REQ-099-062 The system SHALL expose POST /api/v1/auth/mfa/disable, accepting { password } and... |
none | none |
REQ-099-063 The system SHALL expose GET /api/v1/sessions, returning the caller's sessions, and... |
none | none |
REQ-099-064 The system SHALL expose DELETE /api/v1/sessions/{session_id}, returning `{ success... |
none | none |
REQ-099-065 The system SHALL expose DELETE /api/v1/sessions, which deletes every session of the... |
none | none |
REQ-099-066 The system SHALL expose POST /api/v1/auth/authorize, accepting `{ action, resource,... |
none | none |
REQ-099-201 Authentication latency MUST be under 50ms for token validation |
none | none |
REQ-099-202 Authorization queries MUST complete within 100ms (PAM++ timeout: 5s) |
none | none |
REQ-099-203 Session creation MUST complete within 200ms |
none | none |
REQ-099-204 Token refresh MUST complete within 100ms |
none | none |
REQ-099-205 System MUST support 10,000 concurrent authenticated sessions |
none | none |
REQ-099-206 Authentication service MUST scale horizontally with load balancer |
none | none |
REQ-099-207 Session store MUST support Redis cluster for high availability |
none | none |
REQ-099-208 Token blacklist operations MUST complete within 10ms |
none | none |
REQ-099-209 Rate limiting MUST support distributed counters |
none | none |
REQ-099-210 Authentication service MUST achieve 99.9% uptime (SLA) |
none | none |
REQ-099-211 Maximum downtime for deployments MUST NOT exceed 5 minutes |
none | none |
REQ-099-212 Rate limiting MUST NOT cause false positives during traffic spikes |
none | none |
REQ-099-213 PAM++ unavailability MUST trigger fail-secure mode |
none | none |
REQ-099-214 All passwords MUST be hashed with bcrypt (cost factor 12+) |
none | none |
REQ-099-215 All API keys MUST be hashed with bcrypt before storage |
none | none |
REQ-099-216 Encryption at rest MUST use AES-256-GCM |
none | none |
REQ-099-217 TLS 1.3 REQUIRED for all connections |
none | none |
REQ-099-218 MFA MUST be available for all user roles |
none | none |
REQ-099-219 Audit logs MUST be tamper-resistant (hash chain) |
none | none |
REQ-099-067 The Authentication Service SHALL be a stateless REST API that handles API-key, OAuth... |
none | none |
REQ-099-068 The Authorization Engine SHALL delegate every authorization decision to PAM++, SHALL... |
none | none |
REQ-099-069 Token Management SHALL issue JWT access tokens valid for 1 hour and refresh tokens... |
none | none |
REQ-099-070 The Session Store SHALL run on a Redis cluster for high availability, SHALL store... |
none | none |
REQ-099-071 Secrets Management SHALL integrate with HashiCorp Vault or AWS Secrets Manager, SHALL... |
none | none |
REQ-099-072 Audit Logging SHALL store entries with hash chains for tamper resistance, SHALL keep... |
none | none |
REQ-099-073 Every request SHALL pass through the auth middleware, which SHALL validate the token... |
none | none |
REQ-099-074 Login SHALL create a 24-hour session, issue a 1-hour access token and a 7-day refresh... |
none | none |
REQ-099-075 An authorization request SHALL extract the user and the required permission, query... |
none | none |
REQ-099-076 The system SHALL implement middleware that validates tokens before request handling,... |
none | none |
REQ-099-077 The system SHALL implement a UserRepository for user database operations, a... |
none | none |
REQ-099-078 The system SHALL implement interchangeable strategies for authentication (API key,... |
none | none |
REQ-099-079 The system SHALL implement observers for security-event audit logging,... |
none | none |
REQ-099-080 The users table SHALL hold id, email (unique, not null), name, role,... |
none | none |
REQ-099-081 The api_keys table SHALL hold id, user_id (foreign key to users), name,... |
none | none |
REQ-099-082 The sessions table SHALL hold id, user_id (foreign key to users),... |
none | none |
REQ-099-083 PAM++ decisions SHALL be cached in Redis under... |
none | none |
REQ-099-084 Token validation results SHALL be cached in per-instance memory under... |
none | none |
REQ-099-085 Rate-limit counters SHALL be held in Redis under ratelimit:{user_id}:{endpoint} as a... |
none | none |
REQ-099-086 User permissions SHALL be cached in Redis under perms:{user_id} with a 3600-second... |
none | none |
REQ-099-087 The system SHALL apply defence in depth: WAF, DDoS protection and VPN requirement at... |
none | none |
REQ-099-088 The system SHALL follow a zero-trust architecture: it SHALL authenticate and authorize... |
none | none |
REQ-099-089 The system SHALL be secure by default: access SHALL be denied unless an explicit allow... |
none | none |
REQ-099-090 Data at rest SHALL be encrypted with AES-256-GCM under key rotation, data in transit... |
none | none |
REQ-099-220 The system SHALL emit metrics for authentication success and failure rates,... |
none | none |
REQ-099-221 Logs SHALL be structured JSON, SHALL carry correlation IDs for request tracing, SHALL... |
none | none |
REQ-099-222 The system SHALL alert on failed-login thresholds being exceeded, unusual... |
none | none |
REQ-099-223 Dashboards SHALL present real-time authentication metrics, authorization decision... |
none | none |
REQ-099-091 Governance policies SHALL be defined in Prolog syntax, SHALL be evaluated in order of... |
none | none |
REQ-099-092 The policy engine SHALL support Access Control Policies (ACP), Data Governance... |
none | none |
REQ-099-093 When a user attempts an action, the auth middleware SHALL validate authentication, the... |
none | none |
REQ-099-094 The system SHALL implement the compliance controls listed above: SOC 2 CC6.1, CC6.2... |
none | none |
REQ-099-095 GitHub OAuth SHALL use the authorization URL... |
none | none |
REQ-099-096 Google OAuth SHALL use the authorization URL... |
none | none |
REQ-099-097 GitLab OAuth SHALL use the authorization URL https://gitlab.com/oauth/authorize, the... |
none | none |
REQ-099-098 The HashiCorp Vault backend SHALL take its address from VAULT_ADDR, SHALL... |
none | none |
REQ-099-099 The AWS Secrets Manager backend SHALL take a configurable region, SHALL authenticate... |
none | none |
REQ-099-100 Session storage SHALL run on a Redis cluster of at least 3 master nodes, with AOF... |
none | none |
REQ-099-101 Audit records SHALL be written as JSON with a hash chain, held in Elasticsearch hot... |
none | none |
REQ-099-102 Authentication SHALL be accepted only when users can authenticate with email and... |
none | none |
REQ-099-103 Authorization SHALL be accepted only when PAM++ queries return the correct decisions,... |
none | none |
REQ-099-104 MFA SHALL be accepted only when TOTP setup generates unique secrets, TOTP verification... |
none | none |
REQ-099-105 Security SHALL be accepted only when passwords meet the complexity requirements, API... |
none | none |
REQ-099-106 Audit SHALL be accepted only when all authentication events and authorization... |
none | none |
REQ-099-107 Rate limiting SHALL be accepted only when authentication endpoints carry stricter... |
none | none |
REQ-099-108 Compliance SHALL be accepted only when the SOC 2 controls, GDPR Article 32, PCI DSS... |
none | none |
REQ-099-224 Components SHALL log all major operations at appropriate log levels, SHALL include... |
none | none |
REQ-099-225 The system SHALL expose operation duration histograms, request and error rate... |
none | none |
REQ-099-226 The system SHALL propagate traces across component boundaries, SHALL attach... |
none | none |
REQ-099-227 The system SHALL raise critical alerts on error-rate spikes, performance degradation,... |
none | none |
REQ-099-228 The operational dashboard SHALL present real-time system health, performance trends,... |
none | none |
REQ-099-109 The PAM++ client SHALL be configured with the PAM++ host, port, API-key authentication... |
none | none |
REQ-099-110 On a PAM++ timeout the system SHALL log a PAM_TIMEOUT_ALLOW event and allow access;... |
none | none |
REQ-099-111 Per-endpoint rate limits SHALL be enforced as 5 requests per 300 seconds on... |
none | none |
REQ-099-112 Accounts SHALL be locked after 5 failed login attempts for 1800 seconds, and login... |
none | none |
REQ-099-113 Each audit entry SHALL carry the previous entry's hash and a timestamp, SHALL be... |
none | none |
REQ-099-114 Audit-chain verification SHALL recompute every entry's hash and SHALL raise a tamper... |
none | none |
REQ-099-115 Passwords SHALL be at least 12 and at most 128 characters, SHALL contain uppercase,... |
none | none |
REQ-099-116 The system SHALL support API-key authentication for CLI and scripts, OAuth 2.0 for the... |
none | none |
REQ-099-117 An API key SHALL be presented as Authorization: Bearer <key>, SHALL carry the sk_... |
none | none |
REQ-099-118 The OAuth 2.0 flow SHALL redirect the user to the provider, SHALL accept the... |
none | none |
REQ-099-119 The session token SHALL be a JWT expiring after a configurable 24 hours with a 7-day... |
none | none |
REQ-099-120 The system SHALL provide the built-in roles admin (full system access), auditor... |
none | none |
REQ-099-121 Data at rest SHALL be encrypted: database fields with AES-256-GCM, file storage on an... |
none | none |
REQ-099-122 Data in transit SHALL be encrypted: all HTTP over TLS 1.3, all WebSocket traffic over... |
none | none |
REQ-099-123 The master key SHALL be held in an HSM or secure vault, data encryption keys SHALL be... |
none | none |
REQ-099-124 The master key SHALL be rotated annually by manual action, data encryption keys SHALL... |
none | none |
REQ-099-125 Secrets management SHALL support HashiCorp Vault and AWS Secrets Manager as backends,... |
none | none |
REQ-099-126 The authentication middleware SHALL extract the token from the request header, SHALL... |
none | none |
REQ-099-127 The authorization middleware SHALL determine the permission required by the route,... |
none | none |
REQ-099-128 The rate-limiting middleware SHALL identify the requesting user, SHALL check that... |
none | none |
REQ-099-129 The audit log SHALL capture, for authentication the user, method, IP and result; for... |
none | none |
REQ-099-130 Each audit entry SHALL carry event_id, event_type, timestamp, the acting user's... |
none | none |
REQ-099-131 Audit records SHALL be searchable in hot storage for 90 days, archived for 7 years,... |
none | none |
REQ-099-132 The security configuration SHALL accept the enabled authentication methods, a session... |
none | none |
REQ-099-133 The system SHALL read SECRET_KEY for the master encryption key, OAUTH_CLIENT_ID... |
none | none |
REQ-099-134 Authentication failures SHALL be reported as AUTH-001 invalid API key, AUTH-002 API... |
none | none |
REQ-099-135 Authorization failures SHALL be reported as AUTHZ-001 access denied with HTTP status... |
none | none |
REQ-099-136 Every error response SHALL carry the error code, the message, the details (reason,... |
none | none |
REQ-099-229 The security test suite SHALL prove that authentication succeeds with valid... |
none | none |
REQ-099-230 The system SHALL prevent SQL injection, cross-site scripting, cross-site request... |
none | none |
REQ-099-231 The system SHALL conform to the OWASP Top 10, SOC 2 Type II, the GDPR data-handling... |
none | none |
REQ-099-137 Responses SHALL carry the security headers `Strict-Transport-Security:... |
none | none |
REQ-099-138 Security incidents SHALL be classified and answered within the stated response times:... |
none | none |
REQ-099-139 Incident response SHALL follow the steps detect, contain, eradicate, recover, document... |
none | none |
REQ-099-140 The framework SHALL depend on PyJWT >=2.8 for JWT handling, passlib >=1.7 for password... |
none | none |