d69da5ff4c
feat(udt-011): T400.10 — inject TimeProvider into all Application handlers
...
All command handlers that call domain mutators now inject TimeProvider
via constructor and use _timeProvider.GetUtcNow().UtcDateTime as the
explicit 'now' argument. Replaces previous direct DateTime.UtcNow usage.
2026-04-18 10:12:17 -03:00
b619c05762
feat(audit): security events en Auth + authorization handlers (UDT-010 B9)
...
Instruments auth pipeline with ISecurityEventLogger per #REQ-AUTH-SEC:
LoginCommandHandler:
- login success → action=login result=success actorUserId=user.Id
- login failure disaggregated internally (client still sees 401 unified):
user_not_found / user_inactive / invalid_password
— attempts captured with attemptedUsername + FailureReason
LogoutCommandHandler:
- action=logout result=success actorUserId=cmd.UsuarioId
RefreshCommandHandler:
- refresh.issue success on successful rotation
- refresh.reuse_detected failure when revoked token is presented (chain
revoke already happens; we add the security event with metadata.familyId)
- refresh.issue failure for: token_expired / sub_mismatch / user_not_found /
user_inactive
PermissionAuthorizationHandler:
- permission.denied failure on require-permission rejection, with metadata
{ permissionRequired, endpoint, method }. ActorUserId from JWT sub.
DI: ISecurityEventLogger was already registered by B6 (AddInfrastructure).
Test updates: 4 test classes now inject ISecurityEventLogger mock:
- LoginCommandHandlerTests, LogoutCommandHandlerTests, RefreshCommandHandlerTests
- PermissionAuthorizationHandlerTests (Api.Tests)
Suite: 378/378 Application.Tests + 141/141 Api.Tests = 519/519 passing.
Refs: sdd/udt-010-auditoria-trazabilidad/{spec#REQ-SEC-2/3/4/5 #REQ-AUTH-SEC,
design, tasks#B9}
2026-04-16 13:59:27 -03:00
fb07a1139a
feat(application): LoginCommandHandler usa PermisoResolver para permisos efectivos [UDT-009]
2026-04-15 21:29:33 -03:00
9dcd63543e
feat(auth): extend LoginResponse with username + mustChangePassword + ultimoLogin [UDT-008]
2026-04-15 17:39:48 -03:00
cdb8dcd03c
feat(api): login response permisos desde RolPermiso [UDT-006]
2026-04-15 16:24:21 -03:00
3d598faffc
feat(api): UDT-003 registro de usuarios — backend completo (Phases 1-6)
...
- Domain: Usuario.ForCreation factory, UsernameAlreadyExistsException, IUsuarioRepository extendido
- Application: CreateUsuarioCommand/Validator/Handler, UsuarioCreatedDto, AuthOptions password policy
- Infrastructure: UsuarioRepository.ExistsByUsernameAsync + AddAsync (INSERT OUTPUT INSERTED.Id), RoleClaimType="rol" en TokenValidationParameters
- Api: UsuariosController POST api/v1/users [Authorize(Roles="admin")], ExceptionFilter mapea UsernameAlreadyExistsException + SqlException 2627 → 409
- Tests (unit): 43 tests — 33 validator + 10 handler (107 total, green)
- Tests (integration): 7 tests CreateUsuarioEndpoint — 401/403/400/201/409/race/e2e (green)
- Fix: TestWebAppFactory.ConfigureTestServices reemplaza SqlConnectionFactory singleton con CS de test correcto
2026-04-15 10:47:48 -03:00
8bbd2b6f2a
feat(app): update LoginCommandHandler to persist hashed refresh token on login
2026-04-14 13:28:16 -03:00
6c02197369
feat(app): implement LogoutCommand handler with idempotent revocation
2026-04-14 13:28:10 -03:00
f5e67b78a5
feat(app): implement RefreshCommand handler with token rotation and chain revocation
2026-04-14 13:28:06 -03:00
8c26cd3ac5
feat(udt-001): application layer with LoginCommandHandler and ports
2026-04-13 21:36:01 -03:00
