Backend engineering · Security · TypeScript
Identity,
under pressure.
- Tests passing
- 136
- API endpoints
- 25
- Security layers
- 14
- Runtime
- Node 20
Login is a security workflow, not a form.
A convincing identity service must survive hostile state changes. A password can be guessed. A refresh token can be copied. A reset link can be abused. A valid user can request an operation their role should not allow.
This project makes those boundaries explicit in the architecture and verifies them with unit, integration and end to end tests.
Four boundaries before trust.
- 01Identity
Password, Google or GitHub OAuth, then TOTP MFA when enabled.
- 02Policy
Zod validation, rate limits, lockout and role checks reject unsafe requests.
- 03Session
Short lived RS256 access tokens pair with rotating refresh token families.
- 04Evidence
Audit events, request IDs, metrics and health checks preserve operational context.
Controls mapped to failure modes.
Security claims are presented as concrete mechanisms, not generic feature labels.
Credential attack
Argon2id hashing, account lockout and Redis backed sliding window rate limits.
Token theft
RS256 access tokens, refresh token rotation, token families and reuse detection.
Session abuse
Device level session visibility, revocation, blacklist checks and forced global logout.
Privilege misuse
Role based guards, validated request boundaries and structured security audit events.
Recovery failure
Single use reset tokens, expiry, secure delivery and session invalidation after reset.
Invisible operations
Request IDs, Pino logs, Prometheus metrics, health checks and Grafana dashboards.
Typed at every important boundary.
What the implementation demonstrates.
01RepeatabilityDocker Compose brings up the API, PostgreSQL, Redis, Prometheus and Grafana as one environment.
02Boundary coverageThe test suite covers successful flows and failure paths across authentication, MFA, OAuth, sessions and administration.
03Operational visibilityHealth endpoints, structured logs and metrics expose state that would otherwise remain hidden.
04Known limitThis is a portfolio implementation, not a third party audited identity provider. Production use would still require independent review, load testing and deployment specific hardening.