Authentication and authorization

Implemented identity boundary

Identity validates configuration at startup, hashes passwords, signs JWT access tokens, and stores refresh sessions and token history in PostgreSQL. Refresh rotation, session revocation, account state checks, password change, verification, and recovery are described in the authentication guide.

JWT_SECRET must contain at least 32 bytes. Access lifetime is limited to 1–24 hours and refresh/session lifetime to 1–365 days. Process variables override file values, including explicitly empty values. Configuration loading alone does not validate every consuming dependency; the identity module supplies JWT-specific checks.

Platform and organization roles

Implemented Admin operations resolve the access token through Identity and verify platform-admin records. They fail closed when required capabilities are absent. Organization-admin membership is a separate concept from a platform admin or super_admin grant. New organization portal, doctor, patient, prescription and billing operations declare future permissions in OpenAPI but currently return 501 without implementing those permission checks.

The Authorization service implements scoped roles, own/any grants, direct allow/deny overrides and protected owner authority. Admin and Organization expose its management endpoints; other services receive public permission-check capabilities. Live identity and membership eligibility are checked without a permission cache. Resource-owning services load ownership facts and enforce lifecycle rules. Working Admin data routes and preserved legacy organization routes now require permissions. Contract-only business routes retain their documented 501 behavior. See ADR-017.

Operational handling

Use dedicated production credentials and encrypted database/broker connections. The development console email adapter prints complete message bodies, including verification and reset tokens; replace it with an appropriate provider through email.Sender for deployed delivery. CORS defaults to *; configure CORS_ORIGINS for the intended browser clients. Consult actual middleware behavior before treating CORS as an authentication boundary.

A docs container serves static files and does not enforce API authorization. The checked-in OpenAPI servers determine where interactive API requests are sent; hosting docs locally does not automatically select a localhost API.

Medicine reader and administration routes are operational with authentication, authorization, and audit deferred in the initial implementation. Their OpenAPI operations do not declare bearer authentication.