{
  "product": "Specification (reference)",
  "title": "Auth Service",
  "summary": "Registration, sessions, password reset, OAuth providers and role checks.",
  "category": "services",
  "entries": [
    {
      "path": [
        "AI",
        "Accounts",
        "Register with email + password"
      ],
      "value": "",
      "status": "yes",
      "note": "password hashed argon2/bcrypt, never stored plain"
    },
    {
      "path": [
        "AI",
        "Accounts",
        "Email verification"
      ],
      "value": "signed token link",
      "status": "yes",
      "note": "unverified accounts limited"
    },
    {
      "path": [
        "AI",
        "Accounts",
        "Password reset flow"
      ],
      "value": "expiring token",
      "status": "yes",
      "note": "single-use; invalidates sessions on reset"
    },
    {
      "path": [
        "AI",
        "Accounts",
        "Change password (authenticated)"
      ],
      "value": "",
      "status": "yes",
      "note": "requires current password"
    },
    {
      "path": [
        "AI",
        "Sessions",
        "Login issues JWT access + refresh"
      ],
      "value": "short/long lived",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "AI",
        "Sessions",
        "Refresh-token rotation"
      ],
      "value": "",
      "status": "yes",
      "note": "reuse detection revokes family"
    },
    {
      "path": [
        "AI",
        "Sessions",
        "Logout / revoke"
      ],
      "value": "",
      "status": "yes",
      "note": "single session and all-sessions"
    },
    {
      "path": [
        "AI",
        "Security",
        "Rate limiting on auth endpoints"
      ],
      "value": "",
      "status": "yes",
      "note": "per IP + per account"
    },
    {
      "path": [
        "AI",
        "Security",
        "Account lockout / backoff on failures"
      ],
      "value": "",
      "status": "yes",
      "note": "with unlock path"
    },
    {
      "path": [
        "AI",
        "Security",
        "Audit log of auth events"
      ],
      "value": "",
      "status": "yes",
      "note": "login, reset, revoke, lockout"
    },
    {
      "path": [
        "AI",
        "API",
        "Standard error contract"
      ],
      "value": "no user enumeration",
      "status": "yes",
      "note": "same response for unknown email vs wrong password"
    },
    {
      "path": [
        "AI",
        "API",
        "Health + readiness endpoints"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "UI",
        "Pages",
        "Login and register forms"
      ],
      "value": "",
      "status": "yes",
      "note": "inline validation"
    },
    {
      "path": [
        "UI",
        "Pages",
        "Forgot/reset password pages"
      ],
      "value": "",
      "status": "yes",
      "note": ""
    },
    {
      "path": [
        "UI",
        "Pages",
        "Session management view"
      ],
      "value": "active sessions, revoke",
      "status": "yes",
      "note": ""
    }
  ]
}