All 12 ModulesModule 4 of 12
Security + JWT + RBAC
Module 4: Enterprise Authentication & Role-Based Access Control (RBAC)
Implement secure JWT authentication, rotating refresh tokens in httpOnly cookies, hierarchical RBAC permissions, Route Guards, and OWASP security hardening.
JWTRefresh TokensRBACbcryptRoute GuardsHTTP InterceptorsHelmetOWASP Top 10Rate Limiting
Level 1: Build
Level 1: Build — Secure Auth & RBAC Subsystem
Implement end-to-end authentication with role hierarchy (ADMIN, NETWORK_ENGINEER, OPERATOR, VIEWER).
User Story:
As a Security Architect, I require strict RBAC enforcement preventing OPERATOR and VIEWER roles from modifying core router configurations.
Key Deliverables & Specifications:
- Access Token (15m expiration) + Refresh Token rotation pattern
- Express `authorizeRoles(...roles)` middleware
- Angular `AuthGuard` and `RoleGuard` functional guards with `canActivateFn`
- bcrypt password hashing with work factor 12
Implementation Roadmap:
1. **Password Hashing**: Hash user passwords on write using `bcrypt.hash(password, 12)`.
2. **Issue Tokens**: Sign JWT with RS256 or secure HS256 secret.
3. **Protect Routes**: Build `verifyJwt` and `requireRole(['ADMIN', 'NETWORK_ENGINEER'])`.
4. **Angular Interceptor**: Catch 401 Unauthorized and automatically invoke `/api/auth/refresh` without interrupting user UX.