Skip to main content

Authentication & Session Management

Status

Owner: Tech lead · Status: draft · Canonical source: flezi.app.api.backend/app/features/auth/

Covers user identity verification, single sign-on (SSO), and token lifecycles.

Authentication Mechanisms​

  1. Local Authentication: Email and password hashed with bcrypt.
  2. Enterprise SSO (Microsoft Entra ID): OpenID Connect federation for enterprise workforce directories.
  3. Google OAuth2: Token verification via Google Workspace identity endpoints.

Token Architecture​

  • Access Token (JWT): Short-lived (60 min), HS256 signed with secrets from Azure Key Vault.
  • Refresh Token: Stored in DB/Redis with instantaneous revocation upon logout.
  • Internal Service Token: Symmetric internal authorization between Backend and AI Runtime (X-Internal-Service-Token).

Existing Controls​

  • Silent-refresh request queue on the frontend mitigating token-refresh race conditions.
  • Rate limiting on authentication endpoints to prevent brute-force attacks.

Evidence (Files & Configuration)​

  • flezi.app.api.backend/app/features/auth/
  • flezi.app.api.backend/app/middleware/security.py

Limitations & Roadmap​

  • Mandatory Multi-Factor Authentication (MFA/TOTP) for local administrator accounts.