189 lines
5.6 KiB
Markdown
189 lines
5.6 KiB
Markdown
# Indice de Requerimientos Funcionales - MGN-001 Auth
|
|
|
|
## Resumen del Modulo
|
|
|
|
| Campo | Valor |
|
|
|-------|-------|
|
|
| **Codigo** | MGN-001 |
|
|
| **Nombre** | Auth - Autenticacion |
|
|
| **Prioridad** | P0 - Critica |
|
|
| **Total RFs** | 5 |
|
|
| **Estado** | En documentacion |
|
|
| **Fecha** | 2025-12-05 |
|
|
|
|
---
|
|
|
|
## Descripcion General
|
|
|
|
El modulo de autenticacion es el pilar fundamental de seguridad del ERP. Proporciona:
|
|
|
|
- **Autenticacion**: Verificacion de identidad del usuario
|
|
- **Autorizacion**: Generacion de tokens con permisos
|
|
- **Gestion de Sesiones**: Control del ciclo de vida de sesiones
|
|
- **Seguridad**: Proteccion contra ataques comunes
|
|
|
|
---
|
|
|
|
## Lista de Requerimientos Funcionales
|
|
|
|
| ID | Nombre | Prioridad | Complejidad | Estado | Story Points |
|
|
|----|--------|-----------|-------------|--------|--------------|
|
|
| [RF-AUTH-001](./RF-AUTH-001.md) | Login con Email y Password | P0 | Media | Aprobado | 10 |
|
|
| [RF-AUTH-002](./RF-AUTH-002.md) | Generacion y Validacion JWT | P0 | Alta | Aprobado | 9 |
|
|
| [RF-AUTH-003](./RF-AUTH-003.md) | Refresh Token y Renovacion | P0 | Media | Aprobado | 10 |
|
|
| [RF-AUTH-004](./RF-AUTH-004.md) | Logout y Revocacion | P0 | Baja | Aprobado | 6 |
|
|
| [RF-AUTH-005](./RF-AUTH-005.md) | Recuperacion de Password | P1 | Media | Aprobado | 10 |
|
|
|
|
**Total Story Points:** 45
|
|
|
|
---
|
|
|
|
## Grafo de Dependencias
|
|
|
|
```
|
|
RF-AUTH-001 (Login)
|
|
│
|
|
├──► RF-AUTH-002 (JWT Tokens)
|
|
│ │
|
|
│ └──► RF-AUTH-003 (Refresh Token)
|
|
│ │
|
|
│ └──► RF-AUTH-004 (Logout)
|
|
│
|
|
└──► RF-AUTH-005 (Password Recovery)
|
|
│
|
|
└──► RF-AUTH-004 (Logout) [logout-all]
|
|
```
|
|
|
|
### Orden de Implementacion Recomendado
|
|
|
|
1. **RF-AUTH-001** - Login (base de todo)
|
|
2. **RF-AUTH-002** - JWT Tokens (generacion)
|
|
3. **RF-AUTH-003** - Refresh Token (renovacion)
|
|
4. **RF-AUTH-004** - Logout (cierre de sesion)
|
|
5. **RF-AUTH-005** - Password Recovery (recuperacion)
|
|
|
|
---
|
|
|
|
## Endpoints del Modulo
|
|
|
|
| Metodo | Endpoint | RF | Descripcion |
|
|
|--------|----------|-----|-------------|
|
|
| POST | `/api/v1/auth/login` | RF-AUTH-001 | Autenticar usuario |
|
|
| POST | `/api/v1/auth/refresh` | RF-AUTH-003 | Renovar tokens |
|
|
| POST | `/api/v1/auth/logout` | RF-AUTH-004 | Cerrar sesion |
|
|
| POST | `/api/v1/auth/logout-all` | RF-AUTH-004 | Cerrar todas las sesiones |
|
|
| POST | `/api/v1/auth/password/request-reset` | RF-AUTH-005 | Solicitar recuperacion |
|
|
| POST | `/api/v1/auth/password/reset` | RF-AUTH-005 | Cambiar password |
|
|
| GET | `/api/v1/auth/password/validate-token/:token` | RF-AUTH-005 | Validar token reset |
|
|
|
|
---
|
|
|
|
## Tablas de Base de Datos
|
|
|
|
| Tabla | RF | Descripcion |
|
|
|-------|-----|-------------|
|
|
| `users` | RF-AUTH-001 | Usuarios (existente, agregar columnas) |
|
|
| `refresh_tokens` | RF-AUTH-002, RF-AUTH-003 | Tokens de refresh |
|
|
| `revoked_tokens` | RF-AUTH-002 | Blacklist de tokens |
|
|
| `session_history` | RF-AUTH-001, RF-AUTH-004 | Historial de sesiones |
|
|
| `login_attempts` | RF-AUTH-001 | Control de intentos fallidos |
|
|
| `password_reset_tokens` | RF-AUTH-005 | Tokens de recuperacion |
|
|
| `password_history` | RF-AUTH-005 | Historial de passwords |
|
|
|
|
---
|
|
|
|
## Criterios de Aceptacion Consolidados
|
|
|
|
### Seguridad
|
|
|
|
- [ ] Passwords hasheados con bcrypt (salt rounds = 12)
|
|
- [ ] Tokens JWT firmados con RS256
|
|
- [ ] Refresh tokens en httpOnly cookies
|
|
- [ ] Access tokens con expiracion corta (15 min)
|
|
- [ ] Deteccion de token replay
|
|
- [ ] Rate limiting en todos los endpoints
|
|
- [ ] No revelar existencia de emails
|
|
|
|
### Funcionalidad
|
|
|
|
- [ ] Login con email/password funcional
|
|
- [ ] Generacion correcta de par de tokens
|
|
- [ ] Refresh automatico antes de expiracion
|
|
- [ ] Logout individual y global
|
|
- [ ] Recuperacion de password via email
|
|
|
|
### Auditoria
|
|
|
|
- [ ] Todos los logins registrados
|
|
- [ ] Todos los logouts registrados
|
|
- [ ] Intentos fallidos registrados
|
|
- [ ] Cambios de password registrados
|
|
|
|
---
|
|
|
|
## Reglas de Negocio Transversales
|
|
|
|
| ID | Regla | Aplica a |
|
|
|----|-------|----------|
|
|
| RN-T001 | Multi-tenancy: tenant_id obligatorio en tokens | Todos |
|
|
| RN-T002 | Usuarios pueden tener multiples sesiones | RF-001, RF-003 |
|
|
| RN-T003 | Maximo 5 sesiones activas por usuario | RF-001, RF-003 |
|
|
| RN-T004 | Bloqueo despues de 5 intentos fallidos | RF-001 |
|
|
| RN-T005 | Notificaciones de seguridad via email | RF-004, RF-005 |
|
|
|
|
---
|
|
|
|
## Estimacion Total
|
|
|
|
| Capa | Story Points |
|
|
|------|--------------|
|
|
| Database | 9 |
|
|
| Backend | 23 |
|
|
| Frontend | 13 |
|
|
| **Total** | **45** |
|
|
|
|
---
|
|
|
|
## Riesgos Identificados
|
|
|
|
| Riesgo | Probabilidad | Impacto | Mitigacion |
|
|
|--------|--------------|---------|------------|
|
|
| Vulnerabilidad en manejo de tokens | Media | Alto | Code review, testing seguridad |
|
|
| Performance en blacklist | Baja | Medio | Redis con TTL automatico |
|
|
| Email delivery failures | Media | Medio | Retry queue, logs |
|
|
| Session fixation | Baja | Alto | Regenerar tokens post-login |
|
|
|
|
---
|
|
|
|
## Referencias
|
|
|
|
### Documentacion Relacionada
|
|
|
|
- [DDL-SPEC-core_auth.md](../../02-modelado/database-design/DDL-SPEC-core_auth.md) - Especificacion de base de datos
|
|
- [ET-auth-backend.md](../../02-modelado/especificaciones-tecnicas/ET-auth-backend.md) - Especificacion tecnica backend
|
|
- [TP-auth.md](../../04-test-plans/TP-auth.md) - Plan de pruebas
|
|
|
|
### Directivas Aplicables
|
|
|
|
- `DIRECTIVA-DOCUMENTACION-PRE-DESARROLLO.md`
|
|
- `DIRECTIVA-PATRONES-ODOO.md`
|
|
- `ESTANDARES-API-REST-GENERICO.md`
|
|
|
|
---
|
|
|
|
## Historial de Cambios
|
|
|
|
| Version | Fecha | Autor | Cambios |
|
|
|---------|-------|-------|---------|
|
|
| 1.0 | 2025-12-05 | System | Creacion inicial con 5 RFs |
|
|
|
|
---
|
|
|
|
## Aprobaciones
|
|
|
|
| Rol | Nombre | Fecha | Firma |
|
|
|-----|--------|-------|-------|
|
|
| Analista | System | 2025-12-05 | [x] |
|
|
| Tech Lead | - | - | [ ] |
|
|
| Product Owner | - | - | [ ] |
|