Epic: Security, Reliability, and Testing Lifecycle Hardening

# Epic: Security, Reliability, and Testing Lifecycle Hardening

**Epic ID:** `EPIC-SEC-RELIABILITY-01`
**Status:** Draft / Ready for Review
**Priority:** High
**Parent Initiative:** System Hardening & Compliance
**Target Architecture:** Rust (Axum, SeaORM, Keycloak) + React (TypeScript, TanStack Query, IndexedDB)

---

## Epic Overview

This epic establishes the comprehensive framework, codebase updates, and verification processes required to ensure the **CoopData** platform meets industry-standard security, reliability, testing, and compliance baselines.

The platform handles cooperative financial and non-financial data, including:

- Apex-initiated submissions
- Multi-tier compliance tracking
- Cooperative financial reporting
- Offline-first workflows
- Authentication and authorization
- Data synchronization
- KPI and analytics processing

The system must guarantee:

- Strong tenant/data isolation
- Protection against injection attacks
- Protection against brute-force attacks
- Secure authentication and authorization
- Robust auditability
- Safe error handling
- Reliable offline operation
- Idempotent synchronization
- Graceful degradation
- Concurrency protection
- Automated testing
- CI/CD security controls
- Dependency vulnerability monitoring

---

# Implementation Checklist

## Focus Area A — Application Security & Identity Management

- [x] #136

**Labels:** `security`, `backend`, `frontend`, `validation`
**Priority:** High

### Objective

Prevent untrusted input from causing:

- SQL injection
- Cross-Site Scripting (XSS)
- Command injection
- Malicious file/input payload execution

### Backend Requirements

- Audit all DTOs under `backend/src/api/dto/`.
- Validate incoming API payloads using the Rust `validator` crate.
- Ensure database operations use SeaORM's query builder.
- Do not use raw SQL strings with user-controlled values.
- Prohibit unsafe SQL string concatenation.
- Audit all repositories under `backend/src/repositories/`.
- Ensure user input is never passed directly to `std::process::Command`.
- If dynamic command arguments are required, validate them against strict allowlists.

### Frontend Requirements

- Use React's default JSX escaping.
- Validate form input using Zod.
- Audit `frontend/src/pages/cooperative/ManualEntryWizard.tsx`.
- Any dynamic HTML rendered with `dangerouslySetInnerHTML` must first be sanitized using `DOMPurify`.

### Acceptance Criteria

- [ ] All API DTOs have appropriate validation.
- [ ] `ManualEntryWizard.tsx` validates data types, formats, and lengths.
- [ ] No repository contains unsafe SQL string concatenation.
- [ ] Dynamic HTML is sanitized using `DOMPurify`.
- [ ] User-controlled input cannot reach command execution without validation.

### Verification

- Run `npm run lint`.
- Run `cargo clippy`.
- Run security/AST scanners.
- Test XSS payloads such as `alert(1)`.
- Test SQL injection payloads such as `' OR 1=1 --`.

---

- [x] #137

**Labels:** `security`, `authentication`, `authorization`, `rbac`
**Priority:** High

### Objective

Implement a strict **Double-Gatekeeper RBAC architecture**:

1. Frontend authorization for UX/navigation.
2. Backend authorization as the final security boundary.

### Frontend Requirements

- Audit `frontend/src/router/ProtectedRoute.tsx`.
- Protect routes based on authenticated roles.
- Hide unauthorized sidebar modules.
- Prevent cooperative users from accessing Ministry-only UI.

### Backend Requirements

- Validate Keycloak JWTs on every protected request.
- Inspect claims through `backend/src/auth/claims.rs`.
- Validate:
- User identity
- Roles
- Tenant/organization ID
- Implement granular role authorization.
- Support roles:
- `ministry`
- `federation`
- `apex`
- `cooperative`
- Apply authorization at router/handler level.

### Acceptance Criteria

- [ ] All protected routes require authentication.
- [ ] All protected backend endpoints validate JWTs.
- [ ] Role permissions are enforced server-side.
- [ ] Unauthorized requests return `401 Unauthorized` or `403 Forbidden`.
- [ ] Client-side authorization is never treated as the final security boundary.

### Verification

- Authenticate as a cooperative user.
- Attempt to access `/api/v1/ministry/*`.
- Verify the response is `403 Forbidden`.

---

- [x] #139

**Labels:** `security`, `authentication`, `session-management`
**Priority:** High

### Objective

Minimize the vulnerability window of stolen credentials/tokens and ensure inactive sessions are terminated.

### Requirements

- Configure Keycloak access tokens with a 5-minute lifespan.
- Configure refresh tokens with a 30-minute idle timeout.
- Maintain a 10-minute inactivity timeout.
- Track:
- `mousemove`
- `mousedown`
- `keydown`
- `touchstart`
- `scroll`
- Store authentication data in IndexedDB using `idb-keyval`.
- Do not use `localStorage` for JWT storage.
- Logout must invalidate the Keycloak session.
- Logout must immediately clear local authentication data.

### Relevant Files

- `frontend/src/context/AuthContext.tsx`
- `frontend/src/services/shared/authService.ts`

### Acceptance Criteria

- [ ] 10 minutes of inactivity terminates the session.
- [ ] Client redirects to `/`.
- [ ] Tokens are removed from IndexedDB.
- [ ] `keycloak.logout()` is called.
- [ ] Offline authentication cache is cleared appropriately.

### Verification

- Simulate 10 minutes without user activity.
- Confirm automatic logout.
- Confirm token storage is empty.

---

- [x] #129

**Labels:** `security`, `authentication`, `keycloak`
**Priority:** High

### Objective

Enforce strong password requirements.

### Keycloak Password Policy

Configure:

- Minimum length: 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one digit
- At least one special character
- Password must not contain username/email contents

### Local Authentication

If credentials are processed locally:

- Use Argon2id.
- Use the Rust `argon2` crate.
- Do not use MD5.
- Do not use SHA-1.
- Do not use weak bcrypt configurations.

### Acceptance Criteria

- [ ] Weak passwords are rejected.
- [ ] Keycloak realm password policy is configured.
- [ ] Registration enforces the password policy.
- [ ] Password reset enforces the password policy.

### Verification

Test passwords such as:

- `password123`
- `12345678`

Both must be rejected.

---

- [x] #130

**Labels:** `security`, `secrets`, `devops`
**Priority:** High

### Objective

Ensure credentials and secrets never exist in source control.

### Requirements

- Load secrets from environment variables.
- Audit `backend/src/config.rs`.
- Ensure `.env` files are never committed.
- Maintain `.env.example`.
- Use `.gitleaks.toml`.
- Add pre-commit secret scanning.
- Support production secret managers such as:
- AWS Secrets Manager
- HashiCorp Vault

### Acceptance Criteria

- [ ] Repository builds using `.env.example`.
- [ ] No hard-coded passwords exist.
- [ ] No API keys exist in source code.
- [ ] No private keys exist in source code.
- [ ] `.env` is ignored by Git.
- [ ] Production secrets can be loaded externally.

### Verification

```bash
gitleaks detect --source=. --verbose
```

---

- [x] #134

**Labels:** `security`, `backend`, `rate-limiting`, `api`
**Priority:** High

### Objective

Protect sensitive API endpoints against brute-force attacks and abuse.

### Requirements

Implement Axum rate limiting using:

- `tower-limit`
- or Redis-backed token bucket

### Target Endpoints

- `/api/v1/auth/login`
- Maximum: 5 attempts/minute/IP
- `/api/v1/sync/push`
- Maximum: 60 operations/minute/client

### Acceptance Criteria

- [ ] Rate limiting is applied.
- [ ] Exceeding limits returns `429 Too Many Requests`.
- [ ] Response contains `Retry-After`.
- [ ] Limits are configurable.

### Verification

Send multiple requests rapidly and verify:

- HTTP `429 Too Many Requests`

---

- [x] #145

**Labels:** `security`, `devops`, `nginx`, `ddos`
**Priority:** High

### Objective

Protect the application before traffic reaches Axum.

### Requirements

Configure Nginx using `nginx-host.conf`.

Implement:

- `limit_req_zone`
- IP-based throttling
- Connection limits where appropriate

Document WAF/CDN configuration using:

- Cloudflare
- AWS WAF

Include policies for:

- Volumetric throttling
- Geofencing
- Bad bot blocking

### Acceptance Criteria

- [ ] Nginx blocks excessive requests.
- [ ] High-rate traffic does not reach Axum.
- [ ] WAF configuration is documented.
- [ ] Load testing confirms edge protection.

### Verification

- Review Nginx configuration.
- Execute load tests against the ingress endpoint.

---

- [x] #146

**Labels:** `security`, `multi-tenancy`, `data-isolation`, `backend`
**Priority:** Critical

### Objective

Ensure users can only access data belonging to their authorized tenant.

### Requirements

- Audit all repositories under `backend/src/repositories/`.
- Apply tenant filters to database queries.
- Resolve tenant identity from backend claims.
- Never trust tenant IDs supplied by the client.
- Enforce role scope using backend `ScopeEnforcement`.

### Acceptance Criteria

- [ ] Tenant filters are applied to all relevant queries.
- [ ] Tenant IDs are derived from authenticated claims.
- [ ] Cross-tenant reads are blocked.
- [ ] Cross-tenant updates are blocked.
- [ ] Cross-tenant deletes are blocked.
- [ ] Unauthorized access returns `403` or `404`.

### Verification

Authenticate as Tenant A.
Attempt to access:

```
GET /api/v1/cooperative/submissions/{tenant_b_submission_id}
```

Expected result:

- `403 Forbidden`
- or `404 Not Found`

---

## Focus Area B — Reliability, Fault Tolerance & Data Isolation

- [x] #149

**Labels:** `security`, `audit`, `logging`, `compliance`
**Priority:** High

### Objective

Maintain an immutable record of sensitive system actions.

### Actions to Audit

- Data creation
- Data updates
- Data deletion
- Role changes
- Submission approvals
- Submission rejections
- Important authentication events

### Requirements

Audit middleware: `backend/src/api/middleware.rs`

Capture:

- Timestamp
- User ID
- IP address
- User agent
- Action
- Old state
- New state

Store audit information in `audit_logs` or forward structured logs to an immutable external store.

### Acceptance Criteria

- [ ] Sensitive mutations generate audit records.
- [ ] Audit records contain actor information.
- [ ] Audit records contain action type.
- [ ] Audit records contain old/new state where applicable.
- [ ] Normal APIs cannot modify audit records.
- [ ] Normal APIs cannot delete audit records.

### Verification

Perform a cooperative balance sheet update.
Confirm the corresponding audit record exists.

---

- [x] #147

**Labels:** `security`, `backend`, `frontend`, `error-handling`
**Priority:** High

### Objective

Prevent sensitive implementation details from being exposed to users.

### Backend Requirements

Audit: `backend/src/error.rs`

Internal logs may contain:

- Database errors
- Stack information
- Internal details

API responses must only expose safe information such as:

- `bad_request`
- `unauthorized`
- `forbidden`
- `not_found`
- `internal_server_error`

### Frontend Requirements

- Implement React Error Boundaries.
- Add custom 404 page: `frontend/src/pages/shared/NotFoundPage.tsx`

### Acceptance Criteria

- [ ] No stack traces are returned to clients.
- [ ] No SQL errors are returned to clients.
- [ ] No filesystem paths are returned.
- [ ] Internal details are logged using `tracing`.
- [ ] Custom 404 page exists.
- [ ] UI failures are handled gracefully.

### Verification

Trigger a database constraint error.
Confirm:

- Backend logs contain technical details.
- Frontend displays a safe user-friendly message.

---

- [ ] #148

**Labels:** `reliability`, `offline-first`, `frontend`, `indexeddb`
**Priority:** High

### Objective

Allow core workflows to continue during network or external-service failures.

### Requirements

- Use IndexedDB/Dexie repositories.
- Queue local changes when offline.
- Detect `navigator.onLine`.
- Rehydrate appropriate application state from local storage.
- Provide clear offline UI states.
- Gracefully handle unavailable external services.
- Disable unavailable AI extraction features instead of displaying raw API errors.

### Relevant Files

- `frontend/src/context/AuthContext.tsx`
- `frontend/src/pages/cooperative/ManualEntryWizard.tsx`

### Acceptance Criteria

- [ ] Manual entry continues when offline.
- [ ] Data is persisted in IndexedDB.
- [ ] Pending changes are queued.
- [ ] UI clearly indicates offline state.
- [ ] External service failures do not crash the application.

### Verification

Use Chrome DevTools:
**Network → Offline**

Verify:

- Manual entry still loads.
- Navigation works.
- Data persists locally.
- Pending synchronization is retained.

---

- [x] #155

**Labels:** `reliability`, `backend`, `sync`, `idempotency`
**Priority:** High

### Objective

Prevent duplicate records and improve synchronization reliability.

### Idempotency Requirements

Audit: `backend/src/api/middleware.rs`

Ensure idempotency middleware applies to:

- `POST`
- `PUT`
- `PATCH`

Requests must contain:

- `x-correlation-id` (UUID)

### Retry Requirements

Implement exponential backoff:

- Initial delay: 1 second
- Double after each failure
- Maximum delay: 60 seconds
- Add random jitter

### Acceptance Criteria

- [ ] Mutating requests support idempotency.
- [ ] Same correlation ID does not create duplicate records.
- [ ] Initial response can be reused for repeated requests.
- [ ] Sync retries use exponential backoff.
- [ ] Jitter is implemented.

### Verification

Send two simultaneous requests with the same `x-correlation-id`.

Expected:

- Only one database record is created.
- Second request receives the original/cached response.

---

- [ ] **T13 — Circuit Breakers & Service Fallbacks**

**Labels:** `reliability`, `backend`, `resilience`, `fault-tolerance`
**Priority:** High

### Objective

Prevent failing external services from blocking the entire platform.

### Target Dependencies

- Keycloak
- AI/PDF extraction pipeline
- External APIs
- Other critical service integrations

### Requirements

Implement circuit breaker behavior using appropriate Rust tooling or native timeout mechanisms.

Proposed configuration:

- More than 5 failures within 10 seconds → open circuit.
- Circuit remains open for 30 seconds.
- Requests fail fast while circuit is open.

### Fallbacks

Example:
AI extraction unavailable → Allow manual data entry

### Acceptance Criteria

- [ ] External service timeouts are enforced.
- [ ] Circuit breaker opens after configured failures.
- [ ] Requests fail fast when circuit is open.
- [ ] Fallback functionality is available.
- [ ] Axum workers are not blocked indefinitely.

### Verification

Inject artificial latency into Keycloak.
Verify subsequent requests:

- Time out safely.
- Do not block the backend.
- Use fallback behavior where applicable.

---

- [ ] **T14 — Concurrency & Race Condition Prevention**

**Labels:** `reliability`, `database`, `concurrency`, `backend`
**Priority:** High

### Objective

Prevent concurrent writes from causing lost updates or inconsistent data.

### Requirements

Implement optimistic locking using:

- `version: i32` on critical entities such as submissions.

Use atomic database updates where appropriate.

Example:

```sql
UPDATE table
SET value = value + 1
WHERE id = ?
```

Add database-level constraints for critical relationships.

Example:

- `cooperative + reporting_year + submission_type`

### Acceptance Criteria

- [ ] Optimistic locking exists for critical entities.
- [ ] Concurrent updates are detected.
- [ ] Secondary conflicting updates return `409 Conflict`.
- [ ] Critical uniqueness constraints exist.
- [ ] Atomic updates are used where required.

### Verification

Run parallel update requests against the same financial record.

Expected:

- First update succeeds.
- Conflicting update returns `409 Conflict`.
- No silent overwrite occurs.

---

## Focus Area C — Quality Assurance, CI/CD & Security Compliance

- [ ] #157

**Labels:** `testing`, `backend`, `frontend`, `e2e`
**Priority:** High

### Objective

Establish automated testing for critical system functionality.

### Backend Unit Tests

Use: `cargo test`
Cover: `backend/src/services/kpi_engine.rs`

### Frontend Unit Tests

Use: Vitest

### Integration Tests

Create route-level tests covering:

- Authentication
- Authorization
- Headers
- Middleware
- API responses
- Data isolation

Relevant location: `backend/src/test.rs`

### E2E Tests

Use Playwright.

Test:

- Login
- Manual form entry
- Dashboard rendering
- Navigation
- Authorization
- Offline workflows

### Acceptance Criteria

- [ ] Backend unit tests exist.
- [ ] Frontend unit tests exist.
- [ ] Backend integration tests exist.
- [ ] Playwright E2E tests exist.
- [ ] Critical workflows are covered.
- [ ] Tests pass locally.

---

- [ ] **T16 — Regression Tests**

**Labels:** `testing`, `ci`, `regression`
**Priority:** High

### Objective

Prevent previously fixed bugs and vulnerabilities from returning.

### Requirements

Implement the rule:

> Every bug fix must include a regression test reproducing the original problem.

Integrate regression tests into:

- GitHub Actions
- or GitLab CI

### Acceptance Criteria

- [ ] Bug-fixing PRs include regression tests.
- [ ] Regression tests run automatically.
- [ ] Failed regression tests block merges.
- [ ] Branch pushes trigger the regression suite.

### Verification

Create a test that reproduces a known bug.
Confirm CI fails when the bug is reintroduced.

---

- [x] **T17 — Load & Stress Testing**

**Labels:** `testing`, `performance`, `load-testing`, `k6`
**Priority:** High

### Objective

Determine system capacity and behavior under heavy load.

### Tooling

Use:

- k6
- or Locust

### Test Scenarios

Simulate:

- 1,000 concurrent cooperative users submitting financial statements.
- High-frequency analytics requests.
- Concurrent synchronization operations.
- Authentication traffic.

### SLA Targets

- 95% of requests under 200ms.
- Error rate below 0.1%.
- System recovers without manual restart.

### Acceptance Criteria

- [ ] Load tests exist.
- [ ] 1,000 concurrent-user scenario is tested.
- [ ] Analytics load is tested.
- [ ] SLA metrics are measured.
- [ ] Results are documented.
- [ ] System recovers after load.

### Verification

Execute tests against staging and document:

- Throughput
- Latency
- Error rate
- CPU
- Memory
- Database performance

---

- [ ] **T18 — Chaos & Resilience Testing**

**Labels:** `testing`, `chaos`, `reliability`, `docker`
**Priority:** High

### Objective

Verify the platform can recover from infrastructure and dependency failures.

### Failure Scenarios

Test:

- Database connection loss.
- Redis failure.
- Keycloak timeout.
- Backend dependency timeout.
- Network interruption.

### Docker Requirements

Verify `docker-compose.yml` uses appropriate restart policies such as:

```yaml
restart: unless-stopped
```

### Acceptance Criteria

- [ ] Database failure is tested.
- [ ] Redis failure is tested.
- [ ] Keycloak failure is tested.
- [ ] Services recover automatically.
- [ ] No data corruption occurs.
- [ ] Backend reconnects after dependency recovery.

### Verification

Example:

```bash
docker stop db
```

During active processing:

- Stop the database.
- Restore the database.
- Verify backend recovery.
- Verify transaction integrity.

---

- [ ] **T19 — Test Coverage Thresholds in CI**

**Labels:** `testing`, `ci`, `code-coverage`, `quality`
**Priority:** High

### Objective

Maintain minimum automated test coverage.

### Tooling

- Rust: `tarpaulin`
- TypeScript: `vitest --coverage`

### Coverage Requirement

Minimum required coverage: **80%**

### Acceptance Criteria

- [ ] Rust coverage is measured.
- [ ] TypeScript coverage is measured.
- [ ] CI generates coverage reports.
- [ ] CI enforces the 80% minimum.
- [ ] PRs below 80% are blocked.
- [ ] Coverage reports are available for review.

### Verification

Intentionally reduce test coverage.
Confirm the CI pipeline fails.

---

- [ ] **T20 — Code Review Process & Engineering Standards**

**Labels:** `code-review`, `github`, `security`, `ci`
**Priority:** High

### Objective

Standardize security and quality review before code reaches production.

### GitHub PR Template

Create a Pull Request template containing checks for:

- Input validation
- Authentication
- Authorization
- Tenant isolation
- Error handling
- Tests added
- Regression tests
- Dependency changes reviewed
- Security implications reviewed
- Secrets checked

### Branch Protection

Configure protection for important branches, especially `main`.

Require:

- At least 1 peer approval.
- Successful CI checks.
- Passing tests.
- Passing security scans.
- No unresolved required checks.

### Acceptance Criteria

- [ ] PR template exists.
- [ ] Security checklist is enforced.
- [ ] Branch protection is active.
- [ ] Peer approval is required.
- [ ] CI must pass before merge.

### Verification

Attempt to merge a PR without approval or passing CI.
Confirm GitHub blocks the merge.

---

- [ ] **T21 — Dependency Scanning & Security Patching**

**Labels:** `security`, `dependencies`, `devops`, `ci`
**Priority:** High

### Objective

Continuously identify and remediate vulnerable dependencies.

### Requirements

Integrate one or more of:

- Trivy
- Dependabot

Run security scans on:

- Pull requests
- Main branch
- Scheduled CI workflows

### Severity Policy

Block builds when vulnerabilities are:

- High
- Critical

### Acceptance Criteria

- [ ] Dependency scanning is automated.
- [ ] PRs are scanned.
- [ ] High vulnerabilities block builds.
- [ ] Critical vulnerabilities block builds.
- [ ] Dependency updates are tracked.
- [ ] Vulnerability remediation is documented.

### Verification

Run:

```bash
trivy fs --severity HIGH,CRITICAL .
```

Expected:

- 0 HIGH vulnerabilities
- 0 CRITICAL vulnerabilities

---

## Verification & Testing Matrix

| Requirement | Primary Verification | Command / Method | Expected Result |
| ------------------------------ | --------------------- | ----------------------------------- | ------------------------------------------------ |
| Input Sanitization | ESLint / AST / Clippy | `npm run lint` + `cargo clippy` | Zero security-related warnings |
| Authentication & Authorization | Integration Tests | `cargo test --test auth_integration`| Unauthorized requests return 401 / 403 |
| Rate Limiting | k6 | `k6 run scripts/rate_limit_test.js` | HTTP 429 above threshold |
| Data Isolation | Multi-Tenant Tests | `cargo test --test isolation` | Cross-tenant access blocked |
| Audit Trails | Database Verification | `psql -c "SELECT * FROM audit_logs;"` | Actions correctly recorded |
| Idempotency | Concurrency Test | `python scripts/test_idempotency.py`| Duplicate request does not create duplicate data |
| Dependency Security | Trivy | `trivy fs --severity HIGH,CRITICAL .` | No HIGH/CRITICAL vulnerabilities |
| E2E Workflows | Playwright | Playwright test suite | Critical user workflows pass |
| Coverage | Tarpaulin / Vitest | Coverage CI pipeline | Minimum 80% coverage |
| Load Testing | k6 / Locust | Staging load test | SLA requirements achieved |
| Chaos Testing | Docker | Dependency failure simulation | Automatic recovery |
| RBAC | Integration Tests | Role-specific API tests | Unauthorized roles receive 403 |
| Session Expiry | Browser/E2E | Inactivity simulation | User is logged out |
| Error Handling | API Tests | Invalid request scenarios | No internal details exposed |
| Concurrency | Integration Tests | Parallel update requests | Conflicting update returns 409 |

---

## Suggested Implementation Order

### Sprint 1 — Critical Security Foundation
- T1 — Input Sanitization & Injection Prevention
- T2 — Authentication, Authorization, Roles & Permissions
- T5 — Secrets Management
- T8 — Multi-Tenancy & Data Isolation

### Sprint 2 — Authentication & API Protection
- T3 — Session Management & Token Expiry
- T4 — Password Complexity Rules
- T6 — Rate Limiting
- T7 — IP Rate Limiting & DDoS Protection

### Sprint 3 — Reliability & Resilience
- T9 — Audit Trails
- T10 — Safe Error Handling
- T11 — Offline Operations
- T12 — Retry & Idempotency
- T13 — Circuit Breakers
- T14 — Concurrency Protection

### Sprint 4 — Testing Foundation
- T15 — Unit, Integration & E2E Tests
- T16 — Regression Tests
- T17 — Load & Stress Testing

### Sprint 5 — CI/CD & Production Hardening
- T18 — Chaos & Resilience Testing
- T19 — Coverage Thresholds
- T20 — Code Review & Branch Protection
- T21 — Dependency Scanning

---

## Definition of Done

The epic is considered complete only when:

- [ ] All 21 tickets are completed.
- [ ] All critical security requirements are implemented.
- [ ] Multi-tenant isolation has been verified.
- [ ] Authentication and authorization have been tested.
- [ ] Rate limiting is operational.
- [ ] Secrets are removed from source control.
- [ ] Audit logging is operational.
- [ ] Offline workflows are functional.
- [ ] Idempotency is verified.
- [ ] Concurrency protection is verified.
- [ ] Unit tests are implemented.
- [ ] Integration tests are implemented.
- [ ] E2E tests are implemented.
- [ ] Regression tests are enforced.
- [ ] Load tests have been executed.
- [ ] Chaos tests have been executed.
- [ ] Minimum 80% test coverage is enforced.
- [ ] GitHub branch protection is active.
- [ ] Pull request security checklist is active.
- [ ] Dependency scanning is active.
- [ ] No HIGH or CRITICAL dependency vulnerabilities remain.
- [ ] All verification scenarios pass.

---

## Final Epic Status

**Total Tickets:** 21

**Focus Areas:**
- Application Security & Identity Management: T1–T8
- Reliability, Fault Tolerance & Data Isolation: T9–T14
- Quality Assurance, CI/CD & Security Compliance: T15–T21

**Overall Priority:** High
**Epic Status:** Draft / Ready for Review
```

Review the checklist and merged PR #156 first; this is an umbrella epic rather than a single newcomer task. For a remaining item, start at the specific files or endpoints named there, such as backend/src/api/dto/, backend/src/repositories/, backend/src/auth/claims.rs, frontend/src/router/ProtectedRoute.tsx, or nginx-host.conf, then run its listed verification command and confirm its acceptance criteria.

Escrita pelo modelo de indexação a partir do texto da issue.