📋 PM Board
Sub-task EP-09-T03-S03 Kritik 09_auth erpbom-backend

Login rate-limit — ikki o'lchov (IP + login), R34/Q50

Bajarildi
Status:

Tavsif

🔴 **Ikkala o'lchov ham majburiy** (R34): login o'lchovi `users.failed_login_count`/`locked_until`; IP o'lchovi `ip_login_locks`. Ikkalasi ham **5 urinish → 15 daqiqa**. 🔴 **Tekshiruv TARTIBI:** IP qulfi `username` bo'yicha qidiruvdan **OLDIN** (§2.3g). Aks holda hujumchi mavjud bo'lmagan username bilan kelganda oqim `users` qidiruvida to'xtaydi va IP hisoblagichiga umuman yetib bormaydi. 🔴 **Javob — `423`, `401` EMAS.** Akkaunt qulfi ham, IP qulfi ham `423` va **aynan bir xil javob tanasi** bilan qaytadi; klient qaysi o'lchov qulflaganini **ajrata olmasligi kerak** (enumeration). 🔴 **Haqiqat manbai — PostgreSQL, keshlanmaydi** (R55 b): ilova restart'ida oyna nolga tushmaydi (E8/AC51). Hisoblagich **faqat o'sha o'lchovda muvaffaqiyatli login** bo'lganda nolga tushadi. Qulflanganda `auth_logs` ga `account_locked` yoziladi. ⛔ **Qo'lda ochish (manual unlock) — v1 da YO'Q** (ikkala o'lchovda ham); qulf faqat `locked_until` o'tishi bilan ochiladi. Yangi rule kodi yaratilmaydi. 🔴 IP qulfi yuzaga kelganda adminga xabar (`auth.ip_locked_admin`, Q55) — 10_notifications epicida ulanadi; bu yerda faqat hodisa nuqtasi qoldiriladi (port/no-op, forward-ref 2 naqshi).

Qabul mezonlari (DoD)

6 / 6 bajarildi

  • Bir IP dan 5 xato urinishdan keyin 6-si `423` beradi — hatto har safar BOSHQA (mavjud bo'lmagan) username bilan kelinsa ham — AC21

    qa-ep-09-t03-s03 · 2 о аввал

  • Bir login bo'yicha 5 xato urinishdan keyin 6-si `423` beradi

    qa-ep-09-t03-s03 · 2 о аввал

  • Akkaunt qulfi va IP qulfi javob tanasi BAYT-BAYT bir xil (test solishtiradi) — AC24 enumeration sharti

    qa-ep-09-t03-s03 · 2 о аввал

  • IP qulfi `username` qidiruvidan oldin tekshiriladi (mavjud bo'lmagan username bilan ham hisoblagich oshadi)

    qa-ep-09-t03-s03 · 2 о аввал

  • Ilova restart qilingandan keyin ham qulf kuchda qoladi (DB dan o'qiladi) — AC51(b)

    qa-ep-09-t03-s03 · 2 о аввал

  • Muvaffaqiyatli login o'sha o'lchov hisoblagichini nolga tushiradi

    qa-ep-09-t03-s03 · 2 о аввал

O'zgargan fayllar

9 ta

  • modified src/test/java/uz/erpbom/auth/service/LoginRateLimitServiceTest.java
  • modified src/main/java/uz/erpbom/auth/repository/UserRepository.java
  • modified src/main/java/uz/erpbom/common/exception/GlobalExceptionHandler.java
  • modified src/main/java/uz/erpbom/common/exception/AccountLockedException.java
  • modified src/main/java/uz/erpbom/auth/service/LoginRateLimitService.java
  • modified src/main/java/uz/erpbom/auth/service/NoopIpLockedAdminNotificationPort.java
  • modified src/main/java/uz/erpbom/auth/service/IpLockedAdminNotificationPort.java
  • modified src/main/java/uz/erpbom/auth/repository/IpLoginLockRepository.java
  • modified src/main/java/uz/erpbom/auth/entity/IpLoginLock.java

Izoh qoldirish

Tarix

29 yozuv

  • ✎

    team-lead-ep-09 yangiladi

    Yangilandi: pr_url

  • 🔗

    team-lead-ep-09 bog'liqlik qo'shdi

    → EP-09-T03-S01

  • ✎

    team-lead-ep-09 yangiladi

    Yangilandi: estimate_hours

  • ⇄

    qa-ep-09-t03-s03 statusni o'zgartirdi Review → Bajarildi

  • 💬

    qa-ep-09-t03-s03 izoh qoldirdi

    QA tasdiqladi. Spec 09_auth.md #2.3g bilan solishtirildi: ip_login_locks (ip inet PK, failed_login_count, locked_until, updated_at) V6 migratsiyada aynan spec jadvaliga mos; tenant_id/organization_id yoq (AR-1). LoginRateLimitService: assertIpNotLocked/assertAccountNotLocked readOnly=true, register* @Transactional; hech qanday static/in-process kesh yoq - AC701 kod darajasida tasdiqlandi. 423 ACCOUNT_LOCKED sobit kod+xabar (GlobalExceptionHandler), openapi/v1/auth.yaml AccountLocked misoli bilan soz-ma-soz mos. AuditService reuse haqiqiy (EP-09-T04-S03 dan) - registerAccountFailure orqali chaqirilishi kodda tasdiqlandi, secrets filtri bor. Testlar: flock ostida mvn -Dtest=LoginRateLimitServiceTest - 7/7 yashil (Testcontainers PostgreSQL 16). Mutatsiya tekshiruvi: AC699 uchun assertAccountNotLocked xabariga qoshimcha matn qoshib test ataylab buzildi (AssertionFailedError kutilganidek chiqdi), song kod asl holiga tiklandi (git diff toza). AC700 shu subtaskda faqat mexanizm darajasida (users qatorisiz IP hisoblagich ishlashi) tekshirilgan - haqiqiy chaqiruv tartibi EP-09-T07-S01/AC2083 da olchanadi, buni spec ozi aniq belgilagan (2.3g). Login endpoint hali yozilmagan (S02 backlog) - bu subtask faqat mexanizm, javadoc bilan mos. Cross-cutting 8 band tekshirildi: buzilish topilmadi.

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ Muvaffaqiyatli login o'sha o'lchov hisoblagichini nolga tushiradi

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ Ilova restart qilingandan keyin ham qulf kuchda qoladi (DB dan o'qiladi) — AC51(b)

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ IP qulfi `username` qidiruvidan oldin tekshiriladi (mavjud bo'lmagan username bilan ham hisoblagich oshadi)

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ Akkaunt qulfi va IP qulfi javob tanasi BAYT-BAYT bir xil (test solishtiradi) — AC24 enumeration sharti

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ Bir login bo'yicha 5 xato urinishdan keyin 6-si `423` beradi

  • ✓

    qa-ep-09-t03-s03 qabul mezonini belgiladi

    ✓ Bir IP dan 5 xato urinishdan keyin 6-si `423` beradi — hatto har safar BOSHQA (mavjud bo'lmagan) username bilan kelinsa ham — AC21

  • ⇄

    backend-1 statusni o'zgartirdi Ishlanyapti → Review

  • ✎

    backend-1 yangiladi

    Yangilandi: branch, commit_sha

  • 💬

    backend-1 izoh qoldirdi

    LoginRateLimitService — ikkala o'lchov ham PostgreSQL (SELECT ... FOR UPDATE bilan lost-update himoyasi), 423 ACCOUNT_LOCKED sobit kod/xabar bilan (yangi AccountLockedException, kod parametrsiz konstruktor — enumeration invarianti tur darajasida majburlangan). auth_logs account_locked yozuvi uchun mavjud (parallel EP-09-T04-S03) AuditService.log(...) reuse qilindi — o'zim alohida entity/repository yaratmadim (avval JPA entity yozgan edim, keyin AuthLogRepository allaqachon JdbcTemplate asosida composite PK/inet/jsonb uchun ongli tarzda qurilganini ko'rib, o'z versiyamni olib tashladim). IP qulfi uchun auth.ip_locked_admin (Q55) — IpLockedAdminNotificationPort interfeysi + NoopIpLockedAdminNotificationPort default bean sifatida qoldirildi (10_notifications ulanganda almashtiriladi). Login endpoint (S02) hali backlog — bu barg faqat mexanizm, S02 assertIpNotLocked -> username qidiruv -> assertAccountNotLocked -> parol -> registerIpFailure/registerAccountFailure yoki registerIpSuccess/registerAccountSuccess tartibida chaqirishi kerak (LoginRateLimitService javadoc'ida yozilgan). Testlar: LoginRateLimitServiceTest, 7 ta, Testcontainers PostgreSQL 16, AC697-702 hammasi qamrab olingan, yashil. Butun auth+common test suite (29 klass) ham yashil qoldi.

  • 📄

    backend-1 fayllarni qayd etdi

    9 ta fayl qayd etildi

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ Muvaffaqiyatli login o'sha o'lchov hisoblagichini nolga tushiradi

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ Ilova restart qilingandan keyin ham qulf kuchda qoladi (DB dan o'qiladi) — AC51(b)

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ IP qulfi `username` qidiruvidan oldin tekshiriladi (mavjud bo'lmagan username bilan ham hisoblagich oshadi)

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ Akkaunt qulfi va IP qulfi javob tanasi BAYT-BAYT bir xil (test solishtiradi) — AC24 enumeration sharti

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ Bir login bo'yicha 5 xato urinishdan keyin 6-si `423` beradi

  • ✓

    backend-1 qabul mezonini belgiladi

    ✓ Bir IP dan 5 xato urinishdan keyin 6-si `423` beradi — hatto har safar BOSHQA (mavjud bo'lmagan) username bilan kelinsa ham — AC21

  • ⇄

    backend-1 statusni o'zgartirdi Tayyor → Ishlanyapti

    Agent ishni boshladi

  • ⚑

    backend-1 ishga oldi

  • ⇄

    coder-ep-09-t03-s04 statusni o'zgartirdi Ishlanyapti → Tayyor

    Xato bilan next-task orqali claim qilindi — bu ish mening topshirig’imga kirmaydi (S04 bilan shug’ullanaman); boshqa agent ishlasin.

  • ⚐

    coder-ep-09-t03-s04 bo'shatdi

    Xato bilan next-task orqali claim qilindi — bu ish mening topshirig’imga kirmaydi (S04 bilan shug’ullanaman); boshqa agent ishlasin.

  • ⇄

    coder-ep-09-t03-s04 statusni o'zgartirdi Backlog → Ishlanyapti

    Agent ishni boshladi

  • ⚑

    coder-ep-09-t03-s04 ishga oldi

  • 🔗

    pm-agent bog'liqlik qo'shdi

    → EP-09-T03-S01

  • ✦

    pm-agent yaratdi

    Login rate-limit — ikki o'lchov (IP + login), R34/Q50

Ma'lumot

Agent
backend-1
Olingan
2 о аввал
Boshlandi
17.08.2026 21:27
Tugadi
17.08.2026 21:54
Baho
5 soat
Spec
erp/docs/modules/09_auth.md#2.3g
Branch
feat/EP-09-erpbom-backend
Commit
62b4963ec94b
Pull request →

Bog'liqliklar

Agent uchun

Bu ishni AI agent quyidagicha oladi:

curl -s -X POST https://pmboard.ferp.uz/api/items/EP-09-T03-S03/claim \
  -H "X-Agent: backend-dev-1"

Tugatgach:

curl -s -X POST https://pmboard.ferp.uz/api/items/EP-09-T03-S03/status \
  -H "X-Agent: backend-dev-1" \
  -H "Content-Type: application/json" \
  -d '{"status":"review","note":"..."}'