MishkaCms Accounts Domain - Complete user authentication and authorization system.

This Ash domain provides comprehensive user management capabilities including authentication, authorization, permission management, and secure token handling for the MishkaCms platform. Built with security-first principles and modern authentication patterns.

Domain Architecture

Organizes user and security resources into a cohesive system:

• User Management: User registration, authentication, and profile management
• Permission System: Role-based access control with granular permissions
• Token Management: Secure token generation and validation
• Password Security: Secure password handling with reset capabilities
• API Integration: RESTful endpoints for authentication workflows

Resource Organization

MishkaCmsCore.Accounts/
├── User - Core user accounts with authentication
├── Token - Secure token management for sessions/API access
├── Permission - System permissions and capabilities
└── UserPermission - User-permission relationship mapping

Key Features

• Password Authentication: Secure password-based user authentication
• Token-based API Access: JWT or similar token system for API authentication
• Permission Management: Granular permission assignment and validation
• Password Reset: Secure password reset via email tokens
• User Registration: Streamlined user onboarding process
• Profile Management: User profile updates and management
• Admin Controls: Administrative user and permission management

Permission Management

An admin permission is admin:<surface>:<area>, a plain string written where it is used. Accounts are managed with the user area, and what they hold with the permission area:

alias MishkaCmsCore.Accounts.Checks.AccessPermissions

# Grant an account what the granter holds (`admin:<surface>:permission`, within its ceiling)
user
|> Ash.Changeset.for_update(:assign_permissions, %{permission_ids: ids}, actor: granter)
|> Ash.update()

# Ask what a user holds
AccessPermissions.match?(user, %{}, permissions: ["admin:dashboard:runtime:page"])

Security Features

Password Security

• Secure password hashing (likely Argon2 or bcrypt)
• Password strength validation
• Secure password reset workflow
• Protection against timing attacks

Token Security

• Secure token generation and validation
• Token expiration and refresh capabilities
• API endpoint protection via token authentication
• Automatic token metadata in authentication responses

Permission System

• Granular permission assignment
• Role-based access control (RBAC)
• Permission validation middleware
• Administrative permission management

Error Handling

The domain includes comprehensive error handling:

• Authentication failures with proper HTTP status codes
• Invalid token handling
• Permission denied responses
• User not found scenarios
• Password reset token validation

Multi-tenant Considerations

• Users can have different permissions per site/tenant
• Token validation respects tenant boundaries
• Permission checks include tenant context
• Administrative operations scoped to appropriate tenants

Production Considerations

• Monitor authentication attempt rates and patterns
• Implement proper session timeout policies
• Regular audit of user permissions and access
• Secure token storage and transmission
• Password policy enforcement
• Account lockout policies for security
• Regular cleanup of expired tokens
• Comprehensive audit logging of authentication events