# AUTHENTICATION & AUTHORIZATION

[← Data Layer Abstraction](./02-data-layer-abstraction.md) | [Next: Validation Rules →](./04-validation-business-rules.md)

---

## Authentication

- **JWT (JSON Web Tokens)**: Token-based authentication
- **Password Hashing**: bcrypt
- **Session Management**: Token expiration, refresh tokens
- **Multi-factor Authentication (MFA)**: Optional
- **Single Sign-On (SSO)**: SAML, OAuth2 (Optional)

---

## Authorization (RBAC)

- **Role-Based Access Control**: Roles define permissions
- **Scope-based Access**: Project/SPV level access control
- **Permission Matrix**: Resource + Action combinations
- **Override Permissions**: Additional permissions per user

Chi tiết: [User Management & RBAC](../02-functional-requirements/07-user-management-rbac.md)

---

## Implementation

- **Middleware**: `auth.middleware.ts` - Verify JWT tokens
- **Middleware**: `rbac.middleware.ts` - Check permissions
- **Service**: `auth.service.ts` - Login, logout, token management

---

**Next**: [Validation & Business Rules](./04-validation-business-rules.md)