security-patterns

name	security-patterns
version	2.0.0
description	Security architecture, authentication, authorization, and compliance patterns
sasmp_version	1.3.0
bonded_agent	05-security-compliance
bond_type	PRIMARY_BOND
atomic_design	{"single_responsibility":"API security patterns and compliance","boundaries":{"includes":["authentication","authorization","encryption","rate_limiting","input_validation"],"excludes":["infrastructure_security","network_security","physical_security"]}}
parameter_validation	{"schema":{"type":"object","properties":{"auth_type":{"type":"string","enum":["jwt","oauth2","api_key","session"]},"access_control":{"type":"string","enum":["rbac","abac","policy"]},"compliance":{"type":"array","items":{"type":"string","enum":["gdpr","hipaa","pci_dss","soc2"]}}}}}
retry_config	{"enabled":false}
logging	{"level":"INFO","fields":["auth_type","user_id","action","resource","result"],"sensitive_fields_redacted":["password","token","api_key"]}
dependencies	{"skills":[],"agents":["05-security-compliance"]}

Security Patterns Skill

Purpose

Implement comprehensive security for APIs following OWASP guidelines.

Authentication Patterns

JWT Implementation

import jwt from 'jsonwebtoken';

interface TokenPayload {
  sub: string;        // User ID
  roles: string[];
  iat: number;
  exp: number;
  jti: string;        // Token ID for revocation
}

class JWTService {
  private readonly secret = process.env.JWT_SECRET!;
  private readonly accessTTL = '15m';
  private readonly refreshTTL = '7d';

  generateTokenPair(user: User) {
    const jti = crypto.randomUUID();

    const accessToken = jwt.sign(
      { sub: user.id, roles: user.roles, jti },
      this.secret,
      { expiresIn: this.accessTTL, issuer: 'api.example.com' }
    );

     refreshToken = jwt.(
      { : user., jti, :  },
      .,
      { : . }
    );

     { accessToken, refreshToken, jti };
  }

  (: ):  {
     jwt.(token, ., {
      : ,
    })  ;
  }

   (: ): <> {
      redis.();
  }
}