Authentication and RBAC
How AlnnectGroup handles login, session, and fine-grained access control in the Module → Page → Operation model.
Secure login by default
Authentication uses a JWT stored in an HttpOnly cookie, with rotating refresh, token blacklist, and account lockout after failed attempts. Passwords use PBKDF2 with a high derivation cost.
Permissions that make sense
RBAC is hierarchical: each role gets operations (view, create, edit, delete) per page, and pages group into modules. Enforcement is fail-closed — when in doubt, access is denied.
Enforced on back and front
The same permission model protects API endpoints and enables/hides actions in the UI. Adding a new permission to a screen is declarative and consistent across the whole stack.