Hardening security: role enforcement, tenant isolation, rate limiting…

[MABDesigns]

Security Hardening and Multi-Tenancy Protection 🛡️

This PR implements a comprehensive security audit and remediation suite to harden the API infrastructure, ensure robust tenant isolation, and protect against common attack vectors.

📋 Key Improvements

1. Multi-Tenancy & Access Control

• IDOR Prevention: Restricted the revenue-by-tenant report strictly to the superadmin role.
• Defense in Depth: Added secondary role verification directly within ReportController to prevent access even if routing filters are bypassed.
• Tenant Isolation: Verified that all core controllers (Orders, Products) strictly use resolveTenantId() to filter data by the authenticated user's organization.

2. Brute-Force Mitigation

• Strict Auth Throttling: Implemented a dedicated rate-limit tier for login and refresh endpoints (max 5 requests per minute).
• Global Rate Limiting: Enabled a default sliding-window rate limit across all API routes to prevent resource exhaustion.

3. JWT Infrastructure Hardening

• Safe-by-Default Configuration: Removed the insecure change-me-in-production fallback. The system now requires a valid JWT_SECRET in the environment.
• Information Leakage Protection: Obfuscated JWT validation errors. The API now returns a generic Invalid or expired token message instead of raw library exceptions.

4. Protocol Integrity

• Content-Type Enforcement: Added a ContentTypeFilter that mandates application/json for all data-modifying requests (POST, PUT, PATCH), preventing payload injection attacks.

---

⚠️ ACTION REQUIRED: Update Environment Config

This PR removes the insecure fallback secret for JWT. All developers and environments must update their .env file to include a strong, unique JWT_SECRET.

Important

If JWT_SECRET is missing or set to change-me-in-production, the API will throw a RuntimeException and refuse to start. This is a deliberate "Fail Fast" mechanism to prevent insecure deployments.

# Update your .env file with a strong secret
JWT_SECRET=your_super_secret_random_string_here