{
    "name": "basic-compress",
    "description": "Basic compression: 2 large text turns, then compress the whole range into 1 block. Validates the core happy path: context transform injects acp tags, the compress tool applies, and state persists with exactly one active block.",
    "turns": [
        {
            "respond": "text",
            "userText": "Explain authentication systems in depth.",
            "text": "Authentication is the process of verifying the identity of a user, device, or system before granting access to resources. In modern web applications, authentication is typically implemented using session tokens, JSON Web Tokens (JWT), or OAuth 2.0. Password-based authentication verifies credentials against a stored hash (bcrypt, scrypt, argon2); the hash function at src/auth/password.ts:28 implements bcrypt with a cost factor of 12. Once verified, the server issues a session identifier or a signed JWT. JWT encodes a payload containing user claims (sub, iat, exp, roles), signs it with a secret key using HMAC-SHA256, and the client sends it in the Authorization: Bearer header on each request. The server verifies the signature to ensure integrity. JWTs consist of three base64url-encoded parts separated by dots: header (alg + typ), payload (claims), and signature. Token signing lives at src/auth/jwt.ts:15 (signToken), signature verification at src/auth/jwt.ts:78 (verifyToken), and refresh-token rotation at src/auth/jwt.ts:142 (rotateRefreshToken). Two-factor authentication (2FA) adds a second factor: TOTP (time-based one-time passwords, RFC 6238) is generated from a shared secret at src/auth/totp.ts:40, and backup codes are stored hashed at src/auth/totp.ts:96. Rate limiting against brute force is enforced in middleware at src/middleware/auth.ts:30 (sliding-window limiter, 5 attempts per 15 minutes per IP). Session fixation is prevented by regenerating the session id on privilege change at src/auth/session.ts:61. Token storage on the client should use httpOnly, Secure, SameSite=Strict cookies to mitigate XSS-based theft (src/auth/cookies.ts:22). CSRF protection uses double-submit tokens at src/middleware/csrf.ts:18. HTTPS is mandatory in production; HSTS is set at src/middleware/security.ts:14. Common pitfalls include storing JWTs in localStorage (XSS-vulnerable), neglecting token expiration, and failing to validate the alg field (alg-confusion attacks); the allowlist of accepted algorithms is at src/auth/jwt.ts:52. The login endpoint POST /api/auth/login is wired at src/routes/auth.ts:24, logout (token revocation via a denylist) at src/routes/auth.ts:88."
        },
        {
            "respond": "text",
            "userText": "Continue with authorization and access control.",
            "text": "Authorization determines what an authenticated user is allowed to do, after authentication has established who they are. The two dominant models are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). In our codebase, RBAC is implemented at src/authz/rbac.ts:34 (assignRole), src/authz/rbac.ts:72 (checkPermission), with the role-to-permission matrix loaded from config/acl.yaml. Each request passes through the authorization middleware at src/middleware/authz.ts:26, which resolves the user's roles, computes the effective permission set, and rejects with HTTP 403 if the required permission is missing. Permissions follow the resource:action convention (e.g. invoices:read, invoices:write). Resource ownership checks (a user can only edit their own records) are enforced at src/authz/owner.ts:41 via a ownerId column comparison. ABAC extends RBAC by evaluating dynamic attributes (time of day, IP range, risk score) through a policy engine at src/authz/abac.ts:55 (evaluatePolicy); policies are written in a DSL and compiled at src/authz/abac.ts:120. Multi-tenant isolation ensures a tenant never sees another tenant's data: every query is scoped by tenantId at src/db/tenant_scope.ts:19 (a knex plugin that injects WHERE tenant_id = ?). Row-level security policies for PostgreSQL are defined in migrations/0042_rls.sql and tested at tests/rls.test.ts. Audit logging records every privileged action (who/what/when) to the audit_events table via src/audit/log.ts:30; the log is append-only and retained for 365 days. Principle of least privilege is enforced by granting roles the minimal permission set; service accounts use scoped tokens (src/authz/service-account.ts:48) that expire in 1 hour. Broken access control (OWASP A01) is the #1 web risk; common flaws include missing authorization checks on object IDs (IDOR), forced browsing, and inconsistent enforcement between the API and the UI. Our test suite covers these at tests/authz.test.ts (127 cases)."
        },
        {
            "respond": "compress",
            "topic": "Authentication & Authorization Architecture",
            "summary": "## Authentication & Authorization Architecture\n\n### Authentication (who you are)\n- Password hashing: bcrypt cost 12 at src/auth/password.ts:28.\n- JWT: signToken src/auth/jwt.ts:15, verifyToken src/auth/jwt.ts:78, rotateRefreshToken src/auth/jwt.ts:142. Accepted-alg allowlist src/auth/jwt.ts:52 (guards alg-confusion). Header.payload.signature, HMAC-SHA256, sent as Authorization: Bearer.\n- 2FA/TOTP (RFC 6238): src/auth/totp.ts:40 (generate), src/auth/totp.ts:96 (backup codes hashed).\n- Sessions: fixation prevention via session-id regeneration src/auth/session.ts:61.\n- Cookies: httpOnly+Secure+SameSite=Strict at src/auth/cookies.ts:22.\n- Rate limiting (brute force): sliding window 5/15min/IP at src/middleware/auth.ts:30.\n- CSRF: double-submit tokens src/middleware/csrf.ts:18. HSTS src/middleware/security.ts:14.\n- Endpoints: login POST /api/auth/login src/routes/auth.ts:24; logout (token denylist) src/routes/auth.ts:88.\n\n### Authorization (what you can do)\n- RBAC: assignRole src/authz/rbac.ts:34, checkPermission src/authz/rbac.ts:72; matrix in config/acl.yaml; middleware src/middleware/authz.ts:26 (HTTP 403 on deny). Permissions = resource:action.\n- Ownership: src/authz/owner.ts:41 (ownerId compare).\n- ABAC: policy engine src/authz/abac.ts:55, DSL compile src/authz/abac.ts:120.\n- Multi-tenant: tenant-scoped queries src/db/tenant_scope.ts:19; Postgres RLS migrations/0042_rls.sql, tests/rls.test.ts.\n- Audit: append-only audit_events via src/audit/log.ts:30, 365d retention.\n- Service accounts: scoped 1h tokens src/authz/service-account.ts:48.\n- Tests: tests/authz.test.ts (127 cases).\n\n### Decision\nChose JWT (stateless, scalable) over server sessions. RBAC baseline + ABAC for dynamic policies. Tenant isolation via query scoping + DB RLS.",
            "range": "all"
        },
        {
            "respond": "text",
            "text": "Compression complete. The authentication and authorization architecture has been summarized.",
            "auto": true
        }
    ],
    "verify": {
        "blockCount": 1,
        "activeBlockCount": 1,
        "minCompressedCount": 1,
        "summaryContains": "src/auth/jwt.ts:78"
    }
}