Security & Compliance

Defense-in-Depth Security & Authentication Architecture

Comprehensive overview of YeneSchool's security posture — JWT with Redis revocation, 10-role RBAC authorization hierarchy, and rate limiting.

Defense-in-Depth Security & Authentication Architecture

Educational management systems protect highly sensitive minor personal data, continuous academic evaluations, and financial ledgers. YeneSchool enforces a comprehensive Defense-in-Depth security architecture across network, transport, application, and database persistence layers.

1. Authentication & Token Lifecycle

YeneSchool implements modern Dual-Token Authentication designed for both responsive web sessions and offline-capable mobile clients:

Short-Lived Access Tokens (JWT):
- Cryptographically signed with HMAC-SHA256 or RSA.
- 15-minute Time-To-Live (TTL).
- Contains minimal user identity claims (sub, schoolId, role, branchId).
Long-Lived Refresh Tokens:
- 7-day expiration with sliding rotation.
- Stored securely in HttpOnly, SameSite=Lax, Secure cookies on web, or OS-level Keychain / Android Keystore on mobile.
Instant Logout & Token Revocation:
- Unlike naive JWT implementations where stolen tokens remain valid until expiration, YeneSchool maintains a high-speed Redis blacklist.
- When a user logs out or changes their password, their JWT token ID (jti) is immediately blacklisted in Redis for its remaining lifetime. Subsequent requests with that token are instantly rejected with HTTP 401 Unauthorized.

2. 10-Role RBAC Authorization Matrix

Permissions are governed by NestJS @Roles() decorators and custom guard middleware:

Role	Access Scope	Strict Boundary Restrictions
`SUPER_ADMIN`	Platform-wide	Manages school tenants, plans, and system health; cannot view private student grades.
`SCHOOL_OWNER`	Multi-branch executive	Executive analytics, consolidated financial reports, and campus allocations.
`DIRECTOR`	Institutional campus	Master timetables, teacher assessments, siren triggers, and student risk flags.
`SUPERVISOR`	Academic department	Lesson plan approvals, pedagogical rubrics, and curriculum pacing reviews.
`REGISTRAR`	Student admissions	Student enrollments, CSV bulk imports, ID cards, and report card publishing.
`TEACHER`	Assigned classes	Marks entry and attendance marking strictly restricted to subjects and classes taught.
`STUDENT`	Individual student	Read-only access to own timetable, grades, CBT exams, and learning materials.
`PARENT`	Verified children	Attendance alerts and fee clearance strictly scoped to verified biological/legal children.
`FINANCE`	Institutional ledger	Fee structures, payment recording, receipts, and payroll; zero access to academic tests.
`STOREKEEPER`	Inventory warehouse	Asset tracking, stock transactions, bookstore orders, and uniform sales.

3. Rate Limiting & Brute-Force Defense

Sensitive endpoints are protected against automated brute-force attacks via Redis sliding-window limiters:

Authentication (/api/auth/login): Max 5 failed attempts per IP / username pair per 15-minute window before exponential lockouts.
AI Assistant Queries: Enforced per-tier hourly token quotas to prevent denial-of-wallet exhaustion.
Bulk Exports: Rate-limited to prevent bandwidth saturation and unauthorized data scraping.

Backups & Disaster Recovery

Automated PostgreSQL snapshot backups, Docker persistent volume preservation, disaster recovery procedures, and database restoration verification.

Data Privacy & Compliance

Institutional data ownership guarantees, the Legitimate Educational Interest doctrine, zero-advertising commitments, and open data export rights.