Authentication & RBAC

Relevant source files

The following files were used as context for generating this wiki page:

• services/security/app.py
• README.md
• infrastructure/databases/init-databases.sh
• services/api-gateway/app.py
• IMPLEMENTATION_COMPLETE.md
• test.sh

The Authentication & Role-Based Access Control (RBAC) system in Aether-X Ultimate provides a centralized security framework for the entire microservices architecture. It ensures that only authenticated users can access protected AI generation and data processing services, while also providing a mechanism for zero-knowledge encryption and custom security protocols. Sources: README.md, services/security/app.py:1-15

The system is primarily managed by the Security Service (operating on port 8005), which handles user registration, JWT-based authentication, password hashing via bcrypt, and encryption operations. The API Gateway acts as the enforcement point, routing requests through security checks before they reach downstream services like Text Generation or No-Code Development. Sources: IMPLEMENTATION_COMPLETE.md, services/api-gateway/app.py:10-25

Core Architecture

The security architecture follows a microservices pattern where the Security Service acts as the Identity Provider (IdP) and Authorization Server.

Component Interaction

The following diagram illustrates how a user authenticates and accesses a protected resource through the API Gateway.

User Management & Authentication

User accounts are stored across multiple database systems (MySQL, PostgreSQL, MongoDB, Cassandra) to ensure high availability and support different data models. Sources: infrastructure/databases/init-databases.sh:10-40

Security Data Model (SQL)

Field	Type	Description
id	INT / SERIAL / UUID	Primary key for user identification.
username	VARCHAR(255)	Unique identifier for login.
email	VARCHAR(255)	Unique user contact email.
password_hash	VARCHAR(255)	Password hashed using bcrypt algorithm.
created_at	TIMESTAMP	Record creation time.
is_active	BOOLEAN	Account status (stored in application logic).

Sources: infrastructure/databases/init-databases.sh:10-30, services/security/app.py:70-80

Authentication Logic

The system uses the following mechanisms to secure user identity:

1. Registration: Accepts username, email, and password. The password is encrypted using bcrypt.hashpw with a generated salt before storage. Sources: services/security/app.py:65-84
2. Login: Verifies credentials using bcrypt.checkpw. Upon success, the service generates a JWT token. Sources: services/security/app.py:38-43
3. JWT Tokens: Generated with a 24-hour expiration (exp) and signed using the HS256 algorithm with a service-wide JWT_SECRET. Sources: services/security/app.py:45-51

Zero-Knowledge Encryption & Custom Protocols

Aether-X Ultimate implements a zero-knowledge architecture where sensitive data can be encrypted before storage or transmission. Sources: README.md, services/security/app.py:122-135

Encryption Components

• Fernet Symmetric Encryption: Uses AES in CBC mode with a 128-bit key for standard encryption/decryption operations. Sources: services/security/app.py:16-19
• Custom Security Protocols: Users can define their own security parameters, including specific algorithms, key lengths (e.g., 256-bit), and authentication methods like OAuth 2.0. Sources: services/security/app.py:165-195

Authorization & API Enforcement

Authorization is enforced via decorators and Gateway-level proxying.

Authentication Decorator

The require_auth decorator in the Security Service validates the Authorization: Bearer <token> header. It decodes the JWT to extract the user_id before allowing the request to proceed. Sources: services/security/app.py:53-65

API Gateway Security Features

The Gateway provides additional layers of protection:

• Rate Limiting: Limits requests per client IP within a specific window (e.g., 200 requests/60s for generic proxying, 50/60s for image generation). Sources: services/api-gateway/app.py:28-48
• Request Logging: Every access attempt is logged with method, path, IP, status code, and duration. Sources: services/api-gateway/app.py:50-67
• Proxy Security: Filters out Host headers and forwards authentication tokens to the underlying microservices. Sources: services/api-gateway/app.py:76-105

Security Auditing

The system maintains a comprehensive audit trail of security-sensitive events. Sources: services/security/app.py:26-36

Event Types

Event Type	ID	Description
LOGIN_ATTEMPT	login_attempt	Recorded every time a login request is made.
LOGIN_SUCCESS	login_success	Logged upon successful credential verification.
LOGIN_FAILURE	login_failure	Logged with reason (e.g., invalid_credentials).
UNAUTHORIZED_ACCESS	unauthorized_access	Logged when a request lacks a valid token.
ENCRYPTION_OP	encryption_operation	Logged for encrypt/decrypt actions with data length.

Sources: services/security/app.py:26-36, test.sh:84-115

Conclusion

The Authentication & RBAC system in Aether-X Ultimate ensures a secure, auditable, and flexible environment for AI operations. By combining JWT-based identity management with zero-knowledge encryption and granular rate limiting at the Gateway, the platform protects both user data and system resources from unauthorized access and abuse. Sources: IMPLEMENTATION_COMPLETE.md