Security & Access Control

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• server/middleware/auth.py
• server/models/user.py
• server/api/v1/auth_routes.py
• server/core/security.py
• server/config/settings.py

The Security & Access Control module manages user identity verification and resource authorization within the evaluation platform. It ensures that only authenticated users can access specific API endpoints and that users only perform actions permitted by their assigned roles.

This system implements JSON Web Token (JWT) based authentication and Role-Based Access Control (RBAC) to protect sensitive data and evaluation metrics.

Authentication Mechanism

The platform uses JWTs to maintain stateless authentication between the client and the server. Users obtain a token by providing valid credentials to the authentication endpoint.

Token Lifecycle

1. The user sends login credentials (email and password) to /api/v1/auth/login.
2. The server validates the credentials against the database.
3. Upon success, the server generates a JWT containing the user ID and expiration timestamp.
4. The client includes this token in the Authorization header for subsequent requests.

The authentication logic relies on password hashing using bcrypt to ensure credential safety at rest.
Sources: server/api/v1/auth_routes.py, server/core/security.py

Role-Based Access Control (RBAC)

Access control is enforced based on user roles defined in the system. The platform distinguishes between standard users and administrators to restrict sensitive operations like system configuration or global data deletion.

User Roles and Permissions

Role	Permissions
Admin	Full access to all evaluations, user management, and system settings.
User	Create evaluations, view own results, and manage personal profile.
Guest	Read-only access to public evaluation benchmarks (if enabled).

Sources: server/models/user.py, server/middleware/auth.py

Authorization Flow

The middleware intercepts incoming requests to check for a valid token and sufficient permissions. If a route requires Admin privileges, the middleware checks the role claim within the decoded JWT or queries the user record.

Security Configuration

The security behavior is governed by environment variables and configuration settings. These settings define token expiration times, secret keys, and CORS policies.

Key Security Parameters

Parameter	Type	Description
SECRET_KEY	String	Used for signing JWT tokens. Must be kept private.
ACCESS_TOKEN_EXPIRE_MINUTES	Integer	Duration for which a JWT remains valid (Default: 60).
ALGORITHM	String	The hashing algorithm used for JWT (e.g., HS256).
CORS_ORIGINS	List	Allowed origins for cross-origin resource sharing.

Sources: server/config/settings.py

Password Management

Passwords are never stored in plain text. The system uses a dedicated security utility to handle hashing and verification.

• get_password_hash(password: str): Generates a secure hash using a salt.
• verify_password(plain_password, hashed_password): Compares a provided password against the stored hash.

Sources: server/core/security.py

Summary

The Security & Access Control system provides a robust layer of protection for the eval-platform. By combining JWT authentication with role-based restrictions and secure password handling, it ensures data integrity and prevents unauthorized access to evaluation resources. Developers must ensure that the SECRET_KEY is rotated periodically and that all new API endpoints are wrapped with the appropriate authentication middleware.