# Security & Data Integrity

***

**Security Features**

1. **Role-Based Access Control (RBAC):**\
   The platform enforces **Role-Based Access Control (RBAC)** to ensure that users have access only to the resources and functionalities relevant to their roles. This prevents unauthorized personnel from performing critical operations such as license validation, data updates, or system management.
2. **Spring Security Integration:**\
   Using **Spring Security**, we manage authentication and authorization rigorously. All passwords are securely hashed and encrypted, and user sessions are tightly managed to prevent unauthorized access. This ensures that only legitimate users can access or modify sensitive data.
3. **Email Verification & OTP (One-Time Password):**\
   Users must complete a **two-step verification process** involving email verification and an OTP (One-Time Password). This system prevents unauthorized access by confirming the identity of the user and adds an extra layer of security.

   The OTP is generated using **HMAC-SHA1** and a secret key. This mechanism ensures that OTPs are securely generated and that only the intended recipient can access the platform with a valid OTP.
4. **HMAC (Hash-Based Message Authentication Code) Validation:**\
   **HMAC-SHA256** is used to securely authenticate API requests, ensuring that requests originate from trusted sources. Every request is signed with an HMAC using a secret key and timestamp, allowing the platform to verify the authenticity of the request.

   * **API Key Management:** Each organization receives a unique API key, which must be included in requests to the platform. This key acts as a secure identifier, ensuring that all communications between external systems and the platform are authenticated.
   * **HMAC Signature Validation:** The platform validates every request's HMAC signature by comparing it with the computed HMAC using the shared secret. This ensures the integrity of the request and protects against tampering.

   In case of a mismatch, an **HMAC Signature Mismatch Exception** is thrown, ensuring that unauthorized requests are rejected.
5. **Timestamp Verification:**\
   Requests include a **timestamp** to prevent replay attacks. The platform checks that the timestamp is within an acceptable range (e.g., 3 minutes). If the timestamp is outside the tolerance range, the request is rejected with a **TimestampOutOfRangeException**.

***

**Data Integrity and Constraints**

1. **Unique License Code Enforcement:**\
   Every professional license is assigned a **unique license code**, which is enforced at the data level to prevent duplication. This ensures that the licensing system remains accurate and reliable.
2. **Request Count Monitoring:**\
   The platform monitors the number of validation requests made for each license to prevent abuse. This feature tracks requests and helps detect suspicious patterns or potential misuse of the system.
3. **API Request Validation:**\
   All API requests are rigorously validated, including:
   * **API Key Validation:** Ensures that the request is sent from an authorized organization.
   * **Timestamp Validation:** Ensures the request is made within an acceptable time window to prevent replay attacks.
   * **HMAC Signature Validation:** Ensures that the request data has not been tampered with during transmission.
4. **Audit Logging:**\
   Every action performed within the system is logged in an **audit trail**, providing a comprehensive history of system events. This allows for traceability and accountability in the event of security breaches or system issues.
