# TASK IMPLEMENTATION — S3-002

## Security Hardening (TD-002, TD-009, TD-010)

You are implementing the first Sprint 3 task for the INVEETAIRE project.

Sprint 0, Sprint 1, Sprint 2, and the Database Foundation are complete.

Implement **only** the approved Security Hardening scope.

Do not continue to WorkspaceMiddleware or any other Sprint 3 task.

---

## Mandatory Reading

Read before implementation:

* AI.md v1.1
* WORKFLOW.md
* SPRINT3_PLANNING.md
* SPRINT3_EXECUTION_GUIDE.md

Reuse existing Sprint 2 implementation memories where applicable.

---

## Scope

Implement exactly these items:

### TD-002

Implement baseline Content Security Policy inside

```
public/.htaccess
```

Requirements:

* Secure default policy.
* Allow only required origins.
* Prevent inline script execution whenever possible.
* Prevent clickjacking.
* Prevent MIME sniffing.

---

### TD-009

Implement forgot-password rate limiting.

Requirements:

* Limit by IP.
* Limit by email.
* Configurable window.
* Configurable maximum attempts.
* Store timestamps securely.
* Return existing project error responses.
* Log lockout events.

Modify only:

```
app/modules/Auth/AuthService.php
```

If required by the existing architecture:

```
app/modules/Auth/AuthController.php
```

---

### TD-010

Implement expired password reset token cleanup.

Requirements:

* Remove expired reset tokens.
* Execute cleanup safely.
* Never remove active tokens.
* Cleanup should integrate naturally with the existing Auth flow.
* Do not introduce cron dependencies.

---

## Files Allowed

### Modified

```
public/.htaccess

app/modules/Auth/AuthService.php

app/modules/Auth/AuthController.php
```

No other files may be modified.

---

## Constraints

Do NOT:

* create Workspace module
* create WorkspaceMiddleware
* create WorkspaceService
* create WorkspaceController
* modify app/core/*
* modify Router
* modify MiddlewarePipeline
* modify BaseController
* create database migrations
* modify documentation
* perform git operations

---

## Verification

Before finishing:

* Run PHP syntax validation (`php -l`) on every modified PHP file.
* Verify CSP header syntax.
* Verify rate limiting works.
* Verify expired tokens are removed correctly.
* Verify existing authentication behaviour is preserved.
* Verify no unrelated files were modified.

---

## Output Report

Provide:

1. Files modified.
2. Implementation summary.
3. Acceptance criteria checklist.
4. Security checklist.
5. PHP syntax results.
6. Any assumptions made.
7. Confirmation that no other Sprint 3 task was started.

Stop after the implementation report.

Wait for Human Approval.