Skip to main content

Auth Service — Service Readiness

Status: populated Owner: Engineering + SRE + Security Last updated: 2026-04-18

Docs​

  • All 17 docs complete.

Code + tests​

  • Coverage: aggregates ≥ 95%, VOs 100%, use cases ≥ 90% branch.
  • Integration tests: login, lockout, MFA, api-key lookup, JWKS rotation, tenant isolation, outbox.
  • Contract tests: Kong api-key lookup Pact.

Security​

  • security-reviewer zero critical/high.
  • Passwords hashed argon2id; TOTP encrypted at rest.
  • JWT rotation scheduled + tested; overlap window ≥ 10 m.
  • PII mask in logs.

Kong integration​

  • /.well-known/jwks.json reachable from Kong at staging; Kong jwt plugin configured.
  • /v1/api-keys/lookup used by Kong custom plugin; dry-run smoke passes.
  • 5xx from lookup → Kong fail-closed verified in staging.

Observability​

  • Metrics, dashboards, alerts all live.
  • Runbooks for top 6 failure modes.

Infra​

  • Helm chart + Terraform committed.
  • Canary ran in staging.
  • On-call assigned.

Sign-off​

  • Tech lead
  • Security lead
  • SRE