auth-and-rbaclisted

# Auth and RBAC FastAPI authentication and authorization patterns derived from production identity services and multi-tenant backends. ## When to use - Implementing session-based or JWT authentication in FastAPI - Building role-based access control (RBAC) with hierarchical roles (sys_admin > org_admin > sub_org_admin > tenant_admin > member) - Implementing multi-factor authentication (TOTP or Email OTP) with pyotp - Designing auth dependency chains with `Depends(require_auth)` and role-specific guards - Integrating with API gateways that forward identity via custom headers (x-user-data JSON) - Hashing passwords with argon2id in async thread pool to avoid blocking the event loop - Enforcing org/tenant access checks with materialized path hierarchies - Issuing RS256 JWT tokens with key rotation and JWKS endpoint - Implementing refresh token rotation for secure long-lived sessions - Adding rate limiting to login endpoints to prevent brute-force attacks - Enforcing password expiry policies and rotation tracking - Implementing session fingerprinting to detect hijacking attempts ## Core conventions ### Authentication Dependency Chain **Session-based auth chain**: `get_current_session` extracts session ID from cookie → validates in Redis → decrypts → `require_auth` verifies fingerprint + request signature → role dependencies (`require_sys_admin`, `require_org_admin_or_above`, `require_sub_org_admin_or_above`) enforce RBAC. **JWT auth chain**: `get_current_user_jwt` extracts `