# Argon2 in Python
from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=2,         # iterations
    memory_cost=65536,   # 64 MB
    parallelism=2
)

hash = ph.hash("user_password")
# $argon2id$v=19$m=65536,t=2,p=2$...

# Verify
try:
    ph.verify(hash, "user_password")   # True
except Exception:
    # Invalid password
    pass

✓ Minimum 8 characters (12+ recommended)
✓ Allow all printable ASCII + Unicode
✓ Check against known breached passwords (Have I Been Pwned)
✓ No mandatory periodic rotation (promotes weak passwords)
✗ No complexity rules (uppercase + special char requirements)
✗ No password hints
✓ Allow password managers (no paste blocking)

# Roles and permissions table
PERMISSIONS = {
    'admin': {'users:read', 'users:write', 'users:delete', 'reports:read'},
    'editor': {'posts:read', 'posts:write', 'posts:delete'},
    'viewer': {'posts:read', 'reports:read'},
}

def has_permission(user_role: str, required_permission: str) -> bool:
    return required_permission in PERMISSIONS.get(user_role, set())

# Middleware
def require_permission(permission: str):
    def decorator(f):
        @wraps(f)
        def wrapper(*args, **kwargs):
            if not has_permission(current_user.role, permission):
                abort(403)
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route('/api/users', methods=['DELETE'])
@require_permission('users:delete')
def delete_user():
    pass

header.payload.signature

Header:  { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "42", "role": "admin", "exp": 1735689600 }
Signature: HMACSHA256(base64(header) + "." + base64(payload), secret)

import jwt
from datetime import datetime, timedelta

# Issue token
payload = {
    "sub": str(user.id),
    "role": user.role,
    "iat": datetime.utcnow(),
    "exp": datetime.utcnow() + timedelta(hours=1),
}
token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")

# Verify token
try:
    data = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
    user_id = data["sub"]
except jwt.ExpiredSignatureError:
    # Token expired — require re-login
except jwt.InvalidTokenError:
    # Invalid token — reject

Authentication events:
  - Login success/failure (with IP, timestamp, device)
  - MFA success/failure
  - Password change/reset
  - Account lockout

Authorization events:
  - Access denied (403)
  - Role changes
  - Permission grants/revocations

Resource access:
  - Read/write/delete on sensitive data
  - Export operations
  - API calls by service accounts

Admin actions:
  - Configuration changes
  - User management
  - System access

{
  "event_id": "evt_01HZ...",
  "timestamp": "2026-01-15T10:23:45.123Z",
  "event_type": "auth.login_success",
  "actor": {
    "user_id": "usr_42",
    "email": "alice@example.com",
    "ip": "203.0.113.50",
    "user_agent": "Mozilla/5.0..."
  },
  "resource": { "type": "session", "id": "ses_789" },
  "outcome": "success",
  "metadata": { "mfa_method": "totp" }
}