[isharax9]

This pull request introduces several important improvements and security enhancements to the authentication system, schema precision, and exports. The main highlights are the implementation of a secure, single-use password reset flow with OTP attempt tracking and lockout, increased decimal precision for financial data, and new rate limiting for OTP verification. Additionally, the PDF export now limits the number of transactions exported. Comprehensive tests have been added to cover the new authentication logic.

Authentication Security & Features:

• Implements a single-use, short-lived reset token for password resets, with purpose and jti claims, and verifies/invalidates tokens via Redis to prevent replay attacks (src/modules/auth/auth.service.ts, src/modules/auth/auth.otp.test.ts, [1] [2].
• Tracks failed OTP attempts in Redis, locks out after 5 failures, and clears attempts on success; adds tests for all OTP/reset flows (src/modules/auth/auth.service.ts, src/modules/auth/auth.otp.test.ts, [1] [2].
• Adds rate limiting for /verify-otp endpoint, keyed by IP and normalized email, with tests (src/modules/auth/auth.routes.ts, src/modules/auth/authRateLimit.ts, src/modules/auth/authRateLimit.test.ts, [1] [2] [3].
• In production, enforces a minimum length of 32 characters for ACCESS_TOKEN_SECRET and REFRESH_TOKEN_SECRET (src/config/env.ts, src/config/env.tsR20-R38).

Database Schema Precision:

• Increases decimal precision for all monetary fields from DECIMAL(10,2) to DECIMAL(16,2) to support larger balances and amounts (prisma/schema.prisma, prisma/migrations/202609300001_decimal_16_2_precision/migration.sql, [1] [2].

Exports:

• Limits the number of transactions exported to PDF to 500 to prevent performance issues (src/modules/exports/pdfService.ts, [1] [2].

Other minor changes include test improvements and small code style adjustments.