Add 2FA, device management, and password recovery features

.claude/system_prompt.md

@@ -0,0 +1,35 @@
+### **Project Context**
+
+You're a specialized AI assistant named Claude, designed to assist with the **node-template** project. Your primary role is to provide accurate, context-aware, and high-quality responses based on the user's requests.
+
+#### **Core Principles**
+
+-   **Language:** Respond in the same language as the user's prompt.
+-   **Code:** All code must be in **English**, regardless of the language used for explanations.
+-   **Coding Standards:** All code provided must adhere to the rules specified in `./biome.json`.
+-   **Project Structure:** To understand the file and folder organization, you can consult `./context/structure.txt`.
+
+#### **README.md Management**
+
+-   When a user asks to update a `README.md` file within a specific folder or sub-folder, you must update both that file and the main project `./README.md`.
+-   When a user requests creating a `README.md` for a specific directory, **only analyze the files within that directory**. Ignore any sub-directories unless the user explicitly requests you to analyze them as well.
+
+#### **Project Details**
+
+The project is a robust **Node.js, Express, and Sequelize API REST template**. It utilizes **MySQL/MariaDB**, **Redis**, and **Docker**.
+
+-   **Dependencies:**
+    -   **`dependencies`:** Core libraries for the application, including Express, Sequelize, Redis, `@hapi/boom`, `bcrypt`, `jsonwebtoken`, `winston`, and more.
+    -   **`devDependencies`:** Tools for development and testing, such as `@biomejs/biome`, `jest`, `husky`, and `commitlint`.
+-   **Key Scripts:**
+    -   `npm run dev`: Starts the application with `nodemon` for file watching.
+    -   `npm run format:write`: Formats all code according to Biome rules.
+    -   `npm run lint:fix`: Lints and fixes code issues.
+    -   `npm test`: Runs all tests.
+    -   `npm run models:generate`: A custom script for creating database models.
+
+#### **Claude Code Integration**
+
+-   Always consider the current working directory and project structure when making suggestions.
+-   When creating or modifying files, ensure they follow the established project patterns and conventions.
+-   Provide clear explanations for code changes and their impact on the overall project architecture.

.dockerignore

@@ -0,0 +1,162 @@
+# Git files
+.git
+.gitignore
+.gitattributes
+
+# Documentation and metadata
+README.md
+CHANGELOG
+LICENSE
+*.md
+structure.txt
+
+# Development tools and configs
+.vscode/
+.idea/
+*.sublime-*
+.editorconfig
+biome.json
+
+# Environment and secrets
+.env*
+.secrets
+*.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# Node.js
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+.pnpm-debug.log*
+.npm
+.yarn/
+.pnp.*
+coverage/
+.nyc_output/
+.eslintcache
+.stylelintcache
+
+# Build artifacts and cache
+dist/
+build/
+out/
+.next/
+.nuxt/
+.cache/
+.parcel-cache/
+.rpt2_cache/
+.rts2_cache_*/
+*.tsbuildinfo
+
+# Logs (excluding specific service logs)
+logs/
+*.log
+!controllers/logs/
+!models/logs/
+!routes/logs/
+!services/logs/
+
+# Testing
+coverage/
+.nyc_output/
+test-results/
+playwright-report/
+
+# OS files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+Desktop.ini
+$RECYCLE.BIN/
+.directory
+.fuse_hidden*
+.nfs*
+
+# Media files
+*.jpg
+*.jpeg
+*.png
+*.gif
+*.svg
+*.ico
+*.webp
+*.tiff
+*.bmp
+*.mp3
+*.mp4
+*.avi
+*.mov
+*.wmv
+*.flv
+*.wav
+*.ogg
+*.flac
+*.pdf
+
+# Archives and binaries
+*.zip
+*.tar
+*.tar.gz
+*.rar
+*.7z
+*.exe
+*.msi
+*.deb
+*.rpm
+
+# Docker files (for multi-stage builds)
+Dockerfile*
+docker-compose*.yml
+.dockerignore
+
+# Kubernetes files
+kubernetes/
+k8s/
+*.yaml
+*.yml
+!package.json
+
+# Development databases
+*.sqlite
+*.db
+
+# Temporary files
+*.tmp
+*.temp
+*.swp
+*.swo
+*~
+.tmp/
+tmp/
+
+# Project specific exclusions
+sync_models/
+kubernetes/keys/
+0.Project_info/
+
+# IDE and editor files
+*.sublime-workspace
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+
+# Windows
+*.lnk
+*.stackdump
+
+# macOS
+*.icloud
+
+# Linux
+*~

.env.example

@@ -0,0 +1,112 @@
+# =============================================================================
+# ENVIRONMENT CONFIGURATION
+# =============================================================================
+NODE_ENV=local
+PORT=8080
+BASE_URL=http://localhost:8080
+PROJECT_NAME=node-template
+
+# Internationalization
+DEFAULT_TIME_ZONE_NAME=America/Bogota
+DEFAULT_TIME_ZONE_UTC=-05:00
+DEFAULT_LANG=es
+
+# =============================================================================
+# DATABASE CONFIGURATION
+# =============================================================================
+DB_DIALECT=mysql
+DB_SSL=false
+
+# Read Replica
+DB_READ_HOST=localhost
+DB_READ_PORT=3306
+
+# =============================================================================
+# CACHE & SESSION STORAGE
+# =============================================================================
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_DB=0
+REDIS_HOST_LOCAL=localhost
+
+# =============================================================================
+# AUTHENTICATION & SECURITY
+# =============================================================================
+DEFAULT_PASSWORD_LENGTH=8
+
+# JWT
+JWT_ALGORITHM=HS256
+JWT_ACCESS_TOKEN_EXPIRATION_TIME=900000
+JWT_REFRESH_TOKEN_EXPIRATION_TIME=604800000
+
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX_REQUESTS=100
+
+# =============================================================================
+# CLOUD STORAGE & LOCALSTACK
+# =============================================================================
+AWS_REGION=us-east-1
+AWS_S3_BUCKET=localstack-bucket
+AWS_ENDPOINT_URL=http://localstack:4566
+GOOGLE_CLOUD_PROJECT_ID=your_gcp_project_id
+GOOGLE_CLOUD_STORAGE_BUCKET=your_gcs_bucket_name
+AZURE_STORAGE_CONTAINER=your_container_name
+
+# =============================================================================
+# DEVELOPMENT & TESTING
+# =============================================================================
+DEBUG=true
+LOG_LEVEL=debug
+FAKER_LOCALE=es
+FAKER_SEED=12345
+
+# =============================================================================
+# CORS & SECURITY HEADERS
+# =============================================================================
+CORS_ORIGIN=http://localhost:3000,http://localhost:3001
+CORS_METHODS=GET,POST,PUT,DELETE,OPTIONS
+CORS_ALLOWED_HEADERS=Content-Type,Authorization,X-Requested-With
+
+CSP_DEFAULT_SRC='self'
+CSP_SCRIPT_SRC='self' 'unsafe-inline'
+CSP_STYLE_SRC='self' 'unsafe-inline'
+
+# App config
+BOLA_STRICT_MODE=true
+CSRF_ENABLED=true
+CSRF_STRICT_MODE=true
+
+MAX_FILE_SIZE_MB=10
+MAX_FILES_PER_REQUEST=5
+
+SECURITY_AUDIT_ENABLED=true
+ANOMALY_DETECTION_ENABLED=true
+
+# =============================================================================
+# SMTP / EMAIL CONFIGURATION
+# =============================================================================
+# Name of the SMTP provider or service (e.g. Mailhog, Gmail, SES, etc.)
+SMTP_SERVICE=MailHog
+
+# SMTP Host — points to the Mailhog container locally
+SMTP_HOST=localhost
+# SMTP Port — 1025 for Mailhog, 587 or 465 for real servers
+SMTP_PORT=1025
+
+# Whether the server uses TLS/SSL (false for Mailhog)
+SMTP_SECURE=false
+
+# Default "from" address for outgoing emails
+MAIL_DEFAULT_FROM="[email protected]"
+
+# Support or general contact address
+MAIL_SUPPORT_ADDRESS="[email protected]"
+
+# Advanced configuration (Optional TLS)
+SMTP_TLS_REJECT_UNAUTHORIZED=false
+
+# =============================================================================
+# VAULT CONFIGURATION
+# =============================================================================
+VAULT_ADDR=http://localhost:8200
+VAULT_TOKEN=dev-only-token