Add comprehensive security tests for authentication, roles, and user management

- Enhance `test-auth.sh` with SQL injection, XSS, and credential validation tests.
- Extend `test-roles-permissions.sh` to include unauthorized access and duplicate role creation tests.
- Improve `test-users.sh` with checks for invalid emails, duplicate users, and unauthorized actions.
- Introduce `test-security.sh` for thorough security assessments including CSRF, SQL injection, XSS, rate limiting, and session management.
- Add `.serena.gitignore` and `.serena/project.yml` for project configuration and file management.

tests/iam/test-auth.sh

@@ -17,20 +17,55 @@ test_authentication_endpoints() {
   invalid_login=$(jq -n '{email: "invalid@example.com", password: "wrongpassword"}')
   test_api_endpoint "Invalid Login Test" "POST" "/v1/auth/login" 401 "$invalid_login"
   
+  # Security: Test SQL injection in login
+  local sql_injection_login=$(jq -n '{email: "admin@example.com\" OR \"1\"=\"1", password: "password"}')
+  test_api_endpoint "SQL Injection in Login Email (Should Fail)" "POST" "/v1/auth/login" 401 "$sql_injection_login"
+  
+  local sql_injection_pass=$(jq -n '{email: "admin@example.com", password: "password\" OR \"1\"=\"1"}')
+  test_api_endpoint "SQL Injection in Login Password (Should Fail)" "POST" "/v1/auth/login" 401 "$sql_injection_pass"
+  
+  # Security: Test XSS in login
+  local xss_login=$(jq -n '{email: "<script>alert(\"XSS\")</script>", password: "password"}')
+  test_api_endpoint "XSS in Login Email (Should Fail)" "POST" "/v1/auth/login" 401 "$xss_login"
+  
+  # Security: Test empty credentials
+  local empty_login=$(jq -n '{email: "", password: ""}')
+  test_api_endpoint "Empty Credentials (Should Fail)" "POST" "/v1/auth/login" 400 "$empty_login"
+  
+  # Security: Test missing fields
+  local missing_password=$(jq -n '{email: "admin@example.com"}')
+  test_api_endpoint "Missing Password (Should Fail)" "POST" "/v1/auth/login" 400 "$missing_password"
+  
   # Mentor login
   local mentor_login=$(jq -n '{email: "mentor@example.com", password: "password"}')
   test_api_endpoint "Mentor Login" "POST" "/v1/auth/login-mentor" 200 "$mentor_login" false
   
+  # Security: Test invalid mentor login
+  local invalid_mentor=$(jq -n '{email: "nonexistent@example.com", password: "wrongpass"}')
+  test_api_endpoint "Invalid Mentor Login (Should Fail)" "POST" "/v1/auth/login-mentor" 401 "$invalid_mentor"
+  
   # Forgot password
   local forgot_password_data
   forgot_password_data=$(jq -n --arg email "admin@example.com" '{email: $email}')
   test_api_endpoint "Forgot Password Test" "POST" "/v1/auth/forgot" 200 "$forgot_password_data"
   
+  # Security: Test forgot password with invalid email
+  local invalid_forgot=$(jq -n '{email: "not_an_email"}')
+  test_api_endpoint "Forgot Password with Invalid Email (Should Fail)" "POST" "/v1/auth/forgot" 400 "$invalid_forgot"
+  
+  # Security: Test forgot password with non-existent email (should not reveal if user exists)
+  local nonexistent_forgot=$(jq -n '{email: "nonexistent@example.com"}')
+  test_api_endpoint "Forgot Password with Non-existent Email" "POST" "/v1/auth/forgot" 200 "$nonexistent_forgot"
+  
   # Invalid new password (invalid token)
   local new_password_data
   new_password_data=$(jq -n --arg token "some_reset_token" --arg pass "newpassword123!A" '{token: $token, password: $pass}')
   test_api_endpoint "New Password Test (Invalid Token)" "POST" "/v1/auth/new-password" 400 "$new_password_data"
   
+  # Security: Test weak password in reset
+  local weak_reset=$(jq -n --arg token "some_reset_token" '{token: $token, password: "123456"}')
+  test_api_endpoint "New Password with Weak Password (Should Fail)" "POST" "/v1/auth/new-password" 400 "$weak_reset"
+  
   # Refresh token
   local refresh_token=$(curl -s -X POST -H "Content-Type: application/json" \
     -d "$(jq -n '{email: "admin@example.com", password: "password"}')" \
@@ -40,6 +75,14 @@ test_authentication_endpoints() {
     local refresh_data
     refresh_data=$(jq -n --arg token "$refresh_token" '{refresh_token: $token}')
     test_api_endpoint "Refresh Token Test" "POST" "/v1/auth/refresh" 200 "$refresh_data"
+    
+    # Security: Test invalid refresh token
+    local invalid_refresh=$(jq -n '{refresh_token: "invalid_token_12345"}')
+    test_api_endpoint "Invalid Refresh Token (Should Fail)" "POST" "/v1/auth/refresh" 401 "$invalid_refresh"
+    
+    # Security: Test expired/malformed refresh token
+    local malformed_refresh=$(jq -n '{refresh_token: "Bearer.malformed.token"}')
+    test_api_endpoint "Malformed Refresh Token (Should Fail)" "POST" "/v1/auth/refresh" 401 "$malformed_refresh"
   else
     write_test_log "WARN" "✗ Refresh Token Test - Dilewati: Refresh token tidak tersedia dari login"
   fi
@@ -48,6 +91,10 @@ test_authentication_endpoints() {
   local resend_data=$(jq -n '{email: "admin@example.com"}')
   test_api_endpoint "Resend OTP" "POST" "/v1/auth/send-otp" 200 "$resend_data" false
   
+  # Security: Test resend OTP with invalid email
+  local invalid_otp=$(jq -n '{email: "not_an_email"}')
+  test_api_endpoint "Resend OTP with Invalid Email (Should Fail)" "POST" "/v1/auth/send-otp" 400 "$invalid_otp"
+  
   # Logout (skip - endpoint may not exist)
   # test_api_endpoint "Logout" "POST" "/v1/auth/logout" 200 "" true
 }