Add comprehensive security tests for authentication, roles, and user management

- Enhance `test-auth.sh` with SQL injection, XSS, and credential validation tests.
- Extend `test-roles-permissions.sh` to include unauthorized access and duplicate role creation tests.
- Improve `test-users.sh` with checks for invalid emails, duplicate users, and unauthorized actions.
- Introduce `test-security.sh` for thorough security assessments including CSRF, SQL injection, XSS, rate limiting, and session management.
- Add `.serena.gitignore` and `.serena/project.yml` for project configuration and file management.

tests/iam/test-roles-permissions.sh

@@ -13,10 +13,20 @@ test_roles_and_permissions() {
   test_api_endpoint "GET Roles List" "GET" "/v1/roles" 200 "" true
   test_api_endpoint "GET Roles (Paginated)" "GET" "/v1/roles?page=1&limit=10" 200 "" true
   
+  # Security: Test unauthorized access to roles
+  local saved_token="$AUTH_TOKEN"
+  AUTH_TOKEN=""
+  test_api_endpoint "GET Roles without Auth (Should Fail)" "GET" "/v1/roles" 401 "" false
+  AUTH_TOKEN="$saved_token"
+  
   # Get role by ID - use correct endpoint /detail/{id}
   local test_role_id="5713cb37-dc02-4e87-8048-d7a41d352059"
   test_api_endpoint "GET Role By ID" "GET" "/v1/roles/detail/$test_role_id" 200 "" true
   
+  # Security: Test access to non-existent role
+  local fake_role_id="00000000-0000-0000-0000-000000000000"
+  test_api_endpoint "GET Non-existent Role (Should Fail)" "GET" "/v1/roles/detail/$fake_role_id" 404 "" true
+  
   # Create role - use correct endpoint /create
   local create_role_data=$(jq -n '{
     name: "Test Role '$(date +%s)'",
@@ -27,6 +37,9 @@ test_roles_and_permissions() {
   local created_role_id=$(echo "$create_role_response" | jq -r '.data.id // empty')
   
   if [ -n "$created_role_id" ]; then
+    # Security: Test duplicate role creation
+    test_api_endpoint "POST Create Duplicate Role (Should Fail)" "POST" "/v1/roles/create" 400 "$create_role_data" true
+    
     # Update role - use correct endpoint /update/{id}
     local update_role_data=$(jq -n --arg ts "$EPOCHSECONDS" '{
       name: ("Updated Test Role " + $ts),
@@ -35,14 +48,27 @@ test_roles_and_permissions() {
     }')
     test_api_endpoint "PUT Update Role" "PUT" "/v1/roles/update/$created_role_id" 200 "$update_role_data" true
     
+    # Security: Test unauthorized update
+    AUTH_TOKEN=""
+    test_api_endpoint "PUT Update Role without Auth (Should Fail)" "PUT" "/v1/roles/update/$created_role_id" 401 "$update_role_data" false
+    AUTH_TOKEN="$saved_token"
+    
     # Delete role - use correct endpoint /delete/{id}
     test_api_endpoint "DELETE Role" "DELETE" "/v1/roles/delete/$created_role_id" 200 "" true
+    
+    # Security: Test double delete
+    test_api_endpoint "DELETE Already Deleted Role (Should Fail)" "DELETE" "/v1/roles/delete/$created_role_id" 404 "" true
   fi
   
   # Permissions
   test_api_endpoint "GET Permissions List" "GET" "/v1/permissions" 200 "" true
   test_api_endpoint "GET Permissions (Paginated)" "GET" "/v1/permissions?page=1&limit=10" 200 "" true
   
+  # Security: Test unauthorized access to permissions
+  AUTH_TOKEN=""
+  test_api_endpoint "GET Permissions without Auth (Should Fail)" "GET" "/v1/permissions" 401 "" false
+  AUTH_TOKEN="$saved_token"
+  
   # Get permission by ID - use correct endpoint /detail/{id}
   local test_perm_id="023e2dfe-93c3-4008-94a8-b5dff403f73b"
   test_api_endpoint "GET Permission By ID" "GET" "/v1/permissions/detail/$test_perm_id" 200 "" true