if (passwordEncoder.matches(rawPassword, hash)) {
    login(user);
} else {
    reject();
}

HTTP request
  -> normalized login identifier
  -> tenant resolution
  -> authentication attempt
  -> credential verification
  -> risk decision
  -> challenge decision
  -> success/failure transition
  -> session/token issuance or rejection

create table auth_account_state (
    account_id              uuid primary key,
    tenant_id               uuid not null,
    lifecycle_state         varchar(32) not null,
    password_credential_id  uuid,
    failed_login_count      integer not null default 0,
    failed_login_window_at  timestamptz,
    locked_until            timestamptz,
    last_success_login_at   timestamptz,
    last_failure_login_at   timestamptz,
    credential_version      bigint not null default 0,
    updated_at              timestamptz not null
);

create index idx_auth_account_state_tenant_state
    on auth_account_state (tenant_id, lifecycle_state);

create table auth_event (
    event_id          uuid primary key,
    tenant_id         uuid,
    account_id        uuid,
    attempt_id        uuid not null,
    event_type        varchar(64) not null,
    login_identifier  varchar(512),
    subject_ref       varchar(256),
    ip_hash           varchar(128),
    user_agent_hash   varchar(128),
    risk_score        integer,
    outcome           varchar(32) not null,
    reason_code       varchar(64),
    occurred_at       timestamptz not null,
    metadata_json     jsonb not null default '{}'::jsonb
);

create index idx_auth_event_attempt on auth_event (attempt_id);
create index idx_auth_event_tenant_time on auth_event (tenant_id, occurred_at desc);
create index idx_auth_event_account_time on auth_event (account_id, occurred_at desc);

create table auth_login_challenge (
    challenge_id      uuid primary key,
    tenant_id         uuid not null,
    account_id        uuid not null,
    attempt_id        uuid not null,
    challenge_type    varchar(32) not null,
    challenge_state   varchar(32) not null,
    expires_at        timestamptz not null,
    attempts_left     integer not null,
    created_at        timestamptz not null,
    completed_at      timestamptz,
    metadata_json     jsonb not null default '{}'::jsonb
);

public record StartLoginCommand(
        String tenantHint,
        String rawIdentifier,
        char[] rawPassword,
        RequestMetadata requestMetadata,
        String correlationId
) {}

public record LoginDecision(
        LoginOutcome outcome,
        UUID attemptId,
        UUID accountId,
        ChallengeDescriptor challenge,
        SessionDescriptor session,
        String internalReasonCode
) {
    public boolean authenticated() {
        return outcome == LoginOutcome.AUTHENTICATED;
    }
}

public enum LoginOutcome {
    FAILED,
    CHALLENGE_REQUIRED,
    AUTHENTICATED,
    RATE_LIMITED,
    TEMPORARILY_UNAVAILABLE
}

public final class LoginApplicationService {

    private final TenantResolver tenantResolver;
    private final LoginIdentifierNormalizer identifierNormalizer;
    private final LoginRateLimitService rateLimitService;
    private final AccountCredentialRepository credentialRepository;
    private final PasswordVerificationService passwordVerificationService;
    private final LoginStatePolicy loginStatePolicy;
    private final RiskDecisionService riskDecisionService;
    private final ChallengeService challengeService;
    private final SessionIssuer sessionIssuer;
    private final AuthAuditService auditService;

    public LoginDecision startLogin(StartLoginCommand command) {
        UUID attemptId = UUID.randomUUID();
        Instant now = Instant.now();

        NormalizedTenant tenant = tenantResolver.resolve(command.tenantHint(), command.requestMetadata());
        NormalizedIdentifier identifier = identifierNormalizer.normalize(command.rawIdentifier());

        PreAuthLimitDecision preLimit = rateLimitService.checkBeforeCredentialVerification(
                tenant.id(), identifier.value(), command.requestMetadata(), now);

        if (!preLimit.allowed()) {
            auditService.loginRateLimited(attemptId, tenant.id(), identifier, command.requestMetadata(), preLimit.reason());
            return LoginDecisionFactory.rateLimited(attemptId, preLimit.reason());
        }

        AccountCredentialView credentialView = credentialRepository
                .findPasswordCredential(tenant.id(), identifier.value())
                .orElse(AccountCredentialView.synthetic(tenant.id(), identifier.value()));

        PasswordVerificationResult verification = passwordVerificationService.verify(
                command.rawPassword(), credentialView.passwordHash());

        AccountLoginPrecheck precheck = loginStatePolicy.evaluate(credentialView, now);

        if (!verification.matches() || !precheck.loginMayProceed()) {
            rateLimitService.recordFailure(tenant.id(), identifier.value(), credentialView.accountIdOrNull(), command.requestMetadata(), now);
            auditService.loginFailed(attemptId, tenant.id(), credentialView.accountIdOrNull(), identifier,
                    command.requestMetadata(), failureReason(verification, precheck));
            return LoginDecisionFactory.failed(attemptId);
        }

        RiskDecision risk = riskDecisionService.evaluate(
                credentialView.accountId(), tenant.id(), command.requestMetadata(), now);

        if (risk.requiresChallenge()) {
            ChallengeDescriptor challenge = challengeService.createChallenge(
                    tenant.id(), credentialView.accountId(), attemptId, risk.requiredChallenge(), now);
            auditService.loginChallengeRequired(attemptId, tenant.id(), credentialView.accountId(), risk);
            return LoginDecisionFactory.challengeRequired(attemptId, credentialView.accountId(), challenge);
        }

        SessionDescriptor session = sessionIssuer.issueAuthenticatedSession(
                tenant.id(), credentialView.accountId(), credentialView.credentialVersion(), command.requestMetadata(), now);

        rateLimitService.recordSuccess(tenant.id(), identifier.value(), credentialView.accountId(), command.requestMetadata(), now);
        auditService.loginSucceeded(attemptId, tenant.id(), credentialView.accountId(), session.sessionId(), risk);

        return LoginDecisionFactory.authenticated(attemptId, credentialView.accountId(), session);
    }
}

public final class PasswordVerificationService {

    private final PasswordEncoder passwordEncoder;
    private final String syntheticPasswordHash;
    private final ExecutorService hashExecutor;
    private final Duration timeout;

    public PasswordVerificationResult verify(char[] rawPassword, String encodedHash) {
        String hashToVerify = encodedHash == null ? syntheticPasswordHash : encodedHash;
        String password = new String(rawPassword);

        Future<Boolean> future = hashExecutor.submit(() -> passwordEncoder.matches(password, hashToVerify));
        try {
            boolean matched = future.get(timeout.toMillis(), TimeUnit.MILLISECONDS);
            return new PasswordVerificationResult(matched, false);
        } catch (TimeoutException e) {
            future.cancel(true);
            return new PasswordVerificationResult(false, true);
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            return new PasswordVerificationResult(false, true);
        } catch (ExecutionException e) {
            return new PasswordVerificationResult(false, true);
        } finally {
            Arrays.fill(rawPassword, '\0');
        }
    }
}

public final class LoginAuthenticationToken extends AbstractAuthenticationToken {

    private final String tenantHint;
    private final String identifier;
    private final Object credentials;
    private final RequestMetadata requestMetadata;

    public LoginAuthenticationToken(
            String tenantHint,
            String identifier,
            Object credentials,
            RequestMetadata requestMetadata
    ) {
        super(null);
        this.tenantHint = tenantHint;
        this.identifier = identifier;
        this.credentials = credentials;
        this.requestMetadata = requestMetadata;
        setAuthenticated(false);
    }

    private LoginAuthenticationToken(
            AuthenticatedPrincipal principal,
            Collection<? extends GrantedAuthority> authorities
    ) {
        super(authorities);
        this.tenantHint = principal.tenantId().toString();
        this.identifier = principal.subjectRef();
        this.credentials = null;
        this.requestMetadata = null;
        setAuthenticated(true);
        setDetails(principal);
    }

    public static LoginAuthenticationToken authenticated(
            AuthenticatedPrincipal principal,
            Collection<? extends GrantedAuthority> authorities
    ) {
        return new LoginAuthenticationToken(principal, authorities);
    }

    @Override
    public Object getCredentials() {
        return credentials;
    }

    @Override
    public Object getPrincipal() {
        return identifier;
    }

    public String tenantHint() {
        return tenantHint;
    }

    public RequestMetadata requestMetadata() {
        return requestMetadata;
    }
}

public final class LoginAuthenticationProvider implements AuthenticationProvider {

    private final LoginApplicationService loginService;
    private final AuthorityMapper authorityMapper;

    @Override
    public Authentication authenticate(Authentication authentication) {
        LoginAuthenticationToken token = (LoginAuthenticationToken) authentication;

        StartLoginCommand command = new StartLoginCommand(
                token.tenantHint(),
                String.valueOf(token.getPrincipal()),
                String.valueOf(token.getCredentials()).toCharArray(),
                token.requestMetadata(),
                token.requestMetadata().correlationId()
        );

        LoginDecision decision = loginService.startLogin(command);

        return switch (decision.outcome()) {
            case AUTHENTICATED -> LoginAuthenticationToken.authenticated(
                    AuthenticatedPrincipal.from(decision),
                    authorityMapper.map(decision.accountId())
            );
            case CHALLENGE_REQUIRED -> throw new ChallengeRequiredAuthenticationException(decision.challenge());
            case RATE_LIMITED -> throw new RateLimitedAuthenticationException();
            case TEMPORARILY_UNAVAILABLE -> throw new AuthenticationServiceException("Authentication unavailable");
            case FAILED -> throw new BadCredentialsException("Invalid credentials");
        };
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return LoginAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

public final class LoginSuccessHandler implements AuthenticationSuccessHandler {

    private final RedirectTargetValidator redirectTargetValidator;

    @Override
    public void onAuthenticationSuccess(
            HttpServletRequest request,
            HttpServletResponse response,
            Authentication authentication
    ) throws IOException {
        String target = request.getParameter("returnTo");
        String safeTarget = redirectTargetValidator.safeTargetOrDefault(target, "/");

        response.setStatus(HttpServletResponse.SC_FOUND);
        response.setHeader("Location", safeTarget);
    }
}

public final class LoginFailureHandler implements AuthenticationFailureHandler {

    @Override
    public void onAuthenticationFailure(
            HttpServletRequest request,
            HttpServletResponse response,
            AuthenticationException exception
    ) throws IOException {
        response.setStatus(statusFor(exception));
        response.setContentType("application/json");
        response.getWriter().write(genericBodyFor(exception));
    }

    private int statusFor(AuthenticationException exception) {
        if (exception instanceof RateLimitedAuthenticationException) {
            return 429;
        }
        if (exception instanceof ChallengeRequiredAuthenticationException) {
            return 401;
        }
        return 401;
    }

    private String genericBodyFor(AuthenticationException exception) {
        if (exception instanceof ChallengeRequiredAuthenticationException challenge) {
            return "{\"next\":\"additional_verification_required\",\"challengeId\":\""
                    + challenge.challenge().challengeId() + "\"}";
        }
        return "{\"error\":\"invalid_login\",\"message\":\"Invalid username or password\"}";
    }
}

@ApplicationScoped
public class FormLoginAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Inject
    LoginApplicationService loginService;

    @Override
    public AuthenticationStatus validateRequest(
            HttpServletRequest request,
            HttpServletResponse response,
            HttpMessageContext context
    ) throws AuthenticationException {
        if (!isLoginRequest(request)) {
            return context.doNothing();
        }

        StartLoginCommand command = new StartLoginCommand(
                request.getParameter("tenant"),
                request.getParameter("username"),
                request.getParameter("password").toCharArray(),
                RequestMetadata.from(request),
                correlationId(request)
        );

        LoginDecision decision = loginService.startLogin(command);

        return switch (decision.outcome()) {
            case AUTHENTICATED -> context.notifyContainerAboutLogin(
                    decision.accountId().toString(),
                    Set.of("USER")
            );
            case CHALLENGE_REQUIRED -> sendChallenge(response, decision);
            case RATE_LIMITED, FAILED -> sendGenericFailure(response);
            case TEMPORARILY_UNAVAILABLE -> sendUnavailable(response);
        };
    }
}

T1 read failed_count = 4
T2 read failed_count = 4
T1 write failed_count = 5
T2 write failed_count = 5

update auth_account_state
set failed_login_count = failed_login_count + 1,
    last_failure_login_at = now(),
    locked_until = case
        when failed_login_count + 1 >= 10 then now() + interval '15 minutes'
        else locked_until
    end,
    updated_at = now()
where account_id = :account_id;

update auth_login_challenge
set challenge_state = 'PASSED', completed_at = now()
where challenge_id = :challenge_id
  and challenge_state = 'PENDING'
  and expires_at > now()
  and attempts_left > 0;

public enum AuthenticationAssurance {
    NONE,
    PRIMARY_CREDENTIAL_VERIFIED,
    MFA_VERIFIED,
    PHISHING_RESISTANT_VERIFIED,
    ADMIN_STEP_UP_VERIFIED
}

Invalid username or password.

User does not exist.
Password incorrect.
Account exists but is disabled.

We could not sign you in right now. Please try again later.

Additional verification required.

Send code to email ending in ***@example.com

response.sendRedirect(request.getParameter("returnTo"));

public final class RedirectTargetValidator {

    private static final Set<String> ALLOWED_PREFIXES = Set.of("/app", "/dashboard", "/settings");

    public String safeTargetOrDefault(String rawTarget, String defaultTarget) {
        if (rawTarget == null || rawTarget.isBlank()) {
            return defaultTarget;
        }
        if (rawTarget.startsWith("//")) {
            return defaultTarget;
        }
        URI uri;
        try {
            uri = URI.create(rawTarget);
        } catch (IllegalArgumentException ex) {
            return defaultTarget;
        }
        if (uri.isAbsolute()) {
            return defaultTarget;
        }
        String path = uri.getPath();
        return ALLOWED_PREFIXES.stream().anyMatch(path::startsWith) ? rawTarget : defaultTarget;
    }
}

@Test
void passwordCorrectButMfaRequiredMustNotIssueSession() {
    StartLoginCommand command = validPasswordLoginForMfaUser();

    LoginDecision decision = loginService.startLogin(command);

    assertThat(decision.outcome()).isEqualTo(LoginOutcome.CHALLENGE_REQUIRED);
    assertThat(decision.session()).isNull();
    assertThat(challengeRepository.findByAttemptId(decision.attemptId())).isPresent();
    assertThat(auditSink.events()).extracting(AuthEvent::type)
            .contains("login.challenge_required")
            .doesNotContain("login.succeeded");
}

@ParameterizedTest
@MethodSource("invalidLoginScenarios")
void invalidScenariosReturnSameExternalMessage(LoginScenario scenario) throws Exception {
    mockMvc.perform(post("/login")
            .param("username", scenario.username())
            .param("password", scenario.password()))
        .andExpect(status().isUnauthorized())
        .andExpect(jsonPath("$.message").value("Invalid username or password"));
}

@Test
void failedLoginMustNotCreateAuthenticatedSession() throws Exception {
    MvcResult result = mockMvc.perform(post("/login")
            .param("username", "alice@example.com")
            .param("password", "wrong"))
        .andExpect(status().isUnauthorized())
        .andReturn();

    MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false);
    if (session != null) {
        assertThat(session.getAttribute("SPRING_SECURITY_CONTEXT")).isNull();
    }
}

@Test
void concurrentFailuresShouldIncrementCounterAtomically() throws Exception {
    int attempts = 50;
    ExecutorService executor = Executors.newFixedThreadPool(10);
    CountDownLatch start = new CountDownLatch(1);

    List<Future<?>> futures = IntStream.range(0, attempts)
            .mapToObj(i -> executor.submit(() -> {
                start.await();
                loginService.startLogin(wrongPasswordCommand("alice@example.com"));
                return null;
            }))
            .toList();

    start.countDown();
    for (Future<?> future : futures) {
        future.get();
    }

    AuthAccountState state = accountStateRepository.findByIdentifier("alice@example.com");
    assertThat(state.failedLoginCount()).isEqualTo(attempts);
}

/login?returnTo=https://evil.example/callback

Tenant A memakai password + TOTP.
Tenant B memakai password saja.
User alice@example.com ada di dua tenant.
Attacker mengirim 10.000 login attempt dari 500 IP.
Sebagian attempt memakai tenant hint salah.
Sebagian attempt memakai password benar untuk Tenant A.
Sebagian attempt mencoba bypass MFA dengan memanggil endpoint API langsung setelah password benar.

no full session before full authentication
no information leak through failure semantics
no non-atomic failure accounting
no hidden state transition without audit
no fail-open when dependency fails