diff --git a/blog_exceptions.py b/blog_exceptions.py
index cc5672ea..e78b3cef 100644
--- a/blog_exceptions.py
+++ b/blog_exceptions.py
@@ -93,6 +93,11 @@ class PasswordsDoNotMatchError(ValueError):
     pass
 
 
+class WeakPasswordError(ValueError):
+    """Raised when password does not meet strength requirements (length, uppercase, lowercase, special char)."""
+    pass
+
+
 class CommentEmptyError(ValueError):
     """Raised when comment content is empty."""
     pass
diff --git a/flask_setup/__init__.py b/flask_setup/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/frontend/core/components/ArticleForm.jsx b/frontend/core/components/ArticleForm.jsx
index 1ae1c80c..65791902 100644
--- a/frontend/core/components/ArticleForm.jsx
+++ b/frontend/core/components/ArticleForm.jsx
@@ -395,6 +395,8 @@ export default function ArticleForm() {
       if (res.ok) {
         const data = await res.json();
         window.location.href = `/articles/${data.id || articleId}`;
+      } else if (res.status === 401) {
+        window.location.href = '/';
       } else {
         const err = await res.json();
         setError(err.error || _('Failed to save.'));
@@ -435,7 +437,7 @@ export default function ArticleForm() {
           <span className="article-editor-label">{_('Description')}</span>
         </div>
         <div className="article-editor-section-header">
-          <span className="desc-limit-hint">{_('Maximum 300 characters')}</span>
+          <span className="field-hint">{_('Maximum 300 characters')}</span>
           <span className="char-counter">{description.length}/300</span>
         </div>
         <textarea
diff --git a/frontend/static/css/article.css b/frontend/static/css/article.css
index c5f68de5..22cd4b15 100644
--- a/frontend/static/css/article.css
+++ b/frontend/static/css/article.css
@@ -436,13 +436,12 @@ input[type=number] {
 .modal-input-group {
     display: flex;
     flex-direction: column;
-    gap: var(--spacing-sm);
+    gap: 0;
 }
 
 .modal-input-group label {
     font-size: var(--font-body-base);
     color: var(--on-surface-variant);
-    font-family: var(--font-mono);
 }
 
 .stepper-container {
@@ -742,13 +741,6 @@ a.comment-author:hover {
     text-decoration: underline;
 }
 
-.comment-limit-hint,
-.desc-limit-hint {
-    display: block;
-    font-size: var(--font-body-sm);
-    color: var(--text-secondary);
-}
-
 .comments-section {
     margin-top: var(--spacing-xl);
 }
@@ -1838,4 +1830,22 @@ a.comment-author:hover {
     }
 }
 
+/* Comment Rules */
+.comment-rules {
+    font-size: 0.8125rem;
+    color: var(--on-surface-variant);
+    background: var(--surface-container);
+    border: 1px solid var(--outline-variant);
+    border-radius: var(--radius-lg);
+    padding: var(--spacing-sm) var(--spacing-md);
+    margin-bottom: var(--spacing-md);
+}
+.comment-rules p {
+    margin: 0 0 var(--spacing-xs);
+}
+.comment-rules ul {
+    margin: 0;
+    padding-left: var(--spacing-lg);
+}
+
 
diff --git a/frontend/static/css/base.css b/frontend/static/css/base.css
index afb58600..edc8fd54 100644
--- a/frontend/static/css/base.css
+++ b/frontend/static/css/base.css
@@ -778,3 +778,11 @@ hr {
 .nav-item-home {
     font-size: var(--font-headline-md);
 }
+
+.field-hint {
+    display: block;
+    font-size: var(--font-body-xs);
+    color: var(--text-secondary);
+    text-align: justify;
+    margin-bottom: 0.125rem;
+}
diff --git a/frontend/static/css/profile.css b/frontend/static/css/profile.css
index 2c0b0a98..4ac09c13 100644
--- a/frontend/static/css/profile.css
+++ b/frontend/static/css/profile.css
@@ -176,13 +176,12 @@
 .modal-input-group {
     display: flex;
     flex-direction: column;
-    gap: var(--spacing-sm);
+    gap: 0;
 }
 
 .modal-input-group label {
     font-size: var(--font-body-base);
     color: var(--on-surface-variant);
-    font-family: var(--font-mono);
 }
 
 .back-link {
diff --git a/frontend/static/css/user-list.css b/frontend/static/css/user-list.css
index e8110a4c..4e013d01 100644
--- a/frontend/static/css/user-list.css
+++ b/frontend/static/css/user-list.css
@@ -378,13 +378,12 @@ input.search-input {
 .dialog .modal-input-group {
     display: flex;
     flex-direction: column;
-    gap: var(--spacing-sm);
+    gap: 0;
 }
 
 .dialog .modal-input-group label {
     font-size: var(--font-body-base);
     color: var(--on-surface-variant);
-    font-family: var(--font-mono);
 }
 
 .dialog .stepper-container {
diff --git a/frontend/templates/article_detail.html b/frontend/templates/article_detail.html
index d0ebe9d7..e2df7f50 100644
--- a/frontend/templates/article_detail.html
+++ b/frontend/templates/article_detail.html
@@ -195,7 +195,17 @@ <h3 class="comments-title">{{ _('Comments (%(count)s)', count=comment_count) }}<
         {% if current_user %}
         <div class="comment-join-section">
             <h4 class="comment-join-title" id="comment-form-title">{{ _('Join the discussion') }}</h4>
-            <span class="comment-limit-hint">{{ _('Comment must be between 1 and 5000 characters') }}</span>
+            <div class="comment-rules">
+                <p><strong>{{ _('Comment rules:') }}</strong></p>
+                <ul>
+                    <li>{{ _('No links, advertising, or spam.') }}</li>
+                    <li>{{ _('No profanity, insults, or hate speech.') }}</li>
+                    <li>{{ _('Do not post the same message multiple times.') }}</li>
+                    <li>{{ _('Stay respectful and on topic.') }}</li>
+                    <li><strong>{{ _('Violation results in account ban without notice.') }}</strong></li>
+                </ul>
+            </div>
+            <span class="field-hint">{{ _('Comment must be between 1 and 5000 characters') }}</span>
             <form action="{{ url_for('comment.create_comment', article_id=article.article_id) }}" method="POST"
                   id="comment-form"
                   data-create-url="{{ url_for('comment.create_comment', article_id=article.article_id) }}"
diff --git a/frontend/templates/login.html b/frontend/templates/login.html
index 0a4324e8..c052dc29 100644
--- a/frontend/templates/login.html
+++ b/frontend/templates/login.html
@@ -23,7 +23,7 @@ <h1 class="account-title">{{ _('Welcome Back') }}</h1>
         <div class="form-group account-form-group">
             <label for="login-password">{{ _('Password') }}</label>
             <div class="password-wrapper">
-                <input type="password" id="login-password" name="password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" autocomplete="current-password" required>
+                <input type="password" id="login-password" name="password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" autocomplete="current-password" minlength="8" required>
                 <button type="button" class="password-toggle" aria-label="{{ _('Toggle password visibility') }}" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
diff --git a/frontend/templates/profile.html b/frontend/templates/profile.html
index 951ed287..1038bbe8 100644
--- a/frontend/templates/profile.html
+++ b/frontend/templates/profile.html
@@ -107,8 +107,9 @@ <h2 class="modal-title">{{ _('Update Password') }}</h2>
                 <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                 <div class="modal-input-group">
                     <label for="new-password-input">{{ _('New Password') }}</label>
+                    <span class="field-hint">Minimum 8 caractères : au moins une majuscule, une minuscule et un caractère spécial</span>
                     <div class="password-wrapper">
-                        <input type="password" id="new-password-input" name="new_password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" required>
+                        <input type="password" id="new-password-input" name="new_password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" minlength="8" required>
                         <button type="button" class="password-toggle" aria-label="{{ _('Toggle password visibility') }}" aria-pressed="false">{{ icon('visibility') }}</button>
                     </div>
                 </div>
diff --git a/frontend/templates/registration.html b/frontend/templates/registration.html
index b294a6c6..66dc1528 100644
--- a/frontend/templates/registration.html
+++ b/frontend/templates/registration.html
@@ -18,7 +18,14 @@ <h1 class="account-title">{{ _('Join DevJournal') }}</h1>
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <div class="form-group">
             <label for="registration-username">{{ _('Choose Username') }}</label>
-            <input type="text" id="registration-username" name="username" placeholder="{{ _('e.g., dev_journey') }}" autocomplete="username" value="{{ username or '' }}" required>
+            <span class="field-hint">{{ _('3\u201330 characters: letters, numbers, underscores, hyphens') }}</span>
+            <input type="text" id="registration-username" name="username"
+                placeholder="{{ _('e.g., dev_journey') }}"
+                autocomplete="username"
+                minlength="3" maxlength="30"
+                pattern="[a-zA-Z0-9_-]{3,30}"
+                title="{{ _('3-30 characters: letters, numbers, underscores, hyphens') }}"
+                value="{{ username or '' }}" required>
         </div>
         <div class="form-group">
             <label for="registration-email">{{ _('Email Address') }}</label>
@@ -26,15 +33,23 @@ <h1 class="account-title">{{ _('Join DevJournal') }}</h1>
         </div>
         <div class="form-group">
             <label for="registration-password">{{ _('Password') }}</label>
+            <span class="field-hint">{{ _('Minimum 8 characters: at least one uppercase, one lowercase, and one special character') }}</span>
             <div class="password-wrapper">
-                <input type="password" id="registration-password" name="password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" autocomplete="new-password" required>
+                <input type="password" id="registration-password" name="password"
+                    placeholder="{{ _('e.g., MyP@ssw0rd!') }}"
+                    autocomplete="new-password"
+                    minlength="8" required>
                 <button type="button" class="password-toggle" aria-label="{{ _('Toggle password visibility') }}" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
         <div class="form-group account-form-group">
             <label for="registration-confirm-password">{{ _('Confirm Password') }}</label>
+            <span class="field-hint">{{ _('Minimum 8 characters: at least one uppercase, one lowercase, and one special character') }}</span>
             <div class="password-wrapper">
-                <input type="password" id="registration-confirm-password" name="confirm_password" placeholder="{{ _('e.g., MyP@ssw0rd!') }}" autocomplete="new-password" required>
+                <input type="password" id="registration-confirm-password" name="confirm_password"
+                    placeholder="{{ _('e.g., MyP@ssw0rd!') }}"
+                    autocomplete="new-password"
+                    minlength="8" required>
                 <button type="button" class="password-toggle" aria-label="{{ _('Toggle password visibility') }}" aria-pressed="false">{{ icon('visibility') }}</button>
             </div>
         </div>
diff --git a/migrations/V18__add_session_token_and_username_limit.sql b/migrations/V18__add_session_token_and_username_limit.sql
new file mode 100644
index 00000000..4a8f9495
--- /dev/null
+++ b/migrations/V18__add_session_token_and_username_limit.sql
@@ -0,0 +1,5 @@
+ALTER TABLE accounts
+  ADD COLUMN session_token VARCHAR(64);
+
+ALTER TABLE accounts
+  ALTER COLUMN account_username TYPE VARCHAR(30);
diff --git a/src/__init__.py b/src/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/__init__.py b/src/application/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/domain/__init__.py b/src/application/domain/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/domain/account.py b/src/application/domain/account.py
index f720d235..61419e8a 100644
--- a/src/application/domain/account.py
+++ b/src/application/domain/account.py
@@ -26,6 +26,7 @@ class Account:
         avatar_file_id (str | None): UUID of the avatar file in uploaded_files, or None.
         is_banned (bool): Whether the account is currently banned.
         ban_reason (str | None): Optional reason provided by admin when banning.
+        session_token (str | None): Random token for unique session enforcement.
     """
 
     def __init__(
@@ -39,6 +40,7 @@ def __init__(
         avatar_file_id: str | None = None,
         is_banned: bool = False,
         ban_reason: str | None = None,
+        session_token: str | None = None,
     ):
         """
         Initialize a user account.
@@ -53,6 +55,7 @@ def __init__(
             avatar_file_id (str | None): UUID of the avatar file in uploaded_files, or None.
             is_banned (bool): Whether the account is currently banned. Defaults to False.
             ban_reason (str | None): Optional reason provided by admin when banning.
+            session_token (str | None): Random token for unique session enforcement.
         """
         self.account_id = account_id
         self.account_username = account_username
@@ -63,3 +66,4 @@ def __init__(
         self.avatar_file_id = avatar_file_id
         self.is_banned = is_banned
         self.ban_reason = ban_reason
+        self.session_token = session_token
diff --git a/src/application/input_ports/__init__.py b/src/application/input_ports/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/output_ports/__init__.py b/src/application/output_ports/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/output_ports/account_repository.py b/src/application/output_ports/account_repository.py
index 92bb245a..fcde940e 100644
--- a/src/application/output_ports/account_repository.py
+++ b/src/application/output_ports/account_repository.py
@@ -198,6 +198,20 @@ def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str |
         """
         pass
 
+    @abstractmethod
+    def update_session_token(self, account_id: int, token: str | None) -> None:
+        """
+        Updates the session token for a given account.
+
+        Setting token to None effectively invalidates all existing sessions,
+        forcing the user to re-authenticate on next login attempt.
+
+        Args:
+            account_id: The ID of the account to update.
+            token: The new session token, or None to clear.
+        """
+        pass
+
     @abstractmethod
     def delete(self, account_id: int) -> None:
         """
diff --git a/src/application/services/__init__.py b/src/application/services/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/application/services/login_service.py b/src/application/services/login_service.py
index 90b7f6a8..0fd122f5 100644
--- a/src/application/services/login_service.py
+++ b/src/application/services/login_service.py
@@ -1,9 +1,13 @@
+import re
+import secrets
+
 from blog_exceptions import (
     AccountBannedError,
     AccountNotFoundError,
     AuthenticationError,
     AuthorizationError,
     EmailAlreadyTakenError,
+    WeakPasswordError,
 )
 from src.application.domain.account import Account, AccountRole
 from src.application.input_ports.account_session_management import AccountSessionManagementPort
@@ -43,7 +47,9 @@ def authenticate_user(self, username: str, password: str) -> Account:
         """
         Authenticates a user by verifying credentials.
 
-        If successful, the account is saved in the session.
+        If successful, a new session token is generated and persisted
+        in the database (invalidating any previous session), and the
+        account is saved in the session cookie.
         If the existing password hash uses outdated parameters,
         it is seamlessly upgraded to the current Argon2 settings.
 
@@ -72,6 +78,9 @@ def authenticate_user(self, username: str, password: str) -> Account:
                 account.account_password = new_hash
                 self.account_repository.save(account)
 
+            token = secrets.token_urlsafe(32)
+            account.session_token = token
+            self.account_repository.update_session_token(account.account_id, token)
             self.session_repository.save_account(account)
             return account
 
@@ -90,7 +99,13 @@ def get_current_account(self) -> Account | None:
     def terminate_session(self) -> None:
         """
         Terminates the current active session, effectively logging the user out.
+
+        Clears the session token in the database before wiping the session
+        cookie, ensuring the token cannot be reused.
         """
+        current = self.get_current_account()
+        if current:
+            self.account_repository.update_session_token(current.account_id, None)
         self.session_repository.clear()
 
     def get_account_by_username(self, username: str) -> Account | None:
@@ -166,15 +181,16 @@ def update_password(self, new_password: str) -> None:
         """
         Updates the password for the currently logged-in account.
 
-        Retrieves the current account from the session, hashes the new
-        password using the password hasher, and persists the change
-        via the account repository.
+        Validates password strength (lowercase, uppercase, special char),
+        then hashes and persists via the account repository.
 
         Args:
             new_password: The new plaintext password to set.
 
         Raises:
             AuthenticationError: If the user is not signed in.
+            WeakPasswordError: If password lacks lowercase, uppercase,
+                or special character.
         """
         account = self.get_current_account()
         if not account:
@@ -183,6 +199,13 @@ def update_password(self, new_password: str) -> None:
         if not new_password:
             return
 
+        if not re.search(r"[a-z]", new_password):
+            raise WeakPasswordError("Password must contain at least one lowercase letter.")
+        if not re.search(r"[A-Z]", new_password):
+            raise WeakPasswordError("Password must contain at least one uppercase letter.")
+        if not re.search(r"[^a-zA-Z0-9]", new_password):
+            raise WeakPasswordError("Password must contain at least one special character.")
+
         new_hash = self.password_hasher_repository.hash(new_password)
         self.account_repository.update_password(account.account_id, new_hash)
 
@@ -292,6 +315,9 @@ def ban_account(self, admin_id: int, target_account_id: int, ban_reason: str | N
         """
         Bans a user account. Only admins can ban non-admin accounts.
 
+        Clears the session token to force immediate disconnection
+        on the next request from any active session.
+
         Args:
             admin_id: The unique identifier of the admin performing the action.
             target_account_id: The unique identifier of the account to ban.
@@ -314,6 +340,7 @@ def ban_account(self, admin_id: int, target_account_id: int, ban_reason: str | N
             raise AuthorizationError("Cannot ban another admin.")
 
         self.account_repository.update_ban_status(target_account_id, True, ban_reason)
+        self.account_repository.update_session_token(target_account_id, None)
 
     def unban_account(self, admin_id: int, target_account_id: int) -> None:
         """
diff --git a/src/infrastructure/__init__.py b/src/infrastructure/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/input_adapters/dto/__init__.py b/src/infrastructure/input_adapters/dto/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/input_adapters/dto/login_request.py b/src/infrastructure/input_adapters/dto/login_request.py
index 9346df71..6836ec6c 100644
--- a/src/infrastructure/input_adapters/dto/login_request.py
+++ b/src/infrastructure/input_adapters/dto/login_request.py
@@ -10,4 +10,4 @@ class LoginRequest(BaseModel):
     """
 
     username: str = Field(..., min_length=1, description="The account username.")
-    password: str = Field(..., min_length=1, description="The account password.")
+    password: str = Field(..., min_length=8, description="The account password. Minimum 8 characters.")
diff --git a/src/infrastructure/input_adapters/dto/registration_request.py b/src/infrastructure/input_adapters/dto/registration_request.py
index b6bd791b..4c7efbea 100644
--- a/src/infrastructure/input_adapters/dto/registration_request.py
+++ b/src/infrastructure/input_adapters/dto/registration_request.py
@@ -1,6 +1,8 @@
-from pydantic import BaseModel, EmailStr, Field, model_validator
+import re
 
-from blog_exceptions import PasswordsDoNotMatchError
+from pydantic import BaseModel, EmailStr, Field, field_validator, model_validator
+
+from blog_exceptions import PasswordsDoNotMatchError, WeakPasswordError
 
 
 class RegistrationRequest(BaseModel):
@@ -9,14 +11,52 @@ class RegistrationRequest(BaseModel):
 
     Validates the data received at the registration endpoint before
     it is passed to the RegistrationManagementPort. Enforces strict rules
-    on email format, password length, and password confirmation.
+    on username format (3-30 chars, alphanumeric + underscores/hyphens),
+    email format, password strength (8+ chars, lowercase, uppercase,
+    special character), and password confirmation.
     """
 
-    username: str = Field(..., description="The desired username.")
+    username: str = Field(
+        ...,
+        min_length=3,
+        max_length=30,
+        pattern=r"^[a-zA-Z0-9_-]+$",
+        description="The desired username. 3-30 characters: letters, numbers, underscores, hyphens.",
+    )
     email: EmailStr = Field(..., description="A valid email address.")
-    password: str = Field(..., description="The account password.")
+    password: str = Field(
+        ...,
+        min_length=8,
+        description="The account password. Must contain at least one uppercase, one lowercase, and one special character.",
+    )
     confirm_password: str = Field(..., description="Must match the password field.")
 
+    @field_validator("password")
+    @classmethod
+    def password_strength(cls, v: str) -> str:
+        """
+        Validates password strength using three regex checks.
+
+        Ensures the password contains at least one lowercase letter,
+        one uppercase letter, and one special character.
+
+        Args:
+            v: The password string to validate.
+
+        Returns:
+            str: The validated password if all checks pass.
+
+        Raises:
+            WeakPasswordError: If any strength requirement is not met.
+        """
+        if not re.search(r"[a-z]", v):
+            raise WeakPasswordError("Password must contain at least one lowercase letter.")
+        if not re.search(r"[A-Z]", v):
+            raise WeakPasswordError("Password must contain at least one uppercase letter.")
+        if not re.search(r"[^a-zA-Z0-9]", v):
+            raise WeakPasswordError("Password must contain at least one special character.")
+        return v
+
     @model_validator(mode="after")
     def passwords_must_match(self) -> "RegistrationRequest":
         """
diff --git a/src/infrastructure/input_adapters/flask/__init__.py b/src/infrastructure/input_adapters/flask/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
index f37e80ba..a9c93653 100644
--- a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
@@ -1,12 +1,12 @@
 import logging
 import math
 
-from flask_babel import gettext as _
-
-from blog_exceptions import BlogCommentError, FileTooLargeError, FileTypeError
 from flask import abort, flash, jsonify, redirect, render_template, request, session, url_for
 from flask import g as global_request_context
 from flask.views import MethodView
+from flask_babel import gettext as _
+
+from blog_exceptions import BlogCommentError, FileTooLargeError, FileTypeError, WeakPasswordError
 from src.application.domain.account import AccountRole
 from src.application.input_ports.account_session_management import AccountSessionManagementPort
 from src.application.input_ports.comment_management import CommentManagementPort
@@ -45,8 +45,29 @@ def __init__(
         self.comment_service = comment_service
 
     def _identify_user(self):
-        """Injects the current user into the global request context."""
+        """Injects the current user into the global request context.
+
+        Checks for a pre-existing session (user_id + session_token in cookie).
+        After fetching the account, compares the cookie token against the
+        database token. On mismatch (session stolen / another login elsewhere):
+        - Flashes a disconnection message in the "error" category.
+        - Returns a redirect to the article list (non-API paths only).
+        - API paths (/api/) skip the redirect; the 401 is handled by the
+          React front-end via FlaskSessionAdapter returning None.
+        If no mismatch or no pre-existing session, proceeds normally.
+        """
+        had_session = (
+            session.get("user_id") is not None
+            and session.get("session_token") is not None
+        )
         global_request_context.current_user = self.session_service.get_current_account()
+        if had_session and global_request_context.current_user is None:
+            flash(
+                _("You have been disconnected because your account was logged in from another location."),
+                "error",
+            )
+            if not request.path.startswith("/api/"):
+                return redirect(url_for("article.list_articles"))
 
     def register_before_request_handler(self, app):
         """
@@ -71,7 +92,12 @@ def logout(self):
 
         Returns:
             Response: A Flask redirect response.
+
+        Raises:
+            403: If no user is currently authenticated.
         """
+        if not self.session_service.get_current_account():
+            abort(403)
         self.session_service.terminate_session()
         flash(_("You have been logged out."), "info")
         return redirect(url_for("article.list_articles"))
@@ -268,8 +294,9 @@ def update_password(self):
         Handles password change form submission.
 
         Validates authentication, extracts the new password from the form data,
-        and delegates the update to the session service. Redirects back to
-        the profile page with a flash message on success or error.
+        and delegates the update to the session service. Catches both
+        BlogCommentError and WeakPasswordError for user-friendly flash messages.
+        Redirects back to the profile page on success or error.
 
         Returns:
             Response: A Flask redirect response to the profile page.
@@ -286,7 +313,7 @@ def update_password(self):
 
         try:
             self.session_service.update_password(new_password)
-        except BlogCommentError as e:
+        except (BlogCommentError, WeakPasswordError) as e:
             flash(_(str(e)), "error")
         else:
             flash(_("Password updated."), "success")
diff --git a/src/infrastructure/input_adapters/flask/flask_article_adapter.py b/src/infrastructure/input_adapters/flask/flask_article_adapter.py
index 888d6400..fa29f9af 100644
--- a/src/infrastructure/input_adapters/flask/flask_article_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_article_adapter.py
@@ -1,13 +1,13 @@
 import json
 import math
 
+from flask import flash, jsonify, redirect, render_template, request, url_for
+from flask import g as global_request_context
 from flask_babel import gettext as _
 from pydantic import ValidationError
 from werkzeug.wrappers.response import Response
 
 from blog_exceptions import BlogCommentError
-from flask import flash, jsonify, redirect, render_template, request, url_for
-from flask import g as global_request_context
 from src.application.domain.comment import CommentNode
 from src.application.input_ports.article_management import ArticleManagementPort
 from src.infrastructure.input_adapters.dto.article_request import ArticleRequest
diff --git a/src/infrastructure/input_adapters/flask/flask_comment_adapter.py b/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
index bcee9880..c14b933c 100644
--- a/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_comment_adapter.py
@@ -1,12 +1,12 @@
 import time
 
+from flask import abort, flash, redirect, request, url_for
+from flask import g as global_request_context
 from flask_babel import gettext as _
 from pydantic import ValidationError
 from werkzeug.wrappers.response import Response
 
 from blog_exceptions import BlogCommentError
-from flask import flash, redirect, request, url_for
-from flask import g as global_request_context
 from src.application.input_ports.comment_management import CommentManagementPort
 from src.infrastructure.input_adapters.dto.comment_request import CommentRequest
 
@@ -213,11 +213,16 @@ def hard_delete_comment(self, article_id: int, comment_id: int) -> Response:
 
         Returns:
             Response: A redirect to the article detail page.
+
+        Raises:
+            403: If the current user is not authenticated as an admin.
         """
         user = global_request_context.get("current_user")
         if not user:
             flash(_("You must be signed in to delete comments."), "error")
             return redirect(url_for("auth.login"))
+        if user.account_role != "admin":
+            abort(403)
 
         try:
             self.comment_service.hard_delete_comment(
diff --git a/src/infrastructure/input_adapters/flask/flask_file_adapter.py b/src/infrastructure/input_adapters/flask/flask_file_adapter.py
index 06114c65..a4bfc9d6 100644
--- a/src/infrastructure/input_adapters/flask/flask_file_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_file_adapter.py
@@ -1,9 +1,9 @@
 from io import BytesIO
 
+from flask import jsonify, request, send_file
 from flask_babel import gettext as _
 
 from blog_exceptions import FileTooLargeError, FileTypeError
-from flask import jsonify, request, send_file
 from src.application.input_ports.file_management import FileManagementPort
 from src.infrastructure.input_adapters.dto.file_upload_request import FileUploadRequest
 
diff --git a/src/infrastructure/input_adapters/flask/flask_login_adapter.py b/src/infrastructure/input_adapters/flask/flask_login_adapter.py
index f20b2d0b..60e9ac61 100644
--- a/src/infrastructure/input_adapters/flask/flask_login_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_login_adapter.py
@@ -1,10 +1,10 @@
+from flask import flash, redirect, render_template, request, url_for
+from flask import g as global_request_context
+from flask.views import MethodView
 from flask_babel import gettext as _
 from pydantic import ValidationError
 
 from blog_exceptions import AccountBannedError, AuthenticationError
-from flask import flash, redirect, render_template, request, url_for
-from flask import g as global_request_context
-from flask.views import MethodView
 from src.application.input_ports.login_management import LoginManagementPort
 from src.infrastructure.input_adapters.dto.login_request import LoginRequest
 
diff --git a/src/infrastructure/input_adapters/flask/flask_registration_adapter.py b/src/infrastructure/input_adapters/flask/flask_registration_adapter.py
index cbfcc062..797c7d07 100644
--- a/src/infrastructure/input_adapters/flask/flask_registration_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_registration_adapter.py
@@ -1,10 +1,10 @@
+from flask import flash, redirect, render_template, request, url_for
+from flask import g as global_request_context
+from flask.views import MethodView
 from flask_babel import gettext as _
 from pydantic import ValidationError
 
 from blog_exceptions import BlogCommentError
-from flask import flash, redirect, render_template, request, url_for
-from flask import g as global_request_context
-from flask.views import MethodView
 from src.application.input_ports.registration_management import RegistrationManagementPort
 from src.infrastructure.input_adapters.dto.registration_request import RegistrationRequest
 
diff --git a/src/infrastructure/output_adapters/__init__.py b/src/infrastructure/output_adapters/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/output_adapters/dto/__init__.py b/src/infrastructure/output_adapters/dto/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/output_adapters/dto/account_record.py b/src/infrastructure/output_adapters/dto/account_record.py
index f7e4c8c7..6693d7ba 100644
--- a/src/infrastructure/output_adapters/dto/account_record.py
+++ b/src/infrastructure/output_adapters/dto/account_record.py
@@ -25,6 +25,7 @@ class AccountRecord(BaseModel):
     avatar_file_id: str | None = None
     is_banned: bool = False
     ban_reason: str | None = None
+    session_token: str | None = None
 
     def to_domain(self) -> Account:
         """
@@ -33,7 +34,8 @@ def to_domain(self) -> Account:
         Returns:
             Account: The corresponding domain entity, including the
             conversion of the 'account_role' string to an AccountRole enum,
-            the optional avatar_file_id reference, and the ban status fields.
+            the optional avatar_file_id reference, the ban status fields,
+            and the session_token for unique session enforcement.
         """
         return Account(
             account_id=self.account_id,
@@ -45,4 +47,5 @@ def to_domain(self) -> Account:
             avatar_file_id=self.avatar_file_id,
             is_banned=self.is_banned,
             ban_reason=self.ban_reason,
+            session_token=self.session_token,
         )
diff --git a/src/infrastructure/output_adapters/in_memory/__init__.py b/src/infrastructure/output_adapters/in_memory/__init__.py
deleted file mode 100644
index 899c2210..00000000
--- a/src/infrastructure/output_adapters/in_memory/__init__.py
+++ /dev/null
@@ -1,3 +0,0 @@
-"""
-In-memory adapters for hexagonal architecture testing.
-"""
diff --git a/src/infrastructure/output_adapters/in_memory/account_repository.py b/src/infrastructure/output_adapters/in_memory/account_repository.py
index 319c7004..a9d36b7c 100644
--- a/src/infrastructure/output_adapters/in_memory/account_repository.py
+++ b/src/infrastructure/output_adapters/in_memory/account_repository.py
@@ -234,6 +234,22 @@ def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str |
         account.is_banned = is_banned
         account.ban_reason = ban_reason
 
+    def update_session_token(self, account_id: int, token: str | None) -> None:
+        """
+        Updates the session token for the given account in memory.
+
+        Args:
+            account_id: The ID of the account to update.
+            token: The new session token, or None to clear.
+
+        Raises:
+            AccountNotFoundError: If no account with the given ID exists.
+        """
+        account = self._accounts.get(account_id)
+        if account is None:
+            raise AccountNotFoundError(f"Account with id {account_id} not found.")
+        account.session_token = token
+
     def delete(self, account_id: int) -> None:
         """
         Deletes an account by its unique identifier from the in-memory store.
diff --git a/src/infrastructure/output_adapters/session/__init__.py b/src/infrastructure/output_adapters/session/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/output_adapters/session/flask_session_adapter.py b/src/infrastructure/output_adapters/session/flask_session_adapter.py
index 16a7d0cd..1b3f35df 100644
--- a/src/infrastructure/output_adapters/session/flask_session_adapter.py
+++ b/src/infrastructure/output_adapters/session/flask_session_adapter.py
@@ -14,6 +14,7 @@ class FlaskSessionAdapter(AccountSessionRepository):
     _KEY_USER_ID = "user_id"
     _KEY_USERNAME = "username"
     _KEY_ROLE = "role"
+    _KEY_SESSION_TOKEN = "session_token"
 
     def __init__(self, account_repository: AccountRepository):
         """
@@ -34,11 +35,16 @@ def save_account(self, account: Account) -> None:
         flask_session[self._KEY_USER_ID] = account.account_id
         flask_session[self._KEY_USERNAME] = account.account_username
         flask_session[self._KEY_ROLE] = account.account_role.value
+        flask_session[self._KEY_SESSION_TOKEN] = account.session_token
 
     def get_account(self) -> Account | None:
         """
         Retrieves the currently connected domain Account.
 
+        Compares the session token stored in the cookie against the token
+        in the database. If they differ (another login occurred elsewhere),
+        the session is silently cleared.
+
         Returns:
             Account | None: The domain account if a session is active, otherwise None.
         """
@@ -47,7 +53,14 @@ def get_account(self) -> Account | None:
         if not account_id or not str(account_id).isdigit():
             return None
 
-        return self.account_repository.get_by_id(int(str(account_id)))
+        account = self.account_repository.get_by_id(int(str(account_id)))
+
+        session_token = flask_session.get(self._KEY_SESSION_TOKEN)
+        if account and session_token is not None and account.session_token != session_token:
+            self.clear()
+            return None
+
+        return account
 
     def clear(self) -> None:
         """
diff --git a/src/infrastructure/output_adapters/sqlalchemy/__init__.py b/src/infrastructure/output_adapters/sqlalchemy/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/output_adapters/sqlalchemy/models/__init__.py b/src/infrastructure/output_adapters/sqlalchemy/models/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
index c016af8f..10b6a3de 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
@@ -27,3 +27,4 @@ class AccountModel(SqlAlchemyModel):
     avatar_file_id: Mapped[str | None] = mapped_column(Text, nullable=True, default=None)
     is_banned: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
     ban_reason: Mapped[str | None] = mapped_column(String(150), nullable=True, default=None)
+    session_token: Mapped[str | None] = mapped_column(String(64), nullable=True, default=None)
diff --git a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
index 3faa6478..ac7b1f4a 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
@@ -225,6 +225,23 @@ def update_password(self, account_id: int, new_hashed_password: str) -> None:
         model.account_password = new_hashed_password
         self._db_commit()
 
+    def update_session_token(self, account_id: int, token: str | None) -> None:
+        """
+        Updates the session token for the given account directly in the database.
+
+        Performs a targeted column update without loading or saving the full
+        Account entity.
+
+        Args:
+            account_id: The ID of the account to update.
+            token: The new session token, or None to clear.
+        """
+        model = self._db_get(AccountModel, account_id)
+        if model is None:
+            return
+        model.session_token = token
+        self._db_commit()
+
     def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str | None) -> None:
         """
         Sets or clears the ban status for the given account directly in the database.
diff --git a/tests/__init__.py b/tests/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/test_domain_factories.py b/tests/test_domain_factories.py
index 2d6d916e..a55c8c15 100644
--- a/tests/test_domain_factories.py
+++ b/tests/test_domain_factories.py
@@ -15,6 +15,7 @@ def create_test_account(
     account_avatar_file_id: str | None = None,
     is_banned: bool = False,
     ban_reason: str | None = None,
+    session_token: str | None = None,
 ) -> Account:
     """Factory to create a test Account entity with sensible defaults."""
     if account_created_at is None:
@@ -30,6 +31,7 @@ def create_test_account(
         avatar_file_id=account_avatar_file_id,
         is_banned=is_banned,
         ban_reason=ban_reason,
+        session_token=session_token,
     )
 
 
diff --git a/tests/tests_infrastructure/__init__.py b/tests/tests_infrastructure/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_input_adapters/__init__.py b/tests/tests_infrastructure/tests_input_adapters/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/__init__.py b/tests/tests_infrastructure/tests_input_adapters/dto/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/test_login_request.py b/tests/tests_infrastructure/tests_input_adapters/dto/test_login_request.py
index ac06059e..5c33d01b 100644
--- a/tests/tests_infrastructure/tests_input_adapters/dto/test_login_request.py
+++ b/tests/tests_infrastructure/tests_input_adapters/dto/test_login_request.py
@@ -22,3 +22,7 @@ def test_login_request_missing_username(self):
     def test_login_request_missing_password(self):
         with pytest.raises(ValidationError):
             LoginRequest.model_validate({"username": "leia"})
+
+    def test_login_request_password_too_short(self):
+        with pytest.raises(ValidationError):
+            LoginRequest(username="leia", password="short")
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/test_registration_request.py b/tests/tests_infrastructure/tests_input_adapters/dto/test_registration_request.py
index f208cbdb..0ec64d44 100644
--- a/tests/tests_infrastructure/tests_input_adapters/dto/test_registration_request.py
+++ b/tests/tests_infrastructure/tests_input_adapters/dto/test_registration_request.py
@@ -3,6 +3,8 @@
 
 from src.infrastructure.input_adapters.dto.registration_request import RegistrationRequest
 
+VALID_PASSWORD = "Password1!"
+
 
 class TestRegistrationRequest:
     """
@@ -14,8 +16,8 @@ def test_registration_request_valid(self):
         req = RegistrationRequest(
             username="leia",
             email="leia@rebels.com",
-            password="password123",
-            confirm_password="password123"
+            password=VALID_PASSWORD,
+            confirm_password=VALID_PASSWORD,
         )
         assert req.username == "leia"
         assert req.email == "leia@rebels.com"
@@ -25,8 +27,8 @@ def test_registration_request_invalid_email(self):
             RegistrationRequest(
                 username="leia",
                 email="invalid-email",
-                password="password123",
-                confirm_password="password123"
+                password=VALID_PASSWORD,
+                confirm_password=VALID_PASSWORD,
             )
 
     def test_registration_request_password_mismatch(self):
@@ -34,8 +36,8 @@ def test_registration_request_password_mismatch(self):
             RegistrationRequest(
                 username="leia",
                 email="leia@rebels.com",
-                password="password123",
-                confirm_password="different_password"
+                password=VALID_PASSWORD,
+                confirm_password="Different1!",
             )
         assert "Passwords do not match." in str(excinfo.value)
 
@@ -43,6 +45,44 @@ def test_registration_request_missing_field(self):
         with pytest.raises(ValidationError):
             RegistrationRequest.model_validate({
                 "email": "leia@rebels.com",
-                "password": "password123",
-                "confirm_password": "password123"
+                "password": VALID_PASSWORD,
+                "confirm_password": VALID_PASSWORD,
             })
+
+    def test_username_too_short(self):
+        with pytest.raises(ValidationError):
+            RegistrationRequest(
+                username="ab",
+                email="leia@rebels.com",
+                password=VALID_PASSWORD,
+                confirm_password=VALID_PASSWORD,
+            )
+
+    def test_username_invalid_chars(self):
+        with pytest.raises(ValidationError):
+            RegistrationRequest(
+                username="user name!",
+                email="leia@rebels.com",
+                password=VALID_PASSWORD,
+                confirm_password=VALID_PASSWORD,
+            )
+
+    def test_password_no_uppercase(self):
+        with pytest.raises(ValidationError) as excinfo:
+            RegistrationRequest(
+                username="leia",
+                email="leia@rebels.com",
+                password="abcdef8!",
+                confirm_password="abcdef8!",
+            )
+        assert "uppercase" in str(excinfo.value)
+
+    def test_password_no_special(self):
+        with pytest.raises(ValidationError) as excinfo:
+            RegistrationRequest(
+                username="leia",
+                email="leia@rebels.com",
+                password="Abcdefg8",
+                confirm_password="Abcdefg8",
+            )
+        assert "special" in str(excinfo.value)
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/__init__.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
index 26294fd2..9dbff937 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
@@ -108,11 +108,19 @@ def setup_method(self):
         )
 
     def test_logout_clears_session(self):
+        fake_user = create_test_account()
+        self.set_current_user(fake_user)
+        self.mock_session_service.get_current_account.return_value = fake_user
         response = self.client.post("/logout", follow_redirects=True)
         assert b"You have been logged out." in response.data
         assert b"alert-info" in response.data
         self.mock_session_service.terminate_session.assert_called_once()
 
+    def test_logout_not_authenticated_returns_403(self):
+        self.mock_session_service.get_current_account.return_value = None
+        response = self.client.post("/logout")
+        assert response.status_code == 403
+
     def test_logout_get_returns_method_not_allowed(self):
         response = self.client.get("/logout")
         assert response.status_code == 405
@@ -702,3 +710,29 @@ def test_before_request_isolation_between_requests(self):
         self.client.get("/req2")
         user2 = self._captured_user
         assert user2 is None
+
+    def test_before_request_token_mismatch_redirects_non_api(self):
+        self.mock_session_service.get_current_account.return_value = None
+        self.adapter.register_before_request_handler(self.app)
+        self._register_dummy_route("/test-page", "test.page", "page")
+        self._register_dummy_route("/", "article.list_articles", "articles")
+
+        with self.client.session_transaction() as sess:
+            sess["user_id"] = "1"
+            sess["session_token"] = "old_token"
+
+        response = self.client.get("/test-page")
+        assert response.status_code == 302
+
+    def test_before_request_token_mismatch_api_skips_redirect(self):
+        self.mock_session_service.get_current_account.return_value = None
+        self.adapter.register_before_request_handler(self.app)
+        self._register_dummy_route("/api/test", "test.api", "api-test")
+
+        with self.client.session_transaction() as sess:
+            sess["user_id"] = "1"
+            sess["session_token"] = "old_token"
+
+        response = self.client.get("/api/test")
+        assert response.status_code == 200
+        assert b"api-test" in response.data
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
index 846224e3..14cd6608 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_comment_adapter.py
@@ -227,7 +227,7 @@ def test_edit_comment_not_authenticated(self):
 
 class TestCommentHardDelete(CommentAdapterTestBase):
     def test_hard_delete_comment_success(self):
-        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        user = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
         self.set_current_user(user)
         self.mock_comment_service.hard_delete_comment.return_value = True
         response = self.client.post("/articles/1/comments/99/delete-permanent")
@@ -245,7 +245,7 @@ def test_hard_delete_comment_not_authenticated(self):
         self.mock_comment_service.hard_delete_comment.assert_not_called()
 
     def test_hard_delete_comment_service_error_string(self):
-        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        user = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
         self.set_current_user(user)
         from blog_exceptions import CommentNotFoundError
         self.mock_comment_service.hard_delete_comment.side_effect = CommentNotFoundError("Comment not found")
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
index 43087255..0df55592 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
@@ -76,7 +76,7 @@ def test_post_login_invalid_credentials(self):
 
         response = self.client.post("/login", data={
             "username": "wrong",
-            "password": "wrong"
+            "password": "Wr0ng!Pass"
         }, follow_redirects=True)
 
         assert b"Invalid username or password." in response.data
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_registration_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_registration_adapter.py
index d84a5bcc..6264eb1c 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_registration_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_registration_adapter.py
@@ -72,8 +72,8 @@ def test_post_registration_success(self):
         response = self.client.post("/register", data={
             "username": "leia",
             "email": "leia@rebels.com",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"Registration successful. Please sign in." in response.data
@@ -85,7 +85,7 @@ def test_post_registration_password_mismatch(self):
         response = self.client.post("/register", data={
             "username": "leia",
             "email": "leia@rebels.com",
-            "password": "password123",
+            "password": "Str0ng!Pass",
             "confirm_password": "wrong_confirm"
         }, follow_redirects=True)
 
@@ -101,8 +101,8 @@ def test_post_registration_email_taken(self):
         response = self.client.post("/register", data={
             "username": "leia",
             "email": "leia@rebels.com",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"This email is already taken." in response.data
@@ -116,8 +116,8 @@ def test_post_registration_username_taken(self):
         response = self.client.post("/register", data={
             "username": "leia",
             "email": "leia@rebels.com",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"This username is already taken." in response.data
@@ -128,8 +128,8 @@ def test_post_registration_invalid_email(self):
         response = self.client.post("/register", data={
             "username": "leia",
             "email": "invalid-email",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"email: value is not a valid email address" in response.data
diff --git a/tests/tests_infrastructure/tests_output_adapters/__init__.py b/tests/tests_infrastructure/tests_output_adapters/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_output_adapters/dto/__init__.py b/tests/tests_infrastructure/tests_output_adapters/dto/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_output_adapters/dto/tests_sqlalchemy/__init__.py b/tests/tests_infrastructure/tests_output_adapters/dto/tests_sqlalchemy/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_infrastructure/tests_output_adapters/test_flask_session_adapter.py b/tests/tests_infrastructure/tests_output_adapters/test_flask_session_adapter.py
index 96bf1e11..3ebc2f4d 100644
--- a/tests/tests_infrastructure/tests_output_adapters/test_flask_session_adapter.py
+++ b/tests/tests_infrastructure/tests_output_adapters/test_flask_session_adapter.py
@@ -201,3 +201,37 @@ def test_cookie_overflow_resilience(self):
             retrieved = self.adapter.get_account()
             if retrieved:
                 assert retrieved.account_username == long_username
+
+
+class TestFlaskSessionAdapterSessionToken(BaseTestFlaskSessionAdapter):
+    def test_save_account_stores_session_token(self):
+        from flask import session as flask_session
+
+        account = create_test_account(session_token="tok123")
+        self.mock_repo.get_by_id.return_value = account
+        with self.app.test_request_context():
+            self.adapter.save_account(account)
+            assert flask_session.get(self.adapter._KEY_SESSION_TOKEN) == "tok123"
+
+    def test_get_account_token_match(self):
+        from flask import session as flask_session
+
+        account = create_test_account(session_token="tok456")
+        self.mock_repo.get_by_id.return_value = account
+        with self.app.test_request_context():
+            flask_session[self.adapter._KEY_USER_ID] = account.account_id
+            flask_session[self.adapter._KEY_SESSION_TOKEN] = "tok456"
+            retrieved = self.adapter.get_account()
+            assert retrieved == account
+
+    def test_get_account_token_mismatch_returns_none(self):
+        from flask import session as flask_session
+
+        account = create_test_account(session_token="tok789")
+        self.mock_repo.get_by_id.return_value = account
+        with self.app.test_request_context():
+            flask_session[self.adapter._KEY_USER_ID] = account.account_id
+            flask_session[self.adapter._KEY_SESSION_TOKEN] = "wrong_token"
+            retrieved = self.adapter.get_account()
+            assert retrieved is None
+            assert not flask_session
diff --git a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
index a53a96cd..63dd110f 100644
--- a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
+++ b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
@@ -1,5 +1,7 @@
 from datetime import datetime
 
+import pytest
+
 from src.application.domain.account import Account, AccountRole
 from src.application.domain.article import Article
 from src.application.domain.comment import Comment
@@ -270,6 +272,32 @@ def test_update_ban_status_unban(self):
         assert updated.is_banned is False
         assert updated.ban_reason is None
 
+    def test_update_session_token_sets_token(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "em", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_session_token(account.account_id, "abc123")
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.session_token == "abc123"
+
+    def test_update_session_token_clears_token(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "em", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_session_token(account.account_id, "abc123")
+        repo.update_session_token(account.account_id, None)
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.session_token is None
+
+    def test_update_session_token_nonexistent_account_raises(self):
+        from blog_exceptions import AccountNotFoundError
+
+        repo = InMemoryAccountRepository()
+        with pytest.raises(AccountNotFoundError, match="not found"):
+            repo.update_session_token(999, "abc123")
+
 
 class TestInMemoryCommentRepository:
     def test_save_and_get(self):
diff --git a/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/__init__.py b/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_integration/test_account_integration.py b/tests/tests_integration/test_account_integration.py
index dd976be4..608adb80 100644
--- a/tests/tests_integration/test_account_integration.py
+++ b/tests/tests_integration/test_account_integration.py
@@ -16,7 +16,7 @@ def test_duplicate_registration_handling_integ(self, client, db_session):
         existing = AccountModel(
             account_username="existing_user",
             account_email="existing@test.com",
-            account_password="password",
+            account_password="Str0ng!Pass",
             account_role="user"
         )
 
@@ -26,8 +26,8 @@ def test_duplicate_registration_handling_integ(self, client, db_session):
         response_uname = client.post("/register", data={
             "username": "existing_user",
             "email": "new@test.com",
-            "password": "password",
-            "confirm_password": "password"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"already taken" in response_uname.data.lower()
@@ -35,8 +35,8 @@ def test_duplicate_registration_handling_integ(self, client, db_session):
         response_email = client.post("/register", data={
             "username": "new_user",
             "email": "existing@test.com",
-            "password": "password",
-            "confirm_password": "password"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"already taken" in response_email.data.lower()
@@ -51,7 +51,7 @@ def test_profile_update_propagation_and_session_integ(self, client, db_session):
         auth = AccountModel(
             account_username="old_name",
             account_email="old@test.com",
-            account_password="p",
+            account_password="Str0ng!Pass",
             account_role="author"
         )
         db_session.add(auth)
@@ -59,7 +59,7 @@ def test_profile_update_propagation_and_session_integ(self, client, db_session):
         art = ArticleModel(article_title="My Bio", article_content="...", article_author_id=auth.account_id)
         db_session.add(art)
         db_session.commit()
-        client.post("/login", data={"username": "old_name", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "old_name", "password": "Str0ng!Pass"}, follow_redirects=True)
         response_1 = client.get("/")
         assert b"old_name" in response_1.data
         response_2 = client.get(f"/articles/{art.article_id}")
@@ -88,7 +88,7 @@ def _create_user_and_old_file(self, db_session):
         auth = AccountModel(
             account_username="photo_user",
             account_email="photo@test.com",
-            account_password="p",
+            account_password="Str0ng!Pass",
             account_role="user",
             avatar_file_id=self.OLD_FILE_ID,
         )
@@ -98,7 +98,7 @@ def _create_user_and_old_file(self, db_session):
 
     def test_upload_replaces_old_avatar_and_remove_clears_integ(self, client, db_session):
         auth = self._create_user_and_old_file(db_session)
-        client.post("/login", data={"username": "photo_user", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "photo_user", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         upload_resp = client.post(
             "/api/profile/photo",
@@ -134,13 +134,13 @@ def test_update_email_flow(self, client, db_session):
         auth = AccountModel(
             account_username="email_user",
             account_email="before@test.com",
-            account_password="p",
+            account_password="Str0ng!Pass",
             account_role="user",
         )
         db_session.add(auth)
         db_session.commit()
 
-        client.post("/login", data={"username": "email_user", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "email_user", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         response = client.post("/profile/email", data={"email": "after@test.com"}, follow_redirects=True)
         assert response.status_code == 200
@@ -158,20 +158,20 @@ def test_update_password_flow(self, client, db_session):
         auth = AccountModel(
             account_username="pass_user",
             account_email="pass@test.com",
-            account_password="old_pass",
+            account_password="Str0ng!Pass",
             account_role="user",
         )
         db_session.add(auth)
         db_session.commit()
 
-        client.post("/login", data={"username": "pass_user", "password": "old_pass"}, follow_redirects=True)
+        client.post("/login", data={"username": "pass_user", "password": "Str0ng!Pass"}, follow_redirects=True)
 
-        response = client.post("/profile/password", data={"new_password": "new_pass"}, follow_redirects=True)
+        response = client.post("/profile/password", data={"new_password": "Str0ng!Pass2"}, follow_redirects=True)
         assert response.status_code == 200
         assert b"Password updated." in response.data
 
         client.post("/logout", follow_redirects=True)
-        login = client.post("/login", data={"username": "pass_user", "password": "new_pass"}, follow_redirects=True)
+        login = client.post("/login", data={"username": "pass_user", "password": "Str0ng!Pass2"}, follow_redirects=True)
         assert b"Profile" in login.data
 
 
@@ -194,8 +194,8 @@ def test_concurrency_race_condition_registration_integ(self, client, db_session)
         registration_data = {
             "username": "race_winner",
             "email": "race@test.com",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }
 
         with ThreadPoolExecutor(max_workers=5) as executor:
@@ -224,20 +224,20 @@ def test_admin_user_list_pagination(self, client, db_session):
             db_session.add(AccountModel(
                 account_username=f"user_{i}",
                 account_email=f"user_{i}@test.com",
-                account_password="p",
+                account_password="Str0ng!Pass",
                 account_role="user"
             ))
 
         admin = AccountModel(
             account_username="admin_user",
             account_email="admin@test.com",
-            account_password="admin_pass",
+            account_password="Str0ng!Pass",
             account_role="admin"
         )
 
         db_session.add(admin)
         db_session.commit()
-        client.post("/login", data={"username": "admin_user", "password": "admin_pass"}, follow_redirects=True)
+        client.post("/login", data={"username": "admin_user", "password": "Str0ng!Pass"}, follow_redirects=True)
         total_accounts = db_session.query(AccountModel).count()
         r1 = client.get("/admin/users")
         assert r1.status_code == 200
diff --git a/tests/tests_integration/test_article_integration.py b/tests/tests_integration/test_article_integration.py
index c2a969e8..45bb7b8a 100644
--- a/tests/tests_integration/test_article_integration.py
+++ b/tests/tests_integration/test_article_integration.py
@@ -46,7 +46,12 @@ def test_pagination_actual_pages_integ(self, client, db_session):
         """
         Verifies that the application correctly paginates large volumes of data.
         """
-        auth = AccountModel(account_username="paginator", account_email="p@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="paginator",
+            account_email="p@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
 
@@ -70,7 +75,12 @@ def test_large_content_and_unicode_integ(self, client, db_session):
         """
         Stress test: Large content and special characters (Emojis, Unicode).
         """
-        auth = AccountModel(account_username="unicode_boss", account_email="u@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="unicode_boss",
+            account_email="u@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
         large_content = "Word " * 20000
@@ -99,7 +109,12 @@ def test_cascading_deletes_account_integ(self, client, db_session):
         The comment content is NOT masked here because the test bypasses
         the service layer (masking happens in AccountSessionAdapter).
         """
-        auth = AccountModel(account_username="victim", account_email="v@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="victim",
+            account_email="v@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
         art = ArticleModel(article_title="Ghost Article", article_content="...", article_author_id=auth.account_id)
@@ -133,7 +148,7 @@ def test_orphan_comment_hard_delete_single_click_integ(self, client, db_session)
         """
         author = AccountModel(
             account_username="orphan_author", account_email="orphan@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(author)
@@ -160,12 +175,12 @@ def test_orphan_comment_hard_delete_single_click_integ(self, client, db_session)
 
         admin = AccountModel(
             account_username="admin_orphan", account_email="admin_o@t.com",
-            account_password="p", account_role="admin"
+            account_password="Str0ng!Pass", account_role="admin"
         )
 
         db_session.add(admin)
         db_session.commit()
-        client.post("/login", data={"username": "admin_orphan", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "admin_orphan", "password": "Str0ng!Pass"}, follow_redirects=True)
         resp = client.post("/account/delete", data={"account_id": author.account_id}, follow_redirects=True)
         assert resp.status_code == 200
         db_session.expire_all()
@@ -192,7 +207,7 @@ def test_article_delete_end_to_end_integ(self, client, db_session):
         """
         author = AccountModel(
             account_username="del_author", account_email="del@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(author)
         db_session.commit()
@@ -206,7 +221,7 @@ def test_article_delete_end_to_end_integ(self, client, db_session):
         article_id = article.article_id
 
         client.post("/login", data={
-            "username": "del_author", "password": "p"
+            "username": "del_author", "password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         response = client.post(
@@ -223,7 +238,12 @@ def test_orphaned_article_graceful_display_integ(self, client, db_session):
         """
         Verifies that if an article exists without an author, the UI displays fallback info.
         """
-        auth = AccountModel(account_username="ghost_writer", account_email="g@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="ghost_writer",
+            account_email="g@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
         art = ArticleModel(article_title="Ghost Story", article_content="Once upon a time...", article_author_id=auth.account_id)
@@ -253,11 +273,11 @@ class TestArticleDescription:
     def test_create_article_with_description_integ(self, client, db_session):
         auth = AccountModel(
             account_username="desc_author", account_email="desc@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "desc_author", "password": "p"},
+        client.post("/login", data={"username": "desc_author", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         resp = client.post("/api/articles", json={
@@ -276,11 +296,11 @@ def test_create_article_with_description_integ(self, client, db_session):
     def test_create_article_without_description_integ(self, client, db_session):
         auth = AccountModel(
             account_username="no_desc", account_email="nd@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "no_desc", "password": "p"},
+        client.post("/login", data={"username": "no_desc", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         resp = client.post("/api/articles", json={
@@ -298,11 +318,11 @@ def test_create_article_without_description_integ(self, client, db_session):
     def test_description_shown_in_detail_template(self, client, db_session):
         auth = AccountModel(
             account_username="desc_detail", account_email="dd@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "desc_detail", "password": "p"},
+        client.post("/login", data={"username": "desc_detail", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         resp = client.post("/api/articles", json={
@@ -319,11 +339,11 @@ def test_description_shown_in_detail_template(self, client, db_session):
     def test_update_article_description(self, client, db_session):
         auth = AccountModel(
             account_username="update_desc", account_email="ud@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "update_desc", "password": "p"},
+        client.post("/login", data={"username": "update_desc", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         create_resp = client.post("/api/articles", json={
@@ -342,11 +362,11 @@ def test_update_article_description(self, client, db_session):
     def test_description_shown_in_list_template(self, client, db_session):
         auth = AccountModel(
             account_username="desc_list", account_email="dl@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "desc_list", "password": "p"},
+        client.post("/login", data={"username": "desc_list", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         client.post("/api/articles", json={
@@ -363,7 +383,7 @@ def test_search_by_author_via_list_endpoint(self, client, db_session):
         auth = AccountModel(
             account_username="searchable_author",
             account_email="sa@test.com",
-            account_password="p",
+            account_password="Str0ng!Pass",
             account_role="author",
         )
         db_session.add(auth)
diff --git a/tests/tests_integration/test_security_integration.py b/tests/tests_integration/test_security_integration.py
index c8246105..0c565c1d 100644
--- a/tests/tests_integration/test_security_integration.py
+++ b/tests/tests_integration/test_security_integration.py
@@ -11,10 +11,15 @@ def test_xss_protection_integ(self, client, db_session):
         """
         Verifies that the app escapes HTML/Script tags to prevent XSS.
         """
-        auth = AccountModel(account_username="xss_author", account_email="xss@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="xss_author",
+            account_email="xss@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "xss_author", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "xss_author", "password": "Str0ng!Pass"}, follow_redirects=True)
         xss_payload = "<script>alert('XSS')</script>"
 
         response = client.post("/api/articles", json={
@@ -29,11 +34,11 @@ def test_xss_protection_integ(self, client, db_session):
     def test_article_detail_loads_content_via_api(self, client, db_session):
         auth = AccountModel(
             account_username="xss_detail", account_email="xss_d@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "xss_detail", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "xss_detail", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         xss_payload = '<script>alert("xss")</script>'
         resp = client.post("/api/articles", json={
@@ -51,12 +56,12 @@ def test_article_detail_loads_content_via_api(self, client, db_session):
     def test_blocknote_article_xss_sanitized(self, client, db_session):
         auth = AccountModel(
             account_username="xss_bn", account_email="xss_bn@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "xss_bn", "password": "p"},
+        client.post("/login", data={"username": "xss_bn", "password": "Str0ng!Pass"},
                     follow_redirects=True)
 
         xss_content = json.dumps([
@@ -89,7 +94,7 @@ def test_comment_xss_with_newlines_escaped(self, client, db_session):
         """
         auth = AccountModel(
             account_username="xss_comment", account_email="xc@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
@@ -97,7 +102,7 @@ def test_comment_xss_with_newlines_escaped(self, client, db_session):
         db_session.add(article)
         db_session.commit()
 
-        client.post("/login", data={"username": "xss_comment", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "xss_comment", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         malicious_comment = "<script>alert(1)</script>\nclean line"
         client.post(f"/articles/{article.article_id}/comments", data={
@@ -114,10 +119,15 @@ def test_session_cookie_httponly(self, client, db_session):
         Verifies that Flask session cookies are marked HttpOnly.
         This tests that our infrastructure securely implements the Output Port.
         """
-        auth = AccountModel(account_username="secure_user", account_email="s@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="secure_user",
+            account_email="s@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
-        response = client.post("/login", data={"username": "secure_user", "password": "p"})
+        response = client.post("/login", data={"username": "secure_user", "password": "Str0ng!Pass"})
         set_cookie_header = response.headers.get("Set-Cookie")
         assert set_cookie_header is not None
         assert "HttpOnly" in set_cookie_header
@@ -125,12 +135,17 @@ def test_session_cookie_httponly(self, client, db_session):
 
     def test_login_prevents_session_fixation(self, client, db_session):
         """Verifies that the session ID changes upon login to prevent fixation attacks."""
-        auth = AccountModel(account_username="fixation_user", account_email="f@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="fixation_user",
+            account_email="f@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
         client.get("/")
         initial_session_cookie = client.get_cookie("session")
-        client.post("/login", data={"username": "fixation_user", "password": "p"})
+        client.post("/login", data={"username": "fixation_user", "password": "Str0ng!Pass"})
         logged_in_session_cookie = client.get_cookie("session")
         assert initial_session_cookie != logged_in_session_cookie
         assert logged_in_session_cookie is not None
@@ -140,10 +155,15 @@ def test_session_tampering_protection(self, client, db_session):
         Proves that modifying the session cookie without the secret key results in rejection.
         Flask cookies are encoded with a '.' separator: [payload].[timestamp].[signature]
         """
-        auth = AccountModel(account_username="tmpr", account_email="tmpr@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="tmpr",
+            account_email="tmpr@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "tmpr", "password": "p"})
+        client.post("/login", data={"username": "tmpr", "password": "Str0ng!Pass"})
         valid_cookie = client.get_cookie("session")
         cookie_with_truncated_signature = valid_cookie.value[:-5]
         tampered_cookie_value = cookie_with_truncated_signature + "XXXXX"
@@ -153,10 +173,15 @@ def test_session_tampering_protection(self, client, db_session):
 
     def test_session_persistence_inter_client(self, client, db_session):
         """Verifies session survives between different client instances (simulating browser restart)."""
-        auth = AccountModel(account_username="persist", account_email="pe@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="persist",
+            account_email="pe@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "persist", "password": "p"})
+        client.post("/login", data={"username": "persist", "password": "Str0ng!Pass"})
         session_cookie = client.get_cookie("session")
         from blog_comment_application import create_app
         new_app = create_app(db_session)
@@ -176,7 +201,7 @@ def test_secure_cookie_policy_in_production(self, db_session):
         prod_app.config["DEBUG"] = False
         prod_app.config["SESSION_COOKIE_SECURE"] = True
         client = prod_app.test_client()
-        response = client.post("/login", data={"username": "any", "password": "any"})
+        response = client.post("/login", data={"username": "Str0ng!Pass", "password": "Str0ng!Pass"})
         set_cookie = response.headers.get("Set-Cookie")
         if set_cookie:
             assert prod_app.config["SESSION_COOKIE_SECURE"] is True
@@ -186,10 +211,15 @@ def test_session_invalidation_on_secret_key_rotation(self, client, db_session):
         Verifies that rotating the SECRET_KEY invalidates all existing session cookies.
         This is a critical security recovery procedure.
         """
-        auth = AccountModel(account_username="rotate_user", account_email="r@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="rotate_user",
+            account_email="r@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "rotate_user", "password": "p"})
+        client.post("/login", data={"username": "rotate_user", "password": "Str0ng!Pass"})
         response_before = client.get("/profile")
         assert "rotate_user" in response_before.data.decode()
         with client.application.app_context():
@@ -206,10 +236,15 @@ def test_sql_injection_resilience_integ(self, client, db_session):
         """
         Verifies that malicious SQL input is correctly escaped by SQLAlchemy/Postgres.
         """
-        auth = AccountModel(account_username="db_admin", account_email="db@t.com", account_password="p", account_role="author")
+        auth = AccountModel(
+            account_username="db_admin",
+            account_email="db@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "db_admin", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "db_admin", "password": "Str0ng!Pass"}, follow_redirects=True)
         malicious_title = "Safe Title'); DROP TABLE accounts; --"
 
         resp = client.post("/api/articles", json={
@@ -229,7 +264,7 @@ def test_sql_injection_in_login_integ(self, client, db_session):
         """
         response = client.post("/login", data={
             "username": "' OR '1'='1",
-            "password": "any"
+            "password": "Str0ng!Pass"
         }, follow_redirects=True)
         assert b"Invalid username or password" in response.data
 
@@ -243,24 +278,34 @@ def test_ban_workflow_integ(self, client, db_session):
         """
         from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_account_model import AccountModel
 
-        admin = AccountModel(account_username="admin_ban", account_email="ab@t.com", account_password="p", account_role="admin")
-        target = AccountModel(account_username="target_user", account_email="tu@t.com", account_password="p", account_role="user")
+        admin = AccountModel(
+            account_username="admin_ban",
+            account_email="ab@t.com",
+            account_password="Str0ng!Pass",
+            account_role="admin",
+        )
+        target = AccountModel(
+            account_username="target_user",
+            account_email="tu@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(admin)
         db_session.add(target)
         db_session.commit()
 
-        client.post("/login", data={"username": "admin_ban", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "admin_ban", "password": "Str0ng!Pass"}, follow_redirects=True)
         client.post(f"/admin/users/{target.account_id}/ban", data={"ban_reason": "Test ban"}, follow_redirects=True)
         client.get("/logout", follow_redirects=True)
 
-        response = client.post("/login", data={"username": "target_user", "password": "p"}, follow_redirects=True)
+        response = client.post("/login", data={"username": "target_user", "password": "Str0ng!Pass"}, follow_redirects=True)
         assert b"This account has been banned." in response.data
 
-        client.post("/login", data={"username": "admin_ban", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "admin_ban", "password": "Str0ng!Pass"}, follow_redirects=True)
         client.post(f"/admin/users/{target.account_id}/unban", follow_redirects=True)
         client.get("/logout", follow_redirects=True)
 
-        response = client.post("/login", data={"username": "target_user", "password": "p"}, follow_redirects=True)
+        response = client.post("/login", data={"username": "target_user", "password": "Str0ng!Pass"}, follow_redirects=True)
         assert b"articles" in response.data or b"DevJournal" in response.data
 
 
@@ -268,15 +313,25 @@ def test_unauthorized_article_deletion(self, client, db_session):
         """
         Ensures that a user cannot delete another author's article.
         """
-        author = AccountModel(account_username="author1", account_email="a1@t.com", account_password="p", account_role="author")
-        malicious = AccountModel(account_username="hacker", account_email="h@t.com", account_password="p", account_role="user")
+        author = AccountModel(
+            account_username="author1",
+            account_email="a1@t.com",
+            account_password="Str0ng!Pass",
+            account_role="author",
+        )
+        malicious = AccountModel(
+            account_username="hacker",
+            account_email="h@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(author)
         db_session.add(malicious)
         db_session.commit()
         article = ArticleModel(article_title="Secret", article_content="...", article_author_id=author.account_id)
         db_session.add(article)
         db_session.commit()
-        client.post("/login", data={"username": "hacker", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "hacker", "password": "Str0ng!Pass"}, follow_redirects=True)
         response = client.delete(f"/api/articles/{article.article_id}")
         assert response.status_code == 403
         assert response.get_json() == {"error": "Insufficient permissions."}
@@ -319,11 +374,11 @@ def test_create_article_page_renders_for_author(self, client, db_session):
 
         auth = AccountModel(
             account_username="page_author", account_email="page@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(auth)
         db_session.commit()
-        client.post("/login", data={"username": "page_author", "password": "p"})
+        client.post("/login", data={"username": "page_author", "password": "Str0ng!Pass"})
         response = client.get("/articles/new")
         assert response.status_code == 200
         assert b'data-page="create"' in response.data
@@ -400,10 +455,15 @@ def test_session_lifetime_config(self, client):
 
     def test_session_cookie_has_no_expiry(self, client, db_session):
         """Verifies the Set-Cookie header has no Expires or Max-Age (browser-session only)."""
-        auth = AccountModel(account_username="sess_user", account_email="su@t.com", account_password="p", account_role="user")
+        auth = AccountModel(
+            account_username="sess_user",
+            account_email="su@t.com",
+            account_password="Str0ng!Pass",
+            account_role="user",
+        )
         db_session.add(auth)
         db_session.commit()
-        response = client.post("/login", data={"username": "sess_user", "password": "p"})
+        response = client.post("/login", data={"username": "sess_user", "password": "Str0ng!Pass"})
         set_cookie = response.headers.get("Set-Cookie", "")
         assert "Expires=" not in set_cookie
         assert "Max-Age=" not in set_cookie
@@ -461,6 +521,34 @@ def test_forbidden_returns_custom_error_page(self, client):
         assert b"Return to home" in response.data
 
 
+class TestSessionUnique:
+    """Tests focused on session uniqueness (anti-double-connexion)."""
+
+    def test_double_session_redirects_to_home(self, client, db_session):
+        """Login user on client1, login same user on client2.
+        client1's next request → 302 redirect to / + flash."""
+        client.post("/register", data={
+            "username": "double_session",
+            "email": "ds@t.com",
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass",
+        }, follow_redirects=False)
+
+        client2 = client.application.test_client()
+
+        client.post("/login", data={"username": "double_session", "password": "Str0ng!Pass"},
+                     follow_redirects=False)
+        client2.post("/login", data={"username": "double_session", "password": "Str0ng!Pass"},
+                      follow_redirects=False)
+
+        resp = client.get("/profile", follow_redirects=False)
+        assert resp.status_code == 302
+        assert resp.location.endswith("/")
+
+        html = client.get("/", follow_redirects=False).data.decode()
+        assert "You have been disconnected" in html
+
+
 class TestCompression:
     """Tests focused on HTTP response compression (flask-compress)."""
 
diff --git a/tests/tests_integration/test_workflow_integration.py b/tests/tests_integration/test_workflow_integration.py
index 2dbb334a..56fcfb47 100644
--- a/tests/tests_integration/test_workflow_integration.py
+++ b/tests/tests_integration/test_workflow_integration.py
@@ -15,8 +15,8 @@ def test_full_lifecycle_workflow(self, client, db_session):
         reg_response = client.post("/register", data={
             "username": "tester",
             "email": "tester@example.com",
-            "password": "password123",
-            "confirm_password": "password123"
+            "password": "Str0ng!Pass",
+            "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert reg_response.status_code == 200
@@ -27,7 +27,7 @@ def test_full_lifecycle_workflow(self, client, db_session):
 
         login_response = client.post("/login", data={
             "username": "tester",
-            "password": "password123"
+            "password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         assert b"Profile" in login_response.data or b"Welcome" in login_response.data
@@ -65,13 +65,13 @@ def test_full_lifecycle_workflow(self, client, db_session):
     def test_honeypot_blocks_spam_bots(self, client, db_session):
         client.post("/register", data={
             "username": "spam_tester", "email": "spam@t.com",
-            "password": "p12345678", "confirm_password": "p12345678"
+            "password": "Str0ng!Pass", "confirm_password": "Str0ng!Pass"
         }, follow_redirects=True)
         user = db_session.query(AccountModel).filter_by(account_username="spam_tester").first()
         user.account_role = "author"
         db_session.commit()
 
-        client.post("/login", data={"username": "spam_tester", "password": "p12345678"}, follow_redirects=True)
+        client.post("/login", data={"username": "spam_tester", "password": "Str0ng!Pass"}, follow_redirects=True)
         r = client.post("/api/articles", json={"title": "Spam Test", "content": "Spam content"})
         assert r.status_code == 201
         aid = r.get_json()["id"]
@@ -93,12 +93,12 @@ def test_comment_soft_delete_integration(self, client, db_session):
         """
         author = AccountModel(
             account_username="soft_author", account_email="soft@t.com",
-            account_password="p", account_role="author",
+            account_password="Str0ng!Pass", account_role="author",
         )
 
         db_session.add(author)
         db_session.commit()
-        client.post("/login", data={"username": "soft_author", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "soft_author", "password": "Str0ng!Pass"}, follow_redirects=True)
         r = client.post("/api/articles", json={"title": "Soft Del Test", "content": "Content"})
         aid = r.get_json()["id"]
 
@@ -128,11 +128,11 @@ def test_comment_edit_and_soft_delete_integration(self, client, db_session):
         """
         author = AccountModel(
             account_username="edit_user", account_email="edit@t.com",
-            account_password="p", account_role="author",
+            account_password="Str0ng!Pass", account_role="author",
         )
         db_session.add(author)
         db_session.commit()
-        client.post("/login", data={"username": "edit_user", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "edit_user", "password": "Str0ng!Pass"}, follow_redirects=True)
         r = client.post("/api/articles", json={"title": "Edit Test", "content": "Content"})
         aid = r.get_json()["id"]
 
@@ -169,7 +169,12 @@ def test_deep_comment_threading_integ(self, client, db_session):
         """
         Verifies that threading works for multiple levels of nesting.
         """
-        author = AccountModel(account_username="author", account_email="a@t.com", account_password="p", account_role="admin")
+        author = AccountModel(
+            account_username="author",
+            account_email="a@t.com",
+            account_password="Str0ng!Pass",
+            account_role="admin",
+        )
         db_session.add(author)
         db_session.commit()
         article = ArticleModel(article_title="Deep Thread", article_content="...", article_author_id=author.account_id)
@@ -269,7 +274,7 @@ def test_comment_with_newlines_renders_br_tag(self, client, db_session):
         """
         author = AccountModel(
             account_username="newline_author", account_email="nl@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(author)
@@ -278,7 +283,7 @@ def test_comment_with_newlines_renders_br_tag(self, client, db_session):
         db_session.add(article)
         db_session.commit()
 
-        client.post("/login", data={"username": "newline_author", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "newline_author", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         multi_line_comment = "Line 1\nLine 2\nLine 3"
         client.post(f"/articles/{article.article_id}/comments", data={
@@ -298,7 +303,7 @@ def test_reply_with_newlines_renders_br_tag(self, client, db_session):
         """
         author = AccountModel(
             account_username="reply_nl", account_email="rnl@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(author)
@@ -306,7 +311,7 @@ def test_reply_with_newlines_renders_br_tag(self, client, db_session):
         article = ArticleModel(article_title="Reply Newline", article_content="...", article_author_id=author.account_id)
         db_session.add(article)
         db_session.commit()
-        client.post("/login", data={"username": "reply_nl", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "reply_nl", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         client.post(f"/articles/{article.article_id}/comments", data={
             "content": "Root comment"
@@ -330,7 +335,7 @@ def test_article_detail_displays_iso_date(self, client, db_session):
         """
         author = AccountModel(
             account_username="iso_author", account_email="iso@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(author)
         db_session.commit()
@@ -352,7 +357,7 @@ def test_footer_displays_current_year(self, client, db_session):
         """
         author = AccountModel(
             account_username="year_test", account_email="y@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(author)
@@ -365,11 +370,11 @@ def test_footer_displays_current_year(self, client, db_session):
     def test_success_after_article_creation(self, client, db_session):
         author = AccountModel(
             account_username="api_author", account_email="api@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(author)
         db_session.commit()
-        client.post("/login", data={"username": "api_author", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "api_author", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         response = client.post("/api/articles", json={
             "title": "API Test Article",
@@ -384,11 +389,11 @@ def test_success_after_article_creation(self, client, db_session):
     def test_error_on_validation_failure(self, client, db_session):
         author = AccountModel(
             account_username="val_api", account_email="val_api@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(author)
         db_session.commit()
-        client.post("/login", data={"username": "val_api", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "val_api", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         response = client.post("/api/articles", json={"title": "Valid Title"})
 
@@ -402,13 +407,13 @@ def test_nav_consistency_across_pages_integ(self, client, db_session):
         """
         author = AccountModel(
             account_username="nav_author", account_email="nav@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
         db_session.add(author)
         db_session.commit()
 
         client.post("/login", data={
-            "username": "nav_author", "password": "p"
+            "username": "nav_author", "password": "Str0ng!Pass"
         }, follow_redirects=True)
 
         for page in ("/login", "/register", "/profile"):
@@ -432,7 +437,7 @@ def test_nav_consistency_across_pages_integ(self, client, db_session):
     def test_comment_count_displays_total_with_nested(self, client, db_session):
         author = AccountModel(
             account_username="count_author", account_email="count@t.com",
-            account_password="p", account_role="author"
+            account_password="Str0ng!Pass", account_role="author"
         )
 
         db_session.add(author)
@@ -491,7 +496,7 @@ def test_article_list_author_link_points_to_profile(self, client, db_session):
         author = AccountModel(
             account_username="link_test_author",
             account_email="link@test.com",
-            account_password="p",
+            account_password="Str0ng!Pass",
             account_role="author",
         )
 
@@ -523,19 +528,19 @@ def test_admin_promote_user_to_author_integ(self, client, db_session):
         """
         admin = AccountModel(
             account_username="role_admin", account_email="role@t.com",
-            account_password="p", account_role="admin",
+            account_password="Str0ng!Pass", account_role="admin",
         )
         db_session.add(admin)
         db_session.commit()
 
         target = AccountModel(
             account_username="target_user", account_email="target@t.com",
-            account_password="p", account_role="user",
+            account_password="Str0ng!Pass", account_role="user",
         )
         db_session.add(target)
         db_session.commit()
 
-        client.post("/login", data={"username": "role_admin", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "role_admin", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         response = client.post(
             f"/admin/users/{target.account_id}/role",
@@ -556,19 +561,19 @@ def test_non_admin_change_role_returns_error_integ(self, client, db_session):
         """
         user = AccountModel(
             account_username="plain_user", account_email="plain@t.com",
-            account_password="p", account_role="user",
+            account_password="Str0ng!Pass", account_role="user",
         )
         db_session.add(user)
         db_session.commit()
 
         target = AccountModel(
             account_username="victim", account_email="victim@t.com",
-            account_password="p", account_role="user",
+            account_password="Str0ng!Pass", account_role="user",
         )
         db_session.add(target)
         db_session.commit()
 
-        client.post("/login", data={"username": "plain_user", "password": "p"}, follow_redirects=True)
+        client.post("/login", data={"username": "plain_user", "password": "Str0ng!Pass"}, follow_redirects=True)
 
         response = client.post(
             f"/admin/users/{target.account_id}/role",
@@ -583,7 +588,7 @@ class TestCommentHardDeleteIntegration:
     def test_comment_hard_delete_integration(self, client, db_session):
         admin = AccountModel(
             account_username="hard_del_admin", account_email="hda@t.com",
-            account_password="p", account_role="admin",
+            account_password="Str0ng!Pass", account_role="admin",
         )
         db_session.add(admin)
         db_session.commit()
@@ -605,7 +610,7 @@ def test_comment_hard_delete_integration(self, client, db_session):
         db_session.add(comment)
         db_session.commit()
 
-        client.post("/login", data={"username": "hard_del_admin", "password": "p"})
+        client.post("/login", data={"username": "hard_del_admin", "password": "Str0ng!Pass"})
 
         cid = comment.comment_id
         aid = article.article_id
@@ -629,7 +634,7 @@ def test_comment_hard_delete_cascades_to_children_integ(
         """
         admin = AccountModel(
             account_username="cascade_admin", account_email="ca@t.com",
-            account_password="p", account_role="admin",
+            account_password="Str0ng!Pass", account_role="admin",
         )
         db_session.add(admin)
         db_session.commit()
@@ -702,7 +707,7 @@ def test_comment_hard_delete_cascades_to_children_integ(
         un_id = unrelated.comment_id
 
         client.post("/login", data={
-            "username": "cascade_admin", "password": "p",
+            "username": "cascade_admin", "password": "Str0ng!Pass",
         })
 
         resp = client.post(
@@ -730,7 +735,7 @@ def test_article_edit_sets_edited_at_integration(self, client, db_session):
         """
         author = AccountModel(
             account_username="edit_test_author", account_email="eta@t.com",
-            account_password="p", account_role="author",
+            account_password="Str0ng!Pass", account_role="author",
         )
         db_session.add(author)
         db_session.commit()
@@ -745,7 +750,7 @@ def test_article_edit_sets_edited_at_integration(self, client, db_session):
         art_id = article.article_id
         assert article.article_edited_at is None
 
-        client.post("/login", data={"username": "edit_test_author", "password": "p"})
+        client.post("/login", data={"username": "edit_test_author", "password": "Str0ng!Pass"})
 
         resp = client.put(f"/api/articles/{art_id}", json={
             "title": "Updated Title",
diff --git a/tests/tests_services/__init__.py b/tests/tests_services/__init__.py
deleted file mode 100644
index e69de29b..00000000
diff --git a/tests/tests_services/test_login_service.py b/tests/tests_services/test_login_service.py
index 96ec4eca..2fb2a612 100644
--- a/tests/tests_services/test_login_service.py
+++ b/tests/tests_services/test_login_service.py
@@ -138,9 +138,9 @@ def test_update_password_success(self):
         fake_account = create_test_account(account_id=1)
         self.mock_session_repo.get_account.return_value = fake_account
         self.mock_hasher.hash.return_value = "$argon2id$new_hash"
-        result = self.service.update_password("new_secret")
+        result = self.service.update_password("New_Secure1!")
         assert result is None
-        self.mock_hasher.hash.assert_called_once_with("new_secret")
+        self.mock_hasher.hash.assert_called_once_with("New_Secure1!")
         self.mock_repo.update_password.assert_called_once_with(1, "$argon2id$new_hash")
 
     def test_update_password_unauthenticated_returns_error(self):
@@ -281,3 +281,39 @@ def test_authenticate_user_banned(self):
 
         self.mock_repo.find_by_username.assert_called_once_with(fake_account.account_username)
         self.mock_session_repo.save_account.assert_not_called()
+
+    def test_authenticate_user_generates_session_token(self):
+        fake_account = create_test_account()
+        self.mock_repo.find_by_username.return_value = fake_account
+
+        result = self.service.authenticate_user(
+            username=fake_account.account_username,
+            password="password123"
+        )
+
+        assert result.session_token is not None
+        assert len(result.session_token) > 30
+        self.mock_repo.update_session_token.assert_called_once_with(
+            result.account_id, result.session_token
+        )
+        self.mock_session_repo.save_account.assert_called_once_with(result)
+
+    def test_terminate_session_clears_session_token(self):
+        fake_account = create_test_account(account_id=1)
+        self.mock_session_repo.get_account.return_value = fake_account
+        self.mock_repo.get_by_id.return_value = fake_account
+
+        self.service.terminate_session()
+
+        self.mock_repo.update_session_token.assert_called_once_with(1, None)
+        self.mock_session_repo.clear.assert_called_once()
+
+    def test_ban_account_clears_session_token(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target}.get(cid)
+
+        self.service.ban_account(admin_id=1, target_account_id=2, ban_reason="Spam")
+
+        self.mock_repo.update_ban_status.assert_called_once_with(2, True, "Spam")
+        self.mock_repo.update_session_token.assert_called_once_with(2, None)
diff --git a/translations/fr/LC_MESSAGES/messages.mo b/translations/fr/LC_MESSAGES/messages.mo
index 96e523b3..23572bf3 100644
Binary files a/translations/fr/LC_MESSAGES/messages.mo and b/translations/fr/LC_MESSAGES/messages.mo differ
diff --git a/translations/fr/LC_MESSAGES/messages.po b/translations/fr/LC_MESSAGES/messages.po
index 4fd14424..5837ec65 100644
--- a/translations/fr/LC_MESSAGES/messages.po
+++ b/translations/fr/LC_MESSAGES/messages.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PROJECT VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-07-23 20:31+0200\n"
+"POT-Creation-Date: 2026-07-25 19:11+0200\n"
 "PO-Revision-Date: 2026-07-22 14:15+0200\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language: fr\n"
@@ -18,15 +18,15 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Generated-By: Babel 2.10.3\n"
 
-#: blog_comment_application.py:212
+#: blog_comment_application.py:213
 msgid "You do not have permission to access this page."
 msgstr "Vous n'avez pas la permission d'accéder à cette page."
 
-#: blog_comment_application.py:213
+#: blog_comment_application.py:214
 msgid "The page you are looking for does not exist."
 msgstr "La page que vous cherchez n'existe pas."
 
-#: blog_comment_application.py:214
+#: blog_comment_application.py:215
 msgid "An unexpected error occurred. Please try again later."
 msgstr "Une erreur inattendue s'est produite. Veuillez réessayer plus tard."
 
@@ -56,7 +56,7 @@ msgid "Network error."
 msgstr "Erreur réseau."
 
 #: frontend/templates/article_create.html:31
-#: frontend/templates/article_detail.html:218
+#: frontend/templates/article_detail.html:236
 #: frontend/templates/article_edit.html:60
 msgid "Loading..."
 msgstr "Chargement..."
@@ -102,9 +102,9 @@ msgid "Publish"
 msgstr "Publier"
 
 #: frontend/templates/article_create.html:40
-#: frontend/templates/article_detail.html:228
-#: frontend/templates/article_edit.html:69 frontend/templates/profile.html:94
-#: frontend/templates/profile.html:116
+#: frontend/templates/article_detail.html:246
+#: frontend/templates/article_edit.html:69 frontend/templates/profile.html:96
+#: frontend/templates/profile.html:119
 msgid "Save"
 msgstr "Enregistrer"
 
@@ -144,13 +144,13 @@ msgid "Only YouTube links are supported"
 msgstr "Seules les liens YouTube sont supportés"
 
 #: frontend/templates/article_create.html:48
-#: frontend/templates/article_detail.html:222
+#: frontend/templates/article_detail.html:240
 #: frontend/templates/article_edit.html:77
 msgid "Failed to load article."
 msgstr "Échec du chargement de l'article."
 
 #: frontend/templates/article_create.html:49
-#: frontend/templates/article_detail.html:224
+#: frontend/templates/article_detail.html:242
 #: frontend/templates/article_edit.html:78
 msgid "Copy"
 msgstr "Copier"
@@ -161,7 +161,7 @@ msgid "Copy Block"
 msgstr "Copier le bloc"
 
 #: frontend/templates/article_create.html:51
-#: frontend/templates/article_detail.html:220
+#: frontend/templates/article_detail.html:238
 #: frontend/templates/article_edit.html:80
 msgid "Copied to clipboard"
 msgstr "Copié dans le presse-papier"
@@ -189,7 +189,7 @@ msgid "Align text justify"
 msgstr "Justifier le texte"
 
 #: frontend/templates/article_create.html:56
-#: frontend/templates/article_detail.html:223
+#: frontend/templates/article_detail.html:241
 #: frontend/templates/article_edit.html:85
 msgid "Plain Text"
 msgstr "Texte simple"
@@ -205,7 +205,7 @@ msgid "No languages found"
 msgstr "Aucun langage trouvé"
 
 #: frontend/templates/article_create.html:59
-#: frontend/templates/article_detail.html:226
+#: frontend/templates/article_detail.html:244
 #: frontend/templates/article_edit.html:88
 msgid "Something went wrong. Please reload the page."
 msgstr "Une erreur est survenue. Veuillez recharger la page."
@@ -217,7 +217,7 @@ msgid "Anonymous"
 msgstr "Anonyme"
 
 #: frontend/templates/article_detail.html:72
-#: frontend/templates/article_detail.html:149
+#: frontend/templates/article_detail.html:157
 #: frontend/templates/article_list.html:88
 #, python-format
 msgid "edited at %(date)s"
@@ -232,7 +232,8 @@ msgid "Delete this article permanently ?"
 msgstr "Supprimer définitivement cet article ?"
 
 #: frontend/templates/article_detail.html:126
-#: frontend/templates/profile.html:53
+#: frontend/templates/article_detail.html:251
+#: frontend/templates/profile.html:55
 msgid "[Edit]"
 msgstr "[Modifier]"
 
@@ -245,73 +246,95 @@ msgstr "[Supprimer]"
 msgid "Permanently delete this comment? This cannot be undone."
 msgstr "Supprimer définitivement ce commentaire ? Action irréversible."
 
-#: frontend/templates/article_detail.html:143
-msgid "Comment removed"
-msgstr "Commentaire supprimé."
-
-#: frontend/templates/article_detail.html:143
+#: frontend/templates/article_detail.html:144
 msgid "Deleted by admin"
 msgstr "Supprimé par l'administrateur."
 
-#: frontend/templates/article_detail.html:143
+#: frontend/templates/article_detail.html:146
 msgid "Deleted by user"
 msgstr "Supprimé par l'utilisateur."
 
-#: frontend/templates/article_detail.html:143
+#: frontend/templates/article_detail.html:148
 msgid "Deleted due to account deletion"
 msgstr "Supprimé suite à la suppression du compte."
 
-#: frontend/templates/article_detail.html:155
-#: frontend/templates/article_detail.html:227
+#: frontend/templates/article_detail.html:150
+msgid "Comment removed"
+msgstr "Commentaire supprimé."
+
+#: frontend/templates/article_detail.html:163
+#: frontend/templates/article_detail.html:245
 msgid "Reply"
 msgstr "Répondre"
 
-#: frontend/templates/article_detail.html:158
-#: frontend/templates/article_detail.html:164
+#: frontend/templates/article_detail.html:166
+#: frontend/templates/article_detail.html:172
 msgid "View replies"
 msgstr "Voir les réponses"
 
-#: frontend/templates/article_detail.html:158
-#: frontend/templates/article_detail.html:164
+#: frontend/templates/article_detail.html:166
+#: frontend/templates/article_detail.html:172
 msgid "Hide replies"
 msgstr "Masquer les réponses"
 
-#: frontend/templates/article_detail.html:180
+#: frontend/templates/article_detail.html:188
 #, python-format
 msgid "Comments (%(count)s)"
 msgstr "Commentaires (%(count)s)"
 
-#: frontend/templates/article_detail.html:184
+#: frontend/templates/article_detail.html:192
 msgid "No comments yet."
 msgstr "Aucun commentaire pour l'instant."
 
-#: frontend/templates/article_detail.html:189
-#: frontend/templates/article_detail.html:233
+#: frontend/templates/article_detail.html:197
+#: frontend/templates/article_detail.html:253
 msgid "Join the discussion"
 msgstr "Participer à la discussion"
 
-#: frontend/templates/article_detail.html:190
+#: frontend/templates/article_detail.html:199
+msgid "Comment rules:"
+msgstr "Règles des commentaires :"
+
+#: frontend/templates/article_detail.html:201
+msgid "No links, advertising, or spam."
+msgstr "Ne publiez pas de liens, de publicité ou de spam."
+
+#: frontend/templates/article_detail.html:202
+msgid "No profanity, insults, or hate speech."
+msgstr "N'utilisez pas de grossièretés, d'insultes ou de propos haineux."
+
+#: frontend/templates/article_detail.html:203
+msgid "Do not post the same message multiple times."
+msgstr "Ne postez pas le même message plusieurs fois."
+
+#: frontend/templates/article_detail.html:204
+msgid "Stay respectful and on topic."
+msgstr "Restez respectueux et dans le sujet."
+
+#: frontend/templates/article_detail.html:205
+msgid "Violation results in account ban without notice."
+msgstr ""
+"Le non-respect de ces règles entraîne le bannissement du compte, sans "
+"préavis."
+
+#: frontend/templates/article_detail.html:208
 msgid "Comment must be between 1 and 5000 characters"
 msgstr "Le commentaire doit contenir entre 1 et 5 000 caractères"
 
-#: frontend/templates/article_detail.html:201
-#: frontend/templates/article_detail.html:232
+#: frontend/templates/article_detail.html:219
+#: frontend/templates/article_detail.html:252
 msgid "Post Comment"
 msgstr "Publier le commentaire"
 
-#: frontend/templates/article_detail.html:202
-#: frontend/templates/article_detail.html:231
+#: frontend/templates/article_detail.html:220
+#: frontend/templates/article_detail.html:249
 #: frontend/templates/article_list.html:143 frontend/templates/base.html:115
-#: frontend/templates/base.html:139 frontend/templates/profile.html:93
-#: frontend/templates/profile.html:115 frontend/templates/user_list.html:143
+#: frontend/templates/base.html:139 frontend/templates/profile.html:95
+#: frontend/templates/profile.html:118 frontend/templates/user_list.html:143
 msgid "Cancel"
 msgstr "Annuler"
 
-#: frontend/templates/article_detail.html:239
-msgid "[Cancel]"
-msgstr "[Annuler]"
-
-#: frontend/templates/article_detail.html:209
+#: frontend/templates/article_detail.html:227
 #, python-format
 msgid ""
 "Please <a href=\"%(url)s\" class=\"comment-auth-link\">sign in</a> to "
@@ -320,26 +343,30 @@ msgstr ""
 "Veuillez vous <a href=\"%(url)s\" class=\"comment-auth-"
 "link\">connecter</a> pour participer à la conversation."
 
-#: frontend/templates/article_detail.html:219
+#: frontend/templates/article_detail.html:237
 msgid "Unable to render article content."
 msgstr "Impossible d'afficher le contenu de l'article."
 
-#: frontend/templates/article_detail.html:221
+#: frontend/templates/article_detail.html:239
 msgid "Comment cannot be empty"
 msgstr "Le commentaire ne peut pas être vide."
 
-#: frontend/templates/article_detail.html:225
+#: frontend/templates/article_detail.html:243
 msgid "Insert Emoji"
 msgstr "Insérer un émoticône"
 
-#: frontend/templates/article_detail.html:229
+#: frontend/templates/article_detail.html:247
 msgid "Reply to"
 msgstr "Répondre à"
 
-#: frontend/templates/article_detail.html:230
+#: frontend/templates/article_detail.html:248
 msgid "Editing comment"
 msgstr "Modifier le commentaire"
 
+#: frontend/templates/article_detail.html:250
+msgid "[Cancel]"
+msgstr "[Annuler]"
+
 #: frontend/templates/article_edit.html:3
 msgid "Edit Article - DevJournal"
 msgstr "Modifier l'article - DevJournal"
@@ -352,7 +379,11 @@ msgstr "Derniers articles - DevJournal"
 msgid ""
 "DevJournal - Personal thoughts on software development, programming and "
 "technology."
-msgstr "DevJournal - Réflexions personnelles sur le développement logiciel, la programmation et la technologie."
+msgstr ""
+"DevJournal - Réflexions personnelles sur le développement logiciel, la "
+"programmation et la technologie."
+
+#: frontend/templates/article_list.html:26
 msgid "Search by title, description or author..."
 msgstr "Rechercher par titre, description ou auteur..."
 
@@ -451,7 +482,7 @@ msgid "Confirm"
 msgstr "Confirmer"
 
 #: frontend/templates/base.html:122 frontend/templates/base.html:140
-#: frontend/templates/profile.html:152 frontend/templates/user_list.html:88
+#: frontend/templates/profile.html:155 frontend/templates/user_list.html:88
 msgid "Ban"
 msgstr "Bannir"
 
@@ -473,7 +504,7 @@ msgid "© %(year)s DevJournal. All rights reserved."
 msgstr "© %(year)s DevJournal. Tous droits réservés."
 
 #: frontend/templates/error.html:11 frontend/templates/login.html:42
-#: frontend/templates/profile.html:166 frontend/templates/registration.html:53
+#: frontend/templates/profile.html:169 frontend/templates/registration.html:68
 #: frontend/templates/user_list.html:149
 msgid "Return to home"
 msgstr "Retour à l'accueil"
@@ -494,23 +525,23 @@ msgstr "Accédez à vos comptes de développeur."
 msgid "Username"
 msgstr "Nom d'utilisateur"
 
-#: frontend/templates/login.html:21 frontend/templates/registration.html:21
+#: frontend/templates/login.html:21 frontend/templates/registration.html:23
 msgid "e.g., dev_journey"
 msgstr "Ex. : dev_journey"
 
-#: frontend/templates/login.html:24 frontend/templates/registration.html:28
+#: frontend/templates/login.html:24 frontend/templates/registration.html:35
 msgid "Password"
 msgstr "Mot de passe"
 
-#: frontend/templates/login.html:26 frontend/templates/profile.html:109
-#: frontend/templates/registration.html:30
-#: frontend/templates/registration.html:37
+#: frontend/templates/login.html:26 frontend/templates/profile.html:112
+#: frontend/templates/registration.html:39
+#: frontend/templates/registration.html:50
 msgid "e.g., MyP@ssw0rd!"
 msgstr "Ex. : MyP@ssw0rd!"
 
-#: frontend/templates/login.html:27 frontend/templates/profile.html:110
-#: frontend/templates/registration.html:31
-#: frontend/templates/registration.html:38
+#: frontend/templates/login.html:27 frontend/templates/profile.html:113
+#: frontend/templates/registration.html:42
+#: frontend/templates/registration.html:53
 msgid "Toggle password visibility"
 msgstr "Afficher/masquer le mot de passe"
 
@@ -522,80 +553,80 @@ msgstr "Nouveau sur le site ?"
 msgid "Create an account"
 msgstr "Créer un compte"
 
-#: frontend/templates/profile.html:21
+#: frontend/templates/profile.html:22
 msgid "Upload Photo"
 msgstr "Télécharger une photo"
 
-#: frontend/templates/profile.html:26
+#: frontend/templates/profile.html:27
 msgid "Remove Photo"
 msgstr "Supprimer la photo"
 
-#: frontend/templates/profile.html:37 frontend/templates/user_list.html:75
+#: frontend/templates/profile.html:39 frontend/templates/user_list.html:75
 msgid "User"
 msgstr "Utilisateur"
 
-#: frontend/templates/profile.html:38 frontend/templates/user_list.html:76
+#: frontend/templates/profile.html:40 frontend/templates/user_list.html:76
 msgid "Author"
 msgstr "Auteur"
 
-#: frontend/templates/profile.html:40 frontend/templates/user_list.html:78
+#: frontend/templates/profile.html:42 frontend/templates/user_list.html:78
 msgid "Update"
 msgstr "Mettre à jour"
 
-#: frontend/templates/profile.html:49 frontend/templates/profile.html:87
+#: frontend/templates/profile.html:51 frontend/templates/profile.html:89
 #: frontend/templates/user_list.html:50
 msgid "Email"
 msgstr "Email"
 
-#: frontend/templates/profile.html:62 frontend/templates/user_list.html:54
+#: frontend/templates/profile.html:64 frontend/templates/user_list.html:54
 msgid "Member Since"
 msgstr "Membre depuis"
 
-#: frontend/templates/profile.html:67 frontend/templates/user_list.html:66
+#: frontend/templates/profile.html:69 frontend/templates/user_list.html:66
 msgid "N/A"
 msgstr "N/R"
 
-#: frontend/templates/profile.html:73 frontend/templates/user_list.html:52
+#: frontend/templates/profile.html:75 frontend/templates/user_list.html:52
 msgid "Status"
 msgstr "Statut"
 
-#: frontend/templates/profile.html:74 frontend/templates/user_list.html:64
+#: frontend/templates/profile.html:76 frontend/templates/user_list.html:64
 msgid "Banned"
 msgstr "Banni"
 
-#: frontend/templates/profile.html:74 frontend/templates/user_list.html:64
+#: frontend/templates/profile.html:76 frontend/templates/user_list.html:64
 msgid "Active"
 msgstr "Actif"
 
-#: frontend/templates/profile.html:81
+#: frontend/templates/profile.html:83
 msgid "Update Email"
 msgstr "Modifier l'email"
 
-#: frontend/templates/profile.html:89 frontend/templates/registration.html:25
+#: frontend/templates/profile.html:91 frontend/templates/registration.html:32
 msgid "e.g., user@example.com"
 msgstr "Ex. : user@example.com"
 
-#: frontend/templates/profile.html:101
+#: frontend/templates/profile.html:103
 msgid "Update Password"
 msgstr "Modifier le mot de passe"
 
-#: frontend/templates/profile.html:107
+#: frontend/templates/profile.html:109
 msgid "New Password"
 msgstr "Nouveau mot de passe"
 
-#: frontend/templates/profile.html:124
+#: frontend/templates/profile.html:127
 msgid "Manage Users"
 msgstr "Gérer les utilisateurs"
 
-#: frontend/templates/profile.html:126
+#: frontend/templates/profile.html:129
 msgid "Change Password"
 msgstr "Changer le mot de passe"
 
-#: frontend/templates/profile.html:129
+#: frontend/templates/profile.html:132
 msgid "Sign Out"
 msgstr "Déconnexion"
 
-#: frontend/templates/profile.html:136
+#: frontend/templates/profile.html:139
 msgid ""
 "Are you sure you want to delete your account ? This action is "
 "irreversible."
@@ -603,15 +634,15 @@ msgstr ""
 "Êtes-vous sûr de vouloir supprimer votre compte ? Cette action est "
 "irréversible."
 
-#: frontend/templates/profile.html:136 frontend/templates/profile.html:159
+#: frontend/templates/profile.html:139 frontend/templates/profile.html:162
 msgid "Delete Account"
 msgstr "Supprimer le compte"
 
-#: frontend/templates/profile.html:147 frontend/templates/user_list.html:83
+#: frontend/templates/profile.html:150 frontend/templates/user_list.html:83
 msgid "Unban"
 msgstr "Débannir"
 
-#: frontend/templates/profile.html:159 frontend/templates/user_list.html:95
+#: frontend/templates/profile.html:162 frontend/templates/user_list.html:95
 #, python-format
 msgid "Delete user \\\"%(username)s\\\" ? This action is irreversible."
 msgstr "Supprimer l'utilisateur \\\"%(username)s\\\" ? Action irréversible."
@@ -632,23 +663,40 @@ msgstr "Créez votre blog technique en quelques secondes."
 msgid "Choose Username"
 msgstr "Choisir un nom d'utilisateur"
 
-#: frontend/templates/registration.html:24
+#: frontend/templates/registration.html:21
+msgid "3–30 characters: letters, numbers, underscores, hyphens"
+msgstr "3 à 30 caractères : lettres, chiffres, tirets bas et tirets"
+
+#: frontend/templates/registration.html:27
+msgid "3-30 characters: letters, numbers, underscores, hyphens"
+msgstr "3 à 30 caractères : lettres, chiffres, tirets bas et tirets"
+
+#: frontend/templates/registration.html:31
 msgid "Email Address"
 msgstr "Adresse email"
 
-#: frontend/templates/registration.html:35
+#: frontend/templates/registration.html:36
+#: frontend/templates/registration.html:47
+msgid ""
+"Minimum 8 characters: at least one uppercase, one lowercase, and one "
+"special character"
+msgstr ""
+"Minimum 8 caractères : au moins une majuscule, une minuscule et un "
+"caractère spécial"
+
+#: frontend/templates/registration.html:46
 msgid "Confirm Password"
 msgstr "Confirmer le mot de passe"
 
-#: frontend/templates/registration.html:41
+#: frontend/templates/registration.html:56
 msgid "Create Account"
 msgstr "Créer un compte"
 
-#: frontend/templates/registration.html:47
+#: frontend/templates/registration.html:62
 msgid "Already have an account ?"
 msgstr "Déjà un compte ?"
 
-#: frontend/templates/registration.html:48
+#: frontend/templates/registration.html:63
 msgid "Sign In instead"
 msgstr "Connectez-vous"
 
@@ -686,191 +734,194 @@ msgstr "—"
 msgid "Enter page number (1 - %(max)d)"
 msgstr "Entrez le numéro de page (1 - %(max)d)"
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:78
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:56
+msgid ""
+"You have been disconnected because your account was logged in from "
+"another location."
+msgstr ""
+"Vous avez été déconnecté car votre compte a été utilisé depuis un autre "
+"endroit."
+
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:85
 msgid "You have been logged out."
 msgstr "Vous avez été déconnecté."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:110
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:117
 msgid "Please sign in to view your profile."
 msgstr "Veuillez vous connecter pour voir votre profil."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:167
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:174
 msgid "Authentication required."
 msgstr "Authentification requise."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:171
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:178
 msgid "No file provided."
 msgstr "Aucun fichier fourni."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:214
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:245
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:273
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:362
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:225
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:259
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:289
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:379
 msgid "Please sign in."
 msgstr "Veuillez vous connecter."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:219
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:230
 msgid "No avatar to remove."
 msgstr "Aucun avatar à supprimer."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:226
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:240
 msgid "Failed to remove profile photo."
 msgstr "Échec de la suppression de la photo de profil."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:229
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:243
 msgid "Profile photo removed."
 msgstr "Photo de profil supprimée."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:250
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:264
 msgid "Email is required."
 msgstr "L'email est requis."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:257
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:272
 msgid "Email updated."
 msgstr "Email mis à jour."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:278
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:294
 msgid "Password is required."
 msgstr "Le mot de passe est requis."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:285
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:302
 msgid "Password updated."
 msgstr "Mot de passe mis à jour."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:376
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:393
 msgid "Account not found."
 msgstr "Compte introuvable."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:393
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:396
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:417
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:420
 msgid "Account deleted."
 msgstr "Compte supprimé."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:435
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:454
 msgid "Role updated."
 msgstr "Rôle mis à jour."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:470
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:491
 msgid "Account banned."
 msgstr "Compte banni."
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:501
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:522
 msgid "Account unbanned."
 msgstr "Compte débanni."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:114
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:116
 #, python-format
 msgid "Error: %(error)s"
 msgstr "Erreur : %(error)s"
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:156
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:158
 msgid "You must be signed in to author an article."
 msgstr "Vous devez être connecté pour écrire un article."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:160
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:362
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:162
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:373
 msgid "Insufficient permissions: Only authors or admins can create articles."
 msgstr ""
 "Permissions insuffisantes : seuls les auteurs ou administrateurs peuvent "
 "créer des articles."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:181
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:183
 msgid "Article not found."
 msgstr "Article introuvable."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:217
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:262
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:307
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:221
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:269
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:317
 msgid "Unauthorized."
 msgstr "Non autorisé."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:219
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:264
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:309
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:223
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:271
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:319
 msgid "Insufficient permissions."
 msgstr "Permissions insuffisantes."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:223
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:268
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:227
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:275
 msgid "Invalid JSON body."
 msgstr "Corps JSON invalide."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:234
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:279
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:240
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:288
 msgid "Validation error."
 msgstr "Erreur de validation."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:333
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:344
 msgid "You must be logged in to delete articles."
 msgstr "Vous devez être connecté pour supprimer des articles."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:339
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:350
 msgid "error"
 msgstr "erreur"
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:341
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:352
 msgid "Article deleted successfully."
 msgstr "Article supprimé avec succès."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:358
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:369
 msgid "You must be signed in to edit an article."
 msgstr "Vous devez être connecté pour modifier un article."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:367
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:378
 msgid "Error: The requested article could not be found."
 msgstr "Erreur : l'article demandé est introuvable."
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:371
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:382
 msgid "You do not have permission to edit this article."
 msgstr "Vous n'avez pas la permission de modifier cet article."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:64
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:65
 msgid "You must be signed in to post a comment."
 msgstr "Vous devez être connecté pour poster un commentaire."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:80
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:125
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:83
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:130
 #, python-format
 msgid "You're posting too fast. Please wait %(remaining)ss before posting again."
 msgstr ""
 "Vous publiez trop vite. Veuillez patienter %(remaining)s seconde(s) avant"
 " de publier à nouveau."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:92
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:95
 msgid "Comment added."
 msgstr "Commentaire ajouté."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:109
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:112
 msgid "You must be signed in to reply."
 msgstr "Vous devez être connecté pour répondre."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:137
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:142
 msgid "Reply added."
 msgstr "Réponse ajoutée."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:154
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:216
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:159
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:219
 msgid "You must be signed in to delete comments."
 msgstr "Vous devez être connecté pour supprimer des commentaires."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:165
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:170
 msgid "Comment deleted."
 msgstr "Commentaire supprimé."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:167
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:229
-msgid "Unauthorized or error."
-msgstr "Non autorisé ou erreur."
-
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:185
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:188
 msgid "You must be signed in to edit comments."
 msgstr "Vous devez être connecté pour modifier des commentaires."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:198
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:201
 msgid "Comment updated."
 msgstr "Commentaire mis à jour."
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:227
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:230
 msgid "Comment permanently deleted."
 msgstr "Commentaire définitivement supprimé."
 
@@ -878,25 +929,30 @@ msgstr "Commentaire définitivement supprimé."
 msgid "No file provided"
 msgstr "Aucun fichier fourni"
 
-#: src/infrastructure/input_adapters/flask/flask_file_adapter.py:73
+#: src/infrastructure/input_adapters/flask/flask_file_adapter.py:75
 msgid "File not found"
 msgstr "Fichier introuvable"
 
-#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:55
+#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:58
 #, python-format
 msgid "Validation Error (%(location)s): %(message)s"
 msgstr "Erreur de validation (%(location)s) : %(message)s"
 
+#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:67
+#, fuzzy
+msgid "This account has been banned."
+msgstr "Compte débanni."
+
 #: src/infrastructure/input_adapters/flask/flask_login_adapter.py:69
 msgid "Invalid username or password."
 msgstr "Nom d'utilisateur ou mot de passe invalide."
 
-#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:58
+#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:61
 #, python-format
 msgid "%(location)s: %(message)s"
 msgstr "%(location)s : %(message)s"
 
-#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:71
+#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:74
 msgid "Registration successful. Please sign in."
 msgstr "Inscription réussie. Veuillez vous connecter."
 
@@ -943,3 +999,6 @@ msgstr "Inscription réussie. Veuillez vous connecter."
 #~ msgid "user"
 #~ msgstr "Utilisateur"
 
+#~ msgid "Unauthorized or error."
+#~ msgstr "Non autorisé ou erreur."
+
diff --git a/translations/messages.pot b/translations/messages.pot
index 63c1bb5e..0946f800 100644
--- a/translations/messages.pot
+++ b/translations/messages.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PROJECT VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2026-07-23 20:31+0200\n"
+"POT-Creation-Date: 2026-07-25 19:11+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -17,15 +17,15 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Generated-By: Babel 2.10.3\n"
 
-#: blog_comment_application.py:212
+#: blog_comment_application.py:213
 msgid "You do not have permission to access this page."
 msgstr ""
 
-#: blog_comment_application.py:213
+#: blog_comment_application.py:214
 msgid "The page you are looking for does not exist."
 msgstr ""
 
-#: blog_comment_application.py:214
+#: blog_comment_application.py:215
 msgid "An unexpected error occurred. Please try again later."
 msgstr ""
 
@@ -55,7 +55,7 @@ msgid "Network error."
 msgstr ""
 
 #: frontend/templates/article_create.html:31
-#: frontend/templates/article_detail.html:218
+#: frontend/templates/article_detail.html:236
 #: frontend/templates/article_edit.html:60
 msgid "Loading..."
 msgstr ""
@@ -101,9 +101,9 @@ msgid "Publish"
 msgstr ""
 
 #: frontend/templates/article_create.html:40
-#: frontend/templates/article_detail.html:228
-#: frontend/templates/article_edit.html:69 frontend/templates/profile.html:94
-#: frontend/templates/profile.html:116
+#: frontend/templates/article_detail.html:246
+#: frontend/templates/article_edit.html:69 frontend/templates/profile.html:96
+#: frontend/templates/profile.html:119
 msgid "Save"
 msgstr ""
 
@@ -143,13 +143,13 @@ msgid "Only YouTube links are supported"
 msgstr ""
 
 #: frontend/templates/article_create.html:48
-#: frontend/templates/article_detail.html:222
+#: frontend/templates/article_detail.html:240
 #: frontend/templates/article_edit.html:77
 msgid "Failed to load article."
 msgstr ""
 
 #: frontend/templates/article_create.html:49
-#: frontend/templates/article_detail.html:224
+#: frontend/templates/article_detail.html:242
 #: frontend/templates/article_edit.html:78
 msgid "Copy"
 msgstr ""
@@ -160,7 +160,7 @@ msgid "Copy Block"
 msgstr ""
 
 #: frontend/templates/article_create.html:51
-#: frontend/templates/article_detail.html:220
+#: frontend/templates/article_detail.html:238
 #: frontend/templates/article_edit.html:80
 msgid "Copied to clipboard"
 msgstr ""
@@ -188,7 +188,7 @@ msgid "Align text justify"
 msgstr ""
 
 #: frontend/templates/article_create.html:56
-#: frontend/templates/article_detail.html:223
+#: frontend/templates/article_detail.html:241
 #: frontend/templates/article_edit.html:85
 msgid "Plain Text"
 msgstr ""
@@ -204,7 +204,7 @@ msgid "No languages found"
 msgstr ""
 
 #: frontend/templates/article_create.html:59
-#: frontend/templates/article_detail.html:226
+#: frontend/templates/article_detail.html:244
 #: frontend/templates/article_edit.html:88
 msgid "Something went wrong. Please reload the page."
 msgstr ""
@@ -216,7 +216,7 @@ msgid "Anonymous"
 msgstr ""
 
 #: frontend/templates/article_detail.html:72
-#: frontend/templates/article_detail.html:149
+#: frontend/templates/article_detail.html:157
 #: frontend/templates/article_list.html:88
 #, python-format
 msgid "edited at %(date)s"
@@ -231,7 +231,8 @@ msgid "Delete this article permanently ?"
 msgstr ""
 
 #: frontend/templates/article_detail.html:126
-#: frontend/templates/profile.html:53
+#: frontend/templates/article_detail.html:251
+#: frontend/templates/profile.html:55
 msgid "[Edit]"
 msgstr ""
 
@@ -244,83 +245,123 @@ msgstr ""
 msgid "Permanently delete this comment? This cannot be undone."
 msgstr ""
 
-#: frontend/templates/article_detail.html:143
+#: frontend/templates/article_detail.html:144
+msgid "Deleted by admin"
+msgstr ""
+
+#: frontend/templates/article_detail.html:146
+msgid "Deleted by user"
+msgstr ""
+
+#: frontend/templates/article_detail.html:148
+msgid "Deleted due to account deletion"
+msgstr ""
+
+#: frontend/templates/article_detail.html:150
 msgid "Comment removed"
 msgstr ""
 
-#: frontend/templates/article_detail.html:155
-#: frontend/templates/article_detail.html:227
+#: frontend/templates/article_detail.html:163
+#: frontend/templates/article_detail.html:245
 msgid "Reply"
 msgstr ""
 
-#: frontend/templates/article_detail.html:158
-#: frontend/templates/article_detail.html:164
+#: frontend/templates/article_detail.html:166
+#: frontend/templates/article_detail.html:172
 msgid "View replies"
 msgstr ""
 
-#: frontend/templates/article_detail.html:158
-#: frontend/templates/article_detail.html:164
+#: frontend/templates/article_detail.html:166
+#: frontend/templates/article_detail.html:172
 msgid "Hide replies"
 msgstr ""
 
-#: frontend/templates/article_detail.html:180
+#: frontend/templates/article_detail.html:188
 #, python-format
 msgid "Comments (%(count)s)"
 msgstr ""
 
-#: frontend/templates/article_detail.html:184
+#: frontend/templates/article_detail.html:192
 msgid "No comments yet."
 msgstr ""
 
-#: frontend/templates/article_detail.html:189
-#: frontend/templates/article_detail.html:233
+#: frontend/templates/article_detail.html:197
+#: frontend/templates/article_detail.html:253
 msgid "Join the discussion"
 msgstr ""
 
-#: frontend/templates/article_detail.html:190
-msgid "Comment must be between 1 and 5000 characters"
+#: frontend/templates/article_detail.html:199
+msgid "Comment rules:"
 msgstr ""
 
 #: frontend/templates/article_detail.html:201
-#: frontend/templates/article_detail.html:232
-msgid "Post Comment"
+msgid "No links, advertising, or spam."
 msgstr ""
 
 #: frontend/templates/article_detail.html:202
-#: frontend/templates/article_detail.html:231
+msgid "No profanity, insults, or hate speech."
+msgstr ""
+
+#: frontend/templates/article_detail.html:203
+msgid "Do not post the same message multiple times."
+msgstr ""
+
+#: frontend/templates/article_detail.html:204
+msgid "Stay respectful and on topic."
+msgstr ""
+
+#: frontend/templates/article_detail.html:205
+msgid "Violation results in account ban without notice."
+msgstr ""
+
+#: frontend/templates/article_detail.html:208
+msgid "Comment must be between 1 and 5000 characters"
+msgstr ""
+
+#: frontend/templates/article_detail.html:219
+#: frontend/templates/article_detail.html:252
+msgid "Post Comment"
+msgstr ""
+
+#: frontend/templates/article_detail.html:220
+#: frontend/templates/article_detail.html:249
 #: frontend/templates/article_list.html:143 frontend/templates/base.html:115
-#: frontend/templates/base.html:139 frontend/templates/profile.html:93
-#: frontend/templates/profile.html:115 frontend/templates/user_list.html:143
+#: frontend/templates/base.html:139 frontend/templates/profile.html:95
+#: frontend/templates/profile.html:118 frontend/templates/user_list.html:143
 msgid "Cancel"
 msgstr ""
 
-#: frontend/templates/article_detail.html:209
+#: frontend/templates/article_detail.html:227
 #, python-format
 msgid ""
 "Please <a href=\"%(url)s\" class=\"comment-auth-link\">sign in</a> to "
 "join the conversation."
 msgstr ""
 
-#: frontend/templates/article_detail.html:219
+#: frontend/templates/article_detail.html:237
 msgid "Unable to render article content."
 msgstr ""
 
-#: frontend/templates/article_detail.html:221
+#: frontend/templates/article_detail.html:239
 msgid "Comment cannot be empty"
 msgstr ""
 
-#: frontend/templates/article_detail.html:225
+#: frontend/templates/article_detail.html:243
 msgid "Insert Emoji"
 msgstr ""
 
-#: frontend/templates/article_detail.html:229
+#: frontend/templates/article_detail.html:247
 msgid "Reply to"
 msgstr ""
 
-#: frontend/templates/article_detail.html:230
+#: frontend/templates/article_detail.html:248
 msgid "Editing comment"
 msgstr ""
 
+#: frontend/templates/article_detail.html:250
+msgid "[Cancel]"
+msgstr ""
+
 #: frontend/templates/article_edit.html:3
 msgid "Edit Article - DevJournal"
 msgstr ""
@@ -434,7 +475,7 @@ msgid "Confirm"
 msgstr ""
 
 #: frontend/templates/base.html:122 frontend/templates/base.html:140
-#: frontend/templates/profile.html:152 frontend/templates/user_list.html:88
+#: frontend/templates/profile.html:155 frontend/templates/user_list.html:88
 msgid "Ban"
 msgstr ""
 
@@ -456,7 +497,7 @@ msgid "© %(year)s DevJournal. All rights reserved."
 msgstr ""
 
 #: frontend/templates/error.html:11 frontend/templates/login.html:42
-#: frontend/templates/profile.html:166 frontend/templates/registration.html:53
+#: frontend/templates/profile.html:169 frontend/templates/registration.html:68
 #: frontend/templates/user_list.html:149
 msgid "Return to home"
 msgstr ""
@@ -477,23 +518,23 @@ msgstr ""
 msgid "Username"
 msgstr ""
 
-#: frontend/templates/login.html:21 frontend/templates/registration.html:21
+#: frontend/templates/login.html:21 frontend/templates/registration.html:23
 msgid "e.g., dev_journey"
 msgstr ""
 
-#: frontend/templates/login.html:24 frontend/templates/registration.html:28
+#: frontend/templates/login.html:24 frontend/templates/registration.html:35
 msgid "Password"
 msgstr ""
 
-#: frontend/templates/login.html:26 frontend/templates/profile.html:109
-#: frontend/templates/registration.html:30
-#: frontend/templates/registration.html:37
+#: frontend/templates/login.html:26 frontend/templates/profile.html:112
+#: frontend/templates/registration.html:39
+#: frontend/templates/registration.html:50
 msgid "e.g., MyP@ssw0rd!"
 msgstr ""
 
-#: frontend/templates/login.html:27 frontend/templates/profile.html:110
-#: frontend/templates/registration.html:31
-#: frontend/templates/registration.html:38
+#: frontend/templates/login.html:27 frontend/templates/profile.html:113
+#: frontend/templates/registration.html:42
+#: frontend/templates/registration.html:53
 msgid "Toggle password visibility"
 msgstr ""
 
@@ -505,94 +546,94 @@ msgstr ""
 msgid "Create an account"
 msgstr ""
 
-#: frontend/templates/profile.html:21
+#: frontend/templates/profile.html:22
 msgid "Upload Photo"
 msgstr ""
 
-#: frontend/templates/profile.html:26
+#: frontend/templates/profile.html:27
 msgid "Remove Photo"
 msgstr ""
 
-#: frontend/templates/profile.html:37 frontend/templates/user_list.html:75
+#: frontend/templates/profile.html:39 frontend/templates/user_list.html:75
 msgid "User"
 msgstr ""
 
-#: frontend/templates/profile.html:38 frontend/templates/user_list.html:76
+#: frontend/templates/profile.html:40 frontend/templates/user_list.html:76
 msgid "Author"
 msgstr ""
 
-#: frontend/templates/profile.html:40 frontend/templates/user_list.html:78
+#: frontend/templates/profile.html:42 frontend/templates/user_list.html:78
 msgid "Update"
 msgstr ""
 
-#: frontend/templates/profile.html:49 frontend/templates/profile.html:87
+#: frontend/templates/profile.html:51 frontend/templates/profile.html:89
 #: frontend/templates/user_list.html:50
 msgid "Email"
 msgstr ""
 
-#: frontend/templates/profile.html:62 frontend/templates/user_list.html:54
+#: frontend/templates/profile.html:64 frontend/templates/user_list.html:54
 msgid "Member Since"
 msgstr ""
 
-#: frontend/templates/profile.html:67 frontend/templates/user_list.html:66
+#: frontend/templates/profile.html:69 frontend/templates/user_list.html:66
 msgid "N/A"
 msgstr ""
 
-#: frontend/templates/profile.html:73 frontend/templates/user_list.html:52
+#: frontend/templates/profile.html:75 frontend/templates/user_list.html:52
 msgid "Status"
 msgstr ""
 
-#: frontend/templates/profile.html:74 frontend/templates/user_list.html:64
+#: frontend/templates/profile.html:76 frontend/templates/user_list.html:64
 msgid "Banned"
 msgstr ""
 
-#: frontend/templates/profile.html:74 frontend/templates/user_list.html:64
+#: frontend/templates/profile.html:76 frontend/templates/user_list.html:64
 msgid "Active"
 msgstr ""
 
-#: frontend/templates/profile.html:81
+#: frontend/templates/profile.html:83
 msgid "Update Email"
 msgstr ""
 
-#: frontend/templates/profile.html:89 frontend/templates/registration.html:25
+#: frontend/templates/profile.html:91 frontend/templates/registration.html:32
 msgid "e.g., user@example.com"
 msgstr ""
 
-#: frontend/templates/profile.html:101
+#: frontend/templates/profile.html:103
 msgid "Update Password"
 msgstr ""
 
-#: frontend/templates/profile.html:107
+#: frontend/templates/profile.html:109
 msgid "New Password"
 msgstr ""
 
-#: frontend/templates/profile.html:124
+#: frontend/templates/profile.html:127
 msgid "Manage Users"
 msgstr ""
 
-#: frontend/templates/profile.html:126
+#: frontend/templates/profile.html:129
 msgid "Change Password"
 msgstr ""
 
-#: frontend/templates/profile.html:129
+#: frontend/templates/profile.html:132
 msgid "Sign Out"
 msgstr ""
 
-#: frontend/templates/profile.html:136
+#: frontend/templates/profile.html:139
 msgid ""
 "Are you sure you want to delete your account ? This action is "
 "irreversible."
 msgstr ""
 
-#: frontend/templates/profile.html:136 frontend/templates/profile.html:159
+#: frontend/templates/profile.html:139 frontend/templates/profile.html:162
 msgid "Delete Account"
 msgstr ""
 
-#: frontend/templates/profile.html:147 frontend/templates/user_list.html:83
+#: frontend/templates/profile.html:150 frontend/templates/user_list.html:83
 msgid "Unban"
 msgstr ""
 
-#: frontend/templates/profile.html:159 frontend/templates/user_list.html:95
+#: frontend/templates/profile.html:162 frontend/templates/user_list.html:95
 #, python-format
 msgid "Delete user \\\"%(username)s\\\" ? This action is irreversible."
 msgstr ""
@@ -613,23 +654,38 @@ msgstr ""
 msgid "Choose Username"
 msgstr ""
 
-#: frontend/templates/registration.html:24
+#: frontend/templates/registration.html:21
+msgid "3–30 characters: letters, numbers, underscores, hyphens"
+msgstr ""
+
+#: frontend/templates/registration.html:27
+msgid "3-30 characters: letters, numbers, underscores, hyphens"
+msgstr ""
+
+#: frontend/templates/registration.html:31
 msgid "Email Address"
 msgstr ""
 
-#: frontend/templates/registration.html:35
+#: frontend/templates/registration.html:36
+#: frontend/templates/registration.html:47
+msgid ""
+"Minimum 8 characters: at least one uppercase, one lowercase, and one "
+"special character"
+msgstr ""
+
+#: frontend/templates/registration.html:46
 msgid "Confirm Password"
 msgstr ""
 
-#: frontend/templates/registration.html:41
+#: frontend/templates/registration.html:56
 msgid "Create Account"
 msgstr ""
 
-#: frontend/templates/registration.html:47
+#: frontend/templates/registration.html:62
 msgid "Already have an account ?"
 msgstr ""
 
-#: frontend/templates/registration.html:48
+#: frontend/templates/registration.html:63
 msgid "Sign In instead"
 msgstr ""
 
@@ -667,187 +723,188 @@ msgstr ""
 msgid "Enter page number (1 - %(max)d)"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:78
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:56
+msgid ""
+"You have been disconnected because your account was logged in from "
+"another location."
+msgstr ""
+
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:85
 msgid "You have been logged out."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:110
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:117
 msgid "Please sign in to view your profile."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:167
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:174
 msgid "Authentication required."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:171
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:178
 msgid "No file provided."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:214
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:245
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:273
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:362
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:225
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:259
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:289
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:379
 msgid "Please sign in."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:219
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:230
 msgid "No avatar to remove."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:226
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:240
 msgid "Failed to remove profile photo."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:229
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:243
 msgid "Profile photo removed."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:250
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:264
 msgid "Email is required."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:257
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:272
 msgid "Email updated."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:278
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:294
 msgid "Password is required."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:285
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:302
 msgid "Password updated."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:376
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:393
 msgid "Account not found."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:393
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:396
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:417
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:420
 msgid "Account deleted."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:435
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:454
 msgid "Role updated."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:470
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:491
 msgid "Account banned."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:501
+#: src/infrastructure/input_adapters/flask/flask_account_session_adapter.py:522
 msgid "Account unbanned."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:114
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:116
 #, python-format
 msgid "Error: %(error)s"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:156
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:158
 msgid "You must be signed in to author an article."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:160
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:362
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:162
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:373
 msgid "Insufficient permissions: Only authors or admins can create articles."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:181
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:183
 msgid "Article not found."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:217
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:262
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:307
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:221
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:269
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:317
 msgid "Unauthorized."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:219
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:264
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:309
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:223
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:271
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:319
 msgid "Insufficient permissions."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:223
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:268
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:227
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:275
 msgid "Invalid JSON body."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:234
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:279
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:240
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:288
 msgid "Validation error."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:333
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:344
 msgid "You must be logged in to delete articles."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:339
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:350
 msgid "error"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:341
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:352
 msgid "Article deleted successfully."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:358
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:369
 msgid "You must be signed in to edit an article."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:367
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:378
 msgid "Error: The requested article could not be found."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:371
+#: src/infrastructure/input_adapters/flask/flask_article_adapter.py:382
 msgid "You do not have permission to edit this article."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:64
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:65
 msgid "You must be signed in to post a comment."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:80
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:125
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:83
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:130
 #, python-format
 msgid "You're posting too fast. Please wait %(remaining)ss before posting again."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:92
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:95
 msgid "Comment added."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:109
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:112
 msgid "You must be signed in to reply."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:137
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:142
 msgid "Reply added."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:154
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:216
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:159
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:219
 msgid "You must be signed in to delete comments."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:165
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:170
 msgid "Comment deleted."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:167
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:229
-msgid "Unauthorized or error."
-msgstr ""
-
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:185
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:188
 msgid "You must be signed in to edit comments."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:198
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:201
 msgid "Comment updated."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:227
+#: src/infrastructure/input_adapters/flask/flask_comment_adapter.py:230
 msgid "Comment permanently deleted."
 msgstr ""
 
@@ -855,25 +912,29 @@ msgstr ""
 msgid "No file provided"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_file_adapter.py:73
+#: src/infrastructure/input_adapters/flask/flask_file_adapter.py:75
 msgid "File not found"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:55
+#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:58
 #, python-format
 msgid "Validation Error (%(location)s): %(message)s"
 msgstr ""
 
+#: src/infrastructure/input_adapters/flask/flask_login_adapter.py:67
+msgid "This account has been banned."
+msgstr ""
+
 #: src/infrastructure/input_adapters/flask/flask_login_adapter.py:69
 msgid "Invalid username or password."
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:58
+#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:61
 #, python-format
 msgid "%(location)s: %(message)s"
 msgstr ""
 
-#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:71
+#: src/infrastructure/input_adapters/flask/flask_registration_adapter.py:74
 msgid "Registration successful. Please sign in."
 msgstr ""
 
diff --git a/utils/__init__.py b/utils/__init__.py
deleted file mode 100644
index e69de29b..00000000