@dax-crafta/auth 1.2.4 → 1.2.6

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "@dax-crafta/auth",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Authentication plugin for crafta framework",
   "main": "src/index.js",
   "private": false,
   "dependencies": {
     "bcryptjs": "^2.4.3",
+    "express-rate-limit": "^7.1.4",
+    "google-auth-library": "^9.2.0",
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^7.6.3",
+    "nodemailer": "^6.9.7",
+    "otplib": "^12.0.1",
+    "passport": "^0.6.0",
+    "passport-facebook": "^3.0.0",
+    "passport-github2": "^0.1.12",
+    "passport-google-oauth20": "^2.0.0",
     "validator": "^13.11.0"
   },
   "peerDependencies": {

package/src/index.js

@@ -1,204 +1,224 @@
-const jwt = require('jsonwebtoken');
-const bcrypt = require('bcryptjs');
-const mongoose = require('mongoose');
-const validator = require('validator');
+const passport = require('passport');
+const GoogleStrategy = require('passport-google-oauth20').Strategy;
+const FacebookStrategy = require('passport-facebook').Strategy;
+const GitHubStrategy = require('passport-github2').Strategy;
+const AuthService = require('./services/auth.service');
+const createAuthMiddleware = require('./middlewares/auth.middleware');
 
-// Default configuration
 const defaultConfig = {
   strategy: 'jwt',
   fields: ['email', 'password'],
   routes: {
     register: '/register',
     login: '/login',
-    verify: '/verify'
+    verify: '/verify',
+    forgotPassword: '/forgot-password',
+    resetPassword: '/reset-password',
+    refreshToken: '/refresh-token',
+    profile: '/profile',
+    twoFactor: '/2fa'
   },
   mongoUrl: process.env.MONGODB_URI || 'mongodb://localhost:27017/forge-auth',
-  sendVerificationEmail: null,
-  db: null
+  maxLoginAttempts: 5,
+  emailVerification: true,
+  loginAlerts: true,
+  smtp: null,
+  social: {
+    google: null,
+    facebook: null,
+    github: null
+  }
 };
 
-// Create dynamic Mongoose schema based on fields
-function createUserSchema(fields) {
-  const schemaFields = fields.reduce((acc, field) => {
-    acc[field] = { 
-      type: String,
-      required: true,
-      ...(field === 'email' && { 
-        validate: {
-          validator: validator.isEmail,
-          message: 'Invalid email format'
-        }
-      })
-    };
-    return acc;
-  }, {});
-
-  return new mongoose.Schema(schemaFields, { timestamps: true });
-}
-
 function auth(config = {}) {
   const finalConfig = { ...defaultConfig, ...config };
   
-  // Validate JWT secret
   if (!finalConfig.env?.JWT_SECRET) {
     throw new Error('JWT_SECRET is required in environment configuration');
   }
 
-  // Initialize MongoDB connection if custom DB handlers aren't provided
-  let User;
-  if (!finalConfig.db) {
-    mongoose.connect(finalConfig.mongoUrl, {
-      useNewUrlParser: true,
-      useUnifiedTopology: true
-    });
-    
-    const userSchema = createUserSchema(finalConfig.fields);
-    User = mongoose.model('User', userSchema);
+  if (finalConfig.emailVerification && !finalConfig.smtp) {
+    throw new Error('SMTP configuration is required for email verification');
   }
 
-  // Database operations
-  const dbOperations = finalConfig.db || {
-    saveUser: async (userData) => {
-      const user = new User(userData);
-      return await user.save();
-    },
-    getUserByEmail: async (email) => {
-      return await User.findOne({ email });
-    }
-  };
+  const authService = new AuthService(finalConfig);
+  const { rateLimiter, verifyToken, checkRole } = createAuthMiddleware(finalConfig);
+
+  // Configure social login strategies
+  if (finalConfig.social.google) {
+    passport.use(new GoogleStrategy(finalConfig.social.google,
+      async (accessToken, refreshToken, profile, done) => {
+        try {
+          // Handle Google login
+          const user = await authService.handleSocialLogin('google', profile);
+          done(null, user);
+        } catch (error) {
+          done(error);
+        }
+      }
+    ));
+  }
 
   return function(app) {
+    app.use(passport.initialize());
+    app.use(rateLimiter);
+
     // Register route
     app.post(finalConfig.routes.register, async (req, res) => {
       try {
-        // Validate required fields
-        const userData = {};
-        for (const field of finalConfig.fields) {
-          if (!req.body[field]) {
-            return res.status(400).json({ 
-              success: false, 
-              error: `${field} is required` 
-            });
-          }
-          userData[field] = req.body[field];
-        }
-
-        // Hash password
-        if (userData.password) {
-          userData.password = await bcrypt.hash(userData.password, 10);
-        }
-
-        // Save user
-        const savedUser = await dbOperations.saveUser(userData);
+        const user = await authService.register(req.body);
+        res.status(201).json({
+          success: true,
+          message: 'Registration successful. Please verify your email.'
+        });
+      } catch (error) {
+        res.status(400).json({
+          success: false,
+          error: error.message
+        });
+      }
+    });
 
-        // Generate JWT
-        const token = jwt.sign(
-          { id: savedUser._id, email: savedUser.email },
-          finalConfig.env.JWT_SECRET,
-          { expiresIn: '24h' }
+    // Login route with device detection
+    app.post(finalConfig.routes.login, async (req, res) => {
+      try {
+        const deviceInfo = {
+          browser: req.headers['user-agent'],
+          ip: req.ip
+        };
+
+        const result = await authService.login(
+          req.body.email,
+          req.body.password,
+          deviceInfo
         );
 
-        // Send verification email if configured
-        if (finalConfig.sendVerificationEmail) {
-          try {
-            await finalConfig.sendVerificationEmail(savedUser);
-          } catch (emailError) {
-            console.error('Email verification failed:', emailError);
-          }
-        }
-
-        res.status(201).json({ 
+        res.json({
           success: true,
-          token,
-          user: { ...savedUser.toJSON(), password: undefined }
+          ...result
         });
       } catch (error) {
-        if (error.code === 11000) {
-          return res.status(400).json({ 
-            success: false, 
-            error: 'Email already exists' 
-          });
-        }
-        res.status(400).json({ 
-          success: false, 
-          error: error.message 
+        res.status(401).json({
+          success: false,
+          error: error.message
         });
       }
     });
 
-    // Login route
-    app.post(finalConfig.routes.login, async (req, res) => {
+    // 2FA verification
+    app.post(finalConfig.routes.twoFactor, async (req, res) => {
       try {
-        const { email, password } = req.body;
-        
-        if (!email || !password) {
-          return res.status(400).json({ 
-            success: false, 
-            error: 'Email and password are required' 
-          });
-        }
-
-        const user = await dbOperations.getUserByEmail(email);
-        
-        if (!user) {
-          return res.status(404).json({ 
-            success: false, 
-            error: 'User not found' 
-          });
-        }
+        const result = await authService.verify2FA(
+          req.body.userId,
+          req.body.code
+        );
 
-        const isValid = await bcrypt.compare(password, user.password);
-        
-        if (!isValid) {
-          return res.status(401).json({ 
-            success: false, 
-            error: 'Invalid credentials' 
-          });
-        }
+        res.json({
+          success: true,
+          ...result
+        });
+      } catch (error) {
+        res.status(401).json({
+          success: false,
+          error: error.message
+        });
+      }
+    });
 
-        const token = jwt.sign(
-          { id: user._id, email: user.email },
-          finalConfig.env.JWT_SECRET,
-          { expiresIn: '24h' }
-        );
+    // Refresh token
+    app.post(finalConfig.routes.refreshToken, async (req, res) => {
+      try {
+        const result = await authService.refreshToken(req.body.refreshToken);
+        res.json({
+          success: true,
+          ...result
+        });
+      } catch (error) {
+        res.status(401).json({
+          success: false,
+          error: error.message
+        });
+      }
+    });
 
-        res.json({ 
+    // Forgot password
+    app.post(finalConfig.routes.forgotPassword, async (req, res) => {
+      try {
+        await authService.forgotPassword(req.body.email);
+        res.json({
           success: true,
-          token,
-          user: { ...user.toJSON(), password: undefined }
+          message: 'Password reset instructions sent to your email'
         });
       } catch (error) {
-        res.status(400).json({ 
-          success: false, 
-          error: error.message 
+        res.status(400).json({
+          success: false,
+          error: error.message
         });
       }
     });
 
-    // Verify route
-    app.get(finalConfig.routes.verify, (req, res) => {
-      const token = req.headers.authorization?.split(' ')[1];
-      
-      if (!token) {
-        return res.status(401).json({ 
-          success: false, 
-          error: 'No token provided' 
+    // Reset password
+    app.post(finalConfig.routes.resetPassword, async (req, res) => {
+      try {
+        await authService.resetPassword(
+          req.body.token,
+          req.body.newPassword
+        );
+        res.json({
+          success: true,
+          message: 'Password reset successful'
+        });
+      } catch (error) {
+        res.status(400).json({
+          success: false,
+          error: error.message
         });
       }
+    });
 
+    // Update profile (protected route)
+    app.put(finalConfig.routes.profile, verifyToken, async (req, res) => {
       try {
-        const decoded = jwt.verify(token, finalConfig.env.JWT_SECRET);
-        res.json({ 
+        const user = await authService.updateProfile(req.user.id, req.body);
+        res.json({
           success: true,
-          user: decoded 
+          user
         });
       } catch (error) {
-        res.status(401).json({ 
-          success: false, 
-          error: 'Invalid token' 
+        res.status(400).json({
+          success: false,
+          error: error.message
         });
       }
     });
+
+    // Social login routes
+    if (finalConfig.social.google) {
+      app.get('/auth/google',
+        passport.authenticate('google', { scope: ['profile', 'email'] })
+      );
+
+      app.get('/auth/google/callback',
+        passport.authenticate('google', { session: false }),
+        (req, res) => {
+          const { accessToken, refreshToken } = authService.generateTokens(req.user);
+          res.json({
+            success: true,
+            accessToken,
+            refreshToken,
+            user: req.user
+          });
+        }
+      );
+    }
+
+    // Admin-only route example
+    app.get('/admin', verifyToken, checkRole(['admin']), (req, res) => {
+      res.json({
+        success: true,
+        message: 'Admin access granted'
+      });
+    });
   };
 }