@dax-crafta/auth 1.3.3 → 1.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dax-crafta/auth",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Authentication plugin for crafta framework",
   "main": "src/index.js",
   "private": false,

package/src/index.js

@@ -3,6 +3,10 @@ const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const FacebookStrategy = require('passport-facebook').Strategy;
 const GitHubStrategy = require('passport-github2').Strategy;
 const AuthService = require('./services/auth.service');
+const RoleService = require('./services/role.service');
+const AuditService = require('./services/audit.service');
+const MFAService = require('./utils/mfa');
+const PasswordPolicy = require('./utils/password-policy');
 const createAuthMiddleware = require('./middlewares/auth.middleware');
 
 const defaultConfig = {
@@ -16,12 +20,21 @@ const defaultConfig = {
     resetPassword: '/reset-password',
     refreshToken: '/refresh-token',
     profile: '/profile',
-    twoFactor: '/2fa'
+    twoFactor: '/2fa',
+    roles: '/roles',
+    permissions: '/permissions'
   },
   mongoUrl: process.env.MONGODB_URI || 'mongodb://localhost:27017/forge-auth',
   maxLoginAttempts: 5,
   emailVerification: true,
   loginAlerts: true,
+  passwordPolicy: {
+    minLength: 8,
+    requireUppercase: true,
+    requireNumbers: true,
+    requireSpecialChars: true,
+    expiryDays: 90
+  },
   smtp: null,
   social: {
     google: null,
@@ -41,7 +54,12 @@ function auth(config = {}) {
     throw new Error('SMTP configuration is required for email verification');
   }
 
+  // Initialize services
   const authService = new AuthService(finalConfig);
+  const roleService = new RoleService();
+  const auditService = new AuditService();
+  const mfaService = new MFAService();
+  const passwordPolicy = new PasswordPolicy(finalConfig.passwordPolicy);
   const { rateLimiter, verifyToken, checkRole } = createAuthMiddleware(finalConfig);
 
   // Configure social login strategies
@@ -49,7 +67,6 @@ function auth(config = {}) {
     passport.use(new GoogleStrategy(finalConfig.social.google,
       async (accessToken, refreshToken, profile, done) => {
         try {
-          // Handle Google login
           const user = await authService.handleSocialLogin('google', profile);
           done(null, user);
         } catch (error) {
@@ -63,13 +80,40 @@ function auth(config = {}) {
     app.use(passport.initialize());
     app.use(rateLimiter);
 
-    // Register route
+    // Attach services to app
+    app.authService = authService;
+    app.roleService = roleService;
+    app.auditService = auditService;
+    app.mfaService = mfaService;
+    app.passwordPolicy = passwordPolicy;
+
+    // Register route with password policy
     app.post(finalConfig.routes.register, async (req, res) => {
       try {
+        const { isValid, errors } = passwordPolicy.validate(req.body.password, {
+          email: req.body.email,
+          name: req.body.name
+        });
+
+        if (!isValid) {
+          return res.status(400).json({
+            success: false,
+            errors
+          });
+        }
+
         const user = await authService.register(req.body);
+        await auditService.logActivity({
+          userId: user._id,
+          action: 'register',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'success'
+        });
+
         res.status(201).json({
           success: true,
-          message: 'Registration successful. Please verify your email.'
+          message: 'Registration successful'
         });
       } catch (error) {
         res.status(400).json({
@@ -79,7 +123,7 @@ function auth(config = {}) {
       }
     });
 
-    // Login route with device detection
+    // Login route with audit logging and MFA support
     app.post(finalConfig.routes.login, async (req, res) => {
       try {
         const deviceInfo = {
@@ -93,11 +137,27 @@ function auth(config = {}) {
           deviceInfo
         );
 
+        await auditService.logActivity({
+          userId: result.user?._id,
+          action: 'login',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'success'
+        });
+
         res.json({
           success: true,
           ...result
         });
       } catch (error) {
+        await auditService.logActivity({
+          action: 'login',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'failure',
+          details: { error: error.message }
+        });
+
         res.status(401).json({
           success: false,
           error: error.message
@@ -113,22 +173,12 @@ function auth(config = {}) {
           req.body.code
         );
 
-        res.json({
-          success: true,
-          ...result
+        await auditService.logActivity({
+          userId: result.user._id,
+          action: '2fa_verify',
+          status: 'success'
         });
-      } catch (error) {
-        res.status(401).json({
-          success: false,
-          error: error.message
-        });
-      }
-    });
 
-    // Refresh token
-    app.post(finalConfig.routes.refreshToken, async (req, res) => {
-      try {
-        const result = await authService.refreshToken(req.body.refreshToken);
         res.json({
           success: true,
           ...result
@@ -141,33 +191,11 @@ function auth(config = {}) {
       }
     });
 
-    // Forgot password
-    app.post(finalConfig.routes.forgotPassword, async (req, res) => {
-      try {
-        await authService.forgotPassword(req.body.email);
-        res.json({
-          success: true,
-          message: 'Password reset instructions sent to your email'
-        });
-      } catch (error) {
-        res.status(400).json({
-          success: false,
-          error: error.message
-        });
-      }
-    });
-
-    // Reset password
-    app.post(finalConfig.routes.resetPassword, async (req, res) => {
+    // Role management routes
+    app.post('/roles', verifyToken, checkRole(['admin']), async (req, res) => {
       try {
-        await authService.resetPassword(
-          req.body.token,
-          req.body.newPassword
-        );
-        res.json({
-          success: true,
-          message: 'Password reset successful'
-        });
+        const role = await roleService.createRole(req.body);
+        res.status(201).json({ success: true, role });
       } catch (error) {
         res.status(400).json({
           success: false,
@@ -176,10 +204,16 @@ function auth(config = {}) {
       }
     });
 
-    // Update profile (protected route)
+    // Update profile with audit logging
     app.put(finalConfig.routes.profile, verifyToken, async (req, res) => {
       try {
         const user = await authService.updateProfile(req.user.id, req.body);
+        await auditService.logActivity({
+          userId: user._id,
+          action: 'profile_update',
+          status: 'success'
+        });
+
         res.json({
           success: true,
           user
@@ -200,8 +234,15 @@ function auth(config = {}) {
 
       app.get('/auth/google/callback',
         passport.authenticate('google', { session: false }),
-        (req, res) => {
+        async (req, res) => {
           const { accessToken, refreshToken } = authService.generateTokens(req.user);
+          await auditService.logActivity({
+            userId: req.user._id,
+            action: 'social_login',
+            status: 'success',
+            details: { provider: 'google' }
+          });
+
           res.json({
             success: true,
             accessToken,
@@ -212,11 +253,12 @@ function auth(config = {}) {
       );
     }
 
-    // Admin-only route example
-    app.get('/admin', verifyToken, checkRole(['admin']), (req, res) => {
-      res.json({
-        success: true,
-        message: 'Admin access granted'
+    // Error handling middleware
+    app.use((err, req, res, next) => {
+      console.error(err.stack);
+      res.status(500).json({
+        success: false,
+        error: 'Internal Server Error'
       });
     });
   };