@dax-crafta/auth 1.3.3 → 1.3.5

package/README.md

@@ -0,0 +1,175 @@
+# @dax-crafta/auth
+
+A powerful, flexible, and secure authentication system for Node.js applications. Built with enterprise-grade security features while maintaining developer-friendly simplicity.
+
+[![npm version](https://img.shields.io/npm/v/@dax-crafta/auth.svg)](https://www.npmjs.com/package/@dax-crafta/auth)
+[![License](https://img.shields.io/npm/l/@dax-crafta/auth.svg)](https://github.com/dax-crafta/auth/blob/main/LICENSE)
+
+## Features
+
+- 🔐 **Comprehensive Authentication**
+  - Email/Password authentication
+  - Social login (Google, Facebook, GitHub)
+  - JWT-based session management
+  - Refresh token rotation
+
+- 👥 **Advanced Role-Based Access Control (RBAC)**
+  - Custom role creation
+  - Granular permissions
+  - Resource-based access control
+  - Role hierarchy support
+
+- 🔒 **Enterprise Security**
+  - Multi-factor authentication (MFA/2FA)
+  - Password policies and strength validation
+  - Account lockout protection
+  - Brute force prevention
+
+- 📧 **Email Features**
+  - Email verification
+  - Password reset
+  - Login notifications
+  - Custom email templates
+
+- 📝 **Audit Logging**
+  - Detailed activity tracking
+  - Security event logging
+  - User session monitoring
+
+## Quick Start
+
+```bash
+npm install @dax-crafta/auth
+```
+
+```javascript
+const { forge } = require('crafta');
+const { auth } = require('@dax-crafta/auth');
+
+const app = forge();
+
+// Basic setup
+auth({
+  strategy: 'jwt',
+  fields: ['email', 'password'],
+  emailVerification: true
+})(app);
+
+app.listen(3000);
+```
+
+## Configuration
+
+```javascript
+auth({
+  // Authentication Strategy
+  strategy: 'jwt',
+  
+  // User Fields
+  fields: ['name', 'email', 'password', 'age'],
+  
+  // Routes Configuration
+  routes: {
+    register: '/register',
+    login: '/login',
+    verify: '/verify',
+    forgotPassword: '/forgot-password',
+    resetPassword: '/reset-password',
+    refreshToken: '/refresh-token',
+    profile: '/profile',
+    twoFactor: '/2fa'
+  },
+  
+  // Security Settings
+  maxLoginAttempts: 5,
+  emailVerification: true,
+  loginAlerts: true,
+  
+  // Password Policy
+  passwordPolicy: {
+    minLength: 8,
+    requireUppercase: true,
+    requireNumbers: true,
+    requireSpecialChars: true,
+    expiryDays: 90
+  },
+  
+  // Email Configuration
+  smtp: {
+    host: 'smtp.example.com',
+    port: 587,
+    auth: {
+      user: 'your-email@example.com',
+      pass: 'your-password'
+    },
+    from: 'noreply@example.com'
+  },
+  
+  // Social Login
+  social: {
+    google: {
+      clientID: 'your-client-id',
+      clientSecret: 'your-client-secret',
+      callbackURL: 'http://localhost:3000/auth/google/callback'
+    }
+  }
+})(app);
+```
+
+## Role-Based Access Control
+
+```javascript
+// Create a custom role
+const adminRole = await roleService.createRole({
+  name: 'admin',
+  permissions: [{
+    resource: 'users',
+    actions: ['create', 'read', 'update', 'delete']
+  }]
+});
+
+// Check permissions
+const canAccess = await roleService.checkPermission('admin', 'users', 'create');
+```
+
+## Multi-Factor Authentication
+
+```javascript
+// Enable 2FA for a user
+const { secret, qrCode } = await mfaService.generateSecret(
+  'user@example.com',
+  'MyApp'
+);
+
+// Verify 2FA token
+const isValid = mfaService.verifyToken(token, secret);
+```
+
+## Audit Logging
+
+```javascript
+// Log user activity
+await auditService.logActivity({
+  userId: user.id,
+  action: 'login',
+  ipAddress: req.ip,
+  userAgent: req.headers['user-agent'],
+  status: 'success'
+});
+
+// Get user activity history
+const activities = await auditService.getUserActivity(userId);
+```
+
+## Security Best Practices
+
+- Use HTTPS in production
+- Set secure cookie options
+- Configure CORS appropriately
+- Regularly rotate refresh tokens
+- Monitor failed login attempts
+- Implement rate limiting
+
+## License
+
+MIT © Dax Crafta

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dax-crafta/auth",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Authentication plugin for crafta framework",
   "main": "src/index.js",
   "private": false,

package/src/index.js

@@ -3,6 +3,10 @@ const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const FacebookStrategy = require('passport-facebook').Strategy;
 const GitHubStrategy = require('passport-github2').Strategy;
 const AuthService = require('./services/auth.service');
+const RoleService = require('./services/role.service');
+const AuditService = require('./services/audit.service');
+const MFAService = require('./utils/mfa');
+const PasswordPolicy = require('./utils/password-policy');
 const createAuthMiddleware = require('./middlewares/auth.middleware');
 
 const defaultConfig = {
@@ -16,12 +20,21 @@ const defaultConfig = {
     resetPassword: '/reset-password',
     refreshToken: '/refresh-token',
     profile: '/profile',
-    twoFactor: '/2fa'
+    twoFactor: '/2fa',
+    roles: '/roles',
+    permissions: '/permissions'
   },
   mongoUrl: process.env.MONGODB_URI || 'mongodb://localhost:27017/forge-auth',
   maxLoginAttempts: 5,
   emailVerification: true,
   loginAlerts: true,
+  passwordPolicy: {
+    minLength: 8,
+    requireUppercase: true,
+    requireNumbers: true,
+    requireSpecialChars: true,
+    expiryDays: 90
+  },
   smtp: null,
   social: {
     google: null,
@@ -41,7 +54,12 @@ function auth(config = {}) {
     throw new Error('SMTP configuration is required for email verification');
   }
 
+  // Initialize services
   const authService = new AuthService(finalConfig);
+  const roleService = new RoleService();
+  const auditService = new AuditService();
+  const mfaService = new MFAService();
+  const passwordPolicy = new PasswordPolicy(finalConfig.passwordPolicy);
   const { rateLimiter, verifyToken, checkRole } = createAuthMiddleware(finalConfig);
 
   // Configure social login strategies
@@ -49,7 +67,6 @@ function auth(config = {}) {
     passport.use(new GoogleStrategy(finalConfig.social.google,
       async (accessToken, refreshToken, profile, done) => {
         try {
-          // Handle Google login
           const user = await authService.handleSocialLogin('google', profile);
           done(null, user);
         } catch (error) {
@@ -63,13 +80,40 @@ function auth(config = {}) {
     app.use(passport.initialize());
     app.use(rateLimiter);
 
-    // Register route
+    // Attach services to app
+    app.authService = authService;
+    app.roleService = roleService;
+    app.auditService = auditService;
+    app.mfaService = mfaService;
+    app.passwordPolicy = passwordPolicy;
+
+    // Register route with password policy
     app.post(finalConfig.routes.register, async (req, res) => {
       try {
+        const { isValid, errors } = passwordPolicy.validate(req.body.password, {
+          email: req.body.email,
+          name: req.body.name
+        });
+
+        if (!isValid) {
+          return res.status(400).json({
+            success: false,
+            errors
+          });
+        }
+
         const user = await authService.register(req.body);
+        await auditService.logActivity({
+          userId: user._id,
+          action: 'register',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'success'
+        });
+
         res.status(201).json({
           success: true,
-          message: 'Registration successful. Please verify your email.'
+          message: 'Registration successful'
         });
       } catch (error) {
         res.status(400).json({
@@ -79,7 +123,7 @@ function auth(config = {}) {
       }
     });
 
-    // Login route with device detection
+    // Login route with audit logging and MFA support
     app.post(finalConfig.routes.login, async (req, res) => {
       try {
         const deviceInfo = {
@@ -93,11 +137,27 @@ function auth(config = {}) {
           deviceInfo
         );
 
+        await auditService.logActivity({
+          userId: result.user?._id,
+          action: 'login',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'success'
+        });
+
         res.json({
           success: true,
           ...result
         });
       } catch (error) {
+        await auditService.logActivity({
+          action: 'login',
+          ipAddress: req.ip,
+          userAgent: req.headers['user-agent'],
+          status: 'failure',
+          details: { error: error.message }
+        });
+
         res.status(401).json({
           success: false,
           error: error.message
@@ -113,22 +173,12 @@ function auth(config = {}) {
           req.body.code
         );
 
-        res.json({
-          success: true,
-          ...result
+        await auditService.logActivity({
+          userId: result.user._id,
+          action: '2fa_verify',
+          status: 'success'
         });
-      } catch (error) {
-        res.status(401).json({
-          success: false,
-          error: error.message
-        });
-      }
-    });
 
-    // Refresh token
-    app.post(finalConfig.routes.refreshToken, async (req, res) => {
-      try {
-        const result = await authService.refreshToken(req.body.refreshToken);
         res.json({
           success: true,
           ...result
@@ -141,33 +191,11 @@ function auth(config = {}) {
       }
     });
 
-    // Forgot password
-    app.post(finalConfig.routes.forgotPassword, async (req, res) => {
-      try {
-        await authService.forgotPassword(req.body.email);
-        res.json({
-          success: true,
-          message: 'Password reset instructions sent to your email'
-        });
-      } catch (error) {
-        res.status(400).json({
-          success: false,
-          error: error.message
-        });
-      }
-    });
-
-    // Reset password
-    app.post(finalConfig.routes.resetPassword, async (req, res) => {
+    // Role management routes
+    app.post('/roles', verifyToken, checkRole(['admin']), async (req, res) => {
       try {
-        await authService.resetPassword(
-          req.body.token,
-          req.body.newPassword
-        );
-        res.json({
-          success: true,
-          message: 'Password reset successful'
-        });
+        const role = await roleService.createRole(req.body);
+        res.status(201).json({ success: true, role });
       } catch (error) {
         res.status(400).json({
           success: false,
@@ -176,10 +204,16 @@ function auth(config = {}) {
       }
     });
 
-    // Update profile (protected route)
+    // Update profile with audit logging
     app.put(finalConfig.routes.profile, verifyToken, async (req, res) => {
       try {
         const user = await authService.updateProfile(req.user.id, req.body);
+        await auditService.logActivity({
+          userId: user._id,
+          action: 'profile_update',
+          status: 'success'
+        });
+
         res.json({
           success: true,
           user
@@ -200,8 +234,15 @@ function auth(config = {}) {
 
       app.get('/auth/google/callback',
         passport.authenticate('google', { session: false }),
-        (req, res) => {
+        async (req, res) => {
           const { accessToken, refreshToken } = authService.generateTokens(req.user);
+          await auditService.logActivity({
+            userId: req.user._id,
+            action: 'social_login',
+            status: 'success',
+            details: { provider: 'google' }
+          });
+
           res.json({
             success: true,
             accessToken,
@@ -212,11 +253,12 @@ function auth(config = {}) {
       );
     }
 
-    // Admin-only route example
-    app.get('/admin', verifyToken, checkRole(['admin']), (req, res) => {
-      res.json({
-        success: true,
-        message: 'Admin access granted'
+    // Error handling middleware
+    app.use((err, req, res, next) => {
+      console.error(err.stack);
+      res.status(500).json({
+        success: false,
+        error: 'Internal Server Error'
       });
     });
   };