@dax-crafta/auth 1.3.7 → 2.0.0

package/src/middlewares/validation.middleware.js

@@ -0,0 +1,77 @@
+// packages/auth/src/middlewares/validation.middleware.js
+const { body, param, validationResult } = require('express-validator');
+
+// validators
+const registerValidator = [
+  body('email').isEmail().withMessage('Valid email is required'),
+  body('password')
+    .isLength({ min: 8 }).withMessage('Password must be at least 8 characters')
+    .matches(/[A-Z]/).withMessage('Password must contain an uppercase letter')
+    .matches(/\d/).withMessage('Password must contain a number')
+    .matches(/[^A-Za-z0-9]/).withMessage('Password must contain a special character'),
+  body('name').optional().isString().trim().isLength({ min: 2 }).withMessage('Name too short')
+];
+
+const loginValidator = [
+  body('email').isEmail().withMessage('Valid email is required'),
+  body('password').exists().withMessage('Password is required')
+];
+
+const forgotPasswordValidator = [
+  body('email').isEmail().withMessage('Valid email is required')
+];
+
+const resetPasswordValidator = [
+  body('token').exists().withMessage('Reset token required'),
+  body('newPassword')
+    .isLength({ min: 8 }).withMessage('Password must be at least 8 characters')
+    .matches(/[A-Z]/).withMessage('Password must contain an uppercase letter')
+    .matches(/\d/).withMessage('Password must contain a number')
+    .matches(/[^A-Za-z0-9]/).withMessage('Password must contain a special character')
+];
+
+const twoFAValidator = [
+  body('userId').exists().withMessage('userId required'),
+  body('code').isLength({ min: 4 }).withMessage('Invalid 2FA code')
+];
+
+const refreshTokenValidator = [
+  body('refreshToken').exists().withMessage('refreshToken required')
+];
+
+const profileUpdateValidator = [
+  body().custom((value, { req }) => {
+    // prevent sensitive fields in payload
+    const forbidden = ['password', 'role', 'refreshTokens', 'isVerified', 'verificationToken', 'twoFactorSecret', '_id'];
+    for (const f of forbidden) {
+      if (req.body.hasOwnProperty(f)) {
+        throw new Error(`Cannot update field: ${f}`);
+      }
+    }
+    return true;
+  })
+];
+
+// handler to send friendly validation errors
+const handleValidation = (req, res, next) => {
+  const errors = validationResult(req);
+  if (errors.isEmpty()) return next();
+
+  const payload = errors.array().map(e => ({ field: e.param, msg: e.msg }));
+  return res.status(400).json({
+    success: false,
+    error: 'Invalid request data',
+    details: payload
+  });
+};
+
+module.exports = {
+  registerValidator,
+  loginValidator,
+  forgotPasswordValidator,
+  resetPasswordValidator,
+  twoFAValidator,
+  refreshTokenValidator,
+  profileUpdateValidator,
+  handleValidation
+};

package/src/models/audit-log.js

@@ -1,19 +1,20 @@
+// packages/auth/src/models/auditLog.js
 const mongoose = require('mongoose');
 
 const auditLogSchema = new mongoose.Schema({
   userId: {
     type: mongoose.Schema.Types.ObjectId,
     ref: 'User',
-    required: true
+    required: false // allow anonymous actions (e.g., failed login by unknown user)
   },
   action: {
     type: String,
     required: true,
-    enum: ['login', 'logout', 'password_change', 'profile_update', 'role_change', '2fa_enabled', '2fa_disabled']
+    enum: ['login', 'logout', 'password_change', 'profile_update', 'role_change', '2fa_enabled', '2fa_disabled', 'register', 'password_reset_request', 'password_reset']
   },
-  ipAddress: String,
-  userAgent: String,
-  details: mongoose.Schema.Types.Mixed,
+  ipAddress: { type: String, default: '' },
+  userAgent: { type: String, default: '' },
+  details: { type: mongoose.Schema.Types.Mixed, default: {} },
   status: {
     type: String,
     enum: ['success', 'failure'],
@@ -21,8 +22,13 @@ const auditLogSchema = new mongoose.Schema({
   },
   timestamp: {
     type: Date,
-    default: Date.now
+    default: Date.now,
+    index: true
   }
-});
+}, { timestamps: false });
+
+// Index for querying recent logs quickly
+auditLogSchema.index({ timestamp: -1 });
+auditLogSchema.index({ userId: 1, timestamp: -1 });
 
-module.exports = mongoose.model('AuditLog', auditLogSchema);
+module.exports = mongoose.model('AuditLog', auditLogSchema);

package/src/models/role.js

@@ -1,33 +1,35 @@
+// packages/auth/src/models/role.js
 const mongoose = require('mongoose');
 
-const roleSchema = new mongoose.Schema({
-  name: {
+const permissionSchema = new mongoose.Schema({
+  resource: { type: String, required: true },
+  actions: [{
     type: String,
-    required: true,
-    unique: true
-  },
-  permissions: [{
-    resource: String,
-    actions: [{
-      type: String,
-      enum: ['create', 'read', 'update', 'delete', 'manage']
-    }]
-  }],
-  description: String,
-  isSystem: {
-    type: Boolean,
-    default: false
-  },
-  createdAt: {
-    type: Date,
-    default: Date.now
-  },
-  updatedAt: Date
-});
+    enum: ['create', 'read', 'update', 'delete', 'manage'],
+    required: true
+  }]
+}, { _id: false });
+
+const roleSchema = new mongoose.Schema({
+  name: { type: String, required: true, unique: true, trim: true },
+  permissions: { type: [permissionSchema], default: [] },
+  description: { type: String, default: '' },
+  isSystem: { type: Boolean, default: false }
+}, { timestamps: true });
+
+// Ensure case-insensitive uniqueness for name at application level
+roleSchema.index({ name: 1 }, { unique: true });
 
-roleSchema.pre('save', function(next) {
-  this.updatedAt = new Date();
-  next();
-});
+/**
+ * Utility: check if role allows an action on a resource
+ * resource can be string or wildcard
+ */
+roleSchema.methods.can = function(resource, action) {
+  if (!this.permissions || !Array.isArray(this.permissions)) return false;
+  return this.permissions.some(p => {
+    const resourceMatches = (p.resource === resource) || (p.resource === '*');
+    return resourceMatches && p.actions && p.actions.includes(action);
+  });
+};
 
-module.exports = mongoose.model('Role', roleSchema);
+module.exports = mongoose.model('Role', roleSchema);

package/src/models/user.js

@@ -1,59 +1,195 @@
+// packages/auth/src/models/user.js
 const mongoose = require('mongoose');
 const bcrypt = require('bcryptjs');
+const validator = require('validator');
+const crypto = require('crypto');
+
+
+const SALT_ROUNDS = Number(process.env.SALT_ROUNDS) || 12;
+
+const refreshTokenSchema = new mongoose.Schema({
+  token: { type: String, required: true },
+  expires: { type: Date, required: true },
+  createdAt: { type: Date, default: Date.now }
+}, { _id: false });
 
 const userSchema = new mongoose.Schema({
   email: {
     type: String,
     required: true,
     unique: true,
-    lowercase: true
+    lowercase: true,
+    trim: true,
+    validate: {
+      validator: (v) => validator.isEmail(v),
+      message: props => `${props.value} is not a valid email`
+    }
   },
   password: {
     type: String,
-    required: true
+    required: true,
+    minlength: 8
   },
+  passwordHistory: [{
+    hash: String,
+    changedAt: Date
+  }],
   role: {
     type: String,
     enum: ['user', 'admin', 'moderator'],
     default: 'user'
   },
-  isVerified: {
-    type: Boolean,
-    default: false
-  },
-  verificationToken: String,
-  passwordResetToken: String,
-  passwordResetExpires: Date,
-  loginAttempts: {
-    type: Number,
-    default: 0
-  },
-  lockUntil: Date,
-  twoFactorSecret: String,
-  twoFactorEnabled: {
-    type: Boolean,
-    default: false
-  },
-  refreshTokens: [{
-    token: String,
-    expires: Date
+  backupCodes: [{
+    hash: String,
+    used: { type: Boolean, default: false }
   }],
-  customFields: mongoose.Schema.Types.Mixed
+  sessions: [{
+    sessionId: String,
+    userAgent: String,
+    ip: String,
+    createdAt: { type: Date, default: Date.now }
+  }],
+  isVerified: { type: Boolean, default: false },
+  verificationToken: { type: String, select: false },
+  passwordResetToken: { type: String, select: false },
+  passwordResetExpires: { type: Date, select: false },
+  loginAttempts: { type: Number, default: 0 },
+  lockUntil: { type: Date, select: false },
+  twoFactorSecret: { type: String, select: false },
+  twoFactorEnabled: { type: Boolean, default: false },
+  refreshTokens: { type: [refreshTokenSchema], default: [] },
+  customFields: { type: mongoose.Schema.Types.Mixed }
 }, { timestamps: true });
 
-userSchema.pre('save', async function(next) {
-  if (this.isModified('password')) {
-    this.password = await bcrypt.hash(this.password, 10);
+// Indexes
+userSchema.index({ email: 1 }, { unique: true });
+userSchema.index({ 'refreshTokens.expires': 1 }); // helps queries that prune expired refresh tokens
+userSchema.index({ lockUntil: 1 });
+
+// Pre-save: hash password if modified
+userSchema.pre('save', async function (next) {
+  try {
+    if (this.isModified('password')) {
+      const salt = await bcrypt.genSalt(SALT_ROUNDS);
+      this.password = await bcrypt.hash(this.password, salt);
+    }
+    // ensure email normalized
+    if (this.isModified('email') && this.email) {
+      this.email = this.email.toLowerCase().trim();
+    }
+    next();
+  } catch (err) {
+    next(err);
   }
-  next();
 });
 
-userSchema.methods.comparePassword = async function(password) {
-  return bcrypt.compare(password, this.password);
+// Instance methods
+userSchema.methods.comparePassword = async function (candidate) {
+  if (!this.password) return false;
+  return bcrypt.compare(candidate, this.password);
+};
+
+userSchema.methods.recordPasswordHistory = async function () {
+  this.passwordHistory = this.passwordHistory || [];
+  this.passwordHistory.push({
+    hash: this.password,
+    changedAt: new Date()
+  });
+
+  // Keep last 5 only
+  if (this.passwordHistory.length > 5) {
+    this.passwordHistory.shift();
+  }
+
+  await this.save();
+};
+
+userSchema.methods.setBackupCodes = async function (codes) {
+  this.backupCodes = codes.map(c => ({
+    hash: c.hash,
+    used: false
+  }));
+  await this.save();
+};
+
+
+userSchema.methods.isLocked = function () {
+  return !!(this.lockUntil && this.lockUntil > Date.now());
+};
+
+// Add a refresh token (returns the token object)
+userSchema.methods.addRefreshToken = async function (tokenString, expiresAt) {
+  this.refreshTokens = this.refreshTokens || [];
+  this.refreshTokens.push({
+    token: tokenString,
+    expires: expiresAt
+  });
+  await this.save();
+  return tokenString;
+};
+
+// Revoke a specific refresh token (by token string)
+userSchema.methods.revokeRefreshToken = async function (tokenString) {
+  this.refreshTokens = (this.refreshTokens || []).filter(t => t.token !== tokenString);
+  await this.save();
 };
 
-userSchema.methods.isLocked = function() {
-  return this.lockUntil && this.lockUntil > Date.now();
+// Revoke all refresh tokens (e.g., on password reset)
+userSchema.methods.revokeAllRefreshTokens = async function () {
+  this.refreshTokens = [];
+  await this.save();
+};
+
+// Remove expired refresh tokens (useful to call periodically or on sensitive flows)
+userSchema.methods.pruneExpiredRefreshTokens = async function () {
+  const now = Date.now();
+  // Use $pull to let DB do the work, avoids race conditions
+  await this.model('User').updateOne(
+    { _id: this._id },
+    { $pull: { refreshTokens: { expires: { $lte: now } } } }
+  );
+};
+
+// Safe update: apply only allowed fields and save
+userSchema.methods.safeUpdate = async function (updates = {}) {
+  const forbidden = ['password', 'role', 'refreshTokens', 'isVerified', 'verificationToken', '_id', 'twoFactorSecret'];
+  forbidden.forEach(f => delete updates[f]);
+  Object.assign(this, updates);
+  await this.save();
+  return this;
+};
+
+//
+userSchema.methods.addSession = async function (info) {
+  this.sessions.push({
+    sessionId: crypto.randomBytes(16).toString('hex'),
+    userAgent: info.userAgent,
+    ip: info.ip
+  });
+  await this.save();
+};
+
+userSchema.methods.revokeSession = async function (sessionId) {
+  this.sessions = this.sessions.filter(s => s.sessionId !== sessionId);
+  await this.save();
+};
+
+userSchema.methods.revokeAllSessions = async function () {
+  this.sessions = [];
+  await this.save();
+};
+
+
+
+// Static helper: find user by refresh token and prune expired ones while returning valid user
+userSchema.statics.findByRefreshToken = async function (tokenString) {
+  // first prune expired tokens across users (optional heavy op, but targeted query below helps)
+  // Then find user that still has this token and which is not expired
+  const now = Date.now();
+  return this.findOne({
+    'refreshTokens.token': tokenString,
+    'refreshTokens.expires': { $gt: now }
+  }).exec();
 };
 
-module.exports = mongoose.model('User', userSchema);
+module.exports = mongoose.model('User', userSchema);