@dax-crafta/auth 1.3.7 → 2.0.0

package/src/services/auth.service.js

@@ -0,0 +1,320 @@
+const jwt = require('jsonwebtoken');
+const bcrypt = require('bcryptjs');
+const { authenticator } = require('otplib');
+const crypto = require('crypto');
+const User = require('../models/user');
+const EmailService = require('../utils/email');
+const { ApiError } = require('..'); // from index.js
+
+class AuthService {
+  constructor(config) {
+    this.config = config;
+    this.emailService = new EmailService(config);
+  }
+
+  /* ---------------------------------------------
+        REGISTER USER
+  --------------------------------------------- */
+  async register(userData) {
+    const user = new User({
+      ...userData,
+      customFields: this.extractCustomFields(userData)
+    });
+
+    const verificationToken = this.generateSecureToken();
+    user.verificationToken = verificationToken;
+
+    await user.save();
+
+    if (this.config.emailVerification) {
+      await this.emailService.sendVerificationEmail(user, verificationToken);
+    }
+
+    return user;
+  }
+
+  /* ---------------------------------------------
+        LOGIN USER (WITH ATOMIC LOCKOUT)
+  --------------------------------------------- */
+  async login(email, password, deviceInfo) {
+    const user = await User.findOne({ email });
+
+    if (!user) {
+      throw new ApiError('Invalid credentials', 401);
+    }
+
+    // If locked, do NOT allow login
+    if (user.isLocked()) {
+      throw new ApiError('Account locked. Try again later.', 403);
+    }
+
+    const isValid = await user.comparePassword(password);
+    if (!isValid) {
+      await this.incrementLoginAttempts(user);
+      throw new ApiError('Invalid credentials', 401);
+    }
+
+    // RESET LOCKOUT automatically on correct login
+    user.loginAttempts = 0;
+    user.lockUntil = undefined;
+    await user.save();
+
+    // If 2FA is enabled
+    if (user.twoFactorEnabled) {
+      const code = authenticator.generate(user.twoFactorSecret);
+      await this.emailService.send2FACode(user, code);
+      return { requires2FA: true, userId: user._id };
+    }
+
+    // Login alert
+    if (this.config.loginAlerts) {
+      await this.emailService.sendLoginAlert(user, deviceInfo);
+    }
+
+    const tokens = await this.generateTokens(user);
+    return { ...tokens, user };
+  }
+
+  /* ---------------------------------------------
+        VERIFY 2FA
+  --------------------------------------------- */
+  async verify2FA(userId, code) {
+    const user = await User.findById(userId).select('+twoFactorSecret');
+
+    if (!user) throw new ApiError('User not found', 404);
+    if (!user.twoFactorEnabled)
+      throw new ApiError('2FA is not enabled for this user', 400);
+
+    const ok = authenticator.verify({
+      token: code,
+      secret: user.twoFactorSecret
+    });
+
+    // fallback: backup codes
+    if (!ok) {
+      const backupOK = await user.verifyBackupCode(code, this.config.mfaService);
+      if (!backupOK) throw new ApiError('Invalid 2FA code', 401);
+    }
+
+
+    const tokens = await this.generateTokens(user);
+    return { ...tokens, user };
+  }
+
+  /* ---------------------------------------------
+        REFRESH TOKEN (SECURE)
+  --------------------------------------------- */
+  async refreshToken(refreshToken) {
+    // find only valid (non-expired) tokens
+    const user = await User.findByRefreshToken(refreshToken);
+
+    if (!user) throw new ApiError('Invalid or expired refresh token', 401);
+
+    // Refresh token rotation (best practice)
+    await user.revokeRefreshToken(refreshToken);
+
+    const tokens = await this.generateTokens(user);
+    await this.config.auditService.logActivity({
+      userId: user._id,
+      action: 'refresh_token',
+      status: 'success'
+    });
+    return { ...tokens, user };
+  }
+
+  /* ---------------------------------------------
+        FORGOT PASSWORD
+  --------------------------------------------- */
+  async forgotPassword(email) {
+    const user = await User.findOne({ email });
+
+    if (!user) {
+      // DO NOT reveal user existence
+      return;
+    }
+
+    const token = this.generateSecureToken();
+    user.passwordResetToken = token;
+    user.passwordResetExpires = Date.now() + 60 * 60 * 1000; // 1h
+
+    await user.save();
+    await this.emailService.sendPasswordResetEmail(user, token);
+
+    return true;
+  }
+
+  /* ---------------------------------------------
+        RESET PASSWORD
+  --------------------------------------------- */
+  async resetPassword(token, newPassword) {
+    const user = await User.findOne({
+      passwordResetToken: token,
+      passwordResetExpires: { $gt: Date.now() }
+    });
+
+    if (!user) throw new ApiError('Invalid or expired reset token', 400);
+
+    // check password history
+    const reused = await Promise.all(
+      (user.passwordHistory || []).map(async (old) =>
+        bcrypt.compare(newPassword, old.hash)
+      )
+    );
+
+    if (reused.includes(true)) {
+      throw new ApiError('Cannot reuse previous passwords', 400);
+    }
+
+    user.password = newPassword;
+
+    await user.recordPasswordHistory(); // 🔥 add
+    await user.revokeAllRefreshTokens(); // session invalidate
+    user.passwordResetToken = undefined;
+    user.passwordResetExpires = undefined;
+    await this.config.auditService.logActivity({
+      userId: user._id,
+      action: 'password_reset',
+      status: 'success'
+    });
+
+
+    await user.save();
+    return user;
+  }
+
+  /* ---------------------------------------------
+        GENERATE BACKUP CODES
+  --------------------------------------------- */
+  async generateBackupCodes(userId, mfaService) {
+    const user = await User.findById(userId);
+    if (!user) throw new ApiError("User not found", 404);
+
+    const codes = mfaService.generateBackupCodes();
+
+    await user.setBackupCodes(codes.map(c => ({ hash: c.hash })));
+
+    await this.config.auditService.logActivity({
+      userId,
+      action: 'backup_codes_generated',
+      status: 'success'
+    });
+
+    return codes.map(c => c.raw); // show only once
+  }
+
+
+
+  /* ---------------------------------------------
+        UPDATE PROFILE (SAFE)
+  --------------------------------------------- */
+  async updateProfile(userId, updates) {
+    const user = await User.findById(userId);
+    if (!user) throw new ApiError('User not found', 404);
+
+    await user.safeUpdate(updates);
+    await this.config.auditService.logActivity({
+      userId: user._id,
+      action: 'profile_update',
+      status: 'success'
+    });
+
+    return user;
+  }
+
+  /* ---------------------------------------------
+        GENERATE ACCESS + REFRESH TOKEN (ROTATION)
+  --------------------------------------------- */
+  async generateTokens(user) {
+    const accessToken = jwt.sign(
+      {
+        id: user._id,
+        email: user.email,
+        role: user.role
+      },
+      this.config.env.JWT_SECRET,
+      { expiresIn: this.config.accessTokenExpiry || '1h' }
+    );
+
+    const refreshToken = this.generateSecureToken();
+    const expiresAt =
+      Date.now() +
+      (this.config.refreshTokenDays || 7) * 24 * 60 * 60 * 1000;
+
+    await user.addRefreshToken(refreshToken, expiresAt);
+
+    // prune expired refresh tokens in background
+    await user.pruneExpiredRefreshTokens();
+
+    return { accessToken, refreshToken };
+  }
+
+  /* ---------------------------------------------
+        SECURE RANDOM TOKEN
+  --------------------------------------------- */
+  generateSecureToken() {
+    return crypto.randomBytes(32).toString('hex');
+  }
+
+  /* ---------------------------------------------
+        ATOMIC LOGIN ATTEMPT INCREMENT
+  --------------------------------------------- */
+  async incrementLoginAttempts(user) {
+    const MAX = this.config.maxLoginAttempts || 5;
+    const now = Date.now();
+    const lockUntil = now + 60 * 60 * 1000;
+
+    user.loginAttempts = (user.loginAttempts || 0) + 1;
+
+    if (user.loginAttempts >= MAX) {
+      user.lockUntil = lockUntil;
+      await user.save();
+      await this.emailService.sendAccountLockEmail(user);
+      await this.config.auditService.logActivity({
+        userId: user._id,
+        action: 'account_locked',
+        status: 'success'
+      });
+      return;
+    }
+
+    await user.save();
+  }
+
+  /* ---------------------------------------------
+        LOGOUT
+  --------------------------------------------- */
+  async logout(userId, sessionId) {
+    const user = await User.findById(userId);
+    if (!user) throw new ApiError("User not found", 404);
+
+    await user.revokeSession(sessionId);
+
+    await this.config.auditService.logActivity({
+      userId,
+      action: 'logout',
+      status: 'success'
+    });
+
+    return true;
+  }
+
+
+
+  /* ---------------------------------------------
+        CUSTOM FIELD EXTRACTION
+  --------------------------------------------- */
+  extractCustomFields(data) {
+    const reserved = ['email', 'password', 'role'];
+    const fields = {};
+
+    for (const key of Object.keys(data)) {
+      if (!reserved.includes(key)) {
+        fields[key] = data[key];
+      }
+    }
+
+    return fields;
+  }
+}
+
+module.exports = AuthService;

package/src/utils/email.js

@@ -1,50 +1,126 @@
+// packages/auth/src/utils/email.js
 const nodemailer = require('nodemailer');
+const fs = require('fs');
+const path = require('path');
 
 class EmailService {
   constructor(config) {
+    this.config = config;
     this.transporter = nodemailer.createTransport(config.smtp);
     this.from = config.smtp.from;
+    this.templateDir = config.emailTemplateDir || path.join(process.cwd(), "templates/email");
+  }
+
+  // Reusable sender
+  async send({ to, subject, html, text }) {
+    try {
+      await this.transporter.sendMail({
+        from: this.from,
+        to,
+        subject,
+        html,
+        text: text || html.replace(/<[^>]+>/g, '')
+      });
+    } catch (err) {
+      console.error("Email send error:", err);
+    }
+  }
+
+  // Load an HTML template safely
+  loadTemplate(name, variables = {}) {
+    const filePath = path.join(this.templateDir, `${name}.html`);
+    if (!fs.existsSync(filePath)) return null;
+
+    let content = fs.readFileSync(filePath, "utf8");
+
+    // Replace {{variable}}
+    for (const key of Object.keys(variables)) {
+      content = content.replace(new RegExp(`{{${key}}}`, "g"), variables[key]);
+    }
+
+    return content;
   }
 
   async sendVerificationEmail(user, token) {
-    const verificationUrl = `${this.config.baseUrl}/verify-email?token=${token}`;
-    
-    await this.transporter.sendMail({
-      from: this.from,
+    const url = `${this.config.baseUrl}/verify-email?token=${token}`;
+
+    const html = this.loadTemplate("email-verification", {
+      name: user.name || user.email,
+      url
+    }) || `Click to verify your email: <a href="${url}">${url}</a>`;
+
+    return this.send({
       to: user.email,
-      subject: 'Verify Your Email',
-      html: `Click here to verify your email: <a href="${verificationUrl}">${verificationUrl}</a>`
+      subject: "Verify Your Email",
+      html,
+      text: `Verify your email: ${url}`
     });
   }
 
   async sendPasswordResetEmail(user, token) {
-    const resetUrl = `${this.config.baseUrl}/reset-password?token=${token}`;
-    
-    await this.transporter.sendMail({
-      from: this.from,
+    const url = `${this.config.baseUrl}/reset-password?token=${token}`;
+
+    const html = this.loadTemplate("password-reset", {
+      name: user.name || user.email,
+      url
+    }) || `Reset password: <a href="${url}">${url}</a>`;
+
+    return this.send({
       to: user.email,
-      subject: 'Reset Your Password',
-      html: `Click here to reset your password: <a href="${resetUrl}">${resetUrl}</a>`
+      subject: "Reset Your Password",
+      html,
+      text: `Reset your password: ${url}`
     });
   }
 
-  async sendLoginAlert(user, deviceInfo) {
-    await this.transporter.sendMail({
-      from: this.from,
+  async sendLoginAlert(user, info) {
+    const html = this.loadTemplate("login-alert", {
+      name: user.name || user.email,
+      ip: info.ip,
+      agent: info.userAgent
+    }) || `
+      New login detected.<br>
+      IP: ${info.ip}<br>
+      User Agent: ${info.userAgent}
+    `;
+
+    return this.send({
       to: user.email,
-      subject: 'New Login Detected',
-      html: `New login detected from ${deviceInfo.browser} on ${deviceInfo.os}`
+      subject: "New Login Detected",
+      html,
+      text: `New login from IP ${info.ip}`
     });
   }
 
   async send2FACode(user, code) {
-    await this.transporter.sendMail({
-      from: this.from,
+    const html = this.loadTemplate("twofa-code", {
+      name: user.name || user.email,
+      code
+    }) || `Your 2FA code: <b>${code}</b>`;
+
+    return this.send({
+      to: user.email,
+      subject: "Your 2FA Code",
+      html,
+      text: `Your 2FA code is: ${code}`
+    });
+  }
+
+  async sendAccountLockEmail(user) {
+    const html = this.loadTemplate("account-locked", {
+      name: user.name || user.email
+    }) || `
+      Your account has been locked due to too many failed login attempts.<br>
+      Try again after 1 hour.
+    `;
+
+    return this.send({
       to: user.email,
-      subject: '2FA Code',
-      html: `Your 2FA code is: ${code}`
+      subject: "Your Account Has Been Locked",
+      html,
+      text: "Your account is locked for 1 hour due to failed login attempts."
     });
   }
 }
 
-module.exports = EmailService;
+module.exports = EmailService;

package/src/utils/mfa.js

@@ -1,10 +1,12 @@
+// packages/auth/src/utils/mfa.js
 const speakeasy = require('speakeasy');
 const qrcode = require('qrcode');
+const crypto = require('crypto');
 
 class MFAService {
   async generateSecret(label, issuer = 'App') {
     const secret = speakeasy.generateSecret({
-      length: 20,
+      length: 32,
       name: label,
       issuer
     });
@@ -26,13 +28,25 @@ class MFAService {
     });
   }
 
+  // Generate hashed backup codes (safer)
   generateBackupCodes() {
     const codes = [];
     for (let i = 0; i < 10; i++) {
-      codes.push(speakeasy.generateSecret({ length: 10 }).base32);
+      const raw = crypto.randomBytes(10).toString('hex');
+      const hash = crypto.createHash('sha256').update(raw).digest('hex');
+
+      codes.push({
+        raw,       // show raw one time only
+        hash       // stored version
+      });
     }
     return codes;
   }
+
+  verifyBackupCode(rawCode, storedCodes = []) {
+    const rawHash = crypto.createHash('sha256').update(rawCode).digest('hex');
+    return storedCodes.find(c => c.hash === rawHash);
+  }
 }
 
-module.exports = MFAService;
+module.exports = MFAService;

package/src/utils/password-policy.js

@@ -1,3 +1,4 @@
+// packages/auth/src/utils/password-policy.js
 const zxcvbn = require('zxcvbn');
 
 class PasswordPolicy {
@@ -8,7 +9,7 @@ class PasswordPolicy {
       requireLowercase: config.requireLowercase !== false,
       requireNumbers: config.requireNumbers !== false,
       requireSpecialChars: config.requireSpecialChars !== false,
-      passwordHistory: config.passwordHistory || 3,
+      passwordHistory: config.passwordHistory || 5,
       expiryDays: config.expiryDays || 90,
       minStrength: config.minStrength || 3
     };
@@ -17,30 +18,24 @@ class PasswordPolicy {
   validate(password, userInfo = {}) {
     const errors = [];
 
-    if (password.length < this.config.minLength) {
+    if (password.length < this.config.minLength)
       errors.push(`Password must be at least ${this.config.minLength} characters long`);
-    }
 
-    if (this.config.requireUppercase && !/[A-Z]/.test(password)) {
+    if (this.config.requireUppercase && !/[A-Z]/.test(password))
       errors.push('Password must contain at least one uppercase letter');
-    }
 
-    if (this.config.requireLowercase && !/[a-z]/.test(password)) {
+    if (this.config.requireLowercase && !/[a-z]/.test(password))
       errors.push('Password must contain at least one lowercase letter');
-    }
 
-    if (this.config.requireNumbers && !/\d/.test(password)) {
+    if (this.config.requireNumbers && !/\d/.test(password))
       errors.push('Password must contain at least one number');
-    }
 
-    if (this.config.requireSpecialChars && !/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
+    if (this.config.requireSpecialChars && !/[!@#$%^&*(),.?":{}|<>]/.test(password))
       errors.push('Password must contain at least one special character');
-    }
 
     const strength = zxcvbn(password, [userInfo.email, userInfo.name]);
-    if (strength.score < this.config.minStrength) {
+    if (strength.score < this.config.minStrength)
       errors.push('Password is too weak. Please choose a stronger password');
-    }
 
     return {
       isValid: errors.length === 0,
@@ -49,12 +44,21 @@ class PasswordPolicy {
     };
   }
 
-  isExpired(lastPasswordChange) {
+  // History check moved to Model & AuthService
+  allowsReuse(password, passwordHistory, bcrypt) {
+    return Promise.all(
+      passwordHistory.map(old => bcrypt.compare(password, old.hash))
+    ).then(matches => !matches.includes(true));
+  }
+
+  isExpired(lastChange) {
     if (!this.config.expiryDays) return false;
-    
-    const expiryDate = new Date(lastPasswordChange.getTime() + this.config.expiryDays * 24 * 60 * 60 * 1000);
+
+    const expiryDate =
+      new Date(lastChange.getTime() + this.config.expiryDays * 24 * 60 * 60 * 1000);
+
     return expiryDate < new Date();
   }
 }
 
-module.exports = PasswordPolicy;
+module.exports = PasswordPolicy;