@dax-crafta/auth 1.3.7 → 2.0.1

package/README.md

@@ -3,7 +3,7 @@
 A powerful, flexible, and secure authentication system for Node.js applications. Built with enterprise-grade security features while maintaining developer-friendly simplicity.
 
 [![npm version](https://img.shields.io/npm/v/@dax-crafta/auth.svg)](https://www.npmjs.com/package/@dax-crafta/auth)
-[![License](https://img.shields.io/npm/l/@dax-crafta/auth.svg)](https://github.com/daxp472/crafta/auth/blob/main/LICENSE)
+[![License](https://img.shields.io/npm/l/@dax-crafta/auth.svg)](https://github.com/daxp472/crafta/blob/main/LICENSE)
 
 ## Features
 

package/package.json

@@ -1,13 +1,17 @@
 {
   "name": "@dax-crafta/auth",
-  "version": "1.3.7",
+  "version": "2.0.1",
   "description": "A powerful, flexible, and secure authentication plugin for the Crafta framework. Supports JWT, social login, 2FA, RBAC, audit logging, and enterprise-grade security features.",
   "main": "src/index.js",
   "private": false,
   "dependencies": {
     "bcryptjs": "^2.4.3",
+    "cookie-parser": "^1.4.7",
+    "csurf": "^1.11.0",
+    "express-brute": "^1.0.1",
     "express-rate-limit": "^7.1.4",
     "google-auth-library": "^9.2.0",
+    "helmet": "^8.1.0",
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^7.6.3",
     "nodemailer": "^6.9.7",
@@ -16,12 +20,11 @@
     "passport-facebook": "^3.0.0",
     "passport-github2": "^0.1.12",
     "passport-google-oauth20": "^2.0.0",
+    "qrcode": "^1.5.3",
+    "speakeasy": "^2.0.0",
     "validator": "^13.11.0",
-    "zxcvbn": "^4.4.2",
     "winston": "^3.11.0",
-    "express-brute": "^1.0.1",
-    "qrcode": "^1.5.3",
-    "speakeasy": "^2.0.0"
+    "zxcvbn": "^4.4.2"
   },
   "peerDependencies": {
     "crafta": "^1.1.4"

package/src/index.js

@@ -1,13 +1,18 @@
+const express = require('express');
 const passport = require('passport');
+const cookieParser = require('cookie-parser');
+const csrf = require('csurf');
+const helmet = require("helmet");
+
 const GoogleStrategy = require('passport-google-oauth20').Strategy;
-const FacebookStrategy = require('passport-facebook').Strategy;
-const GitHubStrategy = require('passport-github2').Strategy;
 const AuthService = require('./services/auth.service');
 const RoleService = require('./services/role.service');
 const AuditService = require('./services/audit.service');
 const MFAService = require('./utils/mfa');
 const PasswordPolicy = require('./utils/password-policy');
 const createAuthMiddleware = require('./middlewares/auth.middleware');
+const validators = require('./middlewares/validation.middleware');
+
 
 const defaultConfig = {
   strategy: 'jwt',
@@ -40,12 +45,26 @@ const defaultConfig = {
     google: null,
     facebook: null,
     github: null
-  }
+  },
+  env: {
+    JWT_SECRET: process.env.JWT_SECRET
+  },
+  accessTokenExpiry: '1h',
+  refreshTokenDays: 7
 };
 
+// minimal ApiError re-export if needed
+class ApiError extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+
 function auth(config = {}) {
   const finalConfig = { ...defaultConfig, ...config };
-  
+  finalConfig.env = { ...(defaultConfig.env || {}), ...(config.env || process.env) };
+
   if (!finalConfig.env?.JWT_SECRET) {
     throw new Error('JWT_SECRET is required in environment configuration');
   }
@@ -54,214 +73,252 @@ function auth(config = {}) {
     throw new Error('SMTP configuration is required for email verification');
   }
 
-  // Initialize services
   const authService = new AuthService(finalConfig);
   const roleService = new RoleService();
   const auditService = new AuditService();
   const mfaService = new MFAService();
   const passwordPolicy = new PasswordPolicy(finalConfig.passwordPolicy);
-  const { rateLimiter, verifyToken, checkRole } = createAuthMiddleware(finalConfig);
+  const { rateLimiter, limiterFor, verifyToken, checkRole, checkOwnershipOrAdmin } = createAuthMiddleware(finalConfig);
 
-  // Configure social login strategies
-  if (finalConfig.social.google) {
+  // setup passport strategies as earlier if provided...
+  if (finalConfig.social && finalConfig.social.google) {
     passport.use(new GoogleStrategy(finalConfig.social.google,
       async (accessToken, refreshToken, profile, done) => {
         try {
           const user = await authService.handleSocialLogin('google', profile);
           done(null, user);
-        } catch (error) {
-          done(error);
+        } catch (err) {
+          done(err);
         }
       }
     ));
   }
 
-  return function(app) {
+  return function (app) {
+    app.use(cookieParser());
+    // CSRF: enable only if config.enableCSRF === true
+    if (finalConfig.enableCSRF) {
+      // use cookie-based CSRF token and expect header 'x-csrf-token' or cookie
+      const csrfProtection = csrf({ cookie: true });
+      app.use(csrfProtection);
+
+      // expose token endpoint to clients (they must fetch this and send it back on state-changing requests)
+      app.get('/csrf-token', (req, res) => {
+        res.json({ csrfToken: req.csrfToken() });
+      });
+    }
+
     app.use(passport.initialize());
     app.use(rateLimiter);
+    app.use(helmet({
+      contentSecurityPolicy: false, // optional to ease frontend dev
+      crossOriginEmbedderPolicy: false,
+    }));
 
-    // Attach services to app
+
+    // attach services
     app.authService = authService;
     app.roleService = roleService;
     app.auditService = auditService;
     app.mfaService = mfaService;
     app.passwordPolicy = passwordPolicy;
 
-    // Register route with password policy
-    app.post(finalConfig.routes.register, async (req, res) => {
-      try {
-        const { isValid, errors } = passwordPolicy.validate(req.body.password, {
-          email: req.body.email,
-          name: req.body.name
-        });
+    // register
+    app.post(
+      finalConfig.routes.register,
+      limiterFor('register'),
+      validators.registerValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          const { isValid, errors } = passwordPolicy.validate(req.body.password, {
+            email: req.body.email,
+            name: req.body.name
+          });
+
+          if (!isValid) {
+            return res.status(400).json({ success: false, error: 'Password policy violation', details: errors });
+          }
 
-        if (!isValid) {
-          return res.status(400).json({
-            success: false,
-            errors
+          const user = await authService.register(req.body);
+          await auditService.logActivity({
+            userId: user._id,
+            action: 'register',
+            ipAddress: req.ip,
+            userAgent: req.headers['user-agent'],
+            status: 'success'
           });
+
+          res.status(201).json({ success: true, message: 'Registration successful' });
+        } catch (err) {
+          next(err);
         }
+      }
+    );
 
-        const user = await authService.register(req.body);
-        await auditService.logActivity({
-          userId: user._id,
-          action: 'register',
-          ipAddress: req.ip,
-          userAgent: req.headers['user-agent'],
-          status: 'success'
-        });
+    // login
+    app.post(
+      finalConfig.routes.login,
+      limiterFor('login'),
+      validators.loginValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          const deviceInfo = { browser: req.headers['user-agent'], ip: req.ip };
+          const result = await authService.login(req.body.email, req.body.password, deviceInfo);
 
-        res.status(201).json({
-          success: true,
-          message: 'Registration successful'
-        });
-      } catch (error) {
-        res.status(400).json({
-          success: false,
-          error: error.message
-        });
+          await auditService.logActivity({
+            userId: result.user?._id,
+            action: 'login',
+            ipAddress: req.ip,
+            userAgent: req.headers['user-agent'],
+            status: 'success'
+          });
+
+          res.json({ success: true, ...result });
+        } catch (err) {
+          await auditService.logActivity({
+            action: 'login',
+            ipAddress: req.ip,
+            userAgent: req.headers['user-agent'],
+            status: 'failure',
+            details: { error: err.message }
+          });
+          next(err);
+        }
       }
-    });
+    );
 
-    // Login route with audit logging and MFA support
-    app.post(finalConfig.routes.login, async (req, res) => {
-      try {
-        const deviceInfo = {
-          browser: req.headers['user-agent'],
-          ip: req.ip
-        };
-
-        const result = await authService.login(
-          req.body.email,
-          req.body.password,
-          deviceInfo
-        );
-
-        await auditService.logActivity({
-          userId: result.user?._id,
-          action: 'login',
-          ipAddress: req.ip,
-          userAgent: req.headers['user-agent'],
-          status: 'success'
-        });
+    // 2FA verification (rate-limited)
+    app.post(
+      finalConfig.routes.twoFactor,
+      limiterFor('2fa'),
+      validators.twoFAValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          const result = await authService.verify2FA(req.body.userId, req.body.code);
+          await auditService.logActivity({ userId: result.user._id, action: '2fa_verify', status: 'success' });
+          res.json({ success: true, ...result });
+        } catch (err) {
+          next(err);
+        }
+      }
+    );
 
-        res.json({
-          success: true,
-          ...result
-        });
-      } catch (error) {
-        await auditService.logActivity({
-          action: 'login',
-          ipAddress: req.ip,
-          userAgent: req.headers['user-agent'],
-          status: 'failure',
-          details: { error: error.message }
-        });
+    // forgot password (rate-limited)
+    app.post(
+      finalConfig.routes.forgotPassword,
+      limiterFor('forgotPassword'),
+      validators.forgotPasswordValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          await authService.forgotPassword(req.body.email);
+          res.json({ success: true, message: 'Password reset email sent if user exists' });
+        } catch (err) {
+          next(err);
+        }
+      }
+    );
 
-        res.status(401).json({
-          success: false,
-          error: error.message
-        });
+    // reset password
+    app.post(
+      finalConfig.routes.resetPassword,
+      validators.resetPasswordValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          await authService.resetPassword(req.body.token, req.body.newPassword);
+          await auditService.logActivity({ action: 'password_reset', status: 'success' });
+          res.json({ success: true, message: 'Password reset successful' });
+        } catch (err) {
+          next(err);
+        }
       }
-    });
+    );
 
-    // 2FA verification
-    app.post(finalConfig.routes.twoFactor, async (req, res) => {
-      try {
-        const result = await authService.verify2FA(
-          req.body.userId,
-          req.body.code
-        );
-
-        await auditService.logActivity({
-          userId: result.user._id,
-          action: '2fa_verify',
-          status: 'success'
-        });
+    // refresh token
+    app.post(
+      finalConfig.routes.refreshToken,
+      validators.refreshTokenValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          const result = await authService.refreshToken(req.body.refreshToken);
+          res.json({ success: true, ...result });
+        } catch (err) {
+          next(err);
+        }
+      }
+    );
 
-        res.json({
-          success: true,
-          ...result
-        });
-      } catch (error) {
-        res.status(401).json({
-          success: false,
-          error: error.message
-        });
+    // update profile (prevent IDOR: only owner or admin)
+    app.put(
+      finalConfig.routes.profile,
+      verifyToken,
+      checkOwnershipOrAdmin((req) => req.user.id), // target is the calling user; if you allow admin to pass an id param, adapt accordingly
+      validators.profileUpdateValidator,
+      validators.handleValidation,
+      async (req, res, next) => {
+        try {
+          const user = await authService.updateProfile(req.user.id, req.body);
+          await auditService.logActivity({ userId: user._id, action: 'profile_update', status: 'success' });
+          res.json({ success: true, user });
+        } catch (err) {
+          next(err);
+        }
       }
-    });
+    );
 
-    // Role management routes
-    app.post('/roles', verifyToken, checkRole(['admin']), async (req, res) => {
+    // roles (admin only)
+    app.post('/roles', verifyToken, checkRole(['admin']), async (req, res, next) => {
       try {
         const role = await roleService.createRole(req.body);
         res.status(201).json({ success: true, role });
-      } catch (error) {
-        res.status(400).json({
-          success: false,
-          error: error.message
-        });
-      }
-    });
-
-    // Update profile with audit logging
-    app.put(finalConfig.routes.profile, verifyToken, async (req, res) => {
-      try {
-        const user = await authService.updateProfile(req.user.id, req.body);
-        await auditService.logActivity({
-          userId: user._id,
-          action: 'profile_update',
-          status: 'success'
-        });
-
-        res.json({
-          success: true,
-          user
-        });
-      } catch (error) {
-        res.status(400).json({
-          success: false,
-          error: error.message
-        });
+      } catch (err) {
+        next(err);
       }
     });
 
-    // Social login routes
-    if (finalConfig.social.google) {
-      app.get('/auth/google',
-        passport.authenticate('google', { scope: ['profile', 'email'] })
-      );
+    // social google callback example (kept same)
+    if (finalConfig.social && finalConfig.social.google) {
+      app.get('/auth/google', passport.authenticate('google', { scope: ['profile', 'email'] }));
 
       app.get('/auth/google/callback',
         passport.authenticate('google', { session: false }),
-        async (req, res) => {
-          const { accessToken, refreshToken } = authService.generateTokens(req.user);
-          await auditService.logActivity({
-            userId: req.user._id,
-            action: 'social_login',
-            status: 'success',
-            details: { provider: 'google' }
-          });
-
-          res.json({
-            success: true,
-            accessToken,
-            refreshToken,
-            user: req.user
-          });
-        }
-      );
+        async (req, res, next) => {
+          try {
+            const tokens = await authService.generateTokens(req.user);
+            await auditService.logActivity({
+              userId: req.user._id,
+              action: 'social_login',
+              status: 'success',
+              details: { provider: 'google' }
+            });
+            res.json({ success: true, accessToken: tokens.accessToken, refreshToken: tokens.refreshToken, user: req.user });
+          } catch (err) {
+            next(err);
+          }
+        });
     }
 
-    // Error handling middleware
+    // centralized error handler (friendly for clients)
     app.use((err, req, res, next) => {
-      console.error(err.stack);
-      res.status(500).json({
-        success: false,
-        error: 'Internal Server Error'
-      });
+      console.error(err && err.stack ? err.stack : err);
+      const status = err.status || (err.name === 'ValidationError' ? 400 : 500);
+
+      // If client error (4xx) show helpful message, else generic in production
+      let message;
+      if (status >= 400 && status < 500) {
+        message = err.message || 'Bad request';
+      } else {
+        message = process.env.NODE_ENV === 'development' ? (err.message || 'Internal Server Error') : 'Internal Server Error';
+      }
+
+      res.status(status).json({ success: false, error: message });
     });
   };
 }
 
-module.exports = { auth };
+module.exports = { auth, ApiError };

package/src/middlewares/auth.middleware.js

@@ -1,51 +1,111 @@
+// packages/auth/src/middlewares/auth.middleware.js
 const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 
 const createAuthMiddleware = (config) => {
-  const rateLimiter = rateLimit({
+  // Default generic limiter (used for non-sensitive endpoints)
+  const genericLimiter = rateLimit({
     windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 100 // limit each IP to 100 requests per windowMs
+    max: 100,
+    standardHeaders: true,
+    legacyHeaders: false
   });
 
-  const verifyToken = (req, res, next) => {
-    const token = req.headers.authorization?.split(' ')[1];
-    
-    if (!token) {
-      return res.status(401).json({
-        success: false,
-        error: 'No token provided'
-      });
+  // Sensitive endpoint limiters - tuned for production
+  const loginLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.loginMax || 10, // default 10 attempts per 15m
+    message: { success: false, error: 'Too many login attempts, please try later' },
+    standardHeaders: true,
+    legacyHeaders: false
+  });
+
+  const twoFALimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.twoFAMax || 20, // 20 per 15m
+    message: { success: false, error: 'Too many 2FA attempts, please try later' },
+    standardHeaders: true,
+    legacyHeaders: false
+  });
+
+  const forgotPasswordLimiter = rateLimit({
+    windowMs: 60 * 60 * 1000,
+    max: config?.limits?.forgotPasswordMax || 5, // 5 per hour
+    message: { success: false, error: 'Too many password reset requests, please try later' },
+    standardHeaders: true,
+    legacyHeaders: false
+  });
+
+  // Expose function to choose limiter per-route
+  const limiterFor = (routeName) => {
+    switch (routeName) {
+      case 'login': return loginLimiter;
+      case '2fa': return twoFALimiter;
+      case 'forgotPassword': return forgotPasswordLimiter;
+      case 'refresh': return refreshLimiter;
+      default: return genericLimiter;
     }
+  };
+
+  // Refresh token limiter
+  const refreshLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.refreshMax || 30,
+    message: { success: false, error: 'Too many refresh attempts' }
+  });
+
 
+  const verifyToken = (req, res, next) => {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith('Bearer ')) {
+      return res.status(401).json({ success: false, error: 'No token provided' });
+    }
+    const token = header.split(' ')[1];
     try {
       const decoded = jwt.verify(token, config.env.JWT_SECRET);
-      req.user = decoded;
+      // keep minimal user data on req.user
+      req.user = { id: decoded.id, role: decoded.role, email: decoded.email };
       next();
-    } catch (error) {
-      res.status(401).json({
-        success: false,
-        error: 'Invalid token'
-      });
+    } catch (err) {
+      return res.status(401).json({ success: false, error: 'Invalid or expired token' });
     }
   };
 
-  const checkRole = (roles) => {
+  const checkRole = (roles = []) => {
     return (req, res, next) => {
+      if (!req.user) {
+        return res.status(401).json({ success: false, error: 'Unauthorized' });
+      }
       if (!roles.includes(req.user.role)) {
-        return res.status(403).json({
-          success: false,
-          error: 'Insufficient permissions'
-        });
+        return res.status(403).json({ success: false, error: 'Insufficient permissions' });
       }
       next();
     };
   };
 
+  // Ownership check middleware for IDOR protection: allow if owner or admin
+  const checkOwnershipOrAdmin = (getTargetUserId) => {
+    return async (req, res, next) => {
+      try {
+        const targetId = typeof getTargetUserId === 'function' ? getTargetUserId(req) : req.params.id;
+        if (!req.user) return res.status(401).json({ success: false, error: 'Unauthorized' });
+        if (req.user.role === 'admin' || String(req.user.id) === String(targetId)) {
+          return next();
+        }
+        return res.status(403).json({ success: false, error: 'Insufficient permissions to modify this resource' });
+      } catch (err) {
+        return res.status(500).json({ success: false, error: 'Server error' });
+      }
+    };
+  };
+
   return {
-    rateLimiter,
+    rateLimiter: genericLimiter,
+    limiterFor,
     verifyToken,
-    checkRole
+    checkRole,
+    checkOwnershipOrAdmin
   };
 };
 
-module.exports = createAuthMiddleware;
+module.exports = createAuthMiddleware;