@dax-crafta/auth 2.0.2 → 2.1.0

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@dax-crafta/auth",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "A powerful, flexible, and secure authentication plugin for the Crafta framework. Supports JWT, social login, 2FA, RBAC, audit logging, and enterprise-grade security features.",
   "main": "src/index.js",
+  "types": "src/index.d.ts",
   "private": false,
   "dependencies": {
     "bcryptjs": "^2.4.3",

package/src/index.d.ts

@@ -0,0 +1,12 @@
+export function register(email: string, password: string): Promise<any>;
+export function login(email: string, password: string): Promise<any>;
+export function verifyToken(token: string): boolean;
+
+export interface User {
+  email: string;
+  password?: string;
+  role?: string;
+}
+
+export function getUser(id: string): Promise<User>;
+export function logout(): Promise<void>;

package/src/index.js

@@ -3,6 +3,7 @@ const passport = require('passport');
 const cookieParser = require('cookie-parser');
 const csrf = require('csurf');
 const helmet = require("helmet");
+const mongoose = require("mongoose");   // <<< FIX ADDED
 
 const GoogleStrategy = require('passport-google-oauth20').Strategy;
 const AuthService = require('./services/auth.service');
@@ -73,6 +74,21 @@ function auth(config = {}) {
     throw new Error('SMTP configuration is required for email verification');
   }
 
+  // ------------------------------------------
+  // ✅ FIX — Proper MongoDB Connection
+  // ------------------------------------------
+  if (mongoose.connection.readyState === 0) {
+    mongoose.connect(finalConfig.mongoUrl, {
+      useNewUrlParser: true,
+      useUnifiedTopology: true
+    })
+      .then(() => console.log("📦 Auth Library MongoDB Connected"))
+      .catch(err => console.error("❌ Auth Library MongoDB Error:", err));
+  } else {
+    console.log("📦 Using existing mongoose connection");
+  }
+  // ------------------------------------------
+
   const authService = new AuthService(finalConfig);
   const roleService = new RoleService();
   const auditService = new AuditService();
@@ -80,7 +96,6 @@ function auth(config = {}) {
   const passwordPolicy = new PasswordPolicy(finalConfig.passwordPolicy);
   const { rateLimiter, limiterFor, verifyToken, checkRole, checkOwnershipOrAdmin } = createAuthMiddleware(finalConfig);
 
-  // setup passport strategies as earlier if provided...
   if (finalConfig.social && finalConfig.social.google) {
     passport.use(new GoogleStrategy(finalConfig.social.google,
       async (accessToken, refreshToken, profile, done) => {
@@ -96,13 +111,11 @@ function auth(config = {}) {
 
   return function (app) {
     app.use(cookieParser());
-    // CSRF: enable only if config.enableCSRF === true
+
     if (finalConfig.enableCSRF) {
-      // use cookie-based CSRF token and expect header 'x-csrf-token' or cookie
       const csrfProtection = csrf({ cookie: true });
       app.use(csrfProtection);
 
-      // expose token endpoint to clients (they must fetch this and send it back on state-changing requests)
       app.get('/csrf-token', (req, res) => {
         res.json({ csrfToken: req.csrfToken() });
       });
@@ -111,19 +124,17 @@ function auth(config = {}) {
     app.use(passport.initialize());
     app.use(rateLimiter);
     app.use(helmet({
-      contentSecurityPolicy: false, // optional to ease frontend dev
+      contentSecurityPolicy: false,
       crossOriginEmbedderPolicy: false,
     }));
 
-
-    // attach services
     app.authService = authService;
     app.roleService = roleService;
     app.auditService = auditService;
     app.mfaService = mfaService;
     app.passwordPolicy = passwordPolicy;
 
-    // register
+    // REGISTER
     app.post(
       finalConfig.routes.register,
       limiterFor('register'),
@@ -156,7 +167,7 @@ function auth(config = {}) {
       }
     );
 
-    // login
+    // LOGIN
     app.post(
       finalConfig.routes.login,
       limiterFor('login'),
@@ -189,7 +200,7 @@ function auth(config = {}) {
       }
     );
 
-    // 2FA verification (rate-limited)
+    // 2FA
     app.post(
       finalConfig.routes.twoFactor,
       limiterFor('2fa'),
@@ -206,7 +217,7 @@ function auth(config = {}) {
       }
     );
 
-    // forgot password (rate-limited)
+    // FORGOT PASSWORD
     app.post(
       finalConfig.routes.forgotPassword,
       limiterFor('forgotPassword'),
@@ -222,7 +233,7 @@ function auth(config = {}) {
       }
     );
 
-    // reset password
+    // RESET PASSWORD
     app.post(
       finalConfig.routes.resetPassword,
       validators.resetPasswordValidator,
@@ -238,7 +249,7 @@ function auth(config = {}) {
       }
     );
 
-    // refresh token
+    // REFRESH TOKEN
     app.post(
       finalConfig.routes.refreshToken,
       validators.refreshTokenValidator,
@@ -253,11 +264,11 @@ function auth(config = {}) {
       }
     );
 
-    // update profile (prevent IDOR: only owner or admin)
+    // UPDATE PROFILE
     app.put(
       finalConfig.routes.profile,
       verifyToken,
-      checkOwnershipOrAdmin((req) => req.user.id), // target is the calling user; if you allow admin to pass an id param, adapt accordingly
+      checkOwnershipOrAdmin((req) => req.user.id),
       validators.profileUpdateValidator,
       validators.handleValidation,
       async (req, res, next) => {
@@ -271,7 +282,7 @@ function auth(config = {}) {
       }
     );
 
-    // roles (admin only)
+    // CREATE ROLE (ADMIN)
     app.post('/roles', verifyToken, checkRole(['admin']), async (req, res, next) => {
       try {
         const role = await roleService.createRole(req.body);
@@ -281,7 +292,7 @@ function auth(config = {}) {
       }
     });
 
-    // social google callback example (kept same)
+    // GOOGLE OAUTH
     if (finalConfig.social && finalConfig.social.google) {
       app.get('/auth/google', passport.authenticate('google', { scope: ['profile', 'email'] }));
 
@@ -303,17 +314,18 @@ function auth(config = {}) {
         });
     }
 
-    // centralized error handler (friendly for clients)
+    // ERROR HANDLER
     app.use((err, req, res, next) => {
       console.error(err && err.stack ? err.stack : err);
       const status = err.status || (err.name === 'ValidationError' ? 400 : 500);
 
-      // If client error (4xx) show helpful message, else generic in production
       let message;
       if (status >= 400 && status < 500) {
         message = err.message || 'Bad request';
       } else {
-        message = process.env.NODE_ENV === 'development' ? (err.message || 'Internal Server Error') : 'Internal Server Error';
+        message = process.env.NODE_ENV === 'development'
+          ? (err.message || 'Internal Server Error')
+          : 'Internal Server Error';
       }
 
       res.status(status).json({ success: false, error: message });