@dax-crafta/auth 2.1.1 → 2.1.3

package/src/middlewares/auth.middleware.js

@@ -3,38 +3,48 @@ const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 
 const createAuthMiddleware = (config) => {
+  const noOpLimiter = (_req, _res, next) => next();
+  const rateLimitEnabled = config?.features?.rateLimit !== false;
+
   // Default generic limiter (used for non-sensitive endpoints)
-  const genericLimiter = rateLimit({
+  const genericLimiter = rateLimitEnabled ? rateLimit({
     windowMs: 15 * 60 * 1000, // 15 minutes
     max: 100,
     standardHeaders: true,
     legacyHeaders: false
-  });
+  }) : noOpLimiter;
 
   // Sensitive endpoint limiters - tuned for production
-  const loginLimiter = rateLimit({
+  const loginLimiter = rateLimitEnabled ? rateLimit({
     windowMs: 15 * 60 * 1000,
     max: config?.limits?.loginMax || 10, // default 10 attempts per 15m
     message: { success: false, error: 'Too many login attempts, please try later' },
     standardHeaders: true,
     legacyHeaders: false
-  });
+  }) : noOpLimiter;
 
-  const twoFALimiter = rateLimit({
+  const twoFALimiter = rateLimitEnabled ? rateLimit({
     windowMs: 15 * 60 * 1000,
     max: config?.limits?.twoFAMax || 20, // 20 per 15m
     message: { success: false, error: 'Too many 2FA attempts, please try later' },
     standardHeaders: true,
     legacyHeaders: false
-  });
+  }) : noOpLimiter;
 
-  const forgotPasswordLimiter = rateLimit({
+  const forgotPasswordLimiter = rateLimitEnabled ? rateLimit({
     windowMs: 60 * 60 * 1000,
     max: config?.limits?.forgotPasswordMax || 5, // 5 per hour
     message: { success: false, error: 'Too many password reset requests, please try later' },
     standardHeaders: true,
     legacyHeaders: false
-  });
+  }) : noOpLimiter;
+
+  // Refresh token limiter
+  const refreshLimiter = rateLimitEnabled ? rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.refreshMax || 30,
+    message: { success: false, error: 'Too many refresh attempts' }
+  }) : noOpLimiter;
 
   // Expose function to choose limiter per-route
   const limiterFor = (routeName) => {
@@ -42,18 +52,12 @@ const createAuthMiddleware = (config) => {
       case 'login': return loginLimiter;
       case '2fa': return twoFALimiter;
       case 'forgotPassword': return forgotPasswordLimiter;
+      case 'refreshToken': return refreshLimiter;
       case 'refresh': return refreshLimiter;
       default: return genericLimiter;
     }
   };
 
-  // Refresh token limiter
-  const refreshLimiter = rateLimit({
-    windowMs: 15 * 60 * 1000,
-    max: config?.limits?.refreshMax || 30,
-    message: { success: false, error: 'Too many refresh attempts' }
-  });
-
 
   const verifyToken = (req, res, next) => {
     const header = req.headers.authorization;

package/src/models/audit-log.js

@@ -10,7 +10,24 @@ const auditLogSchema = new mongoose.Schema({
   action: {
     type: String,
     required: true,
-    enum: ['login', 'logout', 'password_change', 'profile_update', 'role_change', '2fa_enabled', '2fa_disabled', 'register', 'password_reset_request', 'password_reset']
+    enum: [
+      'login',
+      'logout',
+      'password_change',
+      'profile_update',
+      'role_change',
+      '2fa_enabled',
+      '2fa_disabled',
+      '2fa_verify',
+      'register',
+      'password_reset_request',
+      'password_reset',
+      'email_verify',
+      'account_locked',
+      'refresh_token',
+      'backup_codes_generated',
+      'social_login'
+    ]
   },
   ipAddress: { type: String, default: '' },
   userAgent: { type: String, default: '' },

package/src/models/user.js

@@ -89,10 +89,10 @@ userSchema.methods.comparePassword = async function (candidate) {
   return bcrypt.compare(candidate, this.password);
 };
 
-userSchema.methods.recordPasswordHistory = async function () {
+userSchema.methods.recordPasswordHistory = async function (previousPasswordHash) {
   this.passwordHistory = this.passwordHistory || [];
   this.passwordHistory.push({
-    hash: this.password,
+    hash: previousPasswordHash || this.password,
     changedAt: new Date()
   });
 
@@ -180,6 +180,24 @@ userSchema.methods.revokeAllSessions = async function () {
 };
 
 
+// Verify a backup code using MFA service and mark it as used
+userSchema.methods.verifyBackupCode = async function (rawCode, mfaService) {
+  if (!mfaService || !this.backupCodes || this.backupCodes.length === 0) {
+    return false;
+  }
+
+  const match = mfaService.verifyBackupCode(rawCode, this.backupCodes);
+  if (!match) {
+    return false;
+  }
+
+  // Mark the matched code as used and persist
+  this.backupCodes = this.backupCodes.map((c) =>
+    c.hash === match.hash ? { ...c.toObject?.() ?? c, used: true } : c
+  );
+  await this.save();
+  return true;
+};
 
 // Static helper: find user by refresh token and prune expired ones while returning valid user
 userSchema.statics.findByRefreshToken = async function (tokenString) {

package/src/services/auth.service.js

@@ -4,7 +4,7 @@ const { authenticator } = require('otplib');
 const crypto = require('crypto');
 const User = require('../models/user');
 const EmailService = require('../utils/email');
-const { ApiError } = require('..'); // from index.js
+const ApiError = require('../utils/api-error');
 
 class AuthService {
   constructor(config) {
@@ -12,6 +12,15 @@ class AuthService {
     this.emailService = new EmailService(config);
   }
 
+  async logAudit(entry) {
+    if (!this.config?.auditService) return;
+    try {
+      await this.config.auditService.logActivity(entry);
+    } catch (_err) {
+      // Audit failures should not break auth flows.
+    }
+  }
+
   /* ---------------------------------------------
         REGISTER USER
   --------------------------------------------- */
@@ -33,6 +42,32 @@ class AuthService {
     return user;
   }
 
+  /* ---------------------------------------------
+        VERIFY EMAIL
+  --------------------------------------------- */
+  async verifyEmail(token) {
+    if (!token) {
+      throw new ApiError('Verification token is required', 400);
+    }
+
+    const user = await User.findOne({ verificationToken: token }).select('+verificationToken');
+    if (!user) {
+      throw new ApiError('Invalid or expired verification token', 400);
+    }
+
+    user.isVerified = true;
+    user.verificationToken = undefined;
+    await user.save();
+
+    await this.logAudit({
+      userId: user._id,
+      action: 'email_verify',
+      status: 'success'
+    });
+
+    return user;
+  }
+
   /* ---------------------------------------------
         LOGIN USER (WITH ATOMIC LOCKOUT)
   --------------------------------------------- */
@@ -44,13 +79,16 @@ class AuthService {
     }
 
     // If locked, do NOT allow login
-    if (user.isLocked()) {
+    const securityAttemptsEnabled = this.config?.features?.securityAttempts !== false;
+    if (securityAttemptsEnabled && user.isLocked()) {
       throw new ApiError('Account locked. Try again later.', 403);
     }
 
     const isValid = await user.comparePassword(password);
     if (!isValid) {
-      await this.incrementLoginAttempts(user);
+      if (securityAttemptsEnabled) {
+        await this.incrementLoginAttempts(user);
+      }
       throw new ApiError('Invalid credentials', 401);
     }
 
@@ -60,7 +98,8 @@ class AuthService {
     await user.save();
 
     // If 2FA is enabled
-    if (user.twoFactorEnabled) {
+    const twoFactorEnabled = this.config?.features?.twoFactor !== false;
+    if (twoFactorEnabled && user.twoFactorEnabled) {
       const code = authenticator.generate(user.twoFactorSecret);
       await this.emailService.send2FACode(user, code);
       return { requires2FA: true, userId: user._id };
@@ -114,7 +153,7 @@ class AuthService {
     await user.revokeRefreshToken(refreshToken);
 
     const tokens = await this.generateTokens(user);
-    await this.config.auditService.logActivity({
+    await this.logAudit({
       userId: user._id,
       action: 'refresh_token',
       status: 'success'
@@ -165,13 +204,14 @@ class AuthService {
       throw new ApiError('Cannot reuse previous passwords', 400);
     }
 
+    const previousPasswordHash = user.password;
     user.password = newPassword;
 
-    await user.recordPasswordHistory(); // 🔥 add
+    await user.recordPasswordHistory(previousPasswordHash);
     await user.revokeAllRefreshTokens(); // session invalidate
     user.passwordResetToken = undefined;
     user.passwordResetExpires = undefined;
-    await this.config.auditService.logActivity({
+    await this.logAudit({
       userId: user._id,
       action: 'password_reset',
       status: 'success'
@@ -193,7 +233,7 @@ class AuthService {
 
     await user.setBackupCodes(codes.map(c => ({ hash: c.hash })));
 
-    await this.config.auditService.logActivity({
+    await this.logAudit({
       userId,
       action: 'backup_codes_generated',
       status: 'success'
@@ -212,7 +252,7 @@ class AuthService {
     if (!user) throw new ApiError('User not found', 404);
 
     await user.safeUpdate(updates);
-    await this.config.auditService.logActivity({
+    await this.logAudit({
       userId: user._id,
       action: 'profile_update',
       status: 'success'
@@ -259,6 +299,10 @@ class AuthService {
         ATOMIC LOGIN ATTEMPT INCREMENT
   --------------------------------------------- */
   async incrementLoginAttempts(user) {
+    if (this.config?.features?.securityAttempts === false) {
+      return;
+    }
+
     const MAX = this.config.maxLoginAttempts || 5;
     const now = Date.now();
     const lockUntil = now + 60 * 60 * 1000;
@@ -269,7 +313,7 @@ class AuthService {
       user.lockUntil = lockUntil;
       await user.save();
       await this.emailService.sendAccountLockEmail(user);
-      await this.config.auditService.logActivity({
+      await this.logAudit({
         userId: user._id,
         action: 'account_locked',
         status: 'success'
@@ -289,7 +333,7 @@ class AuthService {
 
     await user.revokeSession(sessionId);
 
-    await this.config.auditService.logActivity({
+    await this.logAudit({
       userId,
       action: 'logout',
       status: 'success'
@@ -298,6 +342,43 @@ class AuthService {
     return true;
   }
 
+  async handleSocialLogin(provider, profile) {
+    if (!profile) {
+      throw new ApiError('Social profile is required', 400);
+    }
+
+    const primaryEmail = profile.emails?.[0]?.value;
+    if (!primaryEmail) {
+      throw new ApiError('Social provider did not return an email', 400);
+    }
+
+    let user = await User.findOne({ email: primaryEmail });
+
+    if (!user) {
+      user = new User({
+        email: primaryEmail,
+        password: this.generateSecureToken(),
+        isVerified: true,
+        customFields: {
+          socialProvider: provider,
+          socialId: profile.id,
+          name: profile.displayName
+        }
+      });
+      await user.save();
+    } else if (profile.displayName) {
+      user.customFields = {
+        ...(user.customFields || {}),
+        socialProvider: provider,
+        socialId: profile.id,
+        name: profile.displayName
+      };
+      await user.save();
+    }
+
+    return user;
+  }
+
 
 
   /* ---------------------------------------------

package/src/testing/adaptive-runner.js

@@ -0,0 +1,74 @@
+const { createLogger } = require('../utils/logger');
+
+// Feature-aware test catalog (mocked; replace run methods with real tests)
+const testCatalog = [
+  {
+    name: 'JWT signing',
+    feature: 'jwt',
+    run: async (cfg, log) => {
+      if (!cfg?.env?.JWT_SECRET) throw new Error('JWT_SECRET missing');
+      log.logInfo('JWT secret present; token signing would proceed');
+    }
+  },
+  {
+    name: 'Email verification/OTP delivery',
+    feature: 'email',
+    run: async (cfg, log) => {
+      if (!cfg?.smtp) throw new Error('SMTP config missing');
+      log.logInfo(`SMTP host: ${cfg.smtp.host}`);
+    }
+  },
+  {
+    name: 'OAuth (Google)',
+    feature: 'oauth',
+    run: async (cfg, log) => {
+      if (!cfg?.social?.google) throw new Error('Google config missing');
+      log.logInfo('Google OAuth config present; would start redirect flow');
+    }
+  },
+  {
+    name: '2FA (TOTP)',
+    feature: 'twofa',
+    run: async (_cfg, log) => {
+      log.logInfo('2FA code verification simulated');
+    }
+  }
+];
+
+function inferFeatureFlags(authConfig = {}) {
+  return {
+    jwt: true, // core always on
+    email: !!(authConfig.emailVerification && authConfig.smtp),
+    oauth: !!(authConfig.social && authConfig.social.google),
+    twofa: true // library supports 2FA routes by default
+  };
+}
+
+async function runAdaptiveTests(authConfig = {}, featureFlags, opts = {}) {
+  const flags = featureFlags || inferFeatureFlags(authConfig);
+  const log = createLogger(opts.logging !== false);
+
+  log.logInfo('Adaptive test runner starting…');
+
+  for (const test of testCatalog) {
+    if (!flags[test.feature]) {
+      log.logSkip(`${test.name} - feature disabled`);
+      continue;
+    }
+    try {
+      await test.run(authConfig, log);
+      log.logSuccess(test.name);
+    } catch (err) {
+      log.logError(`${test.name} failed: ${err.message}`);
+    }
+  }
+
+  log.logSuccess('Adaptive tests complete.');
+  return true;
+}
+
+module.exports = {
+  runAdaptiveTests,
+  inferFeatureFlags,
+  testCatalog
+};

package/src/utils/api-error.js

@@ -0,0 +1,8 @@
+class ApiError extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+
+module.exports = ApiError;

package/src/utils/email.js

@@ -6,13 +6,26 @@ const path = require('path');
 class EmailService {
   constructor(config) {
     this.config = config;
-    this.transporter = nodemailer.createTransport(config.smtp);
-    this.from = config.smtp.from;
+    this.smtpEnabled = !!(
+      config.smtp &&
+      config.smtp.host &&
+      config.smtp.port &&
+      config.smtp.auth &&
+      config.smtp.auth.user &&
+      config.smtp.auth.pass &&
+      config.smtp.from
+    );
+    this.transporter = this.smtpEnabled ? nodemailer.createTransport(config.smtp) : null;
+    this.from = this.smtpEnabled ? config.smtp.from : 'noreply@localhost';
     this.templateDir = config.emailTemplateDir || path.join(process.cwd(), "templates/email");
   }
 
   // Reusable sender
   async send({ to, subject, html, text }) {
+    if (!this.smtpEnabled) {
+      return { sent: false, reason: 'smtp_disabled' };
+    }
+
     try {
       await this.transporter.sendMail({
         from: this.from,
@@ -21,8 +34,10 @@ class EmailService {
         html,
         text: text || html.replace(/<[^>]+>/g, '')
       });
+      return { sent: true };
     } catch (err) {
       console.error("Email send error:", err);
+      return { sent: false, reason: err.message };
     }
   }
 
@@ -42,7 +57,8 @@ class EmailService {
   }
 
   async sendVerificationEmail(user, token) {
-    const url = `${this.config.baseUrl}/verify-email?token=${token}`;
+    const verifyPath = this.config.routes?.verify || '/verify';
+    const url = `${this.config.baseUrl}${verifyPath}?token=${token}`;
 
     const html = this.loadTemplate("email-verification", {
       name: user.name || user.email,
@@ -58,7 +74,8 @@ class EmailService {
   }
 
   async sendPasswordResetEmail(user, token) {
-    const url = `${this.config.baseUrl}/reset-password?token=${token}`;
+    const resetPath = this.config.routes?.resetPassword || '/reset-password';
+    const url = `${this.config.baseUrl}${resetPath}?token=${token}`;
 
     const html = this.loadTemplate("password-reset", {
       name: user.name || user.email,

package/src/utils/logger.js

@@ -0,0 +1,38 @@
+// Lightweight terminal logger with colorized prefixes.
+const COLORS = {
+  reset: '\x1b[0m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  cyan: '\x1b[36m',
+  gray: '\x1b[90m'
+};
+
+const prefix = {
+  success: `${COLORS.green}[SUCCESS]${COLORS.reset}`,
+  info: `${COLORS.cyan}[INFO]${COLORS.reset}`,
+  warn: `${COLORS.yellow}[WARN]${COLORS.reset}`,
+  error: `${COLORS.red}[FAIL]${COLORS.reset}`,
+  skip: `${COLORS.gray}[SKIP]${COLORS.reset}`
+};
+
+function maybeLog(enabled, fn) {
+  return (msg) => {
+    if (enabled === false) return;
+    fn(msg);
+  };
+}
+
+function createLogger(enabled = true) {
+  return {
+    logSuccess: maybeLog(enabled, (msg) => console.log(`${prefix.success} ${msg}`)),
+    logInfo: maybeLog(enabled, (msg) => console.log(`${prefix.info} ${msg}`)),
+    logWarn: maybeLog(enabled, (msg) => console.warn(`${prefix.warn} ${msg}`)),
+    logError: maybeLog(enabled, (msg) => console.error(`${prefix.error} ${msg}`)),
+    logSkip: maybeLog(enabled, (msg) => console.log(`${prefix.skip} ${msg}`))
+  };
+}
+
+module.exports = {
+  createLogger
+};