@dax-crafta/auth 2.1.5 → 2.1.7

package/src/middlewares/auth.middleware.js

@@ -2,6 +2,8 @@
 const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 
+const ApiError = require('../utils/api-error');
+
 const createAuthMiddleware = (config) => {
   const noOpLimiter = (_req, _res, next) => next();
   const rateLimitEnabled = config?.features?.rateLimit !== false;
@@ -46,6 +48,15 @@ const createAuthMiddleware = (config) => {
     message: { success: false, error: 'Too many refresh attempts' }
   }) : noOpLimiter;
 
+  // Register limiter
+  const registerLimiter = rateLimitEnabled ? rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.registerMax || 20,
+    message: { success: false, error: 'Too many registration attempts, please try later' },
+    standardHeaders: true,
+    legacyHeaders: false
+  }) : noOpLimiter;
+
   // Expose function to choose limiter per-route
   const limiterFor = (routeName) => {
     switch (routeName) {
@@ -54,19 +65,29 @@ const createAuthMiddleware = (config) => {
       case 'forgotPassword': return forgotPasswordLimiter;
       case 'refreshToken': return refreshLimiter;
       case 'refresh': return refreshLimiter;
+      case 'register': return registerLimiter;
       default: return genericLimiter;
     }
   };
 
 
   const extractToken = (req) => {
-    const authHeader = req.headers.authorization;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
+    const headers = req.headers || {};
+    let authHeader = headers.authorization;
+    // Guard: duplicate headers arrive as arrays — take first string element
+    if (Array.isArray(authHeader)) {
+      authHeader = authHeader.find(h => typeof h === 'string') || null;
+    }
+    if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
       return authHeader.split(' ')[1];
     }
 
-    if (req.headers['x-access-token']) {
-      return req.headers['x-access-token'];
+    let xAccess = headers['x-access-token'];
+    if (Array.isArray(xAccess)) {
+      xAccess = xAccess.find(h => typeof h === 'string') || null;
+    }
+    if (typeof xAccess === 'string') {
+      return xAccess;
     }
 
     return null;
@@ -75,7 +96,7 @@ const createAuthMiddleware = (config) => {
   const verifyToken = (req, res, next) => {
     const token = extractToken(req);
     if (!token) {
-      return res.status(401).json({ success: false, error: 'No token provided' });
+      return next(ApiError.unauthorized('No token provided'));
     }
 
     try {
@@ -84,17 +105,20 @@ const createAuthMiddleware = (config) => {
       req.user = { id: decoded.id, role: decoded.role, email: decoded.email };
       next();
     } catch (err) {
-      return res.status(401).json({ success: false, error: 'Invalid or expired token' });
+      if (err.name === 'TokenExpiredError') {
+        return next(ApiError.expiredToken());
+      }
+      return next(ApiError.invalidToken());
     }
   };
 
   const checkRole = (roles = []) => {
     return (req, res, next) => {
       if (!req.user) {
-        return res.status(401).json({ success: false, error: 'Unauthorized' });
+        return next(ApiError.unauthorized());
       }
       if (!roles.includes(req.user.role)) {
-        return res.status(403).json({ success: false, error: 'Insufficient permissions' });
+        return next(ApiError.forbidden());
       }
       next();
     };
@@ -105,13 +129,13 @@ const createAuthMiddleware = (config) => {
     return async (req, res, next) => {
       try {
         const targetId = typeof getTargetUserId === 'function' ? getTargetUserId(req) : req.params.id;
-        if (!req.user) return res.status(401).json({ success: false, error: 'Unauthorized' });
+        if (!req.user) return next(ApiError.unauthorized());
         if (req.user.role === 'admin' || String(req.user.id) === String(targetId)) {
           return next();
         }
-        return res.status(403).json({ success: false, error: 'Insufficient permissions to modify this resource' });
+        return next(ApiError.forbidden('Insufficient permissions to modify this resource'));
       } catch (err) {
-        return res.status(500).json({ success: false, error: 'Server error' });
+        return next(ApiError.internal('Server error'));
       }
     };
   };

package/src/middlewares/cors.middleware.js

@@ -0,0 +1,73 @@
+// packages/auth/src/middlewares/cors.middleware.js
+/**
+ * CORS middleware — explicit origin whitelist instead of the default
+ * "reflect any origin" behaviour, which is a security risk for auth APIs.
+ *
+ * If `config.cors` is omitted, we default to a safe deny-everything policy
+ * for auth routes (they should be consumed by a trusted frontend).
+ */
+const ApiError = require('../utils/api-error');
+
+const DEFAULT_CORS = {
+  origin: '*',
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
+  maxAge: 86400
+};
+
+function normalizeOrigin(origin) {
+  if (!origin) return null;
+  try {
+    const u = new URL(origin);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return origin;
+  }
+}
+
+function corsMiddleware(config = {}) {
+  const cors = { ...DEFAULT_CORS, ...(config.cors || {}) };
+
+  // Build the set of allowed origins once.
+  const allowed = Array.isArray(cors.origin)
+    ? cors.origin.map(normalizeOrigin)
+    : cors.origin === '*'
+      ? null // null means "reflect any" (explicit opt-in)
+      : [normalizeOrigin(cors.origin)];
+
+  return (req, res, next) => {
+    const requestOrigin = req.headers.origin;
+
+    // Always set safe headers for preflight.
+    if (req.method === 'OPTIONS') {
+      res.setHeader('Access-Control-Allow-Methods', cors.methods.join(','));
+      res.setHeader('Access-Control-Allow-Headers', cors.allowedHeaders.join(','));
+      res.setHeader('Access-Control-Max-Age', String(cors.maxAge));
+      if (cors.credentials) res.setHeader('Access-Control-Allow-Credentials', 'true');
+      if (allowed === null) {
+        if (requestOrigin) res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      } else if (allowed.includes(normalizeOrigin(requestOrigin))) {
+        res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      }
+      return res.status(204).end();
+    }
+
+    // Actual request.
+    if (allowed === null) {
+      // Reflect any — only safe when the app explicitly opts in.
+      if (requestOrigin) res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+    } else if (requestOrigin && allowed.includes(normalizeOrigin(requestOrigin))) {
+      res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      res.setHeader('Access-Control-Allow-Credentials', String(cors.credentials));
+    } else if (requestOrigin) {
+      // Origin not in whitelist — block it.
+      return next(ApiError.forbidden('Origin not allowed by CORS policy'));
+    }
+
+    if (cors.credentials) res.setHeader('Access-Control-Allow-Credentials', 'true');
+    next();
+  };
+}
+
+module.exports = corsMiddleware;

package/src/middlewares/validation.middleware.js

@@ -43,8 +43,9 @@ const profileUpdateValidator = [
   body().custom((value, { req }) => {
     // prevent sensitive fields in payload
     const forbidden = ['password', 'role', 'refreshTokens', 'isVerified', 'verificationToken', 'twoFactorSecret', '_id'];
+    const body = req.body || {};
     for (const f of forbidden) {
-      if (req.body.hasOwnProperty(f)) {
+      if (Object.prototype.hasOwnProperty.call(body, f)) {
         throw new Error(`Cannot update field: ${f}`);
       }
     }

package/src/models/user.js

@@ -3,6 +3,7 @@ const mongoose = require('mongoose');
 const bcrypt = require('bcryptjs');
 const validator = require('validator');
 const crypto = require('crypto');
+const ApiError = require('../utils/api-error');
 
 
 const SALT_ROUNDS = Number(process.env.SALT_ROUNDS) || 12;
@@ -51,6 +52,8 @@ const userSchema = new mongoose.Schema({
   }],
   isVerified: { type: Boolean, default: false },
   verificationToken: { type: String, select: false },
+  magicLinkToken: { type: String, select: false },
+  magicLinkExpires: { type: Date, select: false },
   passwordResetToken: { type: String, select: false },
   passwordResetExpires: { type: Date, select: false },
   loginAttempts: { type: Number, default: 0 },
@@ -58,11 +61,13 @@ const userSchema = new mongoose.Schema({
   twoFactorSecret: { type: String, select: false },
   twoFactorEnabled: { type: Boolean, default: false },
   refreshTokens: { type: [refreshTokenSchema], default: [] },
+  sessionVersion: { type: Number, default: 0 },
   customFields: { type: mongoose.Schema.Types.Mixed }
 }, { timestamps: true });
 
 // Indexes
 userSchema.index({ email: 1 }, { unique: true });
+userSchema.index({ magicLinkToken: 1 });
 userSchema.index({ 'refreshTokens.expires': 1 }); // helps queries that prune expired refresh tokens
 userSchema.index({ lockUntil: 1 });
 
@@ -90,9 +95,13 @@ userSchema.methods.comparePassword = async function (candidate) {
 };
 
 userSchema.methods.recordPasswordHistory = async function (previousPasswordHash) {
+  if (typeof previousPasswordHash !== 'string' || previousPasswordHash.length === 0) {
+    throw ApiError.internal('recordPasswordHistory requires previousPasswordHash');
+  }
+
   this.passwordHistory = this.passwordHistory || [];
   this.passwordHistory.push({
-    hash: previousPasswordHash || this.password,
+    hash: previousPasswordHash,
     changedAt: new Date()
   });
 
@@ -100,8 +109,6 @@ userSchema.methods.recordPasswordHistory = async function (previousPasswordHash)
   if (this.passwordHistory.length > 5) {
     this.passwordHistory.shift();
   }
-
-  await this.save();
 };
 
 userSchema.methods.setBackupCodes = async function (codes) {
@@ -109,7 +116,6 @@ userSchema.methods.setBackupCodes = async function (codes) {
     hash: c.hash,
     used: false
   }));
-  await this.save();
 };
 
 
@@ -124,20 +130,17 @@ userSchema.methods.addRefreshToken = async function (tokenString, expiresAt) {
     token: tokenString,
     expires: expiresAt
   });
-  await this.save();
   return tokenString;
 };
 
 // Revoke a specific refresh token (by token string)
 userSchema.methods.revokeRefreshToken = async function (tokenString) {
   this.refreshTokens = (this.refreshTokens || []).filter(t => t.token !== tokenString);
-  await this.save();
 };
 
 // Revoke all refresh tokens (e.g., on password reset)
 userSchema.methods.revokeAllRefreshTokens = async function () {
   this.refreshTokens = [];
-  await this.save();
 };
 
 // Remove expired refresh tokens (useful to call periodically or on sensitive flows)
@@ -166,17 +169,14 @@ userSchema.methods.addSession = async function (info) {
     userAgent: info.userAgent,
     ip: info.ip
   });
-  await this.save();
 };
 
 userSchema.methods.revokeSession = async function (sessionId) {
   this.sessions = this.sessions.filter(s => s.sessionId !== sessionId);
-  await this.save();
 };
 
 userSchema.methods.revokeAllSessions = async function () {
   this.sessions = [];
-  await this.save();
 };
 
 
@@ -195,7 +195,6 @@ userSchema.methods.verifyBackupCode = async function (rawCode, mfaService) {
   this.backupCodes = this.backupCodes.map((c) =>
     c.hash === match.hash ? { ...c.toObject?.() ?? c, used: true } : c
   );
-  await this.save();
   return true;
 };
 

package/src/services/auth.service.js

@@ -47,12 +47,12 @@ class AuthService {
   --------------------------------------------- */
   async verifyEmail(token) {
     if (!token) {
-      throw new ApiError('Verification token is required', 400);
+      throw ApiError.badRequest('Verification token is required');
     }
 
     const user = await User.findOne({ verificationToken: token }).select('+verificationToken');
     if (!user) {
-      throw new ApiError('Invalid or expired verification token', 400);
+      throw ApiError.badRequest('Invalid or expired verification token');
     }
 
     user.isVerified = true;
@@ -71,17 +71,17 @@ class AuthService {
   /* ---------------------------------------------
         LOGIN USER (WITH ATOMIC LOCKOUT)
   --------------------------------------------- */
-  async login(email, password, deviceInfo) {
+  async login(email, password, deviceInfo = {}) {
     const user = await User.findOne({ email });
 
     if (!user) {
-      throw new ApiError('Invalid credentials', 401);
+      throw ApiError.invalidCredentials();
     }
 
     // If locked, do NOT allow login
     const securityAttemptsEnabled = this.config?.features?.securityAttempts !== false;
     if (securityAttemptsEnabled && user.isLocked()) {
-      throw new ApiError('Account locked. Try again later.', 403);
+      throw ApiError.accountLocked();
     }
 
     const isValid = await user.comparePassword(password);
@@ -89,7 +89,7 @@ class AuthService {
       if (securityAttemptsEnabled) {
         await this.incrementLoginAttempts(user);
       }
-      throw new ApiError('Invalid credentials', 401);
+      throw ApiError.invalidCredentials();
     }
 
     // RESET LOCKOUT automatically on correct login
@@ -120,9 +120,9 @@ class AuthService {
   async verify2FA(userId, code) {
     const user = await User.findById(userId).select('+twoFactorSecret');
 
-    if (!user) throw new ApiError('User not found', 404);
+    if (!user) throw ApiError.notFound('User not found');
     if (!user.twoFactorEnabled)
-      throw new ApiError('2FA is not enabled for this user', 400);
+      throw ApiError.badRequest('2FA is not enabled for this user');
 
     const ok = authenticator.verify({
       token: code,
@@ -132,7 +132,7 @@ class AuthService {
     // fallback: backup codes
     if (!ok) {
       const backupOK = await user.verifyBackupCode(code, this.config.mfaService);
-      if (!backupOK) throw new ApiError('Invalid 2FA code', 401);
+      if (!backupOK) throw ApiError.twoFactorFailed();
     }
 
 
@@ -147,10 +147,11 @@ class AuthService {
     // find only valid (non-expired) tokens
     const user = await User.findByRefreshToken(refreshToken);
 
-    if (!user) throw new ApiError('Invalid or expired refresh token', 401);
+    if (!user) throw ApiError.invalidToken();
 
     // Refresh token rotation (best practice)
-    await user.revokeRefreshToken(refreshToken);
+    user.revokeRefreshToken(refreshToken);
+    await user.save();
 
     const tokens = await this.generateTokens(user);
     await this.logAudit({
@@ -191,24 +192,20 @@ class AuthService {
       passwordResetExpires: { $gt: Date.now() }
     });
 
-    if (!user) throw new ApiError('Invalid or expired reset token', 400);
-
-    // check password history
-    const reused = await Promise.all(
-      (user.passwordHistory || []).map(async (old) =>
-        bcrypt.compare(newPassword, old.hash)
-      )
-    );
+    if (!user) throw ApiError.badRequest('Invalid or expired reset token');
 
-    if (reused.includes(true)) {
-      throw new ApiError('Cannot reuse previous passwords', 400);
+    // check password history (sequential, short-circuits on first match)
+    for (const old of (user.passwordHistory || [])) {
+      if (await bcrypt.compare(newPassword, old.hash)) {
+        throw ApiError.passwordReuse('Cannot reuse previous passwords');
+      }
     }
 
     const previousPasswordHash = user.password;
     user.password = newPassword;
 
     await user.recordPasswordHistory(previousPasswordHash);
-    await user.revokeAllRefreshTokens(); // session invalidate
+    user.revokeAllRefreshTokens(); // session invalidate
     user.passwordResetToken = undefined;
     user.passwordResetExpires = undefined;
     await this.logAudit({
@@ -217,7 +214,6 @@ class AuthService {
       status: 'success'
     });
 
-
     await user.save();
     return user;
   }
@@ -227,11 +223,12 @@ class AuthService {
   --------------------------------------------- */
   async generateBackupCodes(userId, mfaService) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError("User not found", 404);
+    if (!user) throw ApiError.notFound();
 
     const codes = mfaService.generateBackupCodes();
 
     await user.setBackupCodes(codes.map(c => ({ hash: c.hash })));
+    await user.save();
 
     await this.logAudit({
       userId,
@@ -249,7 +246,7 @@ class AuthService {
   --------------------------------------------- */
   async updateProfile(userId, updates) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError('User not found', 404);
+    if (!user) throw ApiError.notFound();
 
     await user.safeUpdate(updates);
     await this.logAudit({
@@ -269,7 +266,8 @@ class AuthService {
       {
         id: user._id,
         email: user.email,
-        role: user.role
+        role: user.role,
+        sessionVersion: user.sessionVersion || 0
       },
       this.config.env.JWT_SECRET,
       { expiresIn: this.config.accessTokenExpiry || '1h' }
@@ -280,7 +278,8 @@ class AuthService {
       Date.now() +
       (this.config.refreshTokenDays || 7) * 24 * 60 * 60 * 1000;
 
-    await user.addRefreshToken(refreshToken, expiresAt);
+    user.addRefreshToken(refreshToken, expiresAt);
+    await user.save();
 
     // prune expired refresh tokens in background
     await user.pruneExpiredRefreshTokens();
@@ -329,9 +328,10 @@ class AuthService {
   --------------------------------------------- */
   async logout(userId, sessionId) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError("User not found", 404);
+    if (!user) throw ApiError.notFound();
 
     await user.revokeSession(sessionId);
+    await user.save();
 
     await this.logAudit({
       userId,
@@ -344,12 +344,12 @@ class AuthService {
 
   async handleSocialLogin(provider, profile) {
     if (!profile) {
-      throw new ApiError('Social profile is required', 400);
+      throw ApiError.badRequest('Social profile is required');
     }
 
     const primaryEmail = profile.emails?.[0]?.value;
     if (!primaryEmail) {
-      throw new ApiError('Social provider did not return an email', 400);
+      throw ApiError.badRequest('Social provider did not return an email');
     }
 
     let user = await User.findOne({ email: primaryEmail });
@@ -366,13 +366,15 @@ class AuthService {
         }
       });
       await user.save();
-    } else if (profile.displayName) {
+    } else {
       user.customFields = {
         ...(user.customFields || {}),
         socialProvider: provider,
-        socialId: profile.id,
-        name: profile.displayName
+        socialId: profile.id
       };
+      if (profile.displayName) {
+        user.customFields.name = profile.displayName;
+      }
       await user.save();
     }
 

package/src/services/passwordless.service.js

@@ -0,0 +1,66 @@
+// packages/auth/src/services/passwordless.service.js
+/**
+ * PasswordlessService — magic-link login.
+ *
+ * Flow:
+ *   1. POST /auth/magic-link  { email }  → creates a single-use token, emails it
+ *   2. GET  /auth/magic-link/verify?token=...  → validates, logs user in
+ *
+ * Tokens are short-lived (default 15 min) and single-use.
+ */
+const crypto = require('crypto');
+const ApiError = require('../utils/api-error');
+
+class PasswordlessService {
+  constructor(config = {}) {
+    this.config = config;
+    this.emailService = config.emailService;
+    this.tokenTtlMs = (config.passwordless && config.passwordless.tokenTtlMs) || 15 * 60 * 1000;
+  }
+
+  generateToken() {
+    return crypto.randomBytes(32).toString('hex');
+  }
+
+  async requestMagicLink(email, baseUrl) {
+    const User = require('../models/user');
+    const user = await User.findOne({ email });
+    // Don't reveal whether the email exists — just return success either way.
+    if (!user) return { sent: false, reason: 'user_not_found' };
+
+    const token = this.generateToken();
+    user.magicLinkToken = token;
+    user.magicLinkExpires = Date.now() + this.tokenTtlMs;
+    await user.save();
+
+    const linkPath = this.config.routes?.magicLink || '/auth/magic-link/verify';
+    const url = `${baseUrl || ''}${linkPath}?token=${token}`;
+
+    if (this.emailService) {
+      await this.emailService.sendMagicLink(user, url);
+    }
+
+    return { sent: true };
+  }
+
+  async verifyMagicLink(token) {
+    const User = require('../models/user');
+    const user = await User.findOne({
+      magicLinkToken: token,
+      magicLinkExpires: { $gt: Date.now() }
+    }).select('+magicLinkToken +magicLinkExpires');
+
+    if (!user) {
+      throw ApiError.invalidToken('Invalid or expired magic link');
+    }
+
+    // Single-use: consume the token.
+    user.magicLinkToken = undefined;
+    user.magicLinkExpires = undefined;
+    await user.save();
+
+    return user;
+  }
+}
+
+module.exports = PasswordlessService;

package/src/services/session.service.js

@@ -0,0 +1,100 @@
+// packages/auth/src/services/session.service.js
+/**
+ * SessionService — manages user sessions with a global "session version"
+ * stamp so that a password change, admin action, or logout-all can invalidate
+ * every existing JWT issued before the event.
+ *
+ * This is the backbone of true "log out everywhere" behaviour.
+ */
+const ApiError = require('../utils/api-error');
+
+class SessionService {
+  constructor(config = {}) {
+    this.config = config;
+    this.maxSessions = (config.session && config.session.maxSessions) || 5;
+    this.sessionExpiryMs =
+      (config.session && config.session.sessionExpiryMs) || 30 * 24 * 60 * 60 * 1000; // 30d
+  }
+
+  /**
+   * Bump the user's session version. Every existing JWT issued before this
+   * moment becomes invalid.
+   */
+  async bumpSessionVersion(user) {
+    user.sessionVersion = (user.sessionVersion || 0) + 1;
+    await user.save();
+    return user.sessionVersion;
+  }
+
+  /**
+   * Enforce per-user session cap. If the user has more active sessions than
+   * `maxSessions`, drop the oldest ones.
+   */
+  async enforceSessionCap(user) {
+    const sessions = user.sessions || [];
+    if (sessions.length <= this.maxSessions) return;
+
+    // sort oldest-first by createdAt
+    sessions.sort((a, b) => (a.createdAt || 0) - (b.createdAt || 0));
+    const toRemove = sessions.length - this.maxSessions;
+    sessions.splice(0, toRemove);
+    user.sessions = sessions;
+    await user.save();
+  }
+
+  /**
+   * Validate that a decoded JWT's sessionVersion matches the user's current
+   * version. If not, the session has been revoked globally.
+   */
+  validateSession(decoded, user) {
+    const tokenVersion = decoded.sessionVersion || 0;
+    const currentVersion = user.sessionVersion || 0;
+    if (tokenVersion !== currentVersion) {
+      throw ApiError.unauthorized(
+        'Session has been invalidated. Please log in again.'
+      );
+    }
+    return true;
+  }
+
+  /**
+   * Create a new session record for a user (used during login / social login).
+   */
+  async createSession(user, info = {}) {
+    const crypto = require('crypto');
+    const session = {
+      sessionId: crypto.randomBytes(16).toString('hex'),
+      userAgent: info.userAgent || 'unknown',
+      ip: info.ip || 'unknown',
+      createdAt: new Date()
+    };
+    user.sessions = user.sessions || [];
+    user.sessions.push(session);
+    await this.enforceSessionCap(user);
+    return session;
+  }
+
+  /**
+   * Revoke a single session by sessionId.
+   */
+  async revokeSession(user, sessionId) {
+    if (!user.sessions) return;
+    user.sessions = user.sessions.filter((s) => s.sessionId !== sessionId);
+    await user.save();
+  }
+
+  /**
+   * Revoke ALL sessions for a user (logout everywhere).
+   */
+  async revokeAllSessions(user) {
+    user.sessions = [];
+    await this.save(user);
+    return this.bumpSessionVersion(user);
+  }
+
+  async save(user) {
+    await user.save();
+  }
+}
+
+module.exports = SessionService;