@dax-crafta/auth 2.1.7 → 2.1.8

package/src/middlewares/auth.middleware.js

@@ -59,15 +59,25 @@ const createAuthMiddleware = (config) => {
 
   // Expose function to choose limiter per-route
   const limiterFor = (routeName) => {
-    switch (routeName) {
-      case 'login': return loginLimiter;
-      case '2fa': return twoFALimiter;
-      case 'forgotPassword': return forgotPasswordLimiter;
-      case 'refreshToken': return refreshLimiter;
-      case 'refresh': return refreshLimiter;
-      case 'register': return registerLimiter;
-      default: return genericLimiter;
+    const routeLimits = {
+      login: loginLimiter,
+      '2fa': twoFALimiter,
+      forgotPassword: forgotPasswordLimiter,
+      refreshToken: refreshLimiter,
+      refresh: refreshLimiter,
+      register: registerLimiter
+    };
+
+    if (config.limits && config.limits[routeName]) {
+      return rateLimit({
+        windowMs: 15 * 60 * 1000,
+        max: config.limits[routeName],
+        standardHeaders: true,
+        legacyHeaders: false
+      });
     }
+
+    return routeLimits[routeName] || genericLimiter;
   };
 
 
@@ -93,7 +103,7 @@ const createAuthMiddleware = (config) => {
     return null;
   };
 
-  const verifyToken = (req, res, next) => {
+  const verifyToken = async (req, res, next) => {
     const token = extractToken(req);
     if (!token) {
       return next(ApiError.unauthorized('No token provided'));
@@ -101,6 +111,17 @@ const createAuthMiddleware = (config) => {
 
     try {
       const decoded = jwt.verify(token, config.env.JWT_SECRET);
+
+      // Validate session version and IP binding if sessionService is available
+      if (req.app && req.app.sessionService) {
+        const User = require('../models/user');
+        const user = await User.findById(decoded.id);
+        if (!user) {
+          return next(ApiError.unauthorized('User not found'));
+        }
+        req.app.sessionService.validateSession(decoded, user, req.ip);
+      }
+
       // keep minimal user data on req.user
       req.user = { id: decoded.id, role: decoded.role, email: decoded.email };
       next();

package/src/models/user.js

@@ -48,7 +48,8 @@ const userSchema = new mongoose.Schema({
     sessionId: String,
     userAgent: String,
     ip: String,
-    createdAt: { type: Date, default: Date.now }
+    createdAt: { type: Date, default: Date.now },
+    lastActiveAt: { type: Date, default: Date.now }
   }],
   isVerified: { type: Boolean, default: false },
   verificationToken: { type: String, select: false },

package/src/services/audit.service.js

@@ -50,6 +50,72 @@ class AuditService {
       timestamp: { $gte: since }
     });
   }
+
+  /**
+   * Returns login attempt analytics including success rate, top failure reasons,
+   * and time-based patterns (hourly breakdown).
+   * @param {Object} filters - Optional filters like startDate, endDate, userId
+   */
+  async getLoginAttemptAnalytics(filters = {}) {
+    const query = { action: 'login' };
+    if (filters.userId) {
+      query.userId = filters.userId;
+    }
+    if (filters.startDate || filters.endDate) {
+      query.timestamp = {};
+      if (filters.startDate) query.timestamp.$gte = new Date(filters.startDate);
+      if (filters.endDate) query.timestamp.$lte = new Date(filters.endDate);
+    }
+
+    const totalAttempts = await AuditLog.countDocuments(query);
+    const successfulAttempts = await AuditLog.countDocuments({ ...query, status: 'success' });
+    const failedAttempts = await AuditLog.countDocuments({ ...query, status: 'failure' });
+
+    const successRate = totalAttempts > 0
+      ? Number(((successfulAttempts / totalAttempts) * 100).toFixed(2))
+      : 0;
+
+    // Top failure reasons from details.error
+    const topFailures = await AuditLog.aggregate([
+      { $match: { ...query, status: 'failure' } },
+      { $group: { _id: { $ifNull: ['$details.error', 'Unknown reason'] }, count: { $sum: 1 } } },
+      { $sort: { count: -1 } },
+      { $limit: 5 },
+      { $project: { reason: '$_id', count: 1, _id: 0 } }
+    ]);
+
+    // Time-based patterns: hourly distribution (0-23)
+    const timeBasedPatterns = await AuditLog.aggregate([
+      { $match: query },
+      {
+        $group: {
+          _id: { $hour: '$timestamp' },
+          total: { $sum: 1 },
+          success: { $sum: { $cond: [{ $eq: ['$status', 'success'] }, 1, 0] } },
+          failure: { $sum: { $cond: [{ $eq: ['$status', 'failure'] }, 1, 0] } }
+        }
+      },
+      { $sort: { _id: 1 } },
+      {
+        $project: {
+          hour: '$_id',
+          total: 1,
+          success: 1,
+          failure: 1,
+          _id: 0
+        }
+      }
+    ]);
+
+    return {
+      totalAttempts,
+      successfulAttempts,
+      failedAttempts,
+      successRate: `${successRate}%`,
+      topFailures,
+      timeBasedPatterns
+    };
+  }
 }
 
 module.exports = AuditService;

package/src/services/auth.service.js

@@ -110,6 +110,9 @@ class AuthService {
       await this.emailService.sendLoginAlert(user, deviceInfo);
     }
 
+    // Regenerate session ID on login if configured
+    await this.regenerateSessionIdOnLogin(user);
+
     const tokens = await this.generateTokens(user);
     return { ...tokens, user };
   }
@@ -306,31 +309,43 @@ class AuthService {
     const now = Date.now();
     const lockUntil = now + 60 * 60 * 1000;
 
-    user.loginAttempts = (user.loginAttempts || 0) + 1;
+    // Perform atomic increment in DB to prevent concurrent race conditions
+    const updatedUser = await User.findOneAndUpdate(
+      { _id: user._id },
+      { $inc: { loginAttempts: 1 } },
+      { new: true }
+    );
 
-    if (user.loginAttempts >= MAX) {
-      user.lockUntil = lockUntil;
-      await user.save();
-      await this.emailService.sendAccountLockEmail(user);
+    if (updatedUser && updatedUser.loginAttempts >= MAX) {
+      updatedUser.lockUntil = lockUntil;
+      await updatedUser.save();
+      await this.emailService.sendAccountLockEmail(updatedUser);
       await this.logAudit({
-        userId: user._id,
+        userId: updatedUser._id,
         action: 'account_locked',
         status: 'success'
       });
-      return;
     }
 
-    await user.save();
+    // Sync local user instance state
+    user.loginAttempts = updatedUser ? updatedUser.loginAttempts : (user.loginAttempts + 1);
+    if (user.loginAttempts >= MAX) {
+      user.lockUntil = lockUntil;
+    }
   }
 
   /* ---------------------------------------------
         LOGOUT
   --------------------------------------------- */
-  async logout(userId, sessionId) {
+  async logout(userId, sessionId, refreshToken = null) {
     const user = await User.findById(userId);
     if (!user) throw ApiError.notFound();
 
     await user.revokeSession(sessionId);
+    // Also revoke the refresh token so it cannot be reused
+    if (refreshToken) {
+      await user.revokeRefreshToken(refreshToken);
+    }
     await user.save();
 
     await this.logAudit({
@@ -381,6 +396,18 @@ class AuthService {
     return user;
   }
 
+  /* ---------------------------------------------
+        REGENERATE SESSION ID ON LOGIN
+  --------------------------------------------- */
+  async regenerateSessionIdOnLogin(user) {
+    // Opt-in only — bumping sessionVersion on every login invalidates all
+    // existing sessions, which breaks normal multi-session usage.
+    if (this.config?.session?.regenerateSessionIdOnLogin === true) {
+      user.sessionVersion = (user.sessionVersion || 0) + 1;
+      await user.save();
+    }
+  }
+
 
 
   /* ---------------------------------------------

package/src/services/role.service.js

@@ -1,7 +1,12 @@
 const Role = require('../models/role');
+const ApiError = require('../utils/api-error');
 
 class RoleService {
   async createRole(roleData) {
+    const existing = await Role.findOne({ name: roleData.name });
+    if (existing) {
+      throw ApiError.conflict(`Role "${roleData.name}" already exists`);
+    }
     const role = new Role(roleData);
     await role.save();
     return role;

package/src/services/session.service.js

@@ -14,6 +14,7 @@ class SessionService {
     this.maxSessions = (config.session && config.session.maxSessions) || 5;
     this.sessionExpiryMs =
       (config.session && config.session.sessionExpiryMs) || 30 * 24 * 60 * 60 * 1000; // 30d
+    this.ipBinding = (config.session && config.session.ipBinding) || false;
   }
 
   /**
@@ -46,7 +47,7 @@ class SessionService {
    * Validate that a decoded JWT's sessionVersion matches the user's current
    * version. If not, the session has been revoked globally.
    */
-  validateSession(decoded, user) {
+  validateSession(decoded, user, currentIp = null) {
     const tokenVersion = decoded.sessionVersion || 0;
     const currentVersion = user.sessionVersion || 0;
     if (tokenVersion !== currentVersion) {
@@ -54,26 +55,66 @@ class SessionService {
         'Session has been invalidated. Please log in again.'
       );
     }
+
+    if (this.ipBinding && currentIp && decoded.ip && decoded.ip !== currentIp) {
+      throw ApiError.unauthorized(
+        'Session IP address mismatch. Please log in again.'
+      );
+    }
+
     return true;
   }
 
   /**
    * Create a new session record for a user (used during login / social login).
+   *
+   * Tracks device info (userAgent, IP) and timestamps. If a session for the
+   * same device already exists, updates its activity timestamp instead of
+   * creating a duplicate — preventing session bloat from repeated logins.
    */
   async createSession(user, info = {}) {
     const crypto = require('crypto');
+    const userAgent = info.userAgent || 'unknown';
+    const ip = info.ip || 'unknown';
+
+    user.sessions = user.sessions || [];
+
+    // Reuse an existing session from the same device: refresh activity stamp.
+    const existing = user.sessions.find(
+      (s) => s.userAgent === userAgent && s.ip === ip
+    );
+    if (existing) {
+      existing.lastActiveAt = new Date();
+      await this.enforceSessionCap(user);
+      return existing;
+    }
+
     const session = {
       sessionId: crypto.randomBytes(16).toString('hex'),
-      userAgent: info.userAgent || 'unknown',
-      ip: info.ip || 'unknown',
-      createdAt: new Date()
+      userAgent,
+      ip,
+      createdAt: new Date(),
+      lastActiveAt: new Date()
     };
-    user.sessions = user.sessions || [];
     user.sessions.push(session);
     await this.enforceSessionCap(user);
     return session;
   }
 
+  /**
+   * Touch a session's activity timestamp (e.g. on token refresh).
+   * No-op if the session is not found.
+   */
+  async touchSession(user, sessionId) {
+    if (!user.sessions) return null;
+    const session = user.sessions.find((s) => s.sessionId === sessionId);
+    if (session) {
+      session.lastActiveAt = new Date();
+      await user.save();
+    }
+    return session;
+  }
+
   /**
    * Revoke a single session by sessionId.
    */

package/src/services/webhook.service.js

@@ -19,6 +19,13 @@ class WebhookService {
     this.events = this.enabled
       ? config.webhooks.events || ['user.registered', 'user.login', 'user.logout', 'user.password_changed']
       : [];
+    this.deliveryStats = {
+      total: 0,
+      success: 0,
+      failure: 0,
+      lastEvent: null,
+      lastStatus: null
+    };
   }
 
   /**
@@ -71,8 +78,18 @@ class WebhookService {
           res.setEncoding('utf8');
           res.on('data', (chunk) => (payload += chunk));
           res.on('end', () => {
+            const success = res.statusCode >= 200 && res.statusCode < 300;
+            this.deliveryStats.total++;
+            if (success) {
+              this.deliveryStats.success++;
+            } else {
+              this.deliveryStats.failure++;
+            }
+            this.deliveryStats.lastEvent = event;
+            this.deliveryStats.lastStatus = res.statusCode;
+
             resolve({
-              delivered: res.statusCode >= 200 && res.statusCode < 300,
+              delivered: success,
               status: res.statusCode,
               body: payload.slice(0, 500)
             });
@@ -81,13 +98,37 @@ class WebhookService {
       );
 
       req.on('error', (err) => {
+        this.deliveryStats.total++;
+        this.deliveryStats.failure++;
+        this.deliveryStats.lastEvent = event;
+        this.deliveryStats.lastStatus = 'error';
+
         resolve({ delivered: false, reason: err.message });
       });
 
+      req.setTimeout(5000, () => {
+        req.destroy();
+        resolve({ delivered: false, reason: 'request_timeout' });
+      });
+
       req.write(body);
       req.end();
     });
   }
+
+  /**
+   * Returns delivery monitoring statistics.
+   */
+  getDeliveryStatus() {
+    const rate = this.deliveryStats.total > 0
+      ? (this.deliveryStats.success / this.deliveryStats.total) * 100
+      : 0;
+
+    return {
+      ...this.deliveryStats,
+      successRate: `${rate.toFixed(2)}%`
+    };
+  }
 }
 
 module.exports = WebhookService;

package/src/utils/email.js

@@ -61,9 +61,10 @@ class EmailService {
 
     let content = fs.readFileSync(filePath, "utf8");
 
-    // Replace {{variable}}
-    for (const key of Object.keys(variables)) {
-      content = content.replace(new RegExp(`{{${key}}}`, "g"), variables[key]);
+    // Replace {{variable}} using a safer approach
+    for (const [key, value] of Object.entries(variables)) {
+      const regex = new RegExp(`{{\\s*${key}\\s*}}`, "g");
+      content = content.replace(regex, value);
     }
 
     return content;

package/src/utils/password-policy.js

@@ -1,5 +1,6 @@
 // packages/auth/src/utils/password-policy.js
 const zxcvbn = require('zxcvbn');
+const { getPasswordStrength } = require('./password-strength');
 
 class PasswordPolicy {
   constructor(config = {}) {
@@ -37,10 +38,14 @@ class PasswordPolicy {
     if (strength.score < this.config.minStrength)
       errors.push('Password is too weak. Please choose a stronger password');
 
+    // Lightweight heuristic strength score (0-4), complementing zxcvbn
+    const heuristicScore = getPasswordStrength(password);
+
     return {
       isValid: errors.length === 0,
       errors,
-      strength: strength.score
+      strength: strength.score,
+      strengthScore: heuristicScore
     };
   }
 

package/src/utils/password-strength.js

@@ -0,0 +1,68 @@
+// packages/auth/src/utils/password-strength.js
+/**
+ * Password strength scoring utility.
+ *
+ * Returns a strength score from 0 (very weak) to 4 (very strong) based on
+ * length, character variety, and common-pattern detection.
+ *
+ * This complements the zxcvbn-based strength check inside PasswordPolicy,
+ * providing a lightweight, dependency-free heuristic for quick feedback.
+ */
+const COMMON_PASSWORDS = [
+  'password', '123456', '12345678', '123456789', 'qwerty', 'abc123',
+  '111111', '123123', 'admin', 'letmein', 'welcome', 'monkey',
+  'football', 'iloveyou', 'sunshine', 'princess', 'dragon', 'baseball'
+];
+
+const COMMON_SEQUENCES = [
+  'abcdefghijklmnopqrstuvwxyz',
+  '0123456789',
+  'qwertyuiop',
+  'asdfghjkl',
+  'zxcvbnm'
+];
+
+function hasCommonSequence(password, length) {
+  const lower = password.toLowerCase();
+  for (const seq of COMMON_SEQUENCES) {
+    for (let i = 0; i + length <= seq.length; i++) {
+      if (lower.includes(seq.slice(i, i + length))) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Calculate a strength score (0-4) for a password.
+ *
+ * @param {string} password - The password to evaluate.
+ * @returns {number} Score from 0 (very weak) to 4 (very strong).
+ */
+function getPasswordStrength(password) {
+  if (!password || typeof password !== 'string') return 0;
+
+  const lower = password.toLowerCase();
+  const hasLower = /[a-z]/.test(password);
+  const hasUpper = /[A-Z]/.test(password);
+  const hasNumber = /\d/.test(password);
+  const hasSpecial = /[^a-zA-Z0-9]/.test(password);
+
+  let score = 0;
+
+  // Length scoring
+  if (password.length >= 8) score++;
+  if (password.length >= 12) score++;
+
+  // Complexity scoring
+  const varietyCount = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+  if (varietyCount >= 3) score++;
+
+  // Penalize common patterns
+  if (COMMON_PASSWORDS.includes(lower)) return 0;
+  if (hasCommonSequence(password, 3)) score--;
+  if (/(.)\1{2,}/.test(password)) score--; // repeated chars like "aaa"
+
+  return Math.max(0, Math.min(4, score));
+}
+
+module.exports = { getPasswordStrength };

package/test/01-register-login.test.js

@@ -0,0 +1,134 @@
+/**
+ * 01 — Register, login, refresh, logout, profile
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('01-register-login', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+  });
+  after(async () => { await stopApp(); });
+
+  it('register creates a user', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Test User',
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 201, `expected 201, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.success, true);
+    assert.strictEqual(res.body.message, 'Registration successful');
+  });
+
+  it('register rejects duplicate email', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Dup User',
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 409, `expected 409, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_CONFLICT');
+  });
+
+  it('register rejects weak password', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Weak User',
+      email: 'weak@example.com',
+      password: 'abc',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.error || res.body.code, 'should have error message');
+  });
+
+  it('login succeeds with valid creds', async () => {
+    const res = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.ok(res.body.accessToken);
+    assert.ok(res.body.refreshToken);
+  });
+
+  it('login rejects wrong password', async () => {
+    const res = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Wrong@Pass1',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_CREDENTIALS');
+  });
+
+  it('login rejects unknown email', async () => {
+    const res = await req('POST', '/login', {
+      email: 'nobody@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_CREDENTIALS');
+  });
+
+  it('refresh token rotates and old token is invalidated', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const oldRefresh = login.body.refreshToken;
+
+    const refresh = await req('POST', '/refresh-token', { refreshToken: oldRefresh });
+    assert.strictEqual(refresh.status, 200, `expected 200, got ${refresh.status}`);
+    assert.ok(refresh.body.accessToken);
+    assert.notStrictEqual(refresh.body.refreshToken, oldRefresh, 'refresh token should rotate');
+
+    // Old token must be rejected
+    const reuse = await req('POST', '/refresh-token', { refreshToken: oldRefresh });
+    assert.strictEqual(reuse.status, 401, `old refresh token should be rejected, got ${reuse.status}`);
+    assert.strictEqual(reuse.body.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('protected profile returns user data with valid token', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('PUT', '/profile', { name: 'Test User Updated' }, {
+      Authorization: `Bearer ${login.body.accessToken}`,
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.user.email, 'alice@example.com');
+  });
+
+  it('protected route rejects missing token', async () => {
+    const res = await req('PUT', '/profile', { name: 'X' });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_UNAUTHORIZED');
+  });
+
+  it('protected route rejects invalid token', async () => {
+    const res = await req('PUT', '/profile', { name: 'X' }, {
+      Authorization: 'Bearer not-a-real-token',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('logout revokes refresh token', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const logout = await req('POST', '/logout', { refreshToken: login.body.refreshToken }, {
+      Authorization: `Bearer ${login.body.accessToken}`,
+    });
+    assert.strictEqual(logout.status, 200, `expected 200, got ${logout.status} ${JSON.stringify(logout.body)}`);
+
+    // Refresh token should now be dead
+    const after = await req('POST', '/refresh-token', { refreshToken: login.body.refreshToken });
+    assert.strictEqual(after.status, 401, `expected 401 after logout, got ${after.status}`);
+  });
+});