@metaadri/secureauth 1.0.0

package/bin/cli.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+
+const { init } = require('../src/index');
+
+const command = process.argv[2];
+
+switch (command) {
+  case 'init':
+    init();
+    break;
+  case '--help':
+  case '-h':
+  default:
+    console.log(`
+  SecureAuth CLI - Enterprise authentication for Express apps
+
+  Usage:
+    npx secureauth init    Add SecureAuth to your project
+    npx secureauth --help  Show this help message
+    `);
+    break;
+}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@metaadri/secureauth",
+  "publishConfig": {
+    "access": "public"
+  },
+  "version": "1.0.0",
+  "description": "SecureAuth CLI - Add enterprise authentication to any Express app in one command",
+  "bin": {
+    "secureauth": "./bin/cli.js"
+  },
+  "keywords": [
+    "secureauth",
+    "authentication",
+    "2fa",
+    "totp",
+    "jwt",
+    "security",
+    "express",
+    "cli"
+  ],
+  "author": "Bwalya Adrian Mange",
+  "license": "MIT",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "enquirer": "^2.4.1"
+  }
+}

package/src/detector.js

@@ -0,0 +1,74 @@
+const fs = require('fs');
+const path = require('path');
+
+const REQUIRED_DIRS = ['controllers', 'routes', 'middleware', 'models', 'utils', 'database'];
+const SECUREAUTH_DEPS = [
+  'express', 'bcryptjs', 'jsonwebtoken', 'helmet',
+  'express-rate-limit', 'express-slow-down', 'speakeasy',
+  'qrcode', 'dotenv', 'cors', 'uuid'
+];
+
+function detect(dir) {
+  const report = {
+    hasPackageJson: false,
+    hasExpress: false,
+    hasExpressInstalled: false,
+    hasSecureAuthDirs: false,
+    hasEnvFile: false,
+    existingDirs: [],
+    missingDirs: [],
+    installedDeps: [],
+    missingDeps: [],
+    packageJson: null,
+    projectName: path.basename(dir)
+  };
+
+  const pkgPath = path.join(dir, 'package.json');
+  if (fs.existsSync(pkgPath)) {
+    report.hasPackageJson = true;
+    try {
+      report.packageJson = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+    } catch {
+      return report;
+    }
+
+    const allDeps = {
+      ...report.packageJson.dependencies,
+      ...report.packageJson.devDependencies
+    };
+    report.installedDeps = Object.keys(allDeps);
+
+    report.hasExpress = 'express' in allDeps;
+    report.hasExpressInstalled = false;
+
+    const nodeModulesExpress = path.join(dir, 'node_modules', 'express');
+    if (fs.existsSync(nodeModulesExpress)) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(nodeModulesExpress, 'package.json'), 'utf-8'));
+        report.hasExpressInstalled = true;
+      } catch {}
+    }
+
+    report.missingDeps = SECUREAUTH_DEPS.filter(d => !(d in allDeps));
+  }
+
+  const existingDirs = [];
+  const missingDirs = [];
+  for (const d of REQUIRED_DIRS) {
+    const full = path.join(dir, d);
+    if (fs.existsSync(full) && fs.statSync(full).isDirectory()) {
+      existingDirs.push(d);
+    } else {
+      missingDirs.push(d);
+    }
+  }
+  report.existingDirs = existingDirs;
+  report.missingDirs = missingDirs;
+  report.hasSecureAuthDirs = missingDirs.length === 0;
+
+  report.hasEnvFile = fs.existsSync(path.join(dir, '.env'));
+
+  return report;
+}
+
+module.exports = { detect };

package/src/generator.js

@@ -0,0 +1,79 @@
+const { logger } = require('./logger');
+
+function buildEnvContent(answers) {
+  const lines = [];
+
+  lines.push('# SecureAuth Configuration (Node.js/Express)');
+  lines.push('# Auto-generated by SecureAuth CLI');
+  lines.push('');
+
+  lines.push('# ── Server Configuration ──');
+  lines.push(`PORT=${answers.port}`);
+  lines.push('NODE_ENV=development');
+  lines.push('');
+
+  lines.push('# ── JWT Configuration ──');
+  lines.push(`JWT_SECRET=${answers.jwtSecret}`);
+  lines.push('JWT_ALGORITHM=HS256');
+  lines.push('JWT_TEMP_EXPIRY_MINUTES=5');
+  lines.push('JWT_FULL_EXPIRY_HOURS=24');
+  lines.push('');
+
+  lines.push('# ── Bcrypt Configuration ──');
+  lines.push('BCRYPT_ROUNDS=12');
+  lines.push('');
+
+  lines.push('# ── TOTP Configuration ──');
+  lines.push(`TOTP_ISSUER=${answers.projectName || 'SecureAuth-App'}`);
+  lines.push('TOTP_WINDOW=1');
+  lines.push('');
+
+  if (answers.features && answers.features.includes('accountLockout')) {
+    lines.push('# ── Account Lockout ──');
+    lines.push('INACTIVITY_TIMEOUT_MINUTES=5');
+    lines.push('MAX_FAILED_ATTEMPTS=5');
+    lines.push('LOCKOUT_DURATION_MINUTES=30');
+    lines.push('');
+  }
+
+  lines.push('# ── Database Configuration ──');
+  if (answers.database === 'postgres') {
+    lines.push('# For PostgreSQL, provide your connection string below');
+    lines.push('# Format: postgresql://user:password@host:5432/database');
+    lines.push('DATABASE_URL=postgresql://user:password@localhost:5432/secureauth');
+  } else {
+    lines.push('# SQLite — local database file (zero config)');
+    lines.push('DATABASE_URL=./secureauth.db');
+  }
+  lines.push('');
+
+  if (answers.features && answers.features.includes('ddos')) {
+    lines.push('# ── DDoS Protection Limits ──');
+    lines.push('MAX_REQUEST_SIZE=100kb');
+    lines.push('MAX_REQUESTS_PER_MINUTE=60');
+    lines.push('AUTO_BAN_THRESHOLD=100');
+    lines.push('BAN_DURATION_MINUTES=30');
+    lines.push('MAX_CONCURRENT_CONNECTIONS=100');
+    lines.push('');
+  }
+
+  return lines.join('\n');
+}
+
+function writeEnvFile(targetDir, answers) {
+  const fs = require('fs');
+  const path = require('path');
+  const envPath = path.join(targetDir, '.env');
+
+  if (fs.existsSync(envPath)) {
+    logger.warn('.env already exists — skipping (delete it first to regenerate)');
+    return false;
+  }
+
+  const content = buildEnvContent(answers);
+  fs.writeFileSync(envPath, content, 'utf-8');
+  logger.success('.env created with secure defaults');
+  return true;
+}
+
+module.exports = { writeEnvFile, buildEnvContent };

package/src/index.js

@@ -0,0 +1,127 @@
+const path = require('path');
+const fs = require('fs');
+const { logger } = require('./logger');
+const { detect } = require('./detector');
+const { printReport } = require('./reporter');
+const { install } = require('./installer');
+const { writeEnvFile } = require('./generator');
+const { scaffold } = require('./scaffolder');
+const {
+  askProjectType,
+  askProjectName,
+  askDatabase,
+  askPort,
+  askJwtSecret,
+  askFeatures,
+  askConfirm
+} = require('./questions');
+
+const FEATURE_LABELS = {
+  ddos: 'DDoS Protection',
+  admin: 'Admin Dashboard',
+  accountLockout: 'Account Lockout'
+};
+
+function printSuccess(answers, filesCreated) {
+  const features = answers.features && answers.features.length > 0
+    ? answers.features.map(f => '    ' + logger.bullet() + ' ' + (FEATURE_LABELS[f] || f)).join('\n')
+    : '    (none selected — core auth only)';
+
+  logger.box(`
+${logger.checkmark()} SecureAuth installed successfully!
+
+  Files generated:  ${filesCreated}
+  Database:         ${answers.database}
+  Port:             ${answers.port}
+
+  Features enabled:
+${features}
+
+${logger.separator('Quick Start')}
+
+  ${logger.bold('npm start')}
+  ${logger.arrow()} http://localhost:${answers.port}
+
+${logger.separator('API Endpoints')}
+
+  ${logger.dim('Auth')}
+    POST /api/register       Register + 2FA setup
+    POST /api/login          Login (step 1 — password)
+    POST /api/verify-2fa     Login (step 2 — TOTP code)
+    POST /api/refresh        Refresh access token
+
+  ${logger.dim('Protected')}
+    GET  /api/dashboard      User dashboard
+    GET  /api/login-history  Login history${answers.features && answers.features.includes('admin') ? `
+
+  ${logger.dim('Admin')}
+    GET  /api/admin/users    List all users
+    GET  /api/admin/logs     System audit logs
+    GET  /api/admin/stats    System statistics` : ''}
+
+  ${logger.dim('System')}
+    GET  /api/health         Health check
+
+${logger.separator('Demo Credentials')}
+
+  ${logger.bold('User:')}  demo@secureauth.com / Demo@123
+  ${logger.bold('Admin:')} admin@secureauth.com / AdminPassword123!
+
+${logger.separator('Next Steps')}
+
+  1. Review .env and customize settings
+  2. Run ${logger.bold('npm start')}
+  3. Open ${logger.underline('http://localhost:' + answers.port)}
+  4. Register at POST /api/register
+`);
+}
+
+async function init() {
+  logger.banner();
+
+  const targetDir = process.cwd();
+
+  const report = detect(targetDir);
+  printReport(report);
+  logger.info('');
+
+  const projectType = report.hasPackageJson
+    ? 'existing'
+    : await askProjectType();
+
+  const answers = { projectName: report.projectName };
+
+  if (projectType === 'new') {
+    answers.projectName = await askProjectName();
+  }
+
+  answers.database = await askDatabase();
+  answers.port = await askPort(3000);
+  answers.jwtSecret = await askJwtSecret();
+  answers.features = await askFeatures();
+
+  logger.info('');
+  const confirmed = await askConfirm();
+  if (!confirmed) {
+    logger.warn('Installation cancelled.');
+    return;
+  }
+
+  logger.success('Starting SecureAuth installation...');
+  logger.info(`Project:   ${answers.projectName}`);
+  logger.info(`Database:  ${answers.database}`);
+  logger.info(`Port:      ${answers.port}`);
+  logger.info(`Features:  ${answers.features.join(', ') || 'none'}`);
+
+  logger.info('');
+
+  await install(targetDir, report.missingDeps, answers);
+
+  const filesCreated = scaffold(targetDir, answers);
+
+  writeEnvFile(targetDir, answers);
+
+  printSuccess(answers, filesCreated);
+}
+
+module.exports = { init };

package/src/installer.js

@@ -0,0 +1,65 @@
+const { spawn } = require('child_process');
+const { logger } = require('./logger');
+
+const DB_DRIVERS = {
+  sqlite: 'better-sqlite3',
+  postgres: 'pg'
+};
+
+function install(cwd, missingDeps, answers) {
+  return new Promise((resolve, reject) => {
+    const dbDriver = DB_DRIVERS[answers.database];
+    const allDeps = [...missingDeps];
+
+    if (dbDriver && !allDeps.includes(dbDriver)) {
+      allDeps.push(dbDriver);
+    }
+
+    if (allDeps.length === 0) {
+      logger.success('All dependencies already installed');
+      return resolve();
+    }
+
+    logger.info(`Installing ${allDeps.length} packages: ${allDeps.join(', ')}`);
+    logger.info('');
+
+    const args = ['install', ...allDeps, '--save', '--progress=false'];
+
+    const child = spawn('npm', args, {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: true
+    });
+
+    let output = '';
+
+    child.stdout.on('data', data => {
+      output += data.toString();
+    });
+
+    child.stderr.on('data', data => {
+      const line = data.toString().trim();
+      if (line && !line.startsWith('npm WARN')) {
+        output += line + '\n';
+      }
+    });
+
+    child.on('close', code => {
+      if (code === 0) {
+        logger.success('Dependencies installed successfully');
+        resolve();
+      } else {
+        logger.error('npm install failed');
+        logger.error(`Exit code: ${code}`);
+        reject(new Error(`npm install exited with code ${code}`));
+      }
+    });
+
+    child.on('error', err => {
+      logger.error(`Failed to start npm: ${err.message}`);
+      reject(err);
+    });
+  });
+}
+
+module.exports = { install };

package/src/logger.js

@@ -0,0 +1,62 @@
+const chalk = require('chalk');
+
+const logger = {
+  info(msg) {
+    console.log(chalk.blue('ℹ'), msg);
+  },
+  success(msg) {
+    console.log(chalk.green('✔'), msg);
+  },
+  warn(msg) {
+    console.log(chalk.yellow('⚠'), msg);
+  },
+  error(msg) {
+    console.log(chalk.red('✖'), msg);
+  },
+  banner() {
+    console.log(`
+${chalk.cyan('╔══════════════════════════════════════════╗')}
+${chalk.cyan('║')}  ${chalk.bold('SecureAuth CLI')}                    ${chalk.cyan('║')}
+${chalk.cyan('║')}  Enterprise Authentication for Express   ${chalk.cyan('║')}
+${chalk.cyan('╚══════════════════════════════════════════╝')}
+`);
+  },
+  box(content) {
+    const lines = content.split('\n');
+    const width = 70;
+    const top = chalk.cyan('╔' + '═'.repeat(width - 2) + '╗');
+    const bottom = chalk.cyan('╚' + '═'.repeat(width - 2) + '╝');
+    console.log('\n' + top);
+    for (const line of lines) {
+      const stripped = line.replace(/\u001b\[[0-9;]*m/g, '');
+      const padding = width - 4 - stripped.length;
+      console.log(chalk.cyan('║') + ' ' + line + ' '.repeat(Math.max(0, padding)) + chalk.cyan('║'));
+    }
+    console.log(bottom + '\n');
+  },
+
+  bullet() {
+    return chalk.cyan('•');
+  },
+  checkmark() {
+    return chalk.green('✔');
+  },
+  separator(label) {
+    const line = '─'.repeat(30);
+    return chalk.dim(line + ' ' + label + ' ' + line);
+  },
+  bold(text) {
+    return chalk.bold(text);
+  },
+  dim(text) {
+    return chalk.dim(text);
+  },
+  arrow() {
+    return chalk.cyan('→');
+  },
+  underline(text) {
+    return chalk.underline(text);
+  }
+};
+
+module.exports = { logger };

package/src/questions.js

@@ -0,0 +1,110 @@
+const { prompt } = require('enquirer');
+
+async function askProjectType() {
+  const { type } = await prompt({
+    type: 'select',
+    name: 'type',
+    message: 'What kind of project is this?',
+    choices: [
+      { name: 'existing', message: 'Existing Express project — add SecureAuth to it' },
+      { name: 'new', message: 'New project — scaffold from scratch' }
+    ]
+  });
+  return type;
+}
+
+async function askProjectName() {
+  const { name } = await prompt({
+    type: 'input',
+    name: 'name',
+    message: 'What is your project name?',
+    initial: 'my-secure-app',
+    required: true,
+    validate: v => /^[a-z0-9-]+$/.test(v) || 'Use lowercase letters, numbers, and hyphens only'
+  });
+  return name;
+}
+
+async function askDatabase() {
+  const { db } = await prompt({
+    type: 'select',
+    name: 'db',
+    message: 'Which database do you want to use?',
+    choices: [
+      { name: 'sqlite', message: 'SQLite — Zero config, best for development' },
+      { name: 'postgres', message: 'PostgreSQL — Production-grade, requires a running server' }
+    ],
+    initial: 0
+  });
+  return db;
+}
+
+async function askPort(defaultPort) {
+  const { port } = await prompt({
+    type: 'input',
+    name: 'port',
+    message: 'Which port should the server run on?',
+    initial: String(defaultPort),
+    required: true,
+    validate: v => /^\d+$/.test(v) || 'Enter a valid port number'
+  });
+  return parseInt(port, 10);
+}
+
+async function askJwtSecret() {
+  const autoSecret = require('crypto').randomBytes(32).toString('hex');
+  const { choice } = await prompt({
+    type: 'select',
+    name: 'choice',
+    message: 'JWT Secret — auto-generate or enter your own?',
+    choices: [
+      { name: 'auto', message: `Auto-generate a secure secret` },
+      { name: 'manual', message: 'Enter my own secret' }
+    ]
+  });
+  if (choice === 'auto') return autoSecret;
+  const { secret } = await prompt({
+    type: 'invisible',
+    name: 'secret',
+    message: 'Enter your JWT secret:',
+    required: true,
+    validate: v => v.length >= 32 || 'Secret must be at least 32 characters'
+  });
+  return secret;
+}
+
+async function askFeatures() {
+  const { features } = await prompt({
+    type: 'multiselect',
+    name: 'features',
+    message: 'Select additional features to enable:',
+    choices: [
+      { name: 'ddos', message: 'DDoS Protection — Rate limiting + IP blocking' },
+      { name: 'admin', message: 'Admin Dashboard — User management panel' },
+      { name: 'accountLockout', message: 'Account Lockout — Brute-force protection' }
+    ],
+    initial: [0, 2]
+  });
+  return features;
+}
+
+async function askConfirm() {
+  const { confirmed } = await prompt({
+    type: 'toggle',
+    name: 'confirmed',
+    message: 'Ready to install SecureAuth?',
+    enabled: 'Yes',
+    disabled: 'No'
+  });
+  return confirmed;
+}
+
+module.exports = {
+  askProjectType,
+  askProjectName,
+  askDatabase,
+  askPort,
+  askJwtSecret,
+  askFeatures,
+  askConfirm
+};

package/src/reporter.js

@@ -0,0 +1,45 @@
+const { logger } = require('./logger');
+
+function printReport(report) {
+  logger.info(`Project: ${report.projectName}`);
+
+  if (!report.hasPackageJson) {
+    logger.warn('No package.json found — will scaffold from scratch');
+    return;
+  }
+
+  if (report.hasExpress) {
+    logger.success('Express detected in dependencies');
+
+    if (report.hasExpressInstalled) {
+      logger.success('Express is already installed in node_modules');
+    } else {
+      logger.warn('Express declared but not installed — will install');
+    }
+  } else {
+    logger.warn('Express not found — will add it');
+  }
+
+  if (report.missingDeps.length === 0) {
+    logger.success('All SecureAuth dependencies already installed');
+  } else {
+    logger.info(`${report.missingDeps.length} packages to install: ${report.missingDeps.join(', ')}`);
+  }
+
+  if (report.hasSecureAuthDirs) {
+    logger.success('All SecureAuth folders already exist');
+  } else {
+    if (report.existingDirs.length > 0) {
+      logger.info(`Found folders: ${report.existingDirs.join(', ')}`);
+    }
+    logger.info(`Will create: ${report.missingDirs.join(', ')}`);
+  }
+
+  if (report.hasEnvFile) {
+    logger.warn('.env file exists — will not overwrite');
+  } else {
+    logger.info('No .env file — will create one');
+  }
+}
+
+module.exports = { printReport };