@metaadri/secureauth 1.0.0

package/src/scaffolder.js

@@ -0,0 +1,157 @@
+const fs = require('fs');
+const path = require('path');
+const { logger } = require('./logger');
+
+const REQUIRED_DIRS = ['controllers', 'routes', 'middleware', 'models', 'utils', 'database'];
+
+const LOCKOUT_HELPER = `
+async function checkAccountLockout(user) {
+  if (user.locked_until) {
+    const lockedUntil = new Date(user.locked_until);
+    if (lockedUntil > new Date()) {
+      const minutesLeft = Math.ceil((lockedUntil - new Date()) / 60000);
+      throw { status: 423, message: \`Account locked due to too many failed attempts. Try again in \${minutesLeft} minute(s).\` };
+    }
+  }
+}
+`;
+
+const LOCKOUT_CHECK_CODE = `
+    try {
+      await checkAccountLockout(user);
+    } catch (lockErr) {
+      await insertAuditLog(user.id, 'login_attempt_locked', req.ip || 'unknown', req.get('User-Agent') || 'unknown');
+      return res.status(lockErr.status || 423).json({
+        error: 'Account locked',
+        message: lockErr.message
+      });
+    }
+`;
+
+const LOCKOUT_INCREMENT_CODE = `
+      const failedAttempts = await userModel.incrementFailedAttempts(user.id);
+`;
+
+const LOCKOUT_TRIGGER_CODE = `
+      if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
+        await userModel.lockAccount(user.id, LOCKOUT_DURATION_MINUTES);
+        await insertAuditLog(user.id, 'account_locked', req.ip || 'unknown', req.get('User-Agent') || 'unknown');
+        return res.status(423).json({
+          error: 'Account locked',
+          message: \`Account locked due to \${MAX_FAILED_ATTEMPTS} failed attempts. Try again in \${LOCKOUT_DURATION_MINUTES} minutes.\`
+        });
+      }
+`;
+
+const LOCKOUT_RESET_CODE = `
+      await userModel.resetFailedAttempts(user.id);
+`;
+
+const LOCKOUT_MESSAGE_CODE = '`Email or password is incorrect. ${remaining} attempt(s) remaining before account lockout.`';
+
+const DDOS_MIDDLEWARE_CODE = `const ddos = require('./middleware/ddosMiddleware');
+
+app.use(ddos.trackAndBlockIP);
+app.use(ddos.connectionLimiter);
+app.use(ddos.malformedRequestDetector);
+app.use(ddos.validateRequestSize);
+`;
+
+const ADMIN_ROUTES_CODE = `
+const adminController = require('../controllers/adminController');
+const { isAdmin } = require('../middleware/adminMiddleware');
+
+router.get('/admin/stats', checkAndRefreshToken, isAdmin, adminController.getSystemStats);
+router.get('/admin/logs', checkAndRefreshToken, isAdmin, adminController.getSystemLogs);
+router.get('/admin/users', checkAndRefreshToken, isAdmin, adminController.getAllUsers);
+router.delete('/admin/users/:userId', checkAndRefreshToken, isAdmin, adminController.deleteUser);
+`;
+
+function scaffold(targetDir, answers) {
+  const templateDir = path.join(__dirname, '..', 'templates');
+  const hasAdmin = answers.features && answers.features.includes('admin');
+  const hasDdos = answers.features && answers.features.includes('ddos');
+
+  const createdDirs = [];
+  for (const dir of REQUIRED_DIRS) {
+    const dirPath = path.join(targetDir, dir);
+    if (!fs.existsSync(dirPath)) {
+      fs.mkdirSync(dirPath, { recursive: true });
+      createdDirs.push(dir);
+    }
+  }
+  if (createdDirs.length > 0) {
+    logger.info(`Created folders: ${createdDirs.join(', ')}`);
+  }
+
+  const templateFiles = collectFiles(templateDir);
+  let fileCount = 0;
+
+  for (const tmplPath of templateFiles) {
+    const relative = path.relative(templateDir, tmplPath).replace(/\\/g, '/');
+
+    if (answers.database === 'sqlite' && relative.includes('.pg.')) continue;
+    if (answers.database === 'postgres' && relative.includes('.sqlite.')) continue;
+
+    if (relative === 'middleware/adminMiddleware.js' && !hasAdmin) continue;
+    if (relative === 'controllers/adminController.js' && !hasAdmin) continue;
+
+    const destRelative = relative.replace('.pg.', '.').replace('.sqlite.', '.');
+    const destPath = path.join(targetDir, destRelative);
+    const destDir = path.dirname(destPath);
+
+    if (!fs.existsSync(destDir)) {
+      fs.mkdirSync(destDir, { recursive: true });
+    }
+
+    if (fs.existsSync(destPath)) {
+      logger.warn(`Skipped ${destRelative} — already exists`);
+      continue;
+    }
+
+    let content = fs.readFileSync(tmplPath, 'utf-8');
+    content = processContent(content, answers);
+    fs.writeFileSync(destPath, content, 'utf-8');
+    logger.success(`Created ${destRelative}`);
+    fileCount++;
+  }
+
+  return fileCount;
+}
+
+function collectFiles(dir) {
+  const results = [];
+  for (const entry of fs.readdirSync(dir)) {
+    const fullPath = path.join(dir, entry);
+    if (fs.statSync(fullPath).isDirectory()) {
+      results.push(...collectFiles(fullPath));
+    } else {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+function processContent(content, answers) {
+  const hasLockout = answers.features && answers.features.includes('accountLockout');
+  const hasDdos = answers.features && answers.features.includes('ddos');
+  const hasAdmin = answers.features && answers.features.includes('admin');
+
+  content = content.replace(/\{\{PORT\}\}/g, String(answers.port));
+  content = content.replace(/\{\{TOTP_ISSUER\}\}/g, answers.projectName || 'SecureAuth-App');
+
+  content = content.replace(/\{\{ACCOUNT_LOCKOUT\}\}/g, hasLockout ? LOCKOUT_HELPER : '');
+  content = content.replace(/\{\{LOCKOUT_CHECK\}\}/g, hasLockout ? LOCKOUT_CHECK_CODE : '');
+  content = content.replace(/\{\{LOCKOUT_INCREMENT\}\}/g, hasLockout ? LOCKOUT_INCREMENT_CODE : '');
+  content = content.replace(/\{\{LOCKOUT_TRIGGER\}\}/g, hasLockout ? LOCKOUT_TRIGGER_CODE : '');
+  content = content.replace(/\{\{LOCKOUT_RESET\}\}/g, hasLockout ? LOCKOUT_RESET_CODE : '');
+  content = content.replace(/\{\{LOCKOUT_MESSAGE\}\}/g, hasLockout ? LOCKOUT_MESSAGE_CODE : "'Email or password is incorrect'");
+
+  content = content.replace(/\{\{DDOS_MIDDLEWARE\}\}/g, hasDdos ? DDOS_MIDDLEWARE_CODE : '');
+
+  content = content.replace(/\{\{ADMIN_ROUTES\}\}/g, hasAdmin ? ADMIN_ROUTES_CODE : '');
+
+  return content;
+}
+
+module.exports = { scaffold };

package/templates/controllers/adminController.js

@@ -0,0 +1,78 @@
+const userModel = require('../models/userModel');
+const { db } = require('../database/db');
+
+async function getSystemLogs(req, res) {
+  try {
+    const query = `
+      SELECT al.log_id, al.action, al.ip_address, al.user_agent, al.timestamp, u.email, u.full_name
+      FROM audit_logs al
+      LEFT JOIN users u ON al.user_id = u.id
+      ORDER BY al.timestamp DESC
+      LIMIT 100
+    `;
+    const result = await db.query(query);
+    return res.status(200).json({
+      logs: result.rows,
+      count: result.rows.length
+    });
+  } catch (error) {
+    console.error('Error fetching system logs:', error);
+    return res.status(500).json({ error: 'Failed to fetch logs' });
+  }
+}
+
+async function getAllUsers(req, res) {
+  try {
+    const users = await userModel.getAllUsers();
+    return res.status(200).json({
+      users: users,
+      count: users.length
+    });
+  } catch (error) {
+    console.error('Error fetching users:', error);
+    return res.status(500).json({ error: 'Failed to fetch users' });
+  }
+}
+
+async function deleteUser(req, res) {
+  try {
+    const { userId } = req.params;
+    if (!userId) {
+      return res.status(400).json({ error: 'User ID is required' });
+    }
+    const deletedUser = await userModel.deleteUser(userId);
+    if (!deletedUser) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    return res.status(200).json({
+      message: 'User deleted successfully',
+      user: deletedUser
+    });
+  } catch (error) {
+    console.error('Error deleting user:', error);
+    return res.status(500).json({ error: 'Failed to delete user' });
+  }
+}
+
+async function getSystemStats(req, res) {
+  try {
+    const totalUsers = await userModel.countUsers();
+    const logsResult = await db.query('SELECT COUNT(*) as count FROM audit_logs');
+    const totalLogs = parseInt(logsResult.rows[0].count);
+
+    return res.status(200).json({
+      stats: {
+        totalUsers,
+        totalLogs,
+        systemHealth: 'Optimal'
+      }
+    });
+  } catch (error) {
+    console.error('Error fetching system stats:', error);
+    return res.status(500).json({ error: 'Failed to fetch stats' });
+  }
+}
+
+module.exports = {
+  getSystemLogs, getAllUsers, deleteUser, getSystemStats
+};

package/templates/controllers/authController.js

@@ -0,0 +1,345 @@
+const bcrypt = require('bcryptjs');
+const { v4: uuidv4 } = require('uuid');
+const userModel = require('../models/userModel');
+const totpUtils = require('../utils/totpUtils');
+const jwtUtils = require('../utils/jwtUtils');
+const { insertAuditLog, db } = require('../database/db');
+
+const BCRYPT_ROUNDS = parseInt(process.env.BCRYPT_ROUNDS) || 12;
+const MAX_FAILED_ATTEMPTS = parseInt(process.env.MAX_FAILED_ATTEMPTS) || 5;
+const LOCKOUT_DURATION_MINUTES = parseInt(process.env.LOCKOUT_DURATION_MINUTES) || 30;
+
+async function register(req, res) {
+  try {
+    const { fullName, email, password } = req.body;
+
+    if (!fullName || !email || !password) {
+      return res.status(400).json({
+        error: 'Missing required fields',
+        message: 'Please provide fullName, email, and password'
+      });
+    }
+
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (!emailRegex.test(email)) {
+      return res.status(400).json({
+        error: 'Invalid email format',
+        message: 'Please provide a valid email address'
+      });
+    }
+
+    if (password.length < 8) {
+      return res.status(400).json({
+        error: 'Weak password',
+        message: 'Password must be at least 8 characters long'
+      });
+    }
+
+    const existingUser = await userModel.findByEmail(email);
+    if (existingUser) {
+      return res.status(400).json({
+        error: 'Email already registered',
+        message: 'This email address is already associated with an account'
+      });
+    }
+
+    const passwordHash = await bcrypt.hash(password, BCRYPT_ROUNDS);
+    const secretData = totpUtils.generateSecret();
+    const totpSecret = secretData.base32_secret;
+    const qrCode = await totpUtils.generateQR(totpSecret, email);
+
+    const userId = uuidv4();
+    const createdAt = new Date().toISOString();
+
+    await userModel.createUser({
+      id: userId,
+      full_name: fullName,
+      email: email,
+      password_hash: passwordHash,
+      totp_secret: totpSecret,
+      created_at: createdAt
+    });
+
+    const ipAddress = req.ip || req.connection.remoteAddress || 'unknown';
+    const userAgent = req.get('User-Agent') || 'unknown';
+    await insertAuditLog(userId, 'register', ipAddress, userAgent);
+
+    return res.status(201).json({
+      message: 'Registration successful! Scan the QR code with Google Authenticator to complete setup.',
+      qrCode: qrCode,
+      userId: userId,
+      instructions: [
+        '1. Open Google Authenticator on your smartphone',
+        '2. Tap the "+" button to add a new account',
+        '3. Select "Scan a QR code"',
+        '4. Scan the QR code displayed above',
+        '5. Your SecureAuth account will appear in the app',
+        '6. Use the 6-digit code from the app when logging in'
+      ]
+    });
+
+  } catch (error) {
+    console.error('Registration error:', error);
+    return res.status(500).json({
+      error: 'Registration failed',
+      message: 'An error occurred during registration. Please try again.'
+    });
+  }
+}
+
+{{ACCOUNT_LOCKOUT}}
+
+async function loginStep1(req, res) {
+  try {
+    const { email, password } = req.body;
+
+    if (!email || !password) {
+      return res.status(400).json({
+        error: 'Missing required fields',
+        message: 'Please provide email and password'
+      });
+    }
+
+    const user = await userModel.findByEmail(email);
+
+    if (!user) {
+      const ipAddress = req.ip || 'unknown';
+      const userAgent = req.get('User-Agent') || 'unknown';
+      await insertAuditLog(null, 'login_attempt_failed', ipAddress, userAgent);
+
+      return res.status(401).json({
+        error: 'Invalid credentials',
+        message: 'Email or password is incorrect'
+      });
+    }
+
+    {{LOCKOUT_CHECK}}
+
+    const isValid = await bcrypt.compare(password, user.password_hash);
+
+    if (!isValid) {
+      {{LOCKOUT_INCREMENT}}
+
+      const ipAddress = req.ip || 'unknown';
+      const userAgent = req.get('User-Agent') || 'unknown';
+      await insertAuditLog(user.id, 'login_attempt_failed', ipAddress, userAgent);
+
+      {{LOCKOUT_TRIGGER}}
+
+      return res.status(401).json({
+        error: 'Invalid credentials',
+        message: {{LOCKOUT_MESSAGE}}
+      });
+    }
+
+    {{LOCKOUT_RESET}}
+
+    const tempToken = jwtUtils.generateTempJWT(user.id, user.email);
+
+    const ipAddress = req.ip || 'unknown';
+    const userAgent = req.get('User-Agent') || 'unknown';
+    await insertAuditLog(user.id, 'login_step1_success', ipAddress, userAgent);
+
+    return res.status(200).json({
+      message: 'Password verified. Please enter your 6-digit 2FA code.',
+      tempToken: tempToken,
+      '2fa_required': true,
+      next_step: 'POST /api/verify-2fa with the tempToken in Authorization header'
+    });
+
+  } catch (error) {
+    console.error('Login Step 1 error:', error);
+    return res.status(500).json({
+      error: 'Login failed',
+      message: 'An error occurred during login. Please try again.'
+    });
+  }
+}
+
+async function verifyTOTP(req, res) {
+  try {
+    const { token: totpCode, code } = req.body;
+    const finalCode = totpCode || code;
+
+    if (!finalCode) {
+      return res.status(400).json({
+        error: 'Missing TOTP code',
+        message: 'Please provide the 6-digit code from your authenticator app'
+      });
+    }
+
+    const authHeader = req.get('Authorization');
+    const token = jwtUtils.extractTokenFromHeader(authHeader);
+
+    if (!token) {
+      return res.status(401).json({
+        error: 'Missing authorization token',
+        message: 'Please provide the tempToken from login step 1 in Authorization header'
+      });
+    }
+
+    let payload;
+    try {
+      payload = jwtUtils.verifyJWT(token);
+    } catch (error) {
+      return res.status(401).json({
+        error: 'Invalid or expired token',
+        message: error.message
+      });
+    }
+
+    if (!payload['2fa_required']) {
+      return res.status(401).json({
+        error: 'Invalid token type',
+        message: 'This endpoint requires a temporary token from login step 1'
+      });
+    }
+
+    const userId = payload.user_id;
+    const user = await userModel.findById(userId);
+
+    if (!user) {
+      return res.status(401).json({
+        error: 'User not found',
+        message: 'Invalid token'
+      });
+    }
+
+    const isValid = totpUtils.verifyCode(user.totp_secret, finalCode);
+
+    const ipAddress = req.ip || 'unknown';
+    const userAgent = req.get('User-Agent') || 'unknown';
+
+    if (!isValid) {
+      await insertAuditLog(userId, '2fa_fail', ipAddress, userAgent);
+      return res.status(401).json({
+        error: 'Invalid TOTP code',
+        message: 'The code you entered is invalid or has expired. Please try again.'
+      });
+    }
+
+    const fullToken = jwtUtils.generateFullJWT(user.id, user.email, user.full_name, user.role);
+
+    await insertAuditLog(userId, '2fa_success', ipAddress, userAgent);
+    await insertAuditLog(userId, 'login_success', ipAddress, userAgent);
+
+    return res.status(200).json({
+      message: '2FA verification successful. You are now logged in.',
+      accessToken: fullToken,
+      user: {
+        id: user.id,
+        email: user.email,
+        fullName: user.full_name,
+        role: user.role || 'user',
+        createdAt: user.created_at
+      }
+    });
+
+  } catch (error) {
+    console.error('TOTP verification error:', error);
+    return res.status(500).json({
+      error: '2FA verification failed',
+      message: 'An error occurred during 2FA verification. Please try again.'
+    });
+  }
+}
+
+async function getDashboard(req, res) {
+  try {
+    const userId = req.user.user_id;
+    const user = await userModel.findById(userId);
+
+    if (!user) {
+      return res.status(401).json({
+        error: 'User not found',
+        message: 'Invalid token'
+      });
+    }
+
+    const totalUsers = await userModel.countUsers();
+
+    return res.status(200).json({
+      message: 'Welcome to your secure dashboard!',
+      user: {
+        id: user.id,
+        email: user.email,
+        fullName: user.full_name,
+        totpEnabled: Boolean(user.totp_enabled),
+        createdAt: user.created_at
+      },
+      stats: {
+        totalUsers: totalUsers,
+        loginTime: new Date().toISOString()
+      }
+    });
+
+  } catch (error) {
+    console.error('Dashboard error:', error);
+    return res.status(500).json({
+      error: 'Dashboard access failed',
+      message: 'An error occurred. Please try again.'
+    });
+  }
+}
+
+async function getLoginHistory(req, res) {
+  try {
+    const userId = req.user.user_id;
+
+    const query = `
+      SELECT action, ip_address, user_agent, timestamp
+      FROM audit_logs
+      WHERE user_id = $1
+      AND action IN ('login_success', 'login_attempt_failed', 'login_attempt_locked', '2fa_success', '2fa_fail')
+      ORDER BY timestamp DESC
+      LIMIT 10
+    `;
+
+    const result = await db.query(query, [userId]);
+    const rows = result.rows;
+
+    const history = rows.map(row => ({
+      action: row.action,
+      ipAddress: row.ip_address,
+      userAgent: row.user_agent,
+      timestamp: row.timestamp
+    }));
+
+    return res.status(200).json({
+      loginHistory: history,
+      count: history.length
+    });
+
+  } catch (error) {
+    console.error('Login history error:', error);
+    return res.status(500).json({
+      error: 'Failed to fetch login history'
+    });
+  }
+}
+
+async function requestDeletion(req, res) {
+  try {
+    const userId = req.user.user_id;
+    const ipAddress = req.ip || 'unknown';
+    const userAgent = req.get('User-Agent') || 'unknown';
+
+    await insertAuditLog(userId, 'deletion_request', ipAddress, userAgent);
+
+    return res.status(200).json({
+      message: 'Deletion request sent successfully'
+    });
+  } catch (error) {
+    console.error('Deletion request error:', error);
+    return res.status(500).json({ error: 'Failed to request deletion' });
+  }
+}
+
+module.exports = {
+  register,
+  loginStep1,
+  verifyTOTP,
+  getDashboard,
+  getLoginHistory,
+  requestDeletion
+};

package/templates/database/db.pg.js

@@ -0,0 +1,127 @@
+const { Pool } = require('pg');
+const { v4: uuidv4 } = require('uuid');
+const bcrypt = require('bcryptjs');
+
+const connectionString = process.env.DATABASE_URL;
+
+const pool = new Pool({
+  connectionString,
+  ssl: {
+    rejectUnauthorized: false
+  },
+  connectionTimeoutMillis: 5000,
+  idleTimeoutMillis: 10000,
+  max: 3
+});
+
+async function initDatabase() {
+  try {
+    const client = await pool.connect();
+
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        full_name TEXT NOT NULL,
+        email TEXT UNIQUE NOT NULL,
+        password_hash TEXT NOT NULL,
+        totp_secret TEXT NOT NULL,
+        totp_enabled BOOLEAN DEFAULT TRUE,
+        role TEXT DEFAULT 'user',
+        created_at TEXT NOT NULL,
+        failed_login_attempts INTEGER DEFAULT 0,
+        locked_until TEXT,
+        last_failed_login TEXT
+      )
+    `);
+
+    try {
+      await client.query('ALTER TABLE users ADD COLUMN IF NOT EXISTS role TEXT DEFAULT \'user\'');
+    } catch (e) {}
+
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS audit_logs (
+        log_id TEXT PRIMARY KEY,
+        user_id TEXT REFERENCES users(id),
+        action TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        timestamp TEXT NOT NULL
+      )
+    `);
+
+    client.release();
+    console.log('✓ Database initialized successfully (PostgreSQL)');
+  } catch (err) {
+    console.error('❌ Database initialization failed:', err.message || err);
+  }
+}
+
+async function seedDemoUser() {
+  const demoEmail = 'demo@secureauth.com';
+  try {
+    const result = await pool.query('SELECT * FROM users WHERE email = $1', [demoEmail]);
+    if (result.rows.length === 0) {
+      const userId = uuidv4();
+      const passwordHash = await bcrypt.hash('Demo@123', 12);
+      const totpSecret = 'JBSWY3DPEHPK3PXP';
+      const createdAt = new Date().toISOString();
+      await pool.query(`
+        INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+        VALUES ($1, $2, $3, $4, $5, $6, $7)
+      `, [userId, 'Demo User', demoEmail, passwordHash, totpSecret, 'admin', createdAt]);
+      console.log('✓ Demo user created: demo@secureauth.com / Demo@123');
+    }
+  } catch (err) {
+    console.error('❌ Failed to seed demo user:', err);
+  }
+}
+
+async function seedAdminUser() {
+  const adminEmail = 'admin@secureauth.com';
+  try {
+    const result = await pool.query('SELECT * FROM users WHERE email = $1', [adminEmail]);
+    if (result.rows.length === 0) {
+      const userId = uuidv4();
+      const passwordHash = await bcrypt.hash('AdminPassword123!', 12);
+      const totpSecret = 'KVKFKRCPNZQUYMLXOVZGUYLTKVKFKRCP';
+      const createdAt = new Date().toISOString();
+      await pool.query(`
+        INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+        VALUES ($1, $2, $3, $4, $5, $6, $7)
+      `, [userId, 'System Administrator', adminEmail, passwordHash, totpSecret, 'admin', createdAt]);
+      console.log('✓ Admin user created: admin@secureauth.com / AdminPassword123!');
+    }
+  } catch (err) {
+    console.error('❌ Failed to seed admin user:', err);
+  }
+}
+
+async function insertAuditLog(userId, action, ipAddress = 'unknown', userAgent = 'unknown') {
+  const logId = uuidv4();
+  const timestamp = new Date().toISOString();
+  try {
+    await pool.query(`
+      INSERT INTO audit_logs (log_id, user_id, action, ip_address, user_agent, timestamp)
+      VALUES ($1, $2, $3, $4, $5, $6)
+    `, [logId, userId, action, ipAddress, userAgent, timestamp]);
+    return logId;
+  } catch (err) {
+    console.error('❌ Failed to insert audit log:', err);
+    return null;
+  }
+}
+
+pool.on('error', (err) => {
+  console.error('❌ Unexpected Postgres pool error:', err.message);
+});
+
+module.exports = {
+  initDatabase,
+  seedAdminUser,
+  seedDemoUser,
+  insertAuditLog,
+  pool,
+  db: {
+    query: (text, params) => pool.query(text, params)
+  }
+};