@metaadri/secureauth 1.0.0

package/templates/database/db.sqlite.js

@@ -0,0 +1,118 @@
+const Database = require('better-sqlite3');
+const path = require('path');
+const { v4: uuidv4 } = require('uuid');
+const bcrypt = require('bcryptjs');
+
+const dbPath = process.env.DATABASE_URL || path.join(__dirname, '..', 'secureauth.db');
+const db = new Database(dbPath);
+db.pragma('journal_mode = WAL');
+db.pragma('foreign_keys = ON');
+
+function initDatabase() {
+  try {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        full_name TEXT NOT NULL,
+        email TEXT UNIQUE NOT NULL,
+        password_hash TEXT NOT NULL,
+        totp_secret TEXT NOT NULL,
+        totp_enabled INTEGER DEFAULT 1,
+        role TEXT DEFAULT 'user',
+        created_at TEXT NOT NULL,
+        failed_login_attempts INTEGER DEFAULT 0,
+        locked_until TEXT,
+        last_failed_login TEXT
+      )
+    `);
+
+    try {
+      db.exec("ALTER TABLE users ADD COLUMN role TEXT DEFAULT 'user'");
+    } catch (e) {}
+
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS audit_logs (
+        log_id TEXT PRIMARY KEY,
+        user_id TEXT,
+        action TEXT NOT NULL,
+        ip_address TEXT,
+        user_agent TEXT,
+        timestamp TEXT NOT NULL,
+        FOREIGN KEY (user_id) REFERENCES users(id)
+      )
+    `);
+
+    console.log('✓ Database initialized successfully (SQLite)');
+  } catch (err) {
+    console.error('❌ Database initialization failed:', err.message || err);
+  }
+}
+
+function seedDemoUser() {
+  const demoEmail = 'demo@secureauth.com';
+  try {
+    const existing = db.prepare('SELECT * FROM users WHERE email = ?').get(demoEmail);
+    if (!existing) {
+      const userId = uuidv4();
+      const passwordHash = bcrypt.hashSync('Demo@123', 12);
+      const totpSecret = 'JBSWY3DPEHPK3PXP';
+      const createdAt = new Date().toISOString();
+      db.prepare(`
+        INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(userId, 'Demo User', demoEmail, passwordHash, totpSecret, 'admin', createdAt);
+      console.log('✓ Demo user created: demo@secureauth.com / Demo@123');
+    }
+  } catch (err) {
+    console.error('❌ Failed to seed demo user:', err);
+  }
+}
+
+function seedAdminUser() {
+  const adminEmail = 'admin@secureauth.com';
+  try {
+    const existing = db.prepare('SELECT * FROM users WHERE email = ?').get(adminEmail);
+    if (!existing) {
+      const userId = uuidv4();
+      const passwordHash = bcrypt.hashSync('AdminPassword123!', 12);
+      const totpSecret = 'KVKFKRCPNZQUYMLXOVZGUYLTKVKFKRCP';
+      const createdAt = new Date().toISOString();
+      db.prepare(`
+        INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(userId, 'System Administrator', adminEmail, passwordHash, totpSecret, 'admin', createdAt);
+      console.log('✓ Admin user created: admin@secureauth.com / AdminPassword123!');
+    }
+  } catch (err) {
+    console.error('❌ Failed to seed admin user:', err);
+  }
+}
+
+function insertAuditLog(userId, action, ipAddress = 'unknown', userAgent = 'unknown') {
+  const logId = uuidv4();
+  const timestamp = new Date().toISOString();
+  try {
+    db.prepare(`
+      INSERT INTO audit_logs (log_id, user_id, action, ip_address, user_agent, timestamp)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(logId, userId, action, ipAddress, userAgent, timestamp);
+    return logId;
+  } catch (err) {
+    console.error('❌ Failed to insert audit log:', err);
+    return null;
+  }
+}
+
+module.exports = {
+  initDatabase,
+  seedAdminUser,
+  seedDemoUser,
+  insertAuditLog,
+  db: {
+    query: (text, params) => {
+      const stmt = db.prepare(text);
+      const rows = params ? stmt.all(...params) : stmt.all();
+      return { rows };
+    }
+  }
+};

package/templates/middleware/adminMiddleware.js

@@ -0,0 +1,19 @@
+function isAdmin(req, res, next) {
+  if (!req.user) {
+    return res.status(401).json({
+      error: 'Unauthorized',
+      message: 'Authentication required'
+    });
+  }
+
+  if (req.user.role !== 'admin') {
+    return res.status(403).json({
+      error: 'Forbidden',
+      message: 'Access denied: Administrator privileges required'
+    });
+  }
+
+  next();
+}
+
+module.exports = { isAdmin };

package/templates/middleware/authMiddleware.js

@@ -0,0 +1,119 @@
+const jwtUtils = require('../utils/jwtUtils');
+const rateLimit = require('express-rate-limit');
+
+function verifyToken(req, res, next) {
+  try {
+    const authHeader = req.get('Authorization');
+    const token = jwtUtils.extractTokenFromHeader(authHeader);
+
+    if (!token) {
+      return res.status(401).json({
+        error: 'Missing authorization token',
+        message: 'Please provide your access token in Authorization: Bearer <token>'
+      });
+    }
+
+    let payload;
+    try {
+      payload = jwtUtils.verifyJWT(token);
+    } catch (error) {
+      return res.status(401).json({
+        error: 'Invalid or expired token',
+        message: error.message
+      });
+    }
+
+    if (payload['2fa_required']) {
+      return res.status(403).json({
+        error: 'Insufficient permissions',
+        message: 'Please complete 2FA verification first'
+      });
+    }
+
+    req.user = payload;
+    next();
+  } catch (error) {
+    return res.status(500).json({
+      error: 'Authentication failed',
+      message: 'An error occurred during authentication'
+    });
+  }
+}
+
+function checkAndRefreshToken(req, res, next) {
+  try {
+    const authHeader = req.get('Authorization');
+    const token = jwtUtils.extractTokenFromHeader(authHeader);
+
+    if (!token) {
+      return res.status(401).json({
+        error: 'Missing authorization token',
+        message: 'Please log in again'
+      });
+    }
+
+    let payload;
+    try {
+      payload = jwtUtils.verifyJWT(token);
+    } catch (error) {
+      return res.status(401).json({
+        error: 'Invalid or expired token',
+        message: error.message,
+        logout_required: true
+      });
+    }
+
+    if (payload['2fa_required']) {
+      return res.status(403).json({
+        error: 'Insufficient permissions',
+        message: 'Please complete 2FA verification'
+      });
+    }
+
+    const inactivity = jwtUtils.checkInactivity(token);
+
+    if (inactivity.inactive) {
+      return res.status(401).json({
+        error: 'Session expired',
+        message: 'Your session has expired due to inactivity',
+        logout_required: true
+      });
+    }
+
+    req.user = payload;
+
+    if (inactivity.seconds_inactive > 240) {
+      req.refresh_warning = {
+        seconds_until_logout: 300 - inactivity.seconds_inactive,
+        message: 'Session will expire soon due to inactivity'
+      };
+    }
+
+    next();
+  } catch (error) {
+    return res.status(500).json({
+      error: 'Authentication failed',
+      message: error.message
+    });
+  }
+}
+
+function createRateLimiter(maxRequests = 5, windowMinutes = 15) {
+  return rateLimit({
+    windowMs: windowMinutes * 60 * 1000,
+    max: maxRequests,
+    message: {
+      error: 'Rate limit exceeded',
+      message: `Too many requests. Please try again in ${windowMinutes} minutes.`,
+      retry_after: windowMinutes * 60
+    },
+    standardHeaders: true,
+    legacyHeaders: false
+  });
+}
+
+module.exports = {
+  verifyToken,
+  checkAndRefreshToken,
+  createRateLimiter
+};

package/templates/middleware/ddosMiddleware.js

@@ -0,0 +1,183 @@
+const slowDown = require('express-slow-down');
+
+const MAX_REQUESTS_PER_MINUTE = parseInt(process.env.MAX_REQUESTS_PER_MINUTE) || 60;
+const AUTO_BAN_THRESHOLD = parseInt(process.env.AUTO_BAN_THRESHOLD) || 100;
+const BAN_DURATION_MINUTES = parseInt(process.env.BAN_DURATION_MINUTES) || 30;
+const MAX_CONCURRENT_CONNECTIONS = parseInt(process.env.MAX_CONCURRENT_CONNECTIONS) || 100;
+
+const ipRequestCounts = new Map();
+const bannedIPs = new Map();
+const activeConnections = new Map();
+
+function trackAndBlockIP(req, res, next) {
+  const clientIP = req.ip || req.connection.remoteAddress || 'unknown';
+  const now = Date.now();
+
+  if (bannedIPs.has(clientIP)) {
+    const banExpiry = bannedIPs.get(clientIP);
+    if (now < banExpiry) {
+      const minutesLeft = Math.ceil((banExpiry - now) / 60000);
+      return res.status(429).json({
+        error: 'IP Banned',
+        message: `Your IP has been temporarily banned due to suspicious activity. Ban expires in ${minutesLeft} minutes.`,
+        banned_until: new Date(banExpiry).toISOString()
+      });
+    } else {
+      bannedIPs.delete(clientIP);
+    }
+  }
+
+  if (!ipRequestCounts.has(clientIP)) {
+    ipRequestCounts.set(clientIP, []);
+  }
+
+  const requests = ipRequestCounts.get(clientIP);
+  const oneMinuteAgo = now - 60000;
+  const recentRequests = requests.filter(timestamp => timestamp > oneMinuteAgo);
+  ipRequestCounts.set(clientIP, recentRequests);
+  recentRequests.push(now);
+
+  if (recentRequests.length > AUTO_BAN_THRESHOLD) {
+    const banUntil = now + (BAN_DURATION_MINUTES * 60000);
+    bannedIPs.set(clientIP, banUntil);
+    return res.status(429).json({
+      error: 'Too Many Requests - IP Banned',
+      message: `Your IP has been automatically banned for ${BAN_DURATION_MINUTES} minutes due to excessive requests.`,
+      requests_detected: recentRequests.length,
+      threshold: AUTO_BAN_THRESHOLD
+    });
+  }
+
+  if (recentRequests.length > MAX_REQUESTS_PER_MINUTE) {
+    res.setHeader('X-RateLimit-Warning', 'Approaching request limit');
+  }
+
+  next();
+}
+
+const progressiveSlowDown = slowDown({
+  windowMs: 15 * 60 * 1000,
+  delayAfter: 10,
+  delayMs: (hits) => hits * 100,
+  maxDelayMs: 5000,
+  skipSuccessfulRequests: false,
+  skipFailedRequests: false
+});
+
+function connectionLimiter(req, res, next) {
+  const clientIP = req.ip || req.connection.remoteAddress || 'unknown';
+
+  if (!activeConnections.has(clientIP)) {
+    activeConnections.set(clientIP, 0);
+  }
+
+  const currentConnections = activeConnections.get(clientIP);
+
+  if (currentConnections >= MAX_CONCURRENT_CONNECTIONS) {
+    return res.status(429).json({
+      error: 'Too Many Concurrent Connections',
+      message: `Maximum ${MAX_CONCURRENT_CONNECTIONS} concurrent connections per IP allowed.`,
+      current_connections: currentConnections
+    });
+  }
+
+  activeConnections.set(clientIP, currentConnections + 1);
+
+  res.on('finish', () => {
+    const count = activeConnections.get(clientIP) || 0;
+    if (count > 0) {
+      activeConnections.set(clientIP, count - 1);
+    }
+  });
+
+  next();
+}
+
+function validateRequestSize(req, res, next) {
+  const contentLength = req.headers['content-length'];
+  const MAX_SIZE = parseInt(process.env.MAX_REQUEST_SIZE) || 100000;
+
+  if (contentLength && parseInt(contentLength) > MAX_SIZE) {
+    return res.status(413).json({
+      error: 'Payload Too Large',
+      message: `Request body must be less than ${MAX_SIZE / 1000}KB`,
+      received: `${(contentLength / 1000).toFixed(2)}KB`
+    });
+  }
+
+  next();
+}
+
+function malformedRequestDetector(req, res, next) {
+  const userAgent = req.get('User-Agent') || '';
+  const clientIP = req.ip || 'unknown';
+
+  const suspiciousPatterns = [
+    /sqlmap/i,
+    /nikto/i,
+    /nmap/i,
+    /masscan/i,
+    /<script>/i,
+    /\.\.\/\.\.\//,
+    /union.*select/i,
+  ];
+
+  for (const pattern of suspiciousPatterns) {
+    if (pattern.test(userAgent) || pattern.test(req.url)) {
+      const banUntil = Date.now() + (60 * 60000);
+      bannedIPs.set(clientIP, banUntil);
+      return res.status(403).json({
+        error: 'Forbidden',
+        message: 'Suspicious request detected. Your IP has been logged and banned.'
+      });
+    }
+  }
+
+  next();
+}
+
+function getProtectionStats() {
+  const now = Date.now();
+  const activeBans = Array.from(bannedIPs.entries())
+    .filter(([ip, expiry]) => expiry > now)
+    .length;
+
+  const totalActiveConnections = Array.from(activeConnections.values())
+    .reduce((sum, count) => sum + count, 0);
+
+  return {
+    banned_ips: activeBans,
+    active_connections: totalActiveConnections,
+    max_connections_per_ip: MAX_CONCURRENT_CONNECTIONS,
+    auto_ban_threshold: AUTO_BAN_THRESHOLD,
+    ban_duration_minutes: BAN_DURATION_MINUTES,
+    tracked_ips: ipRequestCounts.size
+  };
+}
+
+function cleanupExpiredBans() {
+  const now = Date.now();
+  let cleaned = 0;
+  for (const [ip, expiry] of bannedIPs.entries()) {
+    if (expiry < now) {
+      bannedIPs.delete(ip);
+      cleaned++;
+    }
+  }
+  if (cleaned > 0) {
+    console.log(`Cleaned ${cleaned} expired IP bans`);
+  }
+}
+
+if (process.env.VERCEL !== '1') {
+  setInterval(cleanupExpiredBans, 5 * 60 * 1000);
+}
+
+module.exports = {
+  trackAndBlockIP,
+  progressiveSlowDown,
+  connectionLimiter,
+  validateRequestSize,
+  malformedRequestDetector,
+  getProtectionStats
+};

package/templates/models/userModel.pg.js

@@ -0,0 +1,74 @@
+const { db } = require('../database/db');
+
+async function findByEmail(email) {
+  const result = await db.query('SELECT * FROM users WHERE email = $1', [email]);
+  return result.rows[0];
+}
+
+async function findById(userId) {
+  const result = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
+  return result.rows[0];
+}
+
+async function createUser(userData) {
+  const query = `
+    INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+    VALUES ($1, $2, $3, $4, $5, $6, $7)
+    RETURNING *
+  `;
+  const result = await db.query(query, [
+    userData.id, userData.full_name, userData.email,
+    userData.password_hash, userData.totp_secret,
+    userData.role || 'user', userData.created_at
+  ]);
+  return result.rows[0];
+}
+
+async function getAllUsers() {
+  const result = await db.query('SELECT id, full_name, email, role, created_at FROM users ORDER BY created_at DESC');
+  return result.rows;
+}
+
+async function deleteUser(userId) {
+  await db.query('DELETE FROM audit_logs WHERE user_id = $1', [userId]);
+  const result = await db.query('DELETE FROM users WHERE id = $1 RETURNING *', [userId]);
+  return result.rows[0];
+}
+
+async function countUsers() {
+  const result = await db.query('SELECT COUNT(*) as count FROM users');
+  return parseInt(result.rows[0].count);
+}
+
+async function incrementFailedAttempts(userId) {
+  const result = await db.query(`
+    UPDATE users
+    SET failed_login_attempts = failed_login_attempts + 1,
+        last_failed_login = $1
+    WHERE id = $2
+    RETURNING failed_login_attempts
+  `, [new Date().toISOString(), userId]);
+  return result.rows[0] ? result.rows[0].failed_login_attempts : 0;
+}
+
+async function resetFailedAttempts(userId) {
+  await db.query(`
+    UPDATE users
+    SET failed_login_attempts = 0,
+        locked_until = NULL,
+        last_failed_login = NULL
+    WHERE id = $1
+  `, [userId]);
+}
+
+async function lockAccount(userId, lockoutDurationMinutes) {
+  const lockedUntil = new Date();
+  lockedUntil.setMinutes(lockedUntil.getMinutes() + lockoutDurationMinutes);
+  await db.query('UPDATE users SET locked_until = $1 WHERE id = $2', [lockedUntil.toISOString(), userId]);
+}
+
+module.exports = {
+  findByEmail, findById, createUser, getAllUsers,
+  deleteUser, countUsers, incrementFailedAttempts,
+  resetFailedAttempts, lockAccount
+};

package/templates/models/userModel.sqlite.js

@@ -0,0 +1,68 @@
+const { db } = require('../database/db');
+
+function findByEmail(email) {
+  const result = db.query('SELECT * FROM users WHERE email = ?', [email]);
+  return result.rows[0];
+}
+
+function findById(userId) {
+  const result = db.query('SELECT * FROM users WHERE id = ?', [userId]);
+  return result.rows[0];
+}
+
+function createUser(userData) {
+  db.query(`
+    INSERT INTO users (id, full_name, email, password_hash, totp_secret, role, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+  `, [userData.id, userData.full_name, userData.email,
+      userData.password_hash, userData.totp_secret,
+      userData.role || 'user', userData.created_at]);
+}
+
+function getAllUsers() {
+  const result = db.query('SELECT id, full_name, email, role, created_at FROM users ORDER BY created_at DESC');
+  return result.rows;
+}
+
+function deleteUser(userId) {
+  db.query('DELETE FROM audit_logs WHERE user_id = ?', [userId]);
+  db.query('DELETE FROM users WHERE id = ?', [userId]);
+}
+
+function countUsers() {
+  const result = db.query('SELECT COUNT(*) as count FROM users');
+  return result.rows[0].count;
+}
+
+function incrementFailedAttempts(userId) {
+  const result = db.query(`
+    UPDATE users
+    SET failed_login_attempts = failed_login_attempts + 1,
+        last_failed_login = ?
+    WHERE id = ?
+  `, [new Date().toISOString(), userId]);
+  const row = db.query('SELECT failed_login_attempts FROM users WHERE id = ?', [userId]);
+  return row.rows[0] ? row.rows[0].failed_login_attempts : 0;
+}
+
+function resetFailedAttempts(userId) {
+  db.query(`
+    UPDATE users
+    SET failed_login_attempts = 0,
+        locked_until = NULL,
+        last_failed_login = NULL
+    WHERE id = ?
+  `, [userId]);
+}
+
+function lockAccount(userId, lockoutDurationMinutes) {
+  const lockedUntil = new Date();
+  lockedUntil.setMinutes(lockedUntil.getMinutes() + lockoutDurationMinutes);
+  db.query('UPDATE users SET locked_until = ? WHERE id = ?', [lockedUntil.toISOString(), userId]);
+}
+
+module.exports = {
+  findByEmail, findById, createUser, getAllUsers,
+  deleteUser, countUsers, incrementFailedAttempts,
+  resetFailedAttempts, lockAccount
+};

package/templates/routes/authRoutes.js

@@ -0,0 +1,68 @@
+const express = require('express');
+const router = express.Router();
+const authController = require('../controllers/authController');
+const { verifyToken, checkAndRefreshToken, createRateLimiter } = require('../middleware/authMiddleware');
+const jwtUtils = require('../utils/jwtUtils');
+
+const loginLimiter = createRateLimiter(5, 15);
+
+router.post('/register', authController.register);
+router.post('/login', loginLimiter, authController.loginStep1);
+router.post('/demo/login', authController.demoLogin);
+router.post('/verify-2fa', loginLimiter, authController.verifyTOTP);
+router.get('/dashboard', checkAndRefreshToken, authController.getDashboard);
+router.get('/login-history', checkAndRefreshToken, authController.getLoginHistory);
+router.post('/request-deletion', checkAndRefreshToken, authController.requestDeletion);
+
+router.post('/refresh', (req, res) => {
+  try {
+    const authHeader = req.get('Authorization');
+    const token = jwtUtils.extractTokenFromHeader(authHeader);
+
+    if (!token) {
+      return res.status(401).json({ error: 'Missing token' });
+    }
+
+    const inactivity = jwtUtils.checkInactivity(token);
+
+    if (inactivity.inactive) {
+      return res.status(401).json({
+        error: 'Session expired',
+        message: 'Your session has expired due to inactivity'
+      });
+    }
+
+    const newToken = jwtUtils.refreshJWT(token);
+
+    return res.status(200).json({
+      accessToken: newToken,
+      message: 'Token refreshed successfully'
+    });
+
+  } catch (error) {
+    return res.status(401).json({ error: error.message });
+  }
+});
+
+router.get('/health', (req, res) => {
+  res.status(200).json({
+    status: 'ok',
+    message: 'SecureAuth API is running',
+    timestamp: new Date().toISOString(),
+    version: '2.1.0',
+    framework: 'Express/Node.js',
+    features: [
+      'TOTP Two-Factor Authentication',
+      'JWT Session Management',
+      'Inactivity Auto-Logout',
+      'Account Lockout',
+      'Login History Tracking',
+      'Rate Limiting',
+      'bcrypt Password Hashing'
+    ]
+  });
+});
+
+{{ADMIN_ROUTES}}
+
+module.exports = router;