@metaadri/secureauth 1.0.0

package/templates/server.js

@@ -0,0 +1,93 @@
+require('dotenv').config();
+const express = require('express');
+const cors = require('cors');
+const path = require('path');
+const helmet = require('helmet');
+
+const authRoutes = require('./routes/authRoutes');
+const { initDatabase, seedAdminUser, seedDemoUser } = require('./database/db');
+
+const app = express();
+const PORT = process.env.PORT || {{PORT}};
+
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://fonts.googleapis.com"],
+      scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://cdn.tailwindcss.com", "https://unpkg.com"],
+      fontSrc: ["'self'", "data:", "https://fonts.gstatic.com"],
+      imgSrc: ["'self'", "data:", "https:"],
+      connectSrc: ["'self'", "http://localhost:*", "https://localhost:*"],
+    }
+  },
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }
+}));
+
+{{DDOS_MIDDLEWARE}}
+
+app.use(cors());
+app.use(express.json({ limit: '100kb' }));
+app.use(express.urlencoded({ extended: true, limit: '100kb' }));
+
+app.use(express.static(path.join(__dirname, 'public')));
+app.use('/api', authRoutes);
+
+app.get('/api/health', (req, res) => {
+  res.status(200).json({
+    status: 'ok',
+    message: 'SecureAuth API is running',
+    timestamp: new Date().toISOString(),
+    version: '2.1.0',
+    framework: 'Express/Node.js',
+    features: [
+      'TOTP Two-Factor Authentication',
+      'JWT Session Management',
+      'Inactivity Auto-Logout',
+      'Account Lockout',
+      'Login History Tracking',
+      'Rate Limiting',
+      'bcrypt Password Hashing'
+    ]
+  });
+});
+
+app.get('/', (req, res) => {
+  res.json({ message: 'SecureAuth API is running', version: '2.1.0' });
+});
+
+let dbReady = false;
+
+initDatabase()
+  .then(async () => {
+    await seedAdminUser();
+    await seedDemoUser();
+    dbReady = true;
+    console.log('Database initialized and seeded');
+  })
+  .catch(err => {
+    console.error('Database initialization failed:', err.message);
+  });
+
+app.use((req, res, next) => {
+  if (dbReady) return next();
+  if (req.path.startsWith('/api')) {
+    return res.status(503).json({
+      error: 'System initializing, please try again in a moment.'
+    });
+  }
+  next();
+});
+
+if (process.env.VERCEL !== '1') {
+  app.listen(PORT, () => {
+    console.log(`SecureAuth server running on http://localhost:${PORT}`);
+    console.log(`Mode: ${process.env.NODE_ENV || 'development'}`);
+  });
+}
+
+module.exports = app;

package/templates/utils/jwtUtils.js

@@ -0,0 +1,115 @@
+const jwt = require('jsonwebtoken');
+
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-jwt-secret';
+const JWT_ALGORITHM = process.env.JWT_ALGORITHM || 'HS256';
+const TEMP_JWT_EXPIRY_MINUTES = parseInt(process.env.JWT_TEMP_EXPIRY_MINUTES) || 5;
+const FULL_JWT_EXPIRY_HOURS = parseInt(process.env.JWT_FULL_EXPIRY_HOURS) || 24;
+const INACTIVITY_TIMEOUT_MINUTES = parseInt(process.env.INACTIVITY_TIMEOUT_MINUTES) || 5;
+
+function generateTempJWT(userId, email) {
+  const payload = {
+    user_id: userId,
+    email: email,
+    '2fa_required': true,
+    type: 'temp',
+    iat: Math.floor(Date.now() / 1000)
+  };
+  return jwt.sign(payload, JWT_SECRET, {
+    algorithm: JWT_ALGORITHM,
+    expiresIn: `${TEMP_JWT_EXPIRY_MINUTES}m`
+  });
+}
+
+function generateFullJWT(userId, email, fullName, role) {
+  const payload = {
+    user_id: userId,
+    email: email,
+    full_name: fullName,
+    role: role || 'user',
+    '2fa_required': false,
+    type: 'full',
+    last_activity: new Date().toISOString(),
+    iat: Math.floor(Date.now() / 1000)
+  };
+  return jwt.sign(payload, JWT_SECRET, {
+    algorithm: JWT_ALGORITHM,
+    expiresIn: `${FULL_JWT_EXPIRY_HOURS}h`
+  });
+}
+
+function verifyJWT(token) {
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
+    return decoded;
+  } catch (error) {
+    if (error.name === 'TokenExpiredError') {
+      throw new Error('Token has expired');
+    } else if (error.name === 'JsonWebTokenError') {
+      throw new Error('Invalid token');
+    } else {
+      throw error;
+    }
+  }
+}
+
+function refreshJWT(token) {
+  try {
+    const decoded = verifyJWT(token);
+    const lastActivity = new Date(decoded.last_activity);
+    const timeSinceActivity = Date.now() - lastActivity.getTime();
+    const inactivityTimeoutMs = INACTIVITY_TIMEOUT_MINUTES * 60 * 1000;
+
+    if (timeSinceActivity > inactivityTimeoutMs) {
+      throw new Error('Session expired due to inactivity');
+    }
+
+    const newPayload = {
+      user_id: decoded.user_id,
+      email: decoded.email,
+      full_name: decoded.full_name,
+      role: decoded.role || 'user',
+      '2fa_required': false,
+      type: 'full',
+      last_activity: new Date().toISOString(),
+      iat: decoded.iat,
+      exp: decoded.exp
+    };
+
+    return jwt.sign(newPayload, JWT_SECRET, {
+      algorithm: JWT_ALGORITHM,
+      noTimestamp: true
+    });
+  } catch (error) {
+    throw error;
+  }
+}
+
+function checkInactivity(token) {
+  try {
+    const decoded = verifyJWT(token);
+    const lastActivity = new Date(decoded.last_activity);
+    const timeSinceActivity = Date.now() - lastActivity.getTime();
+    const secondsInactive = Math.floor(timeSinceActivity / 1000);
+    const timeoutSeconds = INACTIVITY_TIMEOUT_MINUTES * 60;
+
+    return {
+      inactive: secondsInactive > timeoutSeconds,
+      seconds_inactive: secondsInactive,
+      timeout_seconds: timeoutSeconds
+    };
+  } catch (error) {
+    return { inactive: true, seconds_inactive: 999999 };
+  }
+}
+
+function extractTokenFromHeader(authHeader) {
+  if (!authHeader) return null;
+  const parts = authHeader.split(' ');
+  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') return null;
+  return parts[1];
+}
+
+module.exports = {
+  generateTempJWT, generateFullJWT, verifyJWT,
+  refreshJWT, checkInactivity, extractTokenFromHeader
+};

package/templates/utils/totpUtils.js

@@ -0,0 +1,52 @@
+const speakeasy = require('speakeasy');
+const QRCode = require('qrcode');
+
+const TOTP_ISSUER = process.env.TOTP_ISSUER || 'SecureAuth';
+
+function generateSecret() {
+  const secret = speakeasy.generateSecret({
+    name: TOTP_ISSUER,
+    length: 32
+  });
+  return {
+    base32_secret: secret.base32,
+    otpauth_url: secret.otpauth_url
+  };
+}
+
+async function generateQR(secret, email) {
+  const otpauthUrl = speakeasy.otpauthURL({
+    secret: secret,
+    label: email,
+    issuer: TOTP_ISSUER,
+    encoding: 'base32'
+  });
+
+  try {
+    const qrCodeDataURL = await QRCode.toDataURL(otpauthUrl);
+    return qrCodeDataURL;
+  } catch (error) {
+    console.error('QR Code generation error:', error);
+    throw new Error('Failed to generate QR code');
+  }
+}
+
+function verifyCode(secret, token, window = 1) {
+  return speakeasy.totp.verify({
+    secret: secret,
+    encoding: 'base32',
+    token: token,
+    window: window
+  });
+}
+
+function generateCode(secret) {
+  return speakeasy.totp({
+    secret: secret,
+    encoding: 'base32'
+  });
+}
+
+module.exports = {
+  generateSecret, generateQR, verifyCode, generateCode
+};