@metaadri/secureauth 1.2.1 → 1.2.3

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "SecureAuth CLI - Add enterprise authentication to any Express app in one command",
   "bin": {
     "secureauth": "bin/cli.js"

package/src/detector.js

@@ -3,11 +3,13 @@ const path = require('path');
 
 const REQUIRED_DIRS = ['controllers', 'routes', 'middleware', 'models', 'utils', 'database'];
 const SECUREAUTH_DEPS = [
-  'express', 'bcryptjs', 'jsonwebtoken', 'helmet',
+  'express', 'jsonwebtoken', 'helmet',
   'express-rate-limit', 'express-slow-down', 'speakeasy',
   'qrcode', 'dotenv', 'cors', 'uuid'
 ];
 
+const BCRYPT_ALIASES = ['bcryptjs', 'bcrypt'];
+
 function detect(dir) {
   const report = {
     hasPackageJson: false,
@@ -49,7 +51,11 @@ function detect(dir) {
       } catch {}
     }
 
-    report.missingDeps = SECUREAUTH_DEPS.filter(d => !(d in allDeps));
+    const hasBcrypt = BCRYPT_ALIASES.some(d => d in allDeps);
+    report.missingDeps = SECUREAUTH_DEPS.filter(d => {
+      if (d === 'bcryptjs') return !hasBcrypt;
+      return !(d in allDeps);
+    });
   }
 
   const existingDirs = [];

package/src/generator.js

@@ -60,18 +60,78 @@ function buildEnvContent(answers) {
   return lines.join('\n');
 }
 
+function mergeEnvContent(existingContent, newContent) {
+  const existingLines = existingContent.split('\n');
+  const existingKeys = new Set();
+  let existingDbUrl = null;
+
+  for (const line of existingLines) {
+    const eqIdx = line.indexOf('=');
+    if (eqIdx !== -1) {
+      const key = line.slice(0, eqIdx).trim();
+      existingKeys.add(key);
+      if (key === 'DATABASE_URL') {
+        existingDbUrl = line.slice(eqIdx + 1).trim();
+      }
+    }
+  }
+
+  const newLines = newContent.split('\n');
+  const merged = [];
+
+  if (existingDbUrl) {
+    for (const line of newLines) {
+      if (line.startsWith('DATABASE_URL=')) {
+        continue;
+      }
+      merged.push(line);
+    }
+    const dbSectionStart = merged.findIndex(l => l.includes('# Database'));
+    if (dbSectionStart !== -1) {
+      merged.splice(dbSectionStart, 0, `DATABASE_URL=${existingDbUrl}`);
+    } else {
+      merged.push('');
+      merged.push('# Database Configuration (preserved from existing .env)');
+      merged.push(`DATABASE_URL=${existingDbUrl}`);
+    }
+  } else {
+    merged.push(...newLines);
+  }
+
+  for (const key of existingKeys) {
+    if (key === 'DATABASE_URL') continue;
+    const existingLine = existingLines.find(l => l.startsWith(key + '='));
+    if (existingLine) {
+      const newIdx = merged.findIndex(l => l.startsWith(key + '='));
+      if (newIdx !== -1) {
+        merged[newIdx] = existingLine;
+      }
+    }
+  }
+
+  return merged.join('\n');
+}
+
 function writeEnvFile(targetDir, answers) {
   const fs = require('fs');
   const path = require('path');
   const envPath = path.join(targetDir, '.env');
 
+  const newContent = buildEnvContent(answers);
+
   if (fs.existsSync(envPath)) {
-    logger.warn('.env already exists — skipping (delete it first to regenerate)');
-    return false;
+    const existingContent = fs.readFileSync(envPath, 'utf-8');
+    const merged = mergeEnvContent(existingContent, newContent);
+    if (merged !== existingContent) {
+      fs.writeFileSync(envPath, merged, 'utf-8');
+      logger.success('.env updated with SecureAuth settings (preserved existing values)');
+    } else {
+      logger.warn('.env already exists — settings are up to date');
+    }
+    return true;
   }
 
-  const content = buildEnvContent(answers);
-  fs.writeFileSync(envPath, content, 'utf-8');
+  fs.writeFileSync(envPath, newContent, 'utf-8');
   logger.success('.env created with secure defaults');
   return true;
 }

package/src/index.js

@@ -6,6 +6,7 @@ const { printReport } = require('./reporter');
 const { install } = require('./installer');
 const { writeEnvFile } = require('./generator');
 const { scaffold } = require('./scaffolder');
+const { patchExisting } = require('./patcher');
 const {
   askProjectType,
   askProjectName,
@@ -13,6 +14,7 @@ const {
   askPort,
   askJwtSecret,
   askFeatures,
+  askInstallMode,
   askConfirm
 } = require('./questions');
 
@@ -101,6 +103,12 @@ async function init(defaults) {
   logger.info(logger.dim('Not sure which features to pick? Visit https://secureauth106293.netlify.app/ for guidance.'));
   answers.features = await askFeatures(defaults);
 
+  if (projectType === 'existing') {
+    answers.installMode = await askInstallMode(defaults);
+  } else {
+    answers.installMode = 'scaffold';
+  }
+
   logger.info('');
   const confirmed = await askConfirm(defaults);
   if (!confirmed) {
@@ -113,16 +121,23 @@ async function init(defaults) {
   logger.info(`Database:  ${answers.database}`);
   logger.info(`Port:      ${answers.port}`);
   logger.info(`Features:  ${answers.features.join(', ') || 'none'}`);
+  if (projectType === 'existing') {
+    logger.info(`Mode:      ${answers.installMode === 'patch' ? 'Patch existing login route' : 'Add alongside existing auth'}`);
+  }
 
   logger.info('');
 
-  await install(targetDir, report.missingDeps, answers);
-
-  const filesCreated = scaffold(targetDir, answers);
-
-  writeEnvFile(targetDir, answers);
-
-  printSuccess(answers, filesCreated);
+  if (answers.installMode === 'patch') {
+    await install(targetDir, report.missingDeps, answers);
+    patchExisting(targetDir, answers);
+    writeEnvFile(targetDir, answers);
+    printSuccess(answers, 0);
+  } else {
+    await install(targetDir, report.missingDeps, answers);
+    const filesCreated = scaffold(targetDir, answers);
+    writeEnvFile(targetDir, answers);
+    printSuccess(answers, filesCreated);
+  }
 }
 
 module.exports = { init };

package/src/installer.js

@@ -28,7 +28,7 @@ function install(cwd, missingDeps, answers) {
     const child = spawn('npm', args, {
       cwd,
       stdio: ['ignore', 'pipe', 'pipe'],
-      shell: true
+      shell: false
     });
 
     let output = '';

package/src/patcher.js

@@ -0,0 +1,409 @@
+const fs = require('fs');
+const path = require('path');
+const { logger } = require('./logger');
+
+const ENTRY_CANDIDATES = ['server.js', 'app.js', 'index.js'];
+const NESTED_ENTRIES = [
+  ['backend', 'server.js'],
+  ['backend', 'app.js'],
+  ['backend', 'index.js'],
+  ['src', 'server.js'],
+  ['src', 'app.js'],
+  ['src', 'index.js']
+];
+const AUTH_ROUTE_PATTERNS = [
+  ['routes', 'auth.js'],
+  ['routes', 'authRoutes.js'],
+  ['backend', 'routes', 'auth.js'],
+  ['backend', 'routes', 'authRoutes.js'],
+  ['src', 'routes', 'auth.js'],
+  ['src', 'routes', 'authRoutes.js']
+];
+
+function findEntryPoint(targetDir) {
+  for (const name of ENTRY_CANDIDATES) {
+    const p = path.join(targetDir, name);
+    if (fs.existsSync(p)) return p;
+  }
+  for (const parts of NESTED_ENTRIES) {
+    const p = path.join(targetDir, ...parts);
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+function findAuthRouteFile(targetDir) {
+  const entry = findEntryPoint(targetDir);
+  if (entry) {
+    const content = fs.readFileSync(entry, 'utf-8');
+    const regex = /require\(['"]\.\/?([^'"]*(?:auth|login)[^'"]*)['"]\)/i;
+    const m = content.match(regex);
+    if (m) {
+      let routePath = m[1].replace(/\.js$/, '');
+      const base = path.dirname(entry);
+      for (const ext of ['', '.js']) {
+        const full = path.resolve(base, routePath + ext);
+        if (fs.existsSync(full)) return full;
+      }
+    }
+  }
+  for (const parts of AUTH_ROUTE_PATTERNS) {
+    const p = path.join(targetDir, ...parts);
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+function detectDatabaseType(targetDir) {
+  const pkgPath = path.join(targetDir, 'package.json');
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+      const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if ('pg' in allDeps || '@neondatabase/serverless' in allDeps) return 'postgres';
+      if ('better-sqlite3' in allDeps || 'sql.js' in allDeps) return 'sqlite';
+      if ('mysql2' in allDeps) return 'mysql';
+    } catch {}
+  }
+  const entry = findEntryPoint(targetDir);
+  if (entry) {
+    try {
+      const content = fs.readFileSync(entry, 'utf-8');
+      if (/require\(['"](pg|@neondatabase\/serverless)['"]\)/.test(content)) return 'postgres';
+      if (/require\(['"]better-sqlite3['"]\)/.test(content)) return 'sqlite';
+      if (/require\(['"]mysql2['"]\)/.test(content)) return 'mysql';
+    } catch {}
+  }
+  const authFile = findAuthRouteFile(targetDir);
+  if (authFile) {
+    try {
+      const content = fs.readFileSync(authFile, 'utf-8');
+      if (/\$\d/.test(content)) return 'postgres';
+      if (/\?\s*\]/.test(content) && /better-sqlite3/.test(content)) return 'sqlite';
+    } catch {}
+  }
+  return 'sqlite';
+}
+
+function isAlreadyPatched(content) {
+  return /checkAccountLockout/.test(content) ||
+    /MAX_FAILED_ATTEMPTS/.test(content) ||
+    /failed_login_attempts/.test(content) ||
+    /LOCKOUT_DURATION_MINUTES/.test(content);
+}
+
+function detectDbVariable(content) {
+  const poolMatch = content.match(/(?:const|let|var)\s+(pool|db|client|query)\s*=\s*(?:new\s+(?:Pool|Client|Database)|require\()/i);
+  if (poolMatch) return poolMatch[1];
+  const exportMatch = content.match(/(?:const|let|var)\s+(\w+)\s*=\s*require\(['"]\.\.?\/[^'"]*db[^'"]*['"]\)/i);
+  if (exportMatch) return exportMatch[1];
+  return 'pool';
+}
+
+function detectParamStyle(content) {
+  if (/\$\d/.test(content)) return 'postgres';
+  return 'sqlite';
+}
+
+function generateLockoutEnvBlock() {
+  return `
+const MAX_FAILED_ATTEMPTS = parseInt(process.env.MAX_FAILED_ATTEMPTS) || 5;
+const LOCKOUT_DURATION_MINUTES = parseInt(process.env.LOCKOUT_DURATION_MINUTES) || 30;
+`;
+}
+
+function generateHelperBlock() {
+  return `
+
+async function checkAccountLockout(user) {
+  if (user.locked_until) {
+    const lockedUntil = new Date(user.locked_until);
+    if (lockedUntil > new Date()) {
+      const minutesLeft = Math.ceil((lockedUntil - new Date()) / 60000);
+      const err = new Error(\`Account locked due to too many failed attempts. Try again in \${minutesLeft} minute(s).\`);
+      err.statusCode = 423;
+      throw err;
+    }
+  }
+}
+`;
+}
+
+function generateLockoutCheckBlock() {
+  return `
+    try {
+      await checkAccountLockout(user);
+    } catch (lockErr) {
+      return res.status(lockErr.statusCode || 423).json({
+        error: 'Account locked',
+        message: lockErr.message
+      });
+    }
+`;
+}
+
+function generateIncrementBlock(dbVar, paramStyle) {
+  if (paramStyle === 'postgres') {
+    return `
+    const failedResult = await ${dbVar}.query('UPDATE users SET failed_login_attempts = failed_login_attempts + 1, last_failed_login = $1 WHERE id = $2 RETURNING failed_login_attempts', [new Date().toISOString(), user.id]);
+    const failedAttempts = failedResult.rows[0] ? failedResult.rows[0].failed_login_attempts : 1;
+    const remaining = MAX_FAILED_ATTEMPTS - failedAttempts;
+    if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
+      const lockedUntil = new Date();
+      lockedUntil.setMinutes(lockedUntil.getMinutes() + LOCKOUT_DURATION_MINUTES);
+      await ${dbVar}.query('UPDATE users SET locked_until = $1 WHERE id = $2', [lockedUntil.toISOString(), user.id]);
+      return res.status(423).json({
+        error: 'Account locked',
+        message: \`Account locked due to \${MAX_FAILED_ATTEMPTS} failed attempts. Try again in \${LOCKOUT_DURATION_MINUTES} minutes.\`
+      });
+    }
+`;
+  } else {
+    return `
+    ${dbVar}.query('UPDATE users SET failed_login_attempts = failed_login_attempts + 1, last_failed_login = ? WHERE id = ?', [new Date().toISOString(), user.id]);
+    const failedRow = ${dbVar}.query('SELECT failed_login_attempts FROM users WHERE id = ?', [user.id]);
+    const failedAttempts = failedRow.rows[0] ? failedRow.rows[0].failed_login_attempts : 1;
+    const remaining = MAX_FAILED_ATTEMPTS - failedAttempts;
+    if (failedAttempts >= MAX_FAILED_ATTEMPTS) {
+      const lockedUntil = new Date();
+      lockedUntil.setMinutes(lockedUntil.getMinutes() + LOCKOUT_DURATION_MINUTES);
+      ${dbVar}.query('UPDATE users SET locked_until = ? WHERE id = ?', [lockedUntil.toISOString(), user.id]);
+      return res.status(423).json({
+        error: 'Account locked',
+        message: \`Account locked due to \${MAX_FAILED_ATTEMPTS} failed attempts. Try again in \${LOCKOUT_DURATION_MINUTES} minutes.\`
+      });
+    }
+`;
+  }
+}
+
+function generateResetBlock(dbVar, paramStyle) {
+  const param = paramStyle === 'postgres' ? '$1' : '?';
+  return `
+    await ${dbVar}.query('UPDATE users SET failed_login_attempts = 0, locked_until = NULL, last_failed_login = NULL WHERE id = ${param}', [user.id]);
+`;
+}
+
+function generateMigrationSql(dbType) {
+  if (dbType === 'postgres') {
+    return `-- SecureAuth: Add account lockout columns
+ALTER TABLE users ADD COLUMN IF NOT EXISTS failed_login_attempts INTEGER DEFAULT 0;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS locked_until TEXT;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS last_failed_login TEXT;
+`;
+  }
+  return `-- SecureAuth: Add account lockout columns
+ALTER TABLE users ADD COLUMN failed_login_attempts INTEGER DEFAULT 0;
+ALTER TABLE users ADD COLUMN locked_until TEXT;
+ALTER TABLE users ADD COLUMN last_failed_login TEXT;
+`;
+}
+
+function addEnvVars(content) {
+  const requireRegex = /(?:const|let|var)\s+\w+\s*=\s*require\([^)]+\)/g;
+  let lastMatch = null;
+  let m;
+  while ((m = requireRegex.exec(content)) !== null) {
+    lastMatch = m;
+  }
+  if (lastMatch) {
+    const insertPos = content.indexOf('\n', lastMatch.index);
+    const splitPos = insertPos !== -1 ? insertPos + 1 : content.length;
+    return {
+      content: content.slice(0, splitPos) + generateLockoutEnvBlock() + content.slice(splitPos),
+      modified: true
+    };
+  }
+  return { content: generateLockoutEnvBlock() + '\n' + content, modified: true };
+}
+
+function addHelper(content) {
+  const loginRouteRegex = /(?:router|app)\s*\.\s*(?:post|get)\s*\(\s*['"](?:\/api\/)?(?:login|signin)['"]/;
+  const loginMatch = content.match(loginRouteRegex);
+  if (!loginMatch) return { content, modified: false };
+
+  const lineStart = content.lastIndexOf('\n', loginMatch.index) + 1;
+  const helper = generateHelperBlock();
+  return {
+    content: content.slice(0, lineStart) + helper + '\n' + content.slice(lineStart),
+    modified: true
+  };
+}
+
+function addLockoutCheck(content, dbVar) {
+  const compareRegex = /(?:const\s+)?is(?:Valid|PasswordValid)\s*=\s*await\s+bcrypt\.compare\(/;
+  const compareMatch = content.match(compareRegex);
+  if (!compareMatch) return { content, modified: false };
+
+  const lineStart = content.lastIndexOf('\n', compareMatch.index) + 1;
+  const lockoutCheck = generateLockoutCheckBlock();
+  return {
+    content: content.slice(0, lineStart) + lockoutCheck + content.slice(lineStart),
+    modified: true
+  };
+}
+
+function addIncrementReset(content, dbVar, paramStyle) {
+  const invalidPwMatch = content.match(/if\s*\(\s*!is(?:Valid|PasswordValid)\s*\)/);
+  if (!invalidPwMatch) return { content, modified: false };
+
+  const blockStart = content.indexOf('{', invalidPwMatch.index);
+  if (blockStart === -1) return { content, modified: false };
+
+  const incrementBlock = generateIncrementBlock(dbVar, paramStyle);
+
+  const afterBrace = content.slice(blockStart + 1);
+  const firstReturn = afterBrace.search(/\breturn\s+res\.status\(401\)/);
+  if (firstReturn === -1) return { content, modified: false };
+
+  const insertPos = blockStart + 1 + firstReturn;
+  content = content.slice(0, insertPos) + incrementBlock + content.slice(insertPos);
+
+  const closingBraceIndex = findMatchingBrace(content, blockStart);
+  if (closingBraceIndex === -1) return { content, modified: false };
+
+  const afterInvalidBlock = content.slice(closingBraceIndex + 1);
+  const successPwMatch = afterInvalidBlock.match(/if\s*\(!is(?:Valid|PasswordValid)\)/);
+  if (successPwMatch) {
+    const secondBlockStart = afterInvalidBlock.indexOf('{', successPwMatch.index);
+    if (secondBlockStart !== -1) {
+      const secondClosing = findMatchingBrace(afterInvalidBlock, secondBlockStart);
+      if (secondClosing !== -1) {
+        const afterSecond = afterInvalidBlock.slice(secondClosing + 1);
+        const resetBlock = generateResetBlock(dbVar, paramStyle);
+        const successMatch = afterSecond.match(/\breturn\s+res\.status\(2\d{2}\)/);
+        if (successMatch) {
+          const insertAfterSecond = closingBraceIndex + 1 + secondClosing + 1 + successMatch.index;
+          content = content.slice(0, insertAfterSecond) + resetBlock + content.slice(insertAfterSecond);
+          return { content, modified: true };
+        }
+      }
+    }
+  }
+
+  const afterInvalidBlockClean = content.slice(closingBraceIndex + 1);
+  const awaitCompareMatch = afterInvalidBlockClean.match(/await\s+bcrypt\.compare\(/);
+  if (awaitCompareMatch) {
+    return { content, modified: false };
+  }
+
+  const resetBlock = generateResetBlock(dbVar, paramStyle);
+  const successMatch = afterInvalidBlockClean.match(/\breturn\s+res\.status\(2\d{2}\)/);
+  if (successMatch) {
+    const insertPos3 = closingBraceIndex + 1 + successMatch.index;
+    content = content.slice(0, insertPos3) + resetBlock + content.slice(insertPos3);
+    return { content, modified: true };
+  }
+
+  return { content, modified: false };
+}
+
+function addStatus423Return(content, dbVar, paramStyle) {
+  const lockedResponse = `\n      return res.status(423).json({
+        error: 'Account locked',
+        message: \`Account locked due to \${MAX_FAILED_ATTEMPTS} failed attempts. Try again in \${LOCKOUT_DURATION_MINUTES} minutes.\`
+      });`;
+  const ifBlockRegex = /if\s*\(\s*failedAttempts\s*>=\s*MAX_FAILED_ATTEMPTS\s*\)\s*\{/;
+  const ifMatch = content.match(ifBlockRegex);
+  if (!ifMatch) return { content, modified: false };
+
+  const blockStart = content.indexOf('{', ifMatch.index);
+  const beforeLock = content.slice(blockStart + 1).match(/\bawait\s+dbVar\.query\(/);
+  if (beforeLock) {
+    const insertAfterLock = blockStart + 1 + beforeLock.index + beforeLock[0].length;
+    const semicolon = content.indexOf(';', insertAfterLock);
+    if (semicolon !== -1) {
+      content = content.slice(0, semicolon + 1) + lockedResponse + content.slice(semicolon + 1);
+      return { content, modified: true };
+    }
+  }
+  return { content, modified: false };
+}
+
+function findMatchingBrace(str, openPos) {
+  if (str[openPos] !== '{') return -1;
+  let depth = 0;
+  for (let i = openPos; i < str.length; i++) {
+    if (str[i] === '{') depth++;
+    else if (str[i] === '}') {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
+function writeMigration(targetDir, dbType) {
+  const migrationsDir = path.join(targetDir, 'migrations');
+  if (!fs.existsSync(migrationsDir)) {
+    fs.mkdirSync(migrationsDir, { recursive: true });
+  }
+
+  const timestamp = new Date().toISOString().replace(/[^0-9]/g, '').slice(0, 14);
+  const fileName = `${timestamp}_add_account_lockout.sql`;
+  const filePath = path.join(migrationsDir, fileName);
+
+  if (fs.existsSync(filePath)) {
+    logger.warn(`Migration ${fileName} already exists — skipping`);
+    return null;
+  }
+
+  const sql = generateMigrationSql(dbType);
+  fs.writeFileSync(filePath, sql, 'utf-8');
+  logger.success(`Created migration: migrations/${fileName}`);
+  return filePath;
+}
+
+function patchExisting(targetDir, answers) {
+  const hasLockout = answers.features && answers.features.includes('accountLockout');
+  if (!hasLockout) {
+    logger.info('Account lockout not selected — skipping patcher');
+    return { patched: false };
+  }
+
+  const authFile = findAuthRouteFile(targetDir);
+  if (!authFile) {
+    logger.warn('Could not find existing auth route file — lockout not patched');
+    return { patched: false };
+  }
+
+  logger.info(`Found auth route: ${path.relative(targetDir, authFile)}`);
+
+  let content = fs.readFileSync(authFile, 'utf-8');
+  if (isAlreadyPatched(content)) {
+    logger.info('Auth route already has lockout protection');
+    const migrationPath = writeMigration(targetDir, detectDatabaseType(targetDir));
+    return { patched: true, alreadyPatched: true, authFile, migrationPath };
+  }
+
+  const dbType = detectDatabaseType(targetDir);
+  const paramStyle = detectParamStyle(content);
+  const dbVar = detectDbVariable(content);
+
+  logger.info(`Database type: ${dbType}, param style: ${paramStyle}, DB variable: \`${dbVar}\``);
+
+  let result = addEnvVars(content);
+  content = result.content;
+
+  result = addHelper(content);
+  content = result.content;
+
+  result = addLockoutCheck(content, dbVar);
+  content = result.content;
+
+  result = addIncrementReset(content, dbVar, paramStyle);
+  content = result.content;
+
+  fs.writeFileSync(authFile, content, 'utf-8');
+  logger.success(`Patched ${path.relative(targetDir, authFile)} with account lockout`);
+
+  const migrationPath = writeMigration(targetDir, dbType);
+
+  logger.info('Add these to your .env file for lockout configuration:');
+  logger.info('  MAX_FAILED_ATTEMPTS=5');
+  logger.info('  LOCKOUT_DURATION_MINUTES=30');
+
+  return { patched: true, authFile, migrationPath, dbType };
+}
+
+module.exports = { patchExisting, findEntryPoint, findAuthRouteFile, detectDatabaseType, detectDbVariable, detectParamStyle, isAlreadyPatched, writeMigration };

package/src/questions.js

@@ -98,6 +98,21 @@ async function askFeatures(defaults) {
   return features;
 }
 
+async function askInstallMode(defaults) {
+  if (defaults) return 'patch';
+  const { mode } = await prompt({
+    type: 'select',
+    name: 'mode',
+    message: 'How would you like to install SecureAuth?',
+    choices: [
+      { name: 'patch', message: 'Patch existing login route with account lockout (Recommended)' },
+      { name: 'alongside', message: 'Add alongside existing auth (mount at /api/secure-auth)' }
+    ],
+    initial: 0
+  });
+  return mode;
+}
+
 async function askConfirm(defaults) {
   if (defaults) return true;
   const { confirmed } = await prompt({
@@ -117,5 +132,6 @@ module.exports = {
   askPort,
   askJwtSecret,
   askFeatures,
+  askInstallMode,
   askConfirm
 };

package/src/scaffolder.js

@@ -117,9 +117,97 @@ function scaffold(targetDir, answers) {
     fileCount++;
   }
 
+  postProcess(targetDir);
   return fileCount;
 }
 
+function postProcessExisting(targetDir) {
+  const serverFiles = ['server.js', 'app.js', 'index.js'];
+  let entryContent = null;
+  let entryPath = null;
+
+  for (const f of serverFiles) {
+    const p = path.join(targetDir, f);
+    if (fs.existsSync(p)) {
+      entryContent = fs.readFileSync(p, 'utf-8');
+      entryPath = p;
+      break;
+    }
+  }
+  if (!entryContent) return;
+
+  const mods = [];
+
+  const dotenvRegex = /require\(['"]dotenv['"]\)\.config\(\);/;
+  if (!dotenvRegex.test(entryContent) && !entryContent.includes("require('dotenv')")) {
+    const firstRequireEnd = entryContent.indexOf(';') + 1;
+    if (firstRequireEnd > 0) {
+      mods.push({ pos: 0, end: firstRequireEnd, insert: `const path = require('path');\nrequire('dotenv').config({ path: path.join(__dirname, '.env') });\n` });
+    }
+  }
+
+  if (mods.length > 0) {
+    for (const m of mods.reverse()) {
+      entryContent = entryContent.slice(0, m.end) + '\n' + m.insert + entryContent.slice(m.end);
+    }
+    fs.writeFileSync(entryPath, entryContent, 'utf-8');
+    logger.info(`Patched ${path.basename(entryPath)} with dotenv config`);
+  }
+}
+
+function postProcess(targetDir) {
+  const files = {
+    'controllers/authController.js': [
+      {
+        search: /(const failedAttempts = await userModel\.incrementFailedAttempts\(user\.id\);)(?!\s+const remaining)/,
+        replace: '$1\n      const remaining = MAX_FAILED_ATTEMPTS - failedAttempts;'
+      }
+    ],
+    'server.js': [
+      {
+        search: /require\('dotenv'\)\.config\(\);/,
+        replace: "const path = require('path');\nrequire('dotenv').config({ path: path.join(__dirname, '.env') });"
+      },
+      {
+        search: /initDatabase\(\)\s*\.then\(async\s*\(\)\s*=>\s*\{[\s\S]*?await seedAdminUser\(\);[\s\S]*?await seedDemoUser\(\);[\s\S]*?dbReady\s*=\s*true;[\s\S]*?console\.log\('Database initialized and seeded'\);\s*\}\)[\s\S]*?\.catch\(err\s*=>\s*\{[\s\S]*?console\.error\('Database initialization failed:',\s*err\.message\);\s*\}\);/,
+        replace: "try {\n  initDatabase();\n  seedAdminUser();\n  seedDemoUser();\n  dbReady = true;\n  console.log('Database initialized and seeded');\n} catch (err) {\n  console.error('Database initialization failed:', err.message);\n}"
+      }
+    ],
+    'database/db.sqlite.js': [
+      {
+        search: /query:\s*\(text,\s*params\)\s*=>\s*\{[^}]*const stmt\s*=\s*db\.prepare\(text\);[^}]*const rows\s*=\s*params\s*\?\s*stmt\.all\(\.\.\.params\)\s*:\s*stmt\.all\(\);[^}]*return\s*\{\s*rows\s*\};[^}]*\}/,
+        replace: "query: (text, params) => {\n      const stmt = db.prepare(text);\n      const sql = text.trim().toUpperCase();\n      if (sql.startsWith('SELECT')) {\n        const rows = params ? stmt.all(...params) : stmt.all();\n        return { rows };\n      }\n      const info = params ? stmt.run(...params) : stmt.run();\n      return { rows: [], changes: info.changes };\n    }"
+      }
+    ],
+    'routes/authRoutes.js': [
+      {
+        search: /router\.post\('\/demo\/login', authController\.demoLogin\);\s*/,
+        replace: ''
+      }
+    ]
+  };
+
+  for (const [relative, rules] of Object.entries(files)) {
+    const filePath = path.join(targetDir, relative);
+    if (!fs.existsSync(filePath)) continue;
+    try {
+      let content = fs.readFileSync(filePath, 'utf-8');
+      const before = content;
+      for (const rule of rules) {
+        content = content.replace(rule.search, rule.replace);
+      }
+      if (content !== before) {
+        fs.writeFileSync(filePath, content, 'utf-8');
+        logger.info(`Patched ${relative}`);
+      }
+    } catch {
+      // skip unreadable files
+    }
+  }
+
+  postProcessExisting(targetDir);
+}
+
 function collectFiles(dir) {
   const results = [];
   for (const entry of fs.readdirSync(dir)) {