@nabhiraj/nab-auth 1.0.0 → 1.1.0

package/README.md

@@ -1,5 +1,7 @@
 # nab-auth
 
+<img src="./nab-auth-logo.png" alt="nab-auth logo" width="180">
+
 [![license](https://img.shields.io/npm/l/@nabhiraj/nab-auth.svg)](LICENSE)
 
 `@nabhiraj/nab-auth` is a configurable Express authentication library. It
@@ -292,6 +294,21 @@ to `true` for HTTPS production deployments. `defaultAdmin.enabled` defaults to
 
 ### Registration and authorization policy
 
+You can provide an optional password validator for registration:
+
+```js
+registration: {
+  validatePassword: (password) => password.length >= 12
+}
+```
+
+The function receives the plaintext password and must return `true` or `false`;
+async functions returning a boolean are also supported. A rejected password
+receives HTTP `400` and is not stored. If omitted, the existing non-empty
+password requirement applies. This setting applies to registration only, not
+password changes or default-admin creation. Validator errors are passed to
+Express error handling; the function must not log or persist passwords.
+
 | Setting | Effect |
 | --- | --- |
 | `registration.verificationRequired` | Requires a valid registration code on `POST /register`. |
@@ -378,6 +395,38 @@ When `jwt.keyProvider` is present, `jwt.keys` is not used.
 
 ## HTTP API
 
+### Per-route middleware
+
+Pass ordered arrays of Express middleware in `createAuthRouter` options:
+
+```js
+const router = auth.createAuthRouter(createTokenPayload, {
+  middleware: {
+    token: { beforeAuth: [loginLimiter, loginAudit] },
+    password: {
+      beforeAuth: [passwordIpLimiter],
+      afterAuth: [passwordUserLimiter]
+    }
+  }
+});
+app.use("/auth", router);
+```
+
+Supported keys are `potentialUsers`, `register`, `token`, `refresh`,
+`twoFactorCode`, `password`, `addRoles`, `removeRole`, and `replaceRoles`.
+Each omitted array defaults to empty. Middleware runs in array order:
+`beforeAuth`, built-in JWT and role checks, `afterAuth`, then the controller.
+`afterAuth` is only permitted for routes with built-in authentication:
+password and role routes, plus registration when
+`userRegistrationRequiresNabAdmin` is enabled. The authenticated claims are
+available as `req.auth` after those checks. Middleware may end the response or
+call `next(error)` in the usual Express way.
+
+The application supplies and configures limiters, including any shared store
+needed across processes. Apply middleware to application-owned routes directly
+with Express. Configure Express proxy trust to match your deployment before
+using client IP addresses for rate limiting.
+
 Mount the router at `/auth` to use these routes:
 
 | Method and route | Request body | Success | Notes |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nabhiraj/nab-auth",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Configurable Express authentication library with pluggable database adapters, JWT, registration verification, and 2FA",
   "type": "module",
   "main": "./src/authenticationLogic/index.js",

package/src/authenticationLogic/config/createAuthConfig.js

@@ -15,6 +15,11 @@ export function createAuthConfig(overrides = {}) {
   validateCodeConfig(config.twoFactor, "twoFactor", "required");
   validateString(config.authorization.adminRole, "authorization.adminRole");
 
+  if (config.registration.validatePassword !== undefined &&
+      typeof config.registration.validatePassword !== "function") {
+    throw new TypeError("registration.validatePassword must be a function");
+  }
+
   if (
     config.database.adapter !== undefined &&
     typeof config.database.adapter !== "function"

package/src/authenticationLogic/config/defaultAuthConfig.js

@@ -24,6 +24,7 @@ export const defaultAuthConfig = {
   },
   registration: {
     verificationRequired: false,
+    validatePassword: undefined,
     codeDigits: 6,
     codeTtlMs: 10 * 60 * 1000
   },

package/src/authenticationLogic/controllers/authController.js

@@ -143,6 +143,16 @@ export function createAuthController({
         return res.status(400).json({ message: "email and password are required" });
       }
 
+      if (config.registration.validatePassword) {
+        const valid = await config.registration.validatePassword(password);
+        if (typeof valid !== "boolean") {
+          throw new TypeError("registration.validatePassword must return a boolean");
+        }
+        if (!valid) {
+          return res.status(400).json({ message: "Password does not meet requirements" });
+        }
+      }
+
       const normalizedEmail = normalizeEmail(email);
       if (await repository.findUserByEmail(normalizedEmail)) {
         return res.status(409).json({ message: "User already exists" });

package/src/authenticationLogic/createAuthenticationLibrary.js

@@ -63,7 +63,7 @@ export function createAuthenticationLibrary(configOverrides = {}) {
         options
       });
 
-      return createAuthRouter({ controller, middleware, config });
+      return createAuthRouter({ controller, middleware, config, routeMiddleware: options.middleware });
     }
   };
 }

package/src/authenticationLogic/routes/authRoutes.js

@@ -1,7 +1,8 @@
 import { Router } from "express";
 
-export function createAuthRouter({ controller, middleware, config }) {
+export function createAuthRouter({ controller, middleware, config, routeMiddleware = {} }) {
   const authRouter = Router();
+  console.log('route middleware is ',routeMiddleware);
 
   const registrationMiddleware = config.authorization.userRegistrationRequiresNabAdmin
     ? [middleware.requireJwt, middleware.requireNabAdmin]
@@ -14,27 +15,49 @@ export function createAuthRouter({ controller, middleware, config }) {
     middleware.requireNabAdmin
   ];
 
-  authRouter.post("/roles", ...roleManagementMiddleware, controller.addRoles);
-  authRouter.delete(
-    "/roles",
-    ...roleManagementMiddleware,
-    controller.removeRole
-  );
-  authRouter.put(
-    "/roles",
-    ...roleManagementMiddleware,
-    controller.replaceRoles
-  );
-  authRouter.patch(
-    "/password",
-    ...passwordChangeMiddleware,
-    controller.changePassword
-  );
-  authRouter.post("/potential-users", controller.createPotentialUser);
-  authRouter.post("/2fa/code", controller.generateTwoFactorCode);
-  authRouter.post("/register", ...registrationMiddleware, controller.registerUser);
-  authRouter.post("/token", controller.issueToken);
-  authRouter.post("/refresh", controller.refreshToken);
+  const routes = {
+    addRoles: ["post", "/roles", roleManagementMiddleware, controller.addRoles],
+    removeRole: ["delete", "/roles", roleManagementMiddleware, controller.removeRole],
+    replaceRoles: ["put", "/roles", roleManagementMiddleware, controller.replaceRoles],
+    password: ["patch", "/password", passwordChangeMiddleware, controller.changePassword],
+    potentialUsers: ["post", "/potential-users", [], controller.createPotentialUser],
+    twoFactorCode: ["post", "/2fa/code", [], controller.generateTwoFactorCode],
+    register: ["post", "/register", registrationMiddleware, controller.registerUser],
+    token: ["post", "/token", [], controller.issueToken],
+    refresh: ["post", "/refresh", [], controller.refreshToken]
+  };
+
+  if (!routeMiddleware || typeof routeMiddleware !== "object" || Array.isArray(routeMiddleware)) {
+    throw new TypeError("options.middleware must be an object");
+  }
+  for (const name of Object.keys(routeMiddleware)) {
+    if (!Object.hasOwn(routes, name)) {
+      throw new TypeError(`Unknown middleware route: ${name}`);
+    }
+  }
+
+  for (const [name, [method, path, auth, handler]] of Object.entries(routes)) {
+    const settings = routeMiddleware[name] ?? {};
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+      throw new TypeError(`options.middleware.${name} must be an object`);
+    }
+    for (const key of Object.keys(settings)) {
+      if (key !== "beforeAuth" && key !== "afterAuth") {
+        throw new TypeError(`Unknown middleware position: ${name}.${key}`);
+      }
+    }
+    const before = settings.beforeAuth ?? [];
+    const after = settings.afterAuth ?? [];
+    for (const [position, value] of [["beforeAuth", before], ["afterAuth", after]]) {
+      if (!Array.isArray(value) || value.some((item) => typeof item !== "function")) {
+        throw new TypeError(`options.middleware.${name}.${position} must be an array of functions`);
+      }
+    }
+    if (!auth.length && Object.hasOwn(settings, "afterAuth")) {
+      throw new TypeError(`options.middleware.${name}.afterAuth requires built-in authentication`);
+    }
+    authRouter[method](path, ...before, ...auth, ...after, handler);
+  }
 
   return authRouter;
 }