mbkauthe 1.0.6 → 1.0.7

package/lib/main.js

@@ -31,111 +31,75 @@ if (mbkautheVar.COOKIE_EXPIRE_TIME !== undefined) {
 
 
 const router = express.Router();
-let COOKIE_EXPIRE_TIME = 2 * 24 * 60 * 60 * 1000; //2 days
+let COOKIE_EXPIRE_TIME = 2 * 24 * 60 * 60 * 1000; // 2 days
 
 try {
   const parsedExpireTime = parseInt(mbkautheVar.COOKIE_EXPIRE_TIME, 10);
   if (!isNaN(parsedExpireTime) && parsedExpireTime > 0) {
-    COOKIE_EXPIRE_TIME = parsedExpireTime * 24 * 60 * 60 * 1000; // Convert days to milliseconds
+    COOKIE_EXPIRE_TIME = parsedExpireTime * 24 * 60 * 60 * 1000;
   } else {
-    console.warn("Invalid COOKIE_EXPIRE_TIME in environment variables, using default value");
+    console.warn("Invalid COOKIE_EXPIRE_TIME, using default value");
   }
-  console.log(`Cookie expiration time set to ${COOKIE_EXPIRE_TIME / (24 * 60 * 60 * 1000)} days for deployed environment`);
 } catch (error) {
   console.log("Error parsing COOKIE_EXPIRE_TIME:", error);
 }
 
-router.use(express.json());
-router.use(express.urlencoded({ extended: true }));
-
-router.use(
-  session({
-    store: new PgSession({
-      pool: dblogin, // Connection pool
-      tableName: "session", // Use another table-name than the default "session" one
-    }),
-    secret: mbkautheVar.SESSION_SECRET_KEY, // Replace with your secret key
-    resave: false,
-    saveUninitialized: false,
-    cookie: {
-      maxAge: COOKIE_EXPIRE_TIME,
-      DOMAIN: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined, // Use root DOMAIN for subDOMAIN sharing
-      httpOnly: true,
-      secure: mbkautheVar.IS_DEPLOYED === 'true', // Use secure cookies in production
-    },
-  })
-);
-
-
-
-router.use(cookieParser()); // Use cookie-parser middleware
-
+// Enable CORS for subdomains
 router.use((req, res, next) => {
-  if (req.session && req.session.user) {
-    const userAgent = req.headers["user-agent"];
-    const userIp =
-      req.headers["x-forwarded-for"] || req.connection.remoteAddress;
-    const formattedIp = userIp === "::1" ? "127.0.0.1" : userIp;
-
-    req.session.otherInfo = {
-      ip: formattedIp,
-      browser: userAgent,
-    };
-
-    next();
-  } else {
-    next();
+  const origin = req.headers.origin;
+  if (origin && origin.endsWith(`.${mbkautheVar.DOMAIN}`)) {
+    res.header('Access-Control-Allow-Origin', origin);
+    res.header('Access-Control-Allow-Credentials', 'true');
+    res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
+    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
   }
+  next();
 });
 
-// Save the username in a cookie, the cookie user name is use
-// for displaying user name in profile menu. This cookie is not use anyelse where.
-// So it is safe to use.
+router.use(express.json());
+router.use(express.urlencoded({ extended: true }));
+router.use(cookieParser());
+
+// Configure session with proper domain settings
+const sessionConfig = {
+  store: new PgSession({
+    pool: dblogin,
+    tableName: "session",
+  }),
+  secret: mbkautheVar.SESSION_SECRET_KEY,
+  resave: false,
+  saveUninitialized: false,
+  cookie: {
+    maxAge: COOKIE_EXPIRE_TIME,
+    domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
+    httpOnly: true,
+    secure: mbkautheVar.IS_DEPLOYED === 'true',
+    sameSite: 'lax',
+  },
+  name: 'mbkauthe.sid' // Unique session cookie name
+};
+
+router.use(session(sessionConfig));
+
+// Middleware to handle session restoration from sessionId cookie
 router.use(async (req, res, next) => {
-  if (req.session && req.session.user) {
+  if (!req.session.user && req.cookies.sessionId) {
     try {
-
-      res.cookie("username", req.session.user.username, {
-        maxAge: COOKIE_EXPIRE_TIME,
-      });
-
-      const query = `SELECT "Role" FROM "Users" WHERE "UserName" = $1`;
-      const result = await dblogin.query(query, [req.session.user.username]);
+      const sessionId = req.cookies.sessionId;
+      const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
+      const result = await dblogin.query(query, [sessionId]);
 
       if (result.rows.length > 0) {
-        req.session.user.role = result.rows[0].Role;
-        res.cookie("userRole", req.session.user.role, {
-          maxAge: COOKIE_EXPIRE_TIME,
-        });
-      } else {
-        req.session.user.role = null;
+        const user = result.rows[0];
+        req.session.user = {
+          id: user.id,
+          username: user.UserName,
+          sessionId,
+        };
+        console.log(`Session restored for user: ${user.UserName}`);
       }
-    } catch (error) {
-      console.log("Error fetching user role:", error.message);
-      req.session.user.role = null; // Fallback to null role
-    }
-  }
-  next();
-});
-
-router.use(async (req, res, next) => {
-  // Check for sessionId cookie if session is not initialized
-  if (!req.session.user && req.cookies && req.cookies.sessionId) {
-    console.log("Restoring session from sessionId cookie"); // Log session restoration
-    const sessionId = req.cookies.sessionId;
-    const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
-    const result = await dblogin.query(query, [sessionId]);
-
-    if (result.rows.length > 0) {
-      const user = result.rows[0];
-      req.session.user = {
-        id: user.id,
-        username: user.UserName,
-        sessionId,
-      };
-      console.log(`Session restored for user: ${user.UserName}`); // Log successful session restoration
-    } else {
-      console.warn("No matching session found for sessionId"); // Log if no session is found
+    } catch (err) {
+      console.error("Session restoration error:", err);
     }
   }
   next();

package/lib/validateSessionAndRole.js

@@ -1,6 +1,27 @@
 import { dblogin } from "./pool.js";
 
 async function validateSession(req, res, next) {
+  // First check if we have a session cookie
+  if (!req.session.user && req.cookies.sessionId) {
+    try {
+      const sessionId = req.cookies.sessionId;
+      const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
+      const result = await dblogin.query(query, [sessionId]);
+
+      if (result.rows.length > 0) {
+        const user = result.rows[0];
+        req.session.user = {
+          id: user.id,
+          username: user.UserName,
+          sessionId,
+        };
+      }
+    } catch (err) {
+      console.error("Session validation error:", err);
+      return res.status(500).json({ success: false, message: "Internal Server Error" });
+    }
+  }
+
   if (!req.session.user) {
     return res.render("templates/Error/NotLoggedIn.handlebars", {
       currentUrl: req.originalUrl,
@@ -12,37 +33,32 @@ async function validateSession(req, res, next) {
     const query = `SELECT "SessionId", "Active" FROM "Users" WHERE "id" = $1`;
     const result = await dblogin.query(query, [id]);
 
-    // Check if user exists and session ID matches
     if (result.rows.length === 0 || result.rows[0].SessionId !== sessionId) {
-      console.log(
-        `Session invalidated for user \"${req.session.user.username}\"`
-      );
+      console.log(`Session invalidated for user "${req.session.user.username}"`);
       req.session.destroy();
-      // ...existing code...
+      res.clearCookie("mbkauthe.sid", { domain: `.${mbkautheVar.DOMAIN}` });
+      res.clearCookie("sessionId", { domain: `.${mbkautheVar.DOMAIN}` });
       return res.render("templates/Error/SessionExpire.handlebars", {
         currentUrl: req.originalUrl,
       });
-      // ...existing code...
     }
 
-    // Check if the user account is inactive
     if (!result.rows[0].Active) {
-      console.log(
-        `Account is inactive for user \"${req.session.user.username}\"`
-      );
+      console.log(`Account is inactive for user "${req.session.user.username}"`);
       req.session.destroy();
-      res.clearCookie("connect.sid");
+      res.clearCookie("mbkauthe.sid", { domain: `.${mbkautheVar.DOMAIN}` });
+      res.clearCookie("sessionId", { domain: `.${mbkautheVar.DOMAIN}` });
       return res.render("templates/Error/AccountInactive.handlebars", {
         currentUrl: req.originalUrl,
       });
     }
 
-    next(); // Proceed if everything is valid
+    next();
   } catch (err) {
     console.error("Session validation error:", err);
     res.status(500).json({ success: false, message: "Internal Server Error" });
   }
-}   
+}
 
 const checkRolePermission = (requiredRole) => {
   return async (req, res, next) => {
@@ -86,7 +102,7 @@ const checkRolePermission = (requiredRole) => {
         .json({ success: false, message: "Internal Server Error" });
     }
   };
-}; 
+};
 
 const validateSessionAndRole = (requiredRole) => {
   return async (req, res, next) => {
@@ -163,4 +179,4 @@ const authenticate = (authentication) => {
   };
 };
 
-export { validateSession, checkRolePermission, validateSessionAndRole, getUserData , authenticate};
+export { validateSession, checkRolePermission, validateSessionAndRole, getUserData, authenticate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",