mbkauthe 1.0.8 → 1.0.10

package/index.js

@@ -2,7 +2,12 @@ import router from "./lib/main.js";
 
 import dotenv from "dotenv";
 dotenv.config();
-const mbkautheVar = JSON.parse(process.env.mbkautheVar);
+let mbkautheVar;
+try {
+    mbkautheVar = JSON.parse(process.env.mbkautheVar);
+} catch (error) {
+    throw new Error("Invalid JSON in process.env.mbkautheVar");
+}
 if (!mbkautheVar) {
     throw new Error("mbkautheVar is not defined");
 }
@@ -27,7 +32,6 @@ if (mbkautheVar.BypassUsers !== undefined) {
     if (!Array.isArray(mbkautheVar.BypassUsers)) {
         throw new Error("mbkautheVar.BypassUsers must be a valid array");
     }
-    const BypassUsers = mbkautheVar.BypassUsers;
 }
 
 

package/lib/main.js

@@ -187,11 +187,11 @@ router.post("/mbkauthe/api/login", async (req, res) => {
 
     if (mbkautheVar.test === "true") {
       // Check if the user is authorized to use the application
-      if (result.rows[0].Role !== "SuperAdmin") {
-        const allowedApps = result.rows[0].AllowedApps;
+      if (user.Role !== "SuperAdmin") {
+        const allowedApps = user.AllowedApps;
         if (!allowedApps || !allowedApps.includes(mbkautheVar.APP_NAME)) {
-          console.warn(`User \"${req.session.user.username}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
-          return res.status(403).json({ success: false, message: `You are not authorized to use the application \"${mbkautheVar.APP_NAME}\"` });
+          console.warn(`User \"${user.UserName}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
+          return res.status(403).json({ success: false, message: `You Are Not Authorized To Use The Application \"${mbkautheVar.APP_NAME}\"` });
         }
       }
     }

package/lib/pool.js

@@ -3,7 +3,38 @@ const { Pool } = pkg;
 
 import dotenv from "dotenv";
 dotenv.config();
-const mbkautheVar = JSON.parse(process.env.mbkautheVar);
+
+let mbkautheVar;
+try {
+  mbkautheVar = JSON.parse(process.env.mbkautheVar);
+} catch (error) {
+  throw new Error("Invalid JSON in process.env.mbkautheVar");
+}
+if (!mbkautheVar) {
+  throw new Error("mbkautheVar is not defined");
+}
+const requiredKeys = ["APP_NAME", "RECAPTCHA_Enabled", "SESSION_SECRET_KEY", "IS_DEPLOYED", "LOGIN_DB", "MBKAUTH_TWO_FA_ENABLE", "DOMAIN"];
+requiredKeys.forEach(key => {
+  if (!mbkautheVar[key]) {
+    throw new Error(`mbkautheVar.${key} is required`);
+  }
+});
+if (mbkautheVar.RECAPTCHA_Enabled === "true") {
+  if (mbkautheVar.RECAPTCHA_SECRET_KEY === undefined) {
+    throw new Error("mbkautheVar.RECAPTCHA_SECRET_KEY is required");
+  }
+}
+if (mbkautheVar.COOKIE_EXPIRE_TIME !== undefined) {
+  const expireTime = parseFloat(mbkautheVar.COOKIE_EXPIRE_TIME);
+  if (isNaN(expireTime) || expireTime <= 0) {
+    throw new Error("mbkautheVar.COOKIE_EXPIRE_TIME must be a valid positive number");
+  }
+}
+if (mbkautheVar.BypassUsers !== undefined) {
+  if (!Array.isArray(mbkautheVar.BypassUsers)) {
+    throw new Error("mbkautheVar.BypassUsers must be a valid array");
+  }
+}
 
 // PostgreSQL connection pool for pool
 const poolConfig = {

package/lib/validateSessionAndRole.js

@@ -8,6 +8,7 @@ async function validateSession(req, res, next) {
       const sessionId = req.cookies.sessionId;
       const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
       const result = await dblogin.query(query, [sessionId]);
+      const userResult= result.rows[0];
 
       if (result.rows.length > 0) {
         const user = result.rows[0];
@@ -31,10 +32,11 @@ async function validateSession(req, res, next) {
 
   try {
     const { id, sessionId } = req.session.user;
-    const query = `SELECT "SessionId", "Active" FROM "Users" WHERE "id" = $1`;
+    const query = `SELECT "SessionId", "Active", "AllowedApps" FROM "Users" WHERE "id" = $1`;
     const result = await dblogin.query(query, [id]);
+    const userResult= result.rows[0];
 
-    if (result.rows.length === 0 || result.rows[0].SessionId !== sessionId) {
+    if (result.rows.length === 0 || userResult.SessionId !== sessionId) {
       console.log(`Session invalidated for user "${req.session.user.username}"`);
       req.session.destroy();
       res.clearCookie("mbkauthe.sid", { domain: `.${mbkautheVar.DOMAIN}` });
@@ -44,7 +46,7 @@ async function validateSession(req, res, next) {
       });
     }
 
-    if (!result.rows[0].Active) {
+    if (!userResult.Active) {
       console.log(`Account is inactive for user "${req.session.user.username}"`);
       req.session.destroy();
       res.clearCookie("mbkauthe.sid", { domain: `.${mbkautheVar.DOMAIN}` });
@@ -55,22 +57,20 @@ async function validateSession(req, res, next) {
     }
 
     if (mbkautheVar.test === "true") {
-      if (result.rows[0].Role !== "SuperAdmin") {
-        const allowedApps = result.rows[0].AllowedApps;
+      if (userResult.Role !== "SuperAdmin") {
+        const allowedApps = userResult.AllowedApps;
         if (!allowedApps || !allowedApps.includes(mbkautheVar.APP_NAME)) {
-          console.warn(
-            `User \"${req.session.user.username}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`
-          );
+          console.warn(`User \"${req.session.user.username}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
           req.session.destroy();
-          res.clearCookie("connect.sid");
-          return res.render("templates/Error/AccountInactive.handlebars", {
-            currentUrl: req.originalUrl,
+          res.clearCookie("mbkauthe.sid", { domain: `.${mbkautheVar.DOMAIN}` });
+          res.clearCookie("sessionId", { domain: `.${mbkautheVar.DOMAIN}` });
+          return res.render("templates/Error/Error.handlebars", {
+            error: `You Are Not Authorized To Use The Application \"${mbkautheVar.APP_NAME}\"`,
           });
         }
       }
     }
 
-
     next();
   } catch (err) {
     console.error("Session validation error:", err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",