mbkauthe 1.1.4 → 1.1.6

package/index.js

@@ -45,7 +45,6 @@ if (process.env.test === "true") {
     });
 }
 
-export { validateSession, checkRolePermission, validateSessionAndRole, getUserData, authenticate } from "./lib/validateSessionAndRole.js";
+export { validateSession, checkRolePermission, validateSessionAndRole, getUserData, authenticate, authapi } from "./lib/validateSessionAndRole.js";
 export { dblogin } from "./lib/pool.js";
-export { authapi } from "./lib/authapi.js";
 export default router;

package/lib/main.js

@@ -246,6 +246,11 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
     const sessionId = crypto.randomBytes(256).toString("hex");
     console.log(`Generated session ID for username: ${username}`);
 
+    // Delete old session record for this user
+    if (user.SessionId) {
+      await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.UserName]);
+    }
+
     await dblogin.query(`UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, [
       sessionId,
       user.id,
@@ -262,11 +267,32 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
     res.cookie("sessionId", sessionId, cookieOptions);
     console.log(req.session.user);
 
-    console.log(`User "${username}" logged in successfully`);
-    res.status(200).json({
-      success: true,
-      message: "Login successful",
-      sessionId,
+
+    // Save session and update username in session table
+    req.session.save(async (err) => {
+      if (err) {
+        console.log("Session save error:", err);
+        return res.status(500).json({ success: false, message: "Internal Server Error" });
+      }
+      try {
+        await dblogin.query(
+          'UPDATE "session" SET username = $1 WHERE sid = $2',
+          [user.UserName, req.sessionID]
+        );
+      } catch (e) {
+        console.log("Failed to update username in session table:", e);
+      }
+
+      const cookieOptions = getCookieOptions();
+      res.cookie("sessionId", sessionId, cookieOptions);
+      console.log(req.session.user);
+
+      console.log(`User "${username}" logged in successfully`);
+      res.status(200).json({
+        success: true,
+        message: "Login successful",
+        sessionId,
+      });
     });
   } catch (err) {
     console.log("Error during login process:", err);

package/lib/validateSessionAndRole.js

@@ -1,5 +1,6 @@
 import { dblogin } from "./pool.js";
 const mbkautheVar = JSON.parse(process.env.mbkautheVar);
+let pool = dblogin;
 
 const getCookieOptions = () => ({
   maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
@@ -210,4 +211,101 @@ const authenticate = (authentication) => {
   };
 };
 
-export { validateSession, checkRolePermission, validateSessionAndRole, getUserData, authenticate };
+const authapi = (requiredRole = []) => {
+    return (req, res, next) => {
+        const token = req.headers["authorization"];
+
+        if (typeof token === 'string') {
+            console.log("[authapi] Received request with token:", token[0] + token[1] + token[2], ".....", token[63]);
+        } else {
+            console.log("[authapi] Token is not a valid string:", token);
+        }
+
+        if (!token) {
+            console.log("[authapi] No token provided in the request headers");
+            return res.status(401).json({
+                success: false,
+                message: "Authorization token is required"
+            });
+        }
+
+        console.log("[authapi] Querying database to validate token");
+        const tokenQuery = 'SELECT * FROM "UserAuthApiKey" WHERE "key" = $1';
+        pool.query(tokenQuery, [token], (err, result) => {
+            if (err) {
+                console.error("[authapi] Database query error while validating token:", err);
+                return res.status(500).json({
+                    success: false,
+                    message: "Internal Server Error"
+                });
+            }
+
+            if (result.rows.length === 0) {
+                console.log("[authapi] Invalid token provided:", token);
+                return res.status(401).json({
+                    success: false,
+                    message: "The AuthApiToken Is Invalid"
+                });
+            }
+
+            const username = result.rows[0].username;
+            console.log("[authapi] Token is valid. Associated username:", username);
+
+            console.log("[authapi] Querying database to validate user and role");
+            const userQuery = `
+                SELECT id, "UserName", "Active", "Role" FROM "Users"
+                WHERE "UserName" = $1 AND "Active" = true
+            `;
+
+            pool.query(userQuery, [username], (err, userResult) => {
+                if (err) {
+                    console.error("[authapi] Database query error while validating user:", err);
+                    return res.status(500).json({
+                        success: false,
+                        message: "Internal Server Error"
+                    });
+                }
+
+                if (userResult.rows.length === 0) {
+                    console.log("[authapi] User does not exist or is not active. Username:", username);
+                    return res.status(401).json({
+                        success: false,
+                        message: "User does not exist or is not active",
+                    });
+                }
+
+                if (username === "demo") {
+                    console.log("[authapi] Demo user attempted to access an endpoint. Access denied.");
+                    return res.status(401).json({
+                        success: false,
+                        message: "Demo user is not allowed to access endpoints",
+                    });
+                }
+
+                const user = userResult.rows[0];
+                console.log("[authapi] User is valid. User details:", user);
+
+                // Check if role is required and if user has it
+                if ((requiredRole && user.Role !== requiredRole) && user.Role !== "SuperAdmin") {
+                    console.log(`[authapi] User does not have the required role. Required: ${requiredRole}, User's role: ${user.Role}`);
+                    return res.status(403).json({
+                        success: false,
+                        message: `Access denied. Required role: ${requiredRole}`,
+                    });
+                }
+
+                console.log("[authapi] User has the required role or no specific role is required. Proceeding to next middleware.");
+                req.user = {
+                    username: user.UserName,
+                    role: user.Role,
+                    // Add other user properties you might need
+                };
+
+                console.log("[authapi] Token and user validation successful. Passing control to next middleware.");
+                next();
+            });
+        });
+    };
+};
+
+export { validateSession, checkRolePermission, validateSessionAndRole, getUserData, authenticate, authapi };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",

package/lib/authapi.js

@@ -1,57 +0,0 @@
-import { pool } from "./pool.js";
-
-export const authapi = () => {
-    return (req, res, next) => {
-        const token = req.headers["authorization"];
-
-        // Query to check if the token exists in UserAuthApiKey table
-        const tokenQuery = 'SELECT * FROM "UserAuthApiKey" WHERE "key" = $1';
-        pool.query(tokenQuery, [token], (err, result) => {
-            if (err) {
-                console.error("Database query error:", err);
-                return res
-                    .status(500)
-                    .json({ success: false, message: "Internal Server Error" });
-            }
-
-            if (result.rows.length === 0) {
-                console.log("Invalid token");
-                return res
-                    .status(401)
-                    .json({ success: false, message: "The AuthApiToken Is InValid" });
-            }
-
-            const username = result.rows[0].username;
-
-            // Query to check if the user exists and is active in Users table
-            const userQuery =
-                'SELECT * FROM "Users" WHERE "UserName" = $1 AND "Active" = true';
-            pool.query(userQuery, [username], (err, userResult) => {
-                if (username === "demo") {
-                    console.log("Demo user is not allowed to access this endpoint");
-                    return res.status(401).json({
-                        success: false,
-                        message: "Demo user is not allowed to access endpoints",
-                    });
-                }
-                if (err) {
-                    console.error("Database query error:", err);
-                    return res
-                        .status(500)
-                        .json({ success: false, message: "Internal Server Error" });
-                }
-
-                if (userResult.rows.length === 0) {
-                    console.log("User does not exist or is not active");
-                    return res.status(401).json({
-                        success: false,
-                        message: "User does not exist or is not active",
-                    });
-                }
-
-                console.log("Token and user are valid");
-                next();
-            });
-        });
-    };
-};