mbkauthe 1.3.4 → 1.3.5

package/docs/db.md

@@ -28,12 +28,12 @@ Ensure your `user_github` table exists with these columns:
 ```sql
 CREATE TABLE user_github (
     id SERIAL PRIMARY KEY,
-    user_name VARCHAR(255) REFERENCES "Users"("UserName"),
-    github_id VARCHAR(255) UNIQUE NOT NULL,
+    user_name VARCHAR(50) REFERENCES "Users"("UserName"),
+    github_id VARCHAR(255) UNIQUE,
     github_username VARCHAR(255),
-    access_token TEXT,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    access_token VARCHAR(255),
+    created_at TimeStamp WITH TIME ZONE DEFAULT NOW(),
+    updated_at TimeStamp WITH TIME ZONE DEFAULT NOW()
 );
 ```
 
@@ -149,18 +149,32 @@ The GitHub login feature is now fully integrated into your mbkauthe system and r
   - `AllowedApps`(JSONB): 
 
 - **Schema:**
-  ```sql
-  CREATE TABLE "Users" (
-      id INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-      "UserName" TEXT NOT NULL,
-      "Password" TEXT NOT NULL,
-      "Role" TEXT CHECK("Role" IN ('SuperAdmin', 'NormalUser', 'Guest')) NOT NULL DEFAULT 'NormalUser'::text,
-      "Active" BOOLEAN NOT NULL DEFAULT true,
-      "HaveMailAccount" BOOLEAN NOT NULL DEFAULT false,
-      "SessionId" TEXT,
-      "AllowedApps" JSONB DEFAULT '["mbkauthe"]'::jsonb
-  );
-  ```
+```sql
+CREATE TYPE role AS ENUM ('SuperAdmin', 'NormalUser', 'Guest');
+
+CREATE TABLE "Users" (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    "UserName" VARCHAR(50) NOT NULL UNIQUE,
+    "Password" VARCHAR(61) NOT NULL, -- For bcrypt hash
+    "Role" role DEFAULT 'NormalUser' NOT NULL,
+    "Active" BOOLEAN DEFAULT FALSE,
+    "HaveMailAccount" BOOLEAN DEFAULT FALSE,
+    "AllowedApps" JSONB DEFAULT '["mbkauthe", "portal"]',
+    "SessionId" VARCHAR(213),
+    "IsOnline" BOOLEAN DEFAULT FALSE,
+    "created_at" TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    "last_login" TIMESTAMP WITH TIME ZONE
+);
+
+-- Add indexes for Users table
+CREATE INDEX IF NOT EXISTS idx_users_session_id ON "Users" ("SessionId")
+CREATE INDEX idx_users_username ON "Users" USING BTREE ("UserName");
+CREATE INDEX idx_users_role ON "Users" USING BTREE ("Role");
+CREATE INDEX idx_users_active ON "Users" USING BTREE ("Active");
+CREATE INDEX idx_users_isonline ON "Users" USING BTREE ("IsOnline");
+CREATE INDEX idx_users_last_login ON "Users" USING BTREE (last_login);
+```
 
 ### Session Table
 
@@ -171,13 +185,20 @@ The GitHub login feature is now fully integrated into your mbkauthe system and r
   - `expire` (TIMESTAMP): Expiration timestamp for the session.
 
 - **Schema:**
-  ```sql
-  CREATE TABLE session (
-          sid VARCHAR PRIMARY KEY,
-          sess JSON NOT NULL,
-          expire TIMESTAMP NOT NULL
-  );
-  ```
+```sql
+CREATE TABLE "session" (
+    sid VARCHAR(33) PRIMARY KEY NOT NULL,
+    sess JSONB NOT NULL,
+    expire TimeStamp WITH TIME ZONE Not Null,
+    "UserName" VARCHAR(50) REFERENCES "Users"("UserName"),
+    last_activity TimeStamp WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Add indexes for session table
+CREATE INDEX idx_session_expire ON "session" USING BTREE (expire);
+CREATE INDEX idx_session_username ON "session" USING BTREE ("UserName");
+CREATE INDEX idx_session_last_activity ON "session" USING BTREE (last_activity);
+```
 
 ### Two-Factor Authentication Table
 
@@ -188,13 +209,15 @@ The GitHub login feature is now fully integrated into your mbkauthe system and r
   - `TwoFASecret` (TEXT): The secret key used for two-factor authentication.
 
 - **Schema:**
-  ```sql
-  CREATE TABLE "TwoFA" (
-          "UserName" TEXT NOT NULL PRIMARY KEY,
-          "TwoFAStatus" TEXT NOT NULL DEFAULT false,
-          "TwoFASecret" TEXT NOT NULL
-  );
-  ```
+```sql
+CREATE TABLE "TwoFA" (
+    "UserName" VARCHAR(50) primary key REFERENCES "Users"("UserName"),
+    "TwoFAStatus" boolean NOT NULL,
+    "TwoFASecret" TEXT
+    );
+
+CREATE INDEX IF NOT EXISTS idx_twofa_username ON "TwoFA" ("UserName")
+```
 
 ### Query to Add a User
 

package/lib/main.js

@@ -82,8 +82,8 @@ router.use(async (req, res, next) => {
   if (!req.session.user && req.cookies.sessionId) {
     try {
       const sessionId = req.cookies.sessionId;
-      const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
-      const result = await dblogin.query(query, [sessionId]);
+  const query = `SELECT id, "UserName", "Active", "Role", "SessionId" FROM "Users" WHERE "SessionId" = $1`;
+  const result = await dblogin.query({ name: 'get-user-by-sessionid', text: query, values: [sessionId] });
 
       if (result.rows.length > 0) {
         const user = result.rows[0];
@@ -112,9 +112,10 @@ const getCookieOptions = () => ({
 
 async function completeLoginProcess(req, res, user, redirectUrl = null) {
   try {
-    const sessionId = crypto.randomBytes(256).toString("hex");
+    // smaller session id is sufficient and faster to generate/serialize
+    const sessionId = crypto.randomBytes(32).toString("hex");
     console.log(`[mbkauthe] Generated session ID for username: ${user.username}`);
-
+    
     // Delete old session record for this user
     await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.username]);
 
@@ -141,14 +142,8 @@ async function completeLoginProcess(req, res, user, redirectUrl = null) {
         console.log("[mbkauthe] Session save error:", err);
         return res.status(500).json({ success: false, message: "Internal Server Error" });
       }
-      try {
-        await dblogin.query(
-          'UPDATE "session" SET username = $1 WHERE sid = $2',
-          [user.username, req.sessionID]
-        );
-      } catch (e) {
-        console.log("[mbkauthe] Failed to update username in session table:", e);
-      }
+      // avoid writing back into the session table here to reduce DB writes;
+      // the pg session store will already persist the session data.
 
       const cookieOptions = getCookieOptions();
       res.cookie("sessionId", sessionId, cookieOptions);
@@ -224,8 +219,8 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
   }
 
   try {
-    const userQuery = `SELECT * FROM "Users" WHERE "UserName" = $1`;
-    const userResult = await dblogin.query(userQuery, [username]);
+  const userQuery = `SELECT id, "UserName", "Password", "Active", "Role", "AllowedApps" FROM "Users" WHERE "UserName" = $1`;
+  const userResult = await dblogin.query({ name: 'get-user-by-username', text: userQuery, values: [username] });
 
     if (userResult.rows.length === 0) {
       console.log(`[mbkauthe] Username does not exist: ${username}`);
@@ -267,8 +262,8 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
     }
 
     if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLocaleLowerCase() === "true") {
-      const query = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
-      const twoFAResult = await dblogin.query(query, [username]);
+  const query = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
+  const twoFAResult = await dblogin.query({ name: 'get-2fa-status', text: query, values: [username] });
 
       if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
         // 2FA is enabled, prompt for token on a separate page

package/lib/pool.js

@@ -32,6 +32,13 @@ const poolConfig = {
     rejectUnauthorized: true,
   },
 
+  // Connection pool tuning for serverless/ephemeral environments (Vercel)
+  // - keep max small to avoid exhausting DB connections
+  // - reduce idle time so connections are returned sooner
+  // - set a short connection timeout to fail fast
+  max: 6,
+  idleTimeoutMillis: 50000,
+  connectionTimeoutMillis: 5000,
 };
 
 export const dblogin = new Pool(poolConfig);

package/lib/validateSessionAndRole.js

@@ -15,8 +15,8 @@ async function validateSession(req, res, next) {
   if (!req.session.user && req.cookies.sessionId) {
     try {
       const sessionId = req.cookies.sessionId;
-      const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
-      const result = await dblogin.query(query, [sessionId]);
+  const query = `SELECT id, "UserName", "Active", "Role", "SessionId" FROM "Users" WHERE "SessionId" = $1`;
+  const result = await dblogin.query({ name: 'get-user-by-sessionid', text: query, values: [sessionId] });
       const userResult = result.rows[0];
 
       if (result.rows.length > 0) {
@@ -49,8 +49,8 @@ async function validateSession(req, res, next) {
 
   try {
     const { id, sessionId } = req.session.user;
-    const query = `SELECT "SessionId", "Active", "Role", "AllowedApps" FROM "Users" WHERE "id" = $1`;
-    const result = await dblogin.query(query, [id]);
+  const query = `SELECT "SessionId", "Active", "Role", "AllowedApps" FROM "Users" WHERE "id" = $1`;
+  const result = await dblogin.query({ name: 'get-user-by-id', text: query, values: [id] });
     const userResult = result.rows[0];
 
     if (result.rows.length === 0 || userResult.SessionId !== sessionId) {
@@ -132,8 +132,8 @@ const checkRolePermission = (requiredRole, notAllowed) => {
 
       const userId = req.session.user.id;
 
-      const query = `SELECT "Role" FROM "Users" WHERE "id" = $1`;
-      const result = await dblogin.query(query, [userId]);
+  const query = `SELECT "Role" FROM "Users" WHERE "id" = $1`;
+  const result = await dblogin.query({ name: 'get-role-by-id', text: query, values: [userId] });
 
       if (result.rows.length === 0) {
         return res.status(401).json({ success: false, message: "User not found" });
@@ -216,84 +216,50 @@ const authapi = (requiredRole = []) => {
       });
     }
 
-    console.log("[mbkauthe] [authapi] Querying database to validate token");
-    const tokenQuery = 'SELECT * FROM "UserAuthApiKey" WHERE "key" = $1';
-    pool.query(tokenQuery, [token], (err, result) => {
-      if (err) {
-        console.error("[mbkauthe] [authapi] Database query error while validating token:", err);
-        return res.status(500).json({
-          success: false,
-          message: "Internal Server Error"
-        });
-      }
-
-      if (result.rows.length === 0) {
-        console.log("[mbkauthe] [authapi] Invalid token provided:", token);
-        return res.status(401).json({
-          success: false,
-          message: "The AuthApiToken Is Invalid"
-        });
-      }
-
-      const username = result.rows[0].username;
-      console.log("[mbkauthe] [authapi] Token is valid. Associated username:", username);
-
-      console.log("[mbkauthe] [authapi] Querying database to validate user and role");
-      const userQuery = `
-                SELECT id, "UserName", "Active", "Role" FROM "Users"
-                WHERE "UserName" = $1 AND "Active" = true
-            `;
-
-      pool.query(userQuery, [username], (err, userResult) => {
-        if (err) {
-          console.error("[mbkauthe] [authapi] Database query error while validating user:", err);
-          return res.status(500).json({
-            success: false,
-            message: "Internal Server Error"
-          });
+    // Single query to validate API key and fetch user in one DB round trip.
+    (async () => {
+      try {
+        const jointQuery = `
+          SELECT u.id, u."UserName", u."Active", u."Role", k."key" as apikey
+          FROM "UserAuthApiKey" k
+          JOIN "Users" u ON u."UserName" = k.username
++          WHERE k."key" = $1 AND u."Active" = true
++          LIMIT 1
++        `;
+
+        const result = await pool.query(jointQuery, [token]);
+
+        if (result.rows.length === 0) {
+          console.log("[mbkauthe] [authapi] Invalid token or associated user inactive:", token);
+          return res.status(401).json({ success: false, message: "The AuthApiToken Is Invalid or user inactive" });
         }
 
-        if (userResult.rows.length === 0) {
-          console.log("[mbkauthe] [authapi] User does not exist or is not active. Username:", username);
-          return res.status(401).json({
-            success: false,
-            message: "User does not exist or is not active",
-          });
-        }
+        const user = result.rows[0];
 
-        if (username === "demo") {
+        if (user.UserName === "demo") {
           console.log("[mbkauthe] [authapi] Demo user attempted to access an endpoint. Access denied.");
-          return res.status(401).json({
-            success: false,
-            message: "Demo user is not allowed to access endpoints",
-          });
+          return res.status(401).json({ success: false, message: "Demo user is not allowed to access endpoints" });
         }
 
-        const user = userResult.rows[0];
-        console.log("[mbkauthe] [authapi] User is valid. User details:", user);
-
-        // Check if role is required and if user has it
+        // role check
         if ((requiredRole && user.Role !== requiredRole) && user.Role !== "SuperAdmin") {
           console.log(`[mbkauthe] [authapi] User does not have the required role. Required: ${requiredRole}, User's role: ${user.Role}`);
-          return res.status(403).json({
-            success: false,
-            message: `Access denied. Required role: ${requiredRole}`,
-          });
+          return res.status(403).json({ success: false, message: `Access denied. Required role: ${requiredRole}` });
         }
 
-        console.log("[mbkauthe] [authapi] User has the required role or no specific role is required. Proceeding to next middleware.");
         req.user = {
           username: user.UserName,
           UserName: user.UserName,
           role: user.Role,
-          Role: user.role,
-          // Add other user properties you might need
+          Role: user.Role,
         };
 
-        console.log("[mbkauthe] [authapi] Token and user validation successful. Passing control to next middleware.");
         next();
-      });
-    });
+      } catch (err) {
+        console.error("[mbkauthe] [authapi] Database error while validating token/user:", err);
+        return res.status(500).json({ success: false, message: "Internal Server Error" });
+      }
+    })();
   };
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",