mbkauthe 1.3.4 → 1.4.0

package/lib/validateSessionAndRole.js

@@ -11,13 +11,27 @@ const getCookieOptions = () => ({
   httpOnly: true
 });
 
+const getClearCookieOptions = () => ({
+  domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
+  secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+  sameSite: 'lax',
+  path: '/',
+  httpOnly: true
+});
+
 async function validateSession(req, res, next) {
   if (!req.session.user && req.cookies.sessionId) {
     try {
       const sessionId = req.cookies.sessionId;
-      const query = `SELECT * FROM "Users" WHERE "SessionId" = $1`;
-      const result = await dblogin.query(query, [sessionId]);
-      const userResult = result.rows[0];
+
+      // Validate sessionId format (should be 64 hex characters)
+      if (typeof sessionId !== 'string' || !/^[a-f0-9]{64}$/i.test(sessionId)) {
+        console.warn("[mbkauthe] Invalid sessionId format detected");
+        return next();
+      }
+
+      const query = `SELECT id, "UserName", "Active", "Role", "SessionId", "AllowedApps" FROM "Users" WHERE "SessionId" = $1 AND "Active" = true`;
+      const result = await dblogin.query({ name: 'get-user-by-sessionid', text: query, values: [sessionId] });
 
       if (result.rows.length > 0) {
         const user = result.rows[0];
@@ -25,7 +39,10 @@ async function validateSession(req, res, next) {
           id: user.id,
           username: user.UserName,
           UserName: user.UserName,
+          role: user.Role,
+          Role: user.Role,
           sessionId,
+          allowedApps: user.AllowedApps,
         };
       }
     } catch (err) {
@@ -48,15 +65,16 @@ async function validateSession(req, res, next) {
   }
 
   try {
-    const { id, sessionId } = req.session.user;
-    const query = `SELECT "SessionId", "Active", "Role", "AllowedApps" FROM "Users" WHERE "id" = $1`;
-    const result = await dblogin.query(query, [id]);
-    const userResult = result.rows[0];
+    const { id, sessionId, role, allowedApps } = req.session.user;
+
+    // Fetch only SessionId and Active status for validation (reduced query)
+    const query = `SELECT "SessionId", "Active" FROM "Users" WHERE "id" = $1`;
+    const result = await dblogin.query({ name: 'get-user-by-id', text: query, values: [id] });
 
-    if (result.rows.length === 0 || userResult.SessionId !== sessionId) {
+    if (result.rows.length === 0 || result.rows[0].SessionId !== sessionId) {
       console.log(`[mbkauthe] Session invalidated for user "${req.session.user.username}"`);
       req.session.destroy();
-      const cookieOptions = getCookieOptions();
+      const cookieOptions = getClearCookieOptions();
       res.clearCookie("mbkauthe.sid", cookieOptions);
       res.clearCookie("sessionId", cookieOptions);
       res.clearCookie("username", cookieOptions);
@@ -70,10 +88,10 @@ async function validateSession(req, res, next) {
       });
     }
 
-    if (!userResult.Active) {
+    if (!result.rows[0].Active) {
       console.log(`[mbkauthe] Account is inactive for user "${req.session.user.username}"`);
       req.session.destroy();
-      const cookieOptions = getCookieOptions();
+      const cookieOptions = getClearCookieOptions();
       res.clearCookie("mbkauthe.sid", cookieOptions);
       res.clearCookie("sessionId", cookieOptions);
       res.clearCookie("username", cookieOptions);
@@ -87,12 +105,11 @@ async function validateSession(req, res, next) {
       });
     }
 
-    if (userResult.Role !== "SuperAdmin") {
-      const allowedApps = userResult.AllowedApps;
+    if (role !== "SuperAdmin") {
       if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
         console.warn(`[mbkauthe] User \"${req.session.user.username}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
         req.session.destroy();
-        const cookieOptions = getCookieOptions();
+        const cookieOptions = getClearCookieOptions();
         res.clearCookie("mbkauthe.sid", cookieOptions);
         res.clearCookie("sessionId", cookieOptions);
         res.clearCookie("username", cookieOptions);
@@ -133,7 +150,7 @@ const checkRolePermission = (requiredRole, notAllowed) => {
       const userId = req.session.user.id;
 
       const query = `SELECT "Role" FROM "Users" WHERE "id" = $1`;
-      const result = await dblogin.query(query, [userId]);
+      const result = await dblogin.query({ name: 'get-role-by-id', text: query, values: [userId] });
 
       if (result.rows.length === 0) {
         return res.status(401).json({ success: false, message: "User not found" });
@@ -202,98 +219,73 @@ const authapi = (requiredRole = []) => {
   return (req, res, next) => {
     const token = req.headers["authorization"];
 
-    if (typeof token === 'string') {
-      console.log("[mbkauthe] [authapi] Received request with token:", token[0] + token[1] + token[2], ".....", token[63]);
-    } else {
-      console.log("[mbkauthe] [authapi] Token is not a valid string:", token);
-    }
-
+    // Validate token
     if (!token) {
-      console.log("[mbkauthe] [authapi] No token provided in the request headers");
+      console.warn("[mbkauthe] [authapi] No token provided in the request headers");
       return res.status(401).json({
         success: false,
         message: "Authorization token is required"
       });
     }
 
-    console.log("[mbkauthe] [authapi] Querying database to validate token");
-    const tokenQuery = 'SELECT * FROM "UserAuthApiKey" WHERE "key" = $1';
-    pool.query(tokenQuery, [token], (err, result) => {
-      if (err) {
-        console.error("[mbkauthe] [authapi] Database query error while validating token:", err);
-        return res.status(500).json({
-          success: false,
-          message: "Internal Server Error"
-        });
-      }
+    if (typeof token !== 'string' || token.length === 0 || token.length > 512) {
+      console.warn("[mbkauthe] [authapi] Invalid token format");
+      return res.status(401).json({
+        success: false,
+        message: "Invalid authorization token format"
+      });
+    }
 
-      if (result.rows.length === 0) {
-        console.log("[mbkauthe] [authapi] Invalid token provided:", token);
-        return res.status(401).json({
-          success: false,
-          message: "The AuthApiToken Is Invalid"
-        });
-      }
+    if (typeof token === 'string' && token.length >= 64) {
+      console.log("[mbkauthe] [authapi] Received request with token:", token.substring(0, 3) + ".....", token.charAt(63));
+    } else {
+      console.log("[mbkauthe] [authapi] Received request with short token");
+    }
 
-      const username = result.rows[0].username;
-      console.log("[mbkauthe] [authapi] Token is valid. Associated username:", username);
-
-      console.log("[mbkauthe] [authapi] Querying database to validate user and role");
-      const userQuery = `
-                SELECT id, "UserName", "Active", "Role" FROM "Users"
-                WHERE "UserName" = $1 AND "Active" = true
-            `;
-
-      pool.query(userQuery, [username], (err, userResult) => {
-        if (err) {
-          console.error("[mbkauthe] [authapi] Database query error while validating user:", err);
-          return res.status(500).json({
-            success: false,
-            message: "Internal Server Error"
-          });
+    // Single query to validate API key and fetch user in one DB round trip.
+    (async () => {
+      try {
+        const jointQuery = `
+          SELECT u.id, u."UserName", u."Active", u."Role", k."key" as apikey
+          FROM "UserAuthApiKey" k
+          JOIN "Users" u ON u."UserName" = k.username
+          WHERE k."key" = $1 AND u."Active" = true
+          LIMIT 1
+        `;
+
+        const result = await pool.query(jointQuery, [token]);
+
+        if (result.rows.length === 0) {
+          console.warn("[mbkauthe] [authapi] Invalid token or associated user inactive");
+          return res.status(401).json({ success: false, message: "The AuthApiToken Is Invalid or user inactive" });
         }
 
-        if (userResult.rows.length === 0) {
-          console.log("[mbkauthe] [authapi] User does not exist or is not active. Username:", username);
-          return res.status(401).json({
-            success: false,
-            message: "User does not exist or is not active",
-          });
-        }
+        const user = result.rows[0];
 
-        if (username === "demo") {
-          console.log("[mbkauthe] [authapi] Demo user attempted to access an endpoint. Access denied.");
-          return res.status(401).json({
-            success: false,
-            message: "Demo user is not allowed to access endpoints",
-          });
+        if (user.UserName === "demo") {
+          console.warn("[mbkauthe] [authapi] Demo user attempted to access an endpoint. Access denied.");
+          return res.status(401).json({ success: false, message: "Demo user is not allowed to access endpoints" });
         }
 
-        const user = userResult.rows[0];
-        console.log("[mbkauthe] [authapi] User is valid. User details:", user);
-
-        // Check if role is required and if user has it
+        // role check
         if ((requiredRole && user.Role !== requiredRole) && user.Role !== "SuperAdmin") {
-          console.log(`[mbkauthe] [authapi] User does not have the required role. Required: ${requiredRole}, User's role: ${user.Role}`);
-          return res.status(403).json({
-            success: false,
-            message: `Access denied. Required role: ${requiredRole}`,
-          });
+          console.warn(`[mbkauthe] [authapi] User does not have the required role. Required: ${requiredRole}, User's role: ${user.Role}`);
+          return res.status(403).json({ success: false, message: `Access denied. Required role: ${requiredRole}` });
         }
 
-        console.log("[mbkauthe] [authapi] User has the required role or no specific role is required. Proceeding to next middleware.");
         req.user = {
           username: user.UserName,
           UserName: user.UserName,
           role: user.Role,
-          Role: user.role,
-          // Add other user properties you might need
+          Role: user.Role,
         };
 
-        console.log("[mbkauthe] [authapi] Token and user validation successful. Passing control to next middleware.");
         next();
-      });
-    });
+      } catch (err) {
+        console.error("[mbkauthe] [authapi] Database error while validating token/user:", err);
+        return res.status(500).json({ success: false, message: "Internal Server Error" });
+      }
+    })();
   };
 };
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "mbkauthe",
-  "version": "1.3.4",
+  "version": "1.4.0",
   "description": "MBKTechStudio's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "test": "set test=true&& nodemon index.js"
+    "dev": "set test=dev&& nodemon index.js"
   },
   "repository": {
     "type": "git",
@@ -26,11 +26,11 @@
   },
   "homepage": "https://github.com/MIbnEKhalid/mbkauthe#readme",
   "dependencies": {
-    "bcrypt": "^5.1.1",
+    "bcrypt": "^6.0.0",
     "cheerio": "^1.0.0",
     "connect-pg-simple": "^10.0.0",
     "cookie-parser": "^1.4.7",
-    "csurf": "^1.11.0",
+    "csurf": "^1.2.2",
     "dotenv": "^16.4.7",
     "express": "^5.1.0",
     "express-handlebars": "^8.0.1",
@@ -44,6 +44,6 @@
     "url": "^0.11.4"
   },
   "devDependencies": {
-    "nodemon": "^2.0.22"
+    "nodemon": "^3.1.11"
   }
 }

package/public/main.js

@@ -0,0 +1,134 @@
+async function logout() {
+  const confirmation = confirm("Are you sure you want to logout?");
+  if (!confirmation) {
+    return;
+  }
+
+  try {
+    // Clear all caches before logging out (except rememberedUsername)
+    await nuclearCacheClear();
+
+    const response = await fetch("/mbkauthe/api/logout", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-cache"
+      },
+      credentials: "include"
+    });
+
+    const result = await response.json();
+
+    if (response.ok) {
+      alert(result.message);
+      // Force a full page reload with cache bypass
+      window.location.href = window.location.origin;
+    } else {
+      alert(result.message);
+    }
+  } catch (error) {
+    console.error("Error during logout:", error);
+    alert("Logout failed");
+  }
+}
+
+async function nuclearCacheClear() {
+  try {
+    // Preserve rememberedUsername before clearing storage
+    const rememberedUsername = localStorage.getItem('rememberedUsername');
+
+    // 1. Clear all possible caches
+    if ('caches' in window) {
+      const cacheNames = await caches.keys();
+      await Promise.all(cacheNames.map(cacheName => caches.delete(cacheName)));
+    }
+
+    // 2. Clear service workers
+    if ('serviceWorker' in navigator) {
+      const registrations = await navigator.serviceWorker.getRegistrations();
+      await Promise.all(registrations.map(registration => registration.unregister()));
+    }
+
+    // 3. Clear all storage except rememberedUsername
+    localStorage.clear();
+    sessionStorage.clear();
+    if (rememberedUsername) {
+      localStorage.setItem('rememberedUsername', rememberedUsername);
+    }
+
+    if ('indexedDB' in window) {
+      try {
+        const dbs = await window.indexedDB.databases();
+        await Promise.all(dbs.map(db => {
+          if (db.name) {
+            return window.indexedDB.deleteDatabase(db.name);
+          }
+          return Promise.resolve();
+        }));
+      } catch (error) {
+        console.error("Error clearing IndexedDB:", error);
+      }
+    }
+
+    // 4. Clear cookies (except those you want to preserve)
+    document.cookie.split(';').forEach(cookie => {
+      const eqPos = cookie.indexOf('=');
+      const name = eqPos > -1 ? cookie.substr(0, eqPos).trim() : cookie.trim();
+
+      // Skip cookies you want to preserve (add conditions as needed)
+      if (!name.startsWith('preserve_')) {  // Example condition
+        document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=${window.location.hostname}`;
+        document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.${window.location.hostname}`;
+      }
+    });
+
+    // 5. Force hard reload with cache busting
+    window.location.reload();
+
+  } catch (error) {
+    console.error('Nuclear cache clear failed:', error);
+    window.location.reload(true);
+  }
+}
+
+async function logoutuser() {
+  await logout();
+}
+
+const validateSessionInterval = 60000;
+// 1 minutes in milliseconds Function to check session validity by sending a request to the server
+function checkSession() {
+  fetch("/api/validate-session")
+    .then((response) => {
+      if (!response.ok) {
+        // Redirect or handle errors (session expired, user inactive, etc.)
+        window.location.reload(); // Reload the page to update the session status
+      }
+    })
+    .catch((error) => console.error("Error checking session:", error));
+}
+// Call validateSession every 2 minutes (120000 milliseconds)
+// setInterval(checkSession, validateSessionInterval);
+
+function getCookieValue(cookieName) {
+  const cookies = document.cookie.split('; ');
+  for (let cookie of cookies) {
+    const [name, value] = cookie.split('=');
+    if (name === cookieName) {
+      return decodeURIComponent(value);
+    }
+  }
+  return null; // Return null if the cookie is not found
+}
+
+function loadpage(url) {
+  window.location.href = url;
+}
+
+function formatDate(date) {
+  return new Date(date).toLocaleString('en-GB', { day: '2-digit', month: '2-digit', year: 'numeric', hour: 'numeric', minute: 'numeric', second: 'numeric', hour12: true });
+}
+
+function reloadPage() {
+  window.location.reload();
+}