mbkauthe 1.4.1 → 2.0.0

package/lib/main.js

@@ -5,14 +5,14 @@ import session from "express-session";
 import pgSession from "connect-pg-simple";
 const PgSession = pgSession(session);
 import { dblogin } from "./pool.js";
-import { authenticate } from "./validateSessionAndRole.js";
+import { authenticate, validateSession, validateSessionAndRole } from "./validateSessionAndRole.js";
 import fetch from 'node-fetch';
 import cookieParser from "cookie-parser";
 import bcrypt from 'bcrypt';
 import rateLimit from 'express-rate-limit';
 import speakeasy from "speakeasy";
-//import passport from 'passport';
-//import GitHubStrategy from 'passport-github2';
+import passport from 'passport';
+import GitHubStrategy from 'passport-github2';
 
 import { createRequire } from "module";
 import fs from "fs";
@@ -36,16 +36,26 @@ router.get('/mbkauthe/main.js', (req, res) => {
 });
 
 // CSRF protection middleware
-const csrfProtection = csurf({ cookie: false });
+const csrfProtection = csurf({ cookie: true });
 
 // CORS and security headers
 router.use((req, res, next) => {
   const origin = req.headers.origin;
-  if (origin && origin.endsWith(`.${mbkautheVar.DOMAIN}`)) {
-    res.header('Access-Control-Allow-Origin', origin);
-    res.header('Access-Control-Allow-Credentials', 'true');
-    res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
-    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+  if (origin) {
+    try {
+      const originUrl = new URL(origin);
+      const allowedDomain = `.${mbkautheVar.DOMAIN}`;
+      // Exact match or subdomain match (must end with .domain.com, not just domain.com)
+      if (originUrl.hostname === mbkautheVar.DOMAIN || 
+          (originUrl.hostname.endsWith(allowedDomain) && originUrl.hostname.charAt(originUrl.hostname.length - allowedDomain.length - 1) !== '.')) {
+        res.header('Access-Control-Allow-Origin', origin);
+        res.header('Access-Control-Allow-Credentials', 'true');
+        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
+        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+      }
+    } catch (err) {
+      // Invalid origin URL, skip CORS headers
+    }
   }
   next();
 });
@@ -71,6 +81,12 @@ const TwoFALimit = rateLimit({
   message: { success: false, message: "Too many 2FA attempts, please try again later" }
 });
 
+const GitHubOAuthLimit = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 10,
+  message: "Too many GitHub login attempts, please try again later"
+});
+
 const sessionConfig = {
   store: new PgSession({
     pool: dblogin,
@@ -85,7 +101,7 @@ const sessionConfig = {
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
     domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
-    secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+    secure: mbkautheVar.IS_DEPLOYED === 'true',
     sameSite: 'lax',
     path: '/'
   },
@@ -100,14 +116,16 @@ router.use(async (req, res, next) => {
     try {
       const sessionId = req.cookies.sessionId;
 
-      // Validate sessionId format (should be 64 hex characters)
+      // Validate sessionId format (should be 64 hex characters) and normalize to lowercase
       if (typeof sessionId !== 'string' || !/^[a-f0-9]{64}$/i.test(sessionId)) {
         console.warn("[mbkauthe] Invalid sessionId format detected");
         return next();
       }
 
-      const query = `SELECT id, "UserName", "Active", "Role", "SessionId", "AllowedApps" FROM "Users" WHERE "SessionId" = $1 AND "Active" = true`;
-      const result = await dblogin.query({ name: 'get-user-by-sessionid', text: query, values: [sessionId] });
+      const normalizedSessionId = sessionId.toLowerCase();
+
+      const query = `SELECT id, "UserName", "Active", "Role", "SessionId", "AllowedApps" FROM "Users" WHERE LOWER("SessionId") = $1 AND "Active" = true`;
+      const result = await dblogin.query({ name: 'restore-user-session', text: query, values: [normalizedSessionId] });
 
       if (result.rows.length > 0) {
         const user = result.rows[0];
@@ -117,8 +135,7 @@ router.use(async (req, res, next) => {
           UserName: user.UserName,
           role: user.Role,
           Role: user.Role,
-          sessionId,
-          allowedApps: user.AllowedApps,
+          sessionId: normalizedSessionId,
         };
       }
     } catch (err) {
@@ -131,7 +148,7 @@ router.use(async (req, res, next) => {
 const getCookieOptions = () => ({
   maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-  secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+  secure: mbkautheVar.IS_DEPLOYED === 'true',
   sameSite: 'lax',
   path: '/',
   httpOnly: true
@@ -139,32 +156,64 @@ const getCookieOptions = () => ({
 
 const getClearCookieOptions = () => ({
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-  secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+  secure: mbkautheVar.IS_DEPLOYED === 'true',
   sameSite: 'lax',
   path: '/',
   httpOnly: true
 });
 
+router.get('/mbkauthe/test', validateSession, LoginLimit, async(req, res) => {
+  if(req.session?.user) {
+    return res.send(`
+      <head> <script src="/mbkauthe/main.js"></script> </head>
+      <p>if you are seeing this page than User is logged in.</p>
+      <p>id: '${req.session.user.id}', UserName: '${req.session.user.username}', Role: '${req.session.user.role}', SessionId: '${req.session.user.sessionId}'</p>
+      <button onclick="logout()">Logout</button><br>
+      <a href="/mbkauthe/info">Info Page</a><br>
+      <a href="/mbkauthe/login">Login Page</a><br>
+      `);
+  }
+});
+
 async function completeLoginProcess(req, res, user, redirectUrl = null) {
   try {
+    // Ensure both username formats are available for compatibility
+    const username = user.username || user.UserName;
+    if (!username) {
+      throw new Error('Username is required in user object');
+    }
+
     // smaller session id is sufficient and faster to generate/serialize
     const sessionId = crypto.randomBytes(32).toString("hex");
-    console.log(`[mbkauthe] Generated session ID for username: ${user.username}`);
+    console.log(`[mbkauthe] Generated session ID for username: ${username}`);
+
+    // Regenerate session to prevent session fixation attacks
+    const oldSessionId = req.sessionID;
+    await new Promise((resolve, reject) => {
+      req.session.regenerate((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    });
 
-    // Delete old session record for this user
-    await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.username]);
+    // Delete all old sessions for this user from session table
+    await dblogin.query({ 
+      name: 'login-delete-old-user-sessions', 
+      text: 'DELETE FROM "session" WHERE sess::text LIKE $1', 
+      values: [`%"username":"${username}"%`] 
+    });
 
-    await dblogin.query(`UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, [
+    await dblogin.query({ name: 'login-update-session-id', text: `UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, values: [
       sessionId,
       user.id,
-    ]);
+    ] });
 
     req.session.user = {
       id: user.id,
-      username: user.username,
-      UserName: user.UserName,
-      role: user.role,
-      Role: user.role,
+      username: username,
+      UserName: username,
+      role: user.role || user.Role,
+      Role: user.role || user.Role,
       sessionId,
     };
 
@@ -182,7 +231,7 @@ async function completeLoginProcess(req, res, user, redirectUrl = null) {
 
       const cookieOptions = getCookieOptions();
       res.cookie("sessionId", sessionId, cookieOptions);
-      console.log(`[mbkauthe] User "${user.username}" logged in successfully`);
+      console.log(`[mbkauthe] User "${username}" logged in successfully`);
 
       const responsePayload = {
         success: true,
@@ -216,8 +265,8 @@ router.use(async (req, res, next) => {
 
 router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
   try {
-    await dblogin.query(`UPDATE "Users" SET "SessionId" = NULL`);
-    await dblogin.query('DELETE FROM "session"');
+    await dblogin.query({ name: 'terminate-all-user-sessions', text: `UPDATE "Users" SET "SessionId" = NULL` });
+    await dblogin.query({ name: 'terminate-all-db-sessions', text: 'DELETE FROM "session"' });
 
     req.session.destroy((err) => {
       if (err) {
@@ -280,11 +329,11 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
   try {
     const userQuery = `SELECT id, "UserName", "Password", "Active", "Role", "AllowedApps" FROM "Users" WHERE "UserName" = $1`;
-    const userResult = await dblogin.query({ name: 'get-user-by-username', text: userQuery, values: [trimmedUsername] });
+    const userResult = await dblogin.query({ name: 'login-get-user', text: userQuery, values: [trimmedUsername] });
 
     if (userResult.rows.length === 0) {
-      console.log(`[mbkauthe] Username does not exist: ${trimmedUsername}`);
-      return res.status(404).json({ success: false, message: "Incorrect Username Or Password" });
+      console.log(`[mbkauthe] Login failed: invalid credentials`);
+      return res.status(401).json({ success: false, message: "Invalid credentials" });
     }
 
     const user = userResult.rows[0];
@@ -299,18 +348,18 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
       try {
         const result = await bcrypt.compare(password, user.Password);
         if (!result) {
-          console.log("[mbkauthe] Incorrect password.");
-          return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password." });
+          console.log("[mbkauthe] Login failed: invalid credentials");
+          return res.status(401).json({ success: false, errorCode: 603, message: "Invalid credentials" });
         }
-        console.log("[mbkauthe] Password matches!");
+        console.log("[mbkauthe] Password validated successfully");
       } catch (err) {
         console.error("[mbkauthe] Error comparing password:", err);
         return res.status(500).json({ success: false, errorCode: 605, message: `Internal Server Error` });
       }
     } else {
       if (user.Password !== password) {
-        console.log(`[mbkauthe] Incorrect password for username: ${trimmedUsername}`);
-        return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password" });
+        console.log(`[mbkauthe] Login failed: invalid credentials`);
+        return res.status(401).json({ success: false, errorCode: 603, message: "Invalid credentials" });
       }
     }
 
@@ -329,7 +378,7 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
     if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLocaleLowerCase() === "true") {
       const query = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
-      const twoFAResult = await dblogin.query({ name: 'get-2fa-status', text: query, values: [trimmedUsername] });
+      const twoFAResult = await dblogin.query({ name: 'login-check-2fa-status', text: query, values: [trimmedUsername] });
 
       if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
         // 2FA is enabled, prompt for token on a separate page
@@ -367,6 +416,7 @@ router.get("/mbkauthe/2fa", csrfProtection, (req, res) => {
     layout: false,
     customURL: mbkautheVar.loginRedirectURL || '/home',
     csrfToken: req.csrfToken(),
+    appName: mbkautheVar.APP_NAME.toLowerCase(),
   });
 });
 
@@ -391,7 +441,7 @@ router.post("/mbkauthe/api/verify-2fa", TwoFALimit, csrfProtection, async (req,
 
   try {
     const query = `SELECT "TwoFASecret" FROM "TwoFA" WHERE "UserName" = $1`;
-    const twoFAResult = await dblogin.query(query, [username]);
+    const twoFAResult = await dblogin.query({ name: 'verify-2fa-secret', text: query, values: [username] });
 
     if (twoFAResult.rows.length === 0 || !twoFAResult.rows[0].TwoFASecret) {
       return res.status(500).json({ success: false, message: "2FA is not configured correctly." });
@@ -421,15 +471,15 @@ router.post("/mbkauthe/api/verify-2fa", TwoFALimit, csrfProtection, async (req,
   }
 });
 
-router.post("/mbkauthe/api/logout", LogoutLimit, csrfProtection, async (req, res) => {
+router.post("/mbkauthe/api/logout", LogoutLimit, async (req, res) => {
   if (req.session.user) {
     try {
       const { id, username } = req.session.user;
 
-      await dblogin.query(`UPDATE "Users" SET "SessionId" = NULL WHERE "id" = $1`, [id]);
+      await dblogin.query({ name: 'logout-clear-session', text: `UPDATE "Users" SET "SessionId" = NULL WHERE "id" = $1`, values: [id] });
 
       if (req.sessionID) {
-        await dblogin.query('DELETE FROM "session" WHERE sid = $1', [req.sessionID]);
+        await dblogin.query({ name: 'logout-delete-session', text: 'DELETE FROM "session" WHERE sid = $1', values: [req.sessionID] });
       }
 
       req.session.destroy((err) => {
@@ -463,7 +513,7 @@ router.get("/mbkauthe/login", LoginLimit, csrfProtection, (req, res) => {
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username || '',
     version: packageJson.version,
-    appName: mbkautheVar.APP_NAME.toUpperCase(),
+    appName: mbkautheVar.APP_NAME.toLowerCase(),
     csrfToken: req.csrfToken(),
   });
 });
@@ -483,9 +533,19 @@ async function getLatestVersion() {
   }
 }
 
-router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
-  let latestVersion;
+router.get("/mbkauthe/bg.avif", (req, res) => {
+  res.sendFile("bg.avif", { root: path.join(process.cwd(), "public") });
+});
 
+router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (req, res) => {
+  let latestVersion;
+  const parameters = req.query;
+  let authorized = false;
+  
+  if (parameters.password && mbkautheVar.Main_SECRET_TOKEN) {
+    authorized = String(parameters.password) === String(mbkautheVar.Main_SECRET_TOKEN);
+  }
+  
   try {
     latestVersion = await getLatestVersion();
     //latestVersion = "Under Development"; // Placeholder for the latest version
@@ -499,6 +559,7 @@ router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
       mbkautheVar: mbkautheVar,
       version: packageJson.version,
       latestVersion,
+      authorized: authorized,
     });
   } catch (err) {
     console.error("[mbkauthe] Error fetching version information:", err);
@@ -515,7 +576,7 @@ router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
         `);
   }
 });
-/*
+
 // Configure GitHub Strategy for login
 passport.use('github-login', new GitHubStrategy({
     clientID: process.env.GITHUB_CLIENT_ID,
@@ -526,28 +587,35 @@ passport.use('github-login', new GitHubStrategy({
     async (accessToken, refreshToken, profile, done) => {
         try {
             // Check if this GitHub account is linked to any user
-            const githubUser = await dblogin.query(
-                'SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps" FROM user_github ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.github_id = $1',
-                [profile.id]
-            );
+            const githubUser = await dblogin.query({
+                name: 'github-login-get-user',
+                text: 'SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id" FROM user_github ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.github_id = $1',
+                values: [profile.id]
+            });
 
             if (githubUser.rows.length === 0) {
                 // GitHub account is not linked to any user
-                return done(new Error('GitHub account not linked to any user'));
+                const error = new Error('GitHub account not linked to any user');
+                error.code = 'GITHUB_NOT_LINKED';
+                return done(error);
             }
 
             const user = githubUser.rows[0];
             
             // Check if the user account is active
             if (!user.Active) {
-                return done(new Error('Account is inactive'));
+                const error = new Error('Account is inactive');
+                error.code = 'ACCOUNT_INACTIVE';
+                return done(error);
             }
 
             // Check if user is authorized for this app (same logic as regular login)
             if (user.Role !== "SuperAdmin") {
                 const allowedApps = user.AllowedApps;
                 if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
-                    return done(new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`));
+                    const error = new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`);
+                    error.code = 'NOT_AUTHORIZED';
+                    return done(error);
                 }
             }
 
@@ -561,6 +629,7 @@ passport.use('github-login', new GitHubStrategy({
             });
         } catch (err) {
             console.error('[mbkauthe] GitHub login error:', err);
+            err.code = err.code || 'GITHUB_AUTH_ERROR';
             return done(err);
         }
     }
@@ -580,25 +649,128 @@ router.use(passport.initialize());
 router.use(passport.session());
 
 // GitHub login initiation
-router.get('/mbkauthe/api/github/login', passport.authenticate('github-login'));
+router.get('/mbkauthe/api/github/login', GitHubOAuthLimit, (req, res, next) => {
+    // Store redirect parameter in session before OAuth flow (validate to prevent open redirect)
+    const redirect = req.query.redirect;
+    if (redirect && typeof redirect === 'string') {
+        // Only allow relative URLs or same-origin URLs to prevent open redirect attacks
+        if (redirect.startsWith('/') && !redirect.startsWith('//')) {
+            req.session.oauthRedirect = redirect;
+        } else {
+            console.warn(`[mbkauthe] Invalid redirect parameter rejected: ${redirect}`);
+        }
+    }
+    passport.authenticate('github-login')(req, res, next);
+});
 
 // GitHub login callback
 router.get('/mbkauthe/api/github/login/callback',
-    passport.authenticate('github-login', { 
-        failureRedirect: '/mbkauthe/login?error=github_auth_failed',
-        session: false // We'll handle session manually
-    }),
+    GitHubOAuthLimit,
+    (req, res, next) => {
+        passport.authenticate('github-login', { 
+            session: false // We'll handle session manually
+        }, (err, user, info) => {
+            // Custom error handling for passport authentication
+            if (err) {
+                console.error('[mbkauthe] GitHub authentication error:', err);
+                
+                // Map error codes to user-friendly messages
+                switch(err.code) {
+                    case 'GITHUB_NOT_LINKED':
+                        return res.status(403).render('Error/dError.handlebars', {
+                            layout: false,
+                            code: '403',
+                            error: 'GitHub Account Not Linked',
+                            message: 'Your GitHub account is not linked to any user in our system. To link your GitHub account, a User must connect their GitHub account to mbktech account through the user settings.',
+                            page: '/mbkauthe/login',
+                            pagename: 'Login',
+                            version: packageJson.version,
+                            app: mbkautheVar.APP_NAME
+                        });
+                    
+                    case 'ACCOUNT_INACTIVE':
+                        return res.status(403).render('Error/dError.handlebars', {
+                            layout: false,
+                            code: '403',
+                            error: 'Account Inactive',
+                            message: 'Your account has been deactivated. Please contact your administrator.',
+                            page: '/mbkauthe/login',
+                            pagename: 'Login',
+                            version: packageJson.version,
+                            app: mbkautheVar.APP_NAME
+                        });
+                    
+                    case 'NOT_AUTHORIZED':
+                        return res.status(403).render('Error/dError.handlebars', {
+                            layout: false,
+                            code: '403',
+                            error: 'Not Authorized',
+                            message: `You are not authorized to access ${mbkautheVar.APP_NAME}. Please contact your administrator.`,
+                            page: '/mbkauthe/login',
+                            pagename: 'Login',
+                            version: packageJson.version,
+                            app: mbkautheVar.APP_NAME
+                        });
+                    
+                    default:
+                        return res.status(500).render('Error/dError.handlebars', {
+                            layout: false,
+                            code: '500',
+                            error: 'Authentication Error',
+                            message: 'An error occurred during GitHub authentication. Please try again.',
+                            page: '/mbkauthe/login',
+                            pagename: 'Login',
+                            version: packageJson.version,
+                            app: mbkautheVar.APP_NAME,
+                            details: process.env.NODE_ENV === 'development' ? `${err.message}\n${err.stack}` : 'Error details hidden in production'
+                        });
+                }
+            }
+            
+            if (!user) {
+                console.error('[mbkauthe] GitHub callback: No user data received');
+                return res.status(401).render('Error/dError.handlebars', {
+                    layout: false,
+                    code: '401',
+                    error: 'Authentication Failed',
+                    message: 'GitHub authentication failed. Please try again.',
+                    page: '/mbkauthe/login',
+                    pagename: 'Login',
+                    version: packageJson.version,
+                    app: mbkautheVar.APP_NAME
+                });
+            }
+            
+            // Authentication successful, attach user to request
+            req.user = user;
+            next();
+        })(req, res, next);
+    },
     async (req, res) => {
         try {
             const githubUser = req.user;
             
-            // Find the actual user record
-            const userQuery = `SELECT * FROM "Users" WHERE "UserName" = $1`;
-            const userResult = await dblogin.query(userQuery, [githubUser.username]);
+            // Find the actual user record with named query
+            const userQuery = `SELECT id, "UserName", "Active", "Role", "AllowedApps" FROM "Users" WHERE "UserName" = $1`;
+            const userResult = await dblogin.query({
+                name: 'github-callback-get-user',
+                text: userQuery,
+                values: [githubUser.username]
+            });
 
             if (userResult.rows.length === 0) {
-                console.log(`[mbkauthe] GitHub login: User not found: ${githubUser.username}`);
-                return res.redirect('/mbkauthe/login?error=user_not_found');
+                console.error(`[mbkauthe] GitHub login: User not found: ${githubUser.username}`);
+                return res.status(404).render('Error/dError.handlebars', {
+                    layout: false,
+                    code: '404',
+                    error: 'User Not Found',
+                    message: 'Your GitHub account is linked, but the user account no longer exists in our system.',
+                    page: '/mbkauthe/login',
+                    pagename: 'Login',
+                    version: packageJson.version,
+                    app: mbkautheVar.APP_NAME,
+                    details: `GitHub username: ${githubUser.username}\nPlease contact your administrator.`
+                });
             }
 
             const user = userResult.rows[0];
@@ -606,14 +778,20 @@ router.get('/mbkauthe/api/github/login/callback',
             // Check 2FA if enabled
             if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLowerCase() === "true") {
                 const twoFAQuery = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
-                const twoFAResult = await dblogin.query(twoFAQuery, [githubUser.username]);
+                const twoFAResult = await dblogin.query({
+                    name: 'github-check-2fa-status',
+                    text: twoFAQuery,
+                    values: [githubUser.username]
+                });
 
                 if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
                     // 2FA is enabled, store pre-auth user and redirect to 2FA
                     req.session.preAuthUser = {
                         id: user.id,
                         username: user.UserName,
+                        UserName: user.UserName,
                         role: user.Role,
+                        Role: user.Role,
                         loginMethod: 'github'
                     };
                     console.log(`[mbkauthe] GitHub login: 2FA required for user: ${githubUser.username}`);
@@ -621,62 +799,64 @@ router.get('/mbkauthe/api/github/login/callback',
                 }
             }
 
-            // Complete login process
+            // Complete login process using the shared function
             const userForSession = {
                 id: user.id,
                 username: user.UserName,
+                UserName: user.UserName,
                 role: user.Role,
+                Role: user.Role
             };
 
-            // Generate session and complete login
-            const sessionId = crypto.randomBytes(32).toString("hex");
-            console.log(`[mbkauthe] GitHub login: Generated session ID for username: ${user.UserName}`);
-
-            // Delete old session record for this user
-            await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.UserName]);
+            // For OAuth redirect flow, we need to handle redirect differently
+            // Store the redirect URL before calling completeLoginProcess
+            const oauthRedirect = req.session.oauthRedirect;
+            delete req.session.oauthRedirect;
 
-            await dblogin.query(`UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, [
-                sessionId,
-                user.id,
-            ]);
-
-            req.session.user = {
-                id: user.id,
-                username: user.UserName,
-                role: user.Role,
-                sessionId,
+            // Custom response handler for OAuth flow - wrap the response object
+            const originalJson = res.json.bind(res);
+            const originalStatus = res.status.bind(res);
+            let statusCode = 200;
+            
+            res.status = function(code) {
+                statusCode = code;
+                return originalStatus(code);
             };
-
-            req.session.save(async (err) => {
-                if (err) {
-                    console.log("[mbkauthe] GitHub login session save error:", err);
-                    return res.redirect('/mbkauthe/login?error=session_error');
-                }
-                
-                try {
-                    await dblogin.query(
-                        'UPDATE "session" SET username = $1 WHERE sid = $2',
-                        [user.UserName, req.sessionID]
-                    );
-                } catch (e) {
-                    console.log("[mbkauthe] GitHub login: Failed to update username in session table:", e);
+            
+            res.json = function(data) {
+                if (data.success && statusCode === 200) {
+                    // If login successful, redirect instead of sending JSON
+                    const redirectUrl = oauthRedirect || mbkautheVar.loginRedirectURL || '/home';
+                    console.log(`[mbkauthe] GitHub login: Redirecting to ${redirectUrl}`);
+                    // Restore original methods before redirect
+                    res.json = originalJson;
+                    res.status = originalStatus;
+                    return res.redirect(redirectUrl);
                 }
+                // Restore original methods for error responses
+                res.json = originalJson;
+                res.status = originalStatus;
+                return originalJson(data);
+            };
 
-                const cookieOptions = getCookieOptions();
-                res.cookie("sessionId", sessionId, cookieOptions);
-                console.log(`[mbkauthe] GitHub login: User "${user.UserName}" logged in successfully`);
-
-                // Redirect to the configured URL or home
-                const redirectUrl = mbkautheVar.loginRedirectURL || '/home';
-                res.redirect(redirectUrl);
-            });
+            await completeLoginProcess(req, res, userForSession);
 
         } catch (err) {
             console.error('[mbkauthe] GitHub login callback error:', err);
-            res.redirect('/mbkauthe/login?error=internal_error');
+            return res.status(500).render('Error/dError.handlebars', {
+                layout: false,
+                code: '500',
+                error: 'Internal Server Error',
+                message: 'An error occurred during GitHub authentication. Please try again.',
+                page: '/mbkauthe/login',
+                pagename: 'Login',
+                version: packageJson.version,
+                app: mbkautheVar.APP_NAME,
+                details: process.env.NODE_ENV === 'development' ? `${err.message}\n${err.stack}` : 'Error details hidden in production'
+            });
         }
     }
 );
-*/
+
 export { getLatestVersion };
 export default router;

package/lib/pool.js

@@ -36,8 +36,8 @@ const poolConfig = {
   // - keep max small to avoid exhausting DB connections
   // - reduce idle time so connections are returned sooner
   // - set a short connection timeout to fail fast
-  max: 10,
-  idleTimeoutMillis: 50000,
+  max: 20,
+  idleTimeoutMillis: 10000,
   connectionTimeoutMillis: 5000,
 };