mbkauthe 1.4.2 → 2.0.1

package/lib/main.js

@@ -5,14 +5,14 @@ import session from "express-session";
 import pgSession from "connect-pg-simple";
 const PgSession = pgSession(session);
 import { dblogin } from "./pool.js";
-import { authenticate } from "./validateSessionAndRole.js";
+import { authenticate, validateSession, validateSessionAndRole } from "./validateSessionAndRole.js";
 import fetch from 'node-fetch';
 import cookieParser from "cookie-parser";
 import bcrypt from 'bcrypt';
 import rateLimit from 'express-rate-limit';
 import speakeasy from "speakeasy";
-//import passport from 'passport';
-//import GitHubStrategy from 'passport-github2';
+import passport from 'passport';
+import GitHubStrategy from 'passport-github2';
 
 import { createRequire } from "module";
 import fs from "fs";
@@ -36,16 +36,26 @@ router.get('/mbkauthe/main.js', (req, res) => {
 });
 
 // CSRF protection middleware
-const csrfProtection = csurf({ cookie: false });
+const csrfProtection = csurf({ cookie: true });
 
 // CORS and security headers
 router.use((req, res, next) => {
   const origin = req.headers.origin;
-  if (origin && origin.endsWith(`.${mbkautheVar.DOMAIN}`)) {
-    res.header('Access-Control-Allow-Origin', origin);
-    res.header('Access-Control-Allow-Credentials', 'true');
-    res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
-    res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+  if (origin) {
+    try {
+      const originUrl = new URL(origin);
+      const allowedDomain = `.${mbkautheVar.DOMAIN}`;
+      // Exact match or subdomain match (must end with .domain.com, not just domain.com)
+      if (originUrl.hostname === mbkautheVar.DOMAIN ||
+        (originUrl.hostname.endsWith(allowedDomain) && originUrl.hostname.charAt(originUrl.hostname.length - allowedDomain.length - 1) !== '.')) {
+        res.header('Access-Control-Allow-Origin', origin);
+        res.header('Access-Control-Allow-Credentials', 'true');
+        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
+        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+      }
+    } catch (err) {
+      // Invalid origin URL, skip CORS headers
+    }
   }
   next();
 });
@@ -71,6 +81,12 @@ const TwoFALimit = rateLimit({
   message: { success: false, message: "Too many 2FA attempts, please try again later" }
 });
 
+const GitHubOAuthLimit = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 10,
+  message: "Too many GitHub login attempts, please try again later"
+});
+
 const sessionConfig = {
   store: new PgSession({
     pool: dblogin,
@@ -85,7 +101,7 @@ const sessionConfig = {
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
     domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
-    secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+    secure: mbkautheVar.IS_DEPLOYED === 'true',
     sameSite: 'lax',
     path: '/'
   },
@@ -100,14 +116,16 @@ router.use(async (req, res, next) => {
     try {
       const sessionId = req.cookies.sessionId;
 
-      // Validate sessionId format (should be 64 hex characters)
+      // Validate sessionId format (should be 64 hex characters) and normalize to lowercase
       if (typeof sessionId !== 'string' || !/^[a-f0-9]{64}$/i.test(sessionId)) {
         console.warn("[mbkauthe] Invalid sessionId format detected");
         return next();
       }
 
-      const query = `SELECT id, "UserName", "Active", "Role", "SessionId", "AllowedApps" FROM "Users" WHERE "SessionId" = $1 AND "Active" = true`;
-      const result = await dblogin.query({ name: 'get-user-by-sessionid', text: query, values: [sessionId] });
+      const normalizedSessionId = sessionId.toLowerCase();
+
+      const query = `SELECT id, "UserName", "Active", "Role", "SessionId", "AllowedApps" FROM "Users" WHERE LOWER("SessionId") = $1 AND "Active" = true`;
+      const result = await dblogin.query({ name: 'restore-user-session', text: query, values: [normalizedSessionId] });
 
       if (result.rows.length > 0) {
         const user = result.rows[0];
@@ -117,8 +135,7 @@ router.use(async (req, res, next) => {
           UserName: user.UserName,
           role: user.Role,
           Role: user.Role,
-          sessionId,
-          allowedApps: user.AllowedApps,
+          sessionId: normalizedSessionId,
         };
       }
     } catch (err) {
@@ -131,7 +148,7 @@ router.use(async (req, res, next) => {
 const getCookieOptions = () => ({
   maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-  secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+  secure: mbkautheVar.IS_DEPLOYED === 'true',
   sameSite: 'lax',
   path: '/',
   httpOnly: true
@@ -139,32 +156,66 @@ const getCookieOptions = () => ({
 
 const getClearCookieOptions = () => ({
   domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-  secure: mbkautheVar.IS_DEPLOYED === 'true' ? 'auto' : false,
+  secure: mbkautheVar.IS_DEPLOYED === 'true',
   sameSite: 'lax',
   path: '/',
   httpOnly: true
 });
 
+router.get('/mbkauthe/test', validateSession, LoginLimit, async (req, res) => {
+  if (req.session?.user) {
+    return res.send(`
+      <head> <script src="/mbkauthe/main.js"></script> </head>
+      <p>if you are seeing this page than User is logged in.</p>
+      <p>id: '${req.session.user.id}', UserName: '${req.session.user.username}', Role: '${req.session.user.role}', SessionId: '${req.session.user.sessionId}'</p>
+      <button onclick="logout()">Logout</button><br>
+      <a href="/mbkauthe/info">Info Page</a><br>
+      <a href="/mbkauthe/login">Login Page</a><br>
+      `);
+  }
+});
+
 async function completeLoginProcess(req, res, user, redirectUrl = null) {
   try {
+    // Ensure both username formats are available for compatibility
+    const username = user.username || user.UserName;
+    if (!username) {
+      throw new Error('Username is required in user object');
+    }
+
     // smaller session id is sufficient and faster to generate/serialize
     const sessionId = crypto.randomBytes(32).toString("hex");
-    console.log(`[mbkauthe] Generated session ID for username: ${user.username}`);
+    console.log(`[mbkauthe] Generated session ID for username: ${username}`);
+
+    // Regenerate session to prevent session fixation attacks
+    const oldSessionId = req.sessionID;
+    await new Promise((resolve, reject) => {
+      req.session.regenerate((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    });
 
-    // Delete old session record for this user
-    await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.username]);
+    // Delete all old sessions for this user from session table
+    await dblogin.query({
+      name: 'login-delete-old-user-sessions',
+      text: 'DELETE FROM "session" WHERE sess::text LIKE $1',
+      values: [`%"username":"${username}"%`]
+    });
 
-    await dblogin.query(`UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, [
-      sessionId,
-      user.id,
-    ]);
+    await dblogin.query({
+      name: 'login-update-session-id', text: `UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, values: [
+        sessionId,
+        user.id,
+      ]
+    });
 
     req.session.user = {
       id: user.id,
-      username: user.username,
-      UserName: user.UserName,
-      role: user.role,
-      Role: user.role,
+      username: username,
+      UserName: username,
+      role: user.role || user.Role,
+      Role: user.role || user.Role,
       sessionId,
     };
 
@@ -182,7 +233,7 @@ async function completeLoginProcess(req, res, user, redirectUrl = null) {
 
       const cookieOptions = getCookieOptions();
       res.cookie("sessionId", sessionId, cookieOptions);
-      console.log(`[mbkauthe] User "${user.username}" logged in successfully`);
+      console.log(`[mbkauthe] User "${username}" logged in successfully`);
 
       const responsePayload = {
         success: true,
@@ -216,8 +267,8 @@ router.use(async (req, res, next) => {
 
 router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
   try {
-    await dblogin.query(`UPDATE "Users" SET "SessionId" = NULL`);
-    await dblogin.query('DELETE FROM "session"');
+    await dblogin.query({ name: 'terminate-all-user-sessions', text: `UPDATE "Users" SET "SessionId" = NULL` });
+    await dblogin.query({ name: 'terminate-all-db-sessions', text: 'DELETE FROM "session"' });
 
     req.session.destroy((err) => {
       if (err) {
@@ -280,11 +331,11 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
   try {
     const userQuery = `SELECT id, "UserName", "Password", "Active", "Role", "AllowedApps" FROM "Users" WHERE "UserName" = $1`;
-    const userResult = await dblogin.query({ name: 'get-user-by-username', text: userQuery, values: [trimmedUsername] });
+    const userResult = await dblogin.query({ name: 'login-get-user', text: userQuery, values: [trimmedUsername] });
 
     if (userResult.rows.length === 0) {
-      console.log(`[mbkauthe] Username does not exist: ${trimmedUsername}`);
-      return res.status(404).json({ success: false, message: "Incorrect Username Or Password" });
+      console.log(`[mbkauthe] Login failed: invalid credentials`);
+      return res.status(401).json({ success: false, message: "Invalid credentials" });
     }
 
     const user = userResult.rows[0];
@@ -299,18 +350,18 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
       try {
         const result = await bcrypt.compare(password, user.Password);
         if (!result) {
-          console.log("[mbkauthe] Incorrect password.");
-          return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password." });
+          console.log("[mbkauthe] Login failed: invalid credentials");
+          return res.status(401).json({ success: false, errorCode: 603, message: "Invalid credentials" });
         }
-        console.log("[mbkauthe] Password matches!");
+        console.log("[mbkauthe] Password validated successfully");
       } catch (err) {
         console.error("[mbkauthe] Error comparing password:", err);
         return res.status(500).json({ success: false, errorCode: 605, message: `Internal Server Error` });
       }
     } else {
       if (user.Password !== password) {
-        console.log(`[mbkauthe] Incorrect password for username: ${trimmedUsername}`);
-        return res.status(401).json({ success: false, errorCode: 603, message: "Incorrect Username Or Password" });
+        console.log(`[mbkauthe] Login failed: invalid credentials`);
+        return res.status(401).json({ success: false, errorCode: 603, message: "Invalid credentials" });
       }
     }
 
@@ -329,7 +380,7 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
     if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLocaleLowerCase() === "true") {
       const query = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
-      const twoFAResult = await dblogin.query({ name: 'get-2fa-status', text: query, values: [trimmedUsername] });
+      const twoFAResult = await dblogin.query({ name: 'login-check-2fa-status', text: query, values: [trimmedUsername] });
 
       if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
         // 2FA is enabled, prompt for token on a separate page
@@ -367,6 +418,7 @@ router.get("/mbkauthe/2fa", csrfProtection, (req, res) => {
     layout: false,
     customURL: mbkautheVar.loginRedirectURL || '/home',
     csrfToken: req.csrfToken(),
+    appName: mbkautheVar.APP_NAME.toLowerCase(),
   });
 });
 
@@ -391,7 +443,7 @@ router.post("/mbkauthe/api/verify-2fa", TwoFALimit, csrfProtection, async (req,
 
   try {
     const query = `SELECT "TwoFASecret" FROM "TwoFA" WHERE "UserName" = $1`;
-    const twoFAResult = await dblogin.query(query, [username]);
+    const twoFAResult = await dblogin.query({ name: 'verify-2fa-secret', text: query, values: [username] });
 
     if (twoFAResult.rows.length === 0 || !twoFAResult.rows[0].TwoFASecret) {
       return res.status(500).json({ success: false, message: "2FA is not configured correctly." });
@@ -421,15 +473,15 @@ router.post("/mbkauthe/api/verify-2fa", TwoFALimit, csrfProtection, async (req,
   }
 });
 
-router.post("/mbkauthe/api/logout", LogoutLimit, csrfProtection, async (req, res) => {
+router.post("/mbkauthe/api/logout", LogoutLimit, async (req, res) => {
   if (req.session.user) {
     try {
       const { id, username } = req.session.user;
 
-      await dblogin.query(`UPDATE "Users" SET "SessionId" = NULL WHERE "id" = $1`, [id]);
+      await dblogin.query({ name: 'logout-clear-session', text: `UPDATE "Users" SET "SessionId" = NULL WHERE "id" = $1`, values: [id] });
 
       if (req.sessionID) {
-        await dblogin.query('DELETE FROM "session" WHERE sid = $1', [req.sessionID]);
+        await dblogin.query({ name: 'logout-delete-session', text: 'DELETE FROM "session" WHERE sid = $1', values: [req.sessionID] });
       }
 
       req.session.destroy((err) => {
@@ -463,7 +515,7 @@ router.get("/mbkauthe/login", LoginLimit, csrfProtection, (req, res) => {
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username || '',
     version: packageJson.version,
-    appName: mbkautheVar.APP_NAME.toUpperCase(),
+    appName: mbkautheVar.APP_NAME.toLowerCase(),
     csrfToken: req.csrfToken(),
   });
 });
@@ -483,8 +535,18 @@ async function getLatestVersion() {
   }
 }
 
-router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
+router.get("/mbkauthe/bg.avif", (req, res) => {
+  res.sendFile("bg.avif", { root: path.join(process.cwd(), "public") });
+});
+
+router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (req, res) => {
   let latestVersion;
+  const parameters = req.query;
+  let authorized = false;
+
+  if (parameters.password && mbkautheVar.Main_SECRET_TOKEN) {
+    authorized = String(parameters.password) === String(mbkautheVar.Main_SECRET_TOKEN);
+  }
 
   try {
     latestVersion = await getLatestVersion();
@@ -499,6 +561,7 @@ router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
       mbkautheVar: mbkautheVar,
       version: packageJson.version,
       latestVersion,
+      authorized: authorized,
     });
   } catch (err) {
     console.error("[mbkauthe] Error fetching version information:", err);
@@ -515,64 +578,72 @@ router.get(["/mbkauthe/info", "/mbkauthe/i"], LoginLimit, async (_, res) => {
         `);
   }
 });
-/*
+
 // Configure GitHub Strategy for login
 passport.use('github-login', new GitHubStrategy({
-    clientID: process.env.GITHUB_CLIENT_ID,
-    clientSecret: process.env.GITHUB_CLIENT_SECRET,
-    callbackURL: '/mbkauthe/api/github/login/callback',
-    scope: ['user:email']
+  clientID: mbkautheVar.GITHUB_CLIENT_ID,
+  clientSecret: mbkautheVar.GITHUB_CLIENT_SECRET,
+  callbackURL: '/mbkauthe/api/github/login/callback',
+  scope: ['user:email']
 },
-    async (accessToken, refreshToken, profile, done) => {
-        try {
-            // Check if this GitHub account is linked to any user
-            const githubUser = await dblogin.query(
-                'SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps" FROM user_github ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.github_id = $1',
-                [profile.id]
-            );
-
-            if (githubUser.rows.length === 0) {
-                // GitHub account is not linked to any user
-                return done(new Error('GitHub account not linked to any user'));
-            }
-
-            const user = githubUser.rows[0];
-            
-            // Check if the user account is active
-            if (!user.Active) {
-                return done(new Error('Account is inactive'));
-            }
-
-            // Check if user is authorized for this app (same logic as regular login)
-            if (user.Role !== "SuperAdmin") {
-                const allowedApps = user.AllowedApps;
-                if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
-                    return done(new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`));
-                }
-            }
-
-            // Return user data for login
-            return done(null, {
-                id: user.id, // This should be the user ID from the Users table
-                username: user.UserName,
-                role: user.Role,
-                githubId: user.github_id,
-                githubUsername: user.github_username
-            });
-        } catch (err) {
-            console.error('[mbkauthe] GitHub login error:', err);
-            return done(err);
+  async (accessToken, refreshToken, profile, done) => {
+    try {
+      // Check if this GitHub account is linked to any user
+      const githubUser = await dblogin.query({
+        name: 'github-login-get-user',
+        text: 'SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id" FROM user_github ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.github_id = $1',
+        values: [profile.id]
+      });
+
+      if (githubUser.rows.length === 0) {
+        // GitHub account is not linked to any user
+        const error = new Error('GitHub account not linked to any user');
+        error.code = 'GITHUB_NOT_LINKED';
+        return done(error);
+      }
+
+      const user = githubUser.rows[0];
+
+      // Check if the user account is active
+      if (!user.Active) {
+        const error = new Error('Account is inactive');
+        error.code = 'ACCOUNT_INACTIVE';
+        return done(error);
+      }
+
+      // Check if user is authorized for this app (same logic as regular login)
+      if (user.Role !== "SuperAdmin") {
+        const allowedApps = user.AllowedApps;
+        if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+          const error = new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`);
+          error.code = 'NOT_AUTHORIZED';
+          return done(error);
         }
+      }
+
+      // Return user data for login
+      return done(null, {
+        id: user.id, // This should be the user ID from the Users table
+        username: user.UserName,
+        role: user.Role,
+        githubId: user.github_id,
+        githubUsername: user.github_username
+      });
+    } catch (err) {
+      console.error('[mbkauthe] GitHub login error:', err);
+      err.code = err.code || 'GITHUB_AUTH_ERROR';
+      return done(err);
     }
+  }
 ));
 
 // Serialize/Deserialize user for GitHub login
 passport.serializeUser((user, done) => {
-    done(null, user);
+  done(null, user);
 });
 
 passport.deserializeUser((user, done) => {
-    done(null, user);
+  done(null, user);
 });
 
 // Initialize passport
@@ -580,103 +651,228 @@ router.use(passport.initialize());
 router.use(passport.session());
 
 // GitHub login initiation
-router.get('/mbkauthe/api/github/login', passport.authenticate('github-login'));
+router.get('/mbkauthe/api/github/login', GitHubOAuthLimit, (req, res, next) => {
+  if (mbkautheVar.GITHUB_LOGIN_ENABLED) {
+    // Store redirect parameter in session before OAuth flow (validate to prevent open redirect)
+    const redirect = req.query.redirect;
+    if (redirect && typeof redirect === 'string') {
+      // Only allow relative URLs or same-origin URLs to prevent open redirect attacks
+      if (redirect.startsWith('/') && !redirect.startsWith('//')) {
+        req.session.oauthRedirect = redirect;
+      } else {
+        console.warn(`[mbkauthe] Invalid redirect parameter rejected: ${redirect}`);
+      }
+    }
+    passport.authenticate('github-login')(req, res, next);
+  }
+  else {
+    res.status(403).render('Error/dError.handlebars', {
+      layout: false,
+      code: '403',
+      error: 'GitHub Login Disabled',
+      message: 'GitHub login is currently disabled. Please use your username and password to log in.',
+      page: '/mbkauthe/login',
+      pagename: 'Login',
+      version: packageJson.version,
+      app: mbkautheVar.APP_NAME
+    });
+  }
+});
 
 // GitHub login callback
 router.get('/mbkauthe/api/github/login/callback',
-    passport.authenticate('github-login', { 
-        failureRedirect: '/mbkauthe/login?error=github_auth_failed',
-        session: false // We'll handle session manually
-    }),
-    async (req, res) => {
-        try {
-            const githubUser = req.user;
-            
-            // Find the actual user record
-            const userQuery = `SELECT * FROM "Users" WHERE "UserName" = $1`;
-            const userResult = await dblogin.query(userQuery, [githubUser.username]);
-
-            if (userResult.rows.length === 0) {
-                console.log(`[mbkauthe] GitHub login: User not found: ${githubUser.username}`);
-                return res.redirect('/mbkauthe/login?error=user_not_found');
-            }
-
-            const user = userResult.rows[0];
-
-            // Check 2FA if enabled
-            if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLowerCase() === "true") {
-                const twoFAQuery = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
-                const twoFAResult = await dblogin.query(twoFAQuery, [githubUser.username]);
-
-                if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
-                    // 2FA is enabled, store pre-auth user and redirect to 2FA
-                    req.session.preAuthUser = {
-                        id: user.id,
-                        username: user.UserName,
-                        role: user.Role,
-                        loginMethod: 'github'
-                    };
-                    console.log(`[mbkauthe] GitHub login: 2FA required for user: ${githubUser.username}`);
-                    return res.redirect('/mbkauthe/2fa');
-                }
-            }
-
-            // Complete login process
-            const userForSession = {
-                id: user.id,
-                username: user.UserName,
-                role: user.Role,
-            };
-
-            // Generate session and complete login
-            const sessionId = crypto.randomBytes(32).toString("hex");
-            console.log(`[mbkauthe] GitHub login: Generated session ID for username: ${user.UserName}`);
-
-            // Delete old session record for this user
-            await dblogin.query('DELETE FROM "session" WHERE username = $1', [user.UserName]);
-
-            await dblogin.query(`UPDATE "Users" SET "SessionId" = $1 WHERE "id" = $2`, [
-                sessionId,
-                user.id,
-            ]);
-
-            req.session.user = {
-                id: user.id,
-                username: user.UserName,
-                role: user.Role,
-                sessionId,
-            };
-
-            req.session.save(async (err) => {
-                if (err) {
-                    console.log("[mbkauthe] GitHub login session save error:", err);
-                    return res.redirect('/mbkauthe/login?error=session_error');
-                }
-                
-                try {
-                    await dblogin.query(
-                        'UPDATE "session" SET username = $1 WHERE sid = $2',
-                        [user.UserName, req.sessionID]
-                    );
-                } catch (e) {
-                    console.log("[mbkauthe] GitHub login: Failed to update username in session table:", e);
-                }
-
-                const cookieOptions = getCookieOptions();
-                res.cookie("sessionId", sessionId, cookieOptions);
-                console.log(`[mbkauthe] GitHub login: User "${user.UserName}" logged in successfully`);
-
-                // Redirect to the configured URL or home
-                const redirectUrl = mbkautheVar.loginRedirectURL || '/home';
-                res.redirect(redirectUrl);
+  GitHubOAuthLimit,
+  (req, res, next) => {
+    passport.authenticate('github-login', {
+      session: false // We'll handle session manually
+    }, (err, user, info) => {
+      // Custom error handling for passport authentication
+      if (err) {
+        console.error('[mbkauthe] GitHub authentication error:', err);
+
+        // Map error codes to user-friendly messages
+        switch (err.code) {
+          case 'GITHUB_NOT_LINKED':
+            return res.status(403).render('Error/dError.handlebars', {
+              layout: false,
+              code: '403',
+              error: 'GitHub Account Not Linked',
+              message: 'Your GitHub account is not linked to any user in our system. To link your GitHub account, a User must connect their GitHub account to mbktech account through the user settings.',
+              page: '/mbkauthe/login',
+              pagename: 'Login',
+              version: packageJson.version,
+              app: mbkautheVar.APP_NAME
+            });
+
+          case 'ACCOUNT_INACTIVE':
+            return res.status(403).render('Error/dError.handlebars', {
+              layout: false,
+              code: '403',
+              error: 'Account Inactive',
+              message: 'Your account has been deactivated. Please contact your administrator.',
+              page: '/mbkauthe/login',
+              pagename: 'Login',
+              version: packageJson.version,
+              app: mbkautheVar.APP_NAME
+            });
+
+          case 'NOT_AUTHORIZED':
+            return res.status(403).render('Error/dError.handlebars', {
+              layout: false,
+              code: '403',
+              error: 'Not Authorized',
+              message: `You are not authorized to access ${mbkautheVar.APP_NAME}. Please contact your administrator.`,
+              page: '/mbkauthe/login',
+              pagename: 'Login',
+              version: packageJson.version,
+              app: mbkautheVar.APP_NAME
             });
 
-        } catch (err) {
-            console.error('[mbkauthe] GitHub login callback error:', err);
-            res.redirect('/mbkauthe/login?error=internal_error');
+          default:
+            return res.status(500).render('Error/dError.handlebars', {
+              layout: false,
+              code: '500',
+              error: 'Authentication Error',
+              message: 'An error occurred during GitHub authentication. Please try again.',
+              page: '/mbkauthe/login',
+              pagename: 'Login',
+              version: packageJson.version,
+              app: mbkautheVar.APP_NAME,
+              details: process.env.NODE_ENV === 'development' ? `${err.message}\n${err.stack}` : 'Error details hidden in production'
+            });
         }
+      }
+
+      if (!user) {
+        console.error('[mbkauthe] GitHub callback: No user data received');
+        return res.status(401).render('Error/dError.handlebars', {
+          layout: false,
+          code: '401',
+          error: 'Authentication Failed',
+          message: 'GitHub authentication failed. Please try again.',
+          page: '/mbkauthe/login',
+          pagename: 'Login',
+          version: packageJson.version,
+          app: mbkautheVar.APP_NAME
+        });
+      }
+
+      // Authentication successful, attach user to request
+      req.user = user;
+      next();
+    })(req, res, next);
+  },
+  async (req, res) => {
+    try {
+      const githubUser = req.user;
+
+      // Find the actual user record with named query
+      const userQuery = `SELECT id, "UserName", "Active", "Role", "AllowedApps" FROM "Users" WHERE "UserName" = $1`;
+      const userResult = await dblogin.query({
+        name: 'github-callback-get-user',
+        text: userQuery,
+        values: [githubUser.username]
+      });
+
+      if (userResult.rows.length === 0) {
+        console.error(`[mbkauthe] GitHub login: User not found: ${githubUser.username}`);
+        return res.status(404).render('Error/dError.handlebars', {
+          layout: false,
+          code: '404',
+          error: 'User Not Found',
+          message: 'Your GitHub account is linked, but the user account no longer exists in our system.',
+          page: '/mbkauthe/login',
+          pagename: 'Login',
+          version: packageJson.version,
+          app: mbkautheVar.APP_NAME,
+          details: `GitHub username: ${githubUser.username}\nPlease contact your administrator.`
+        });
+      }
+
+      const user = userResult.rows[0];
+
+      // Check 2FA if enabled
+      if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLowerCase() === "true") {
+        const twoFAQuery = `SELECT "TwoFAStatus" FROM "TwoFA" WHERE "UserName" = $1`;
+        const twoFAResult = await dblogin.query({
+          name: 'github-check-2fa-status',
+          text: twoFAQuery,
+          values: [githubUser.username]
+        });
+
+        if (twoFAResult.rows.length > 0 && twoFAResult.rows[0].TwoFAStatus) {
+          // 2FA is enabled, store pre-auth user and redirect to 2FA
+          req.session.preAuthUser = {
+            id: user.id,
+            username: user.UserName,
+            UserName: user.UserName,
+            role: user.Role,
+            Role: user.Role,
+            loginMethod: 'github'
+          };
+          console.log(`[mbkauthe] GitHub login: 2FA required for user: ${githubUser.username}`);
+          return res.redirect('/mbkauthe/2fa');
+        }
+      }
+
+      // Complete login process using the shared function
+      const userForSession = {
+        id: user.id,
+        username: user.UserName,
+        UserName: user.UserName,
+        role: user.Role,
+        Role: user.Role
+      };
+
+      // For OAuth redirect flow, we need to handle redirect differently
+      // Store the redirect URL before calling completeLoginProcess
+      const oauthRedirect = req.session.oauthRedirect;
+      delete req.session.oauthRedirect;
+
+      // Custom response handler for OAuth flow - wrap the response object
+      const originalJson = res.json.bind(res);
+      const originalStatus = res.status.bind(res);
+      let statusCode = 200;
+
+      res.status = function (code) {
+        statusCode = code;
+        return originalStatus(code);
+      };
+
+      res.json = function (data) {
+        if (data.success && statusCode === 200) {
+          // If login successful, redirect instead of sending JSON
+          const redirectUrl = oauthRedirect || mbkautheVar.loginRedirectURL || '/home';
+          console.log(`[mbkauthe] GitHub login: Redirecting to ${redirectUrl}`);
+          // Restore original methods before redirect
+          res.json = originalJson;
+          res.status = originalStatus;
+          return res.redirect(redirectUrl);
+        }
+        // Restore original methods for error responses
+        res.json = originalJson;
+        res.status = originalStatus;
+        return originalJson(data);
+      };
+
+      await completeLoginProcess(req, res, userForSession);
+
+    } catch (err) {
+      console.error('[mbkauthe] GitHub login callback error:', err);
+      return res.status(500).render('Error/dError.handlebars', {
+        layout: false,
+        code: '500',
+        error: 'Internal Server Error',
+        message: 'An error occurred during GitHub authentication. Please try again.',
+        page: '/mbkauthe/login',
+        pagename: 'Login',
+        version: packageJson.version,
+        app: mbkautheVar.APP_NAME,
+        details: process.env.NODE_ENV === 'development' ? `${err.message}\n${err.stack}` : 'Error details hidden in production'
+      });
     }
+  }
 );
-*/
+
 export { getLatestVersion };
 export default router;