mbkauthe 2.3.0 → 2.4.0

package/lib/main.js

@@ -328,7 +328,7 @@ router.post("/mbkauthe/api/terminateAllSessions", authenticate(mbkautheVar.Main_
 router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
   console.log("[mbkauthe] Login request received");
 
-  const { username, password } = req.body;
+  const { username, password, redirect } = req.body;
 
   // Input validation
   if (!username || !password) {
@@ -401,7 +401,7 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
           if (deviceUser.Role !== "SuperAdmin") {
             const allowedApps = deviceUser.AllowedApps;
-            if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+            if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
               console.warn(`[mbkauthe] User \"${trimmedUsername}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
               return res.status(403).json({ success: false, message: `You Are Not Authorized To Use The Application \"${mbkautheVar.APP_NAME}\"` });
             }
@@ -424,7 +424,9 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
             Role: deviceUser.Role,
             allowedApps: deviceUser.AllowedApps,
           };
-          return await completeLoginProcess(req, res, userForSession);
+          // If a redirect is provided, validate and pass it through
+          const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
+          return await completeLoginProcess(req, res, userForSession, requestedRedirect);
         }
       } catch (deviceErr) {
         console.error("[mbkauthe] Error checking trusted device:", deviceErr);
@@ -481,7 +483,7 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
     if (user.Role !== "SuperAdmin") {
       const allowedApps = user.AllowedApps;
-      if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+      if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
         console.warn(`[mbkauthe] User \"${user.UserName}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
         return res.status(403).json({ success: false, message: `You Are Not Authorized To Use The Application \"${mbkautheVar.APP_NAME}\"` });
       }
@@ -489,14 +491,16 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
 
     if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLocaleLowerCase() === "true" && user.TwoFAStatus) {
       // 2FA is enabled, prompt for token on a separate page
+      const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
       req.session.preAuthUser = {
         id: user.id,
         username: user.UserName,
         role: user.Role,
         Role: user.Role,
+        redirectUrl: requestedRedirect
       };
       console.log(`[mbkauthe] 2FA required for user: ${trimmedUsername}`);
-      return res.json({ success: true, twoFactorRequired: true });
+      return res.json({ success: true, twoFactorRequired: true, redirectUrl: requestedRedirect });
     }
 
     // If 2FA is not enabled, proceed with login
@@ -507,7 +511,8 @@ router.post("/mbkauthe/api/login", LoginLimit, async (req, res) => {
       Role: user.Role,
       allowedApps: user.AllowedApps,
     };
-    await completeLoginProcess(req, res, userForSession);
+    const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
+    await completeLoginProcess(req, res, userForSession, requestedRedirect);
 
   } catch (err) {
     console.error("[mbkauthe] Error during login process:", err);
@@ -519,9 +524,19 @@ router.get("/mbkauthe/2fa", csrfProtection, (req, res) => {
   if (!req.session.preAuthUser) {
     return res.redirect("/mbkauthe/login");
   }
+
+  // Prefer explicit redirect from query string, else from session preAuthUser redirectUrl, else fallback value
+  let redirectFromQuery = req.query && typeof req.query.redirect === 'string' ? req.query.redirect : null;
+  let redirectToUse = redirectFromQuery || req.session.preAuthUser.redirectUrl || (mbkautheVar.loginRedirectURL || '/dashboard');
+
+  // Validate redirectToUse to prevent open redirect attacks
+  if (redirectToUse && !(typeof redirectToUse === 'string' && redirectToUse.startsWith('/') && !redirectToUse.startsWith('//'))) {
+    redirectToUse = mbkautheVar.loginRedirectURL || '/dashboard';
+  }
+
   res.render("2fa.handlebars", {
     layout: false,
-    customURL: mbkautheVar.loginRedirectURL || '/dashboard',
+    customURL: redirectToUse,
     csrfToken: req.csrfToken(),
     appName: mbkautheVar.APP_NAME.toLowerCase(),
     DEVICE_TRUST_DURATION_DAYS: mbkautheVar.DEVICE_TRUST_DURATION_DAYS
@@ -574,7 +589,14 @@ router.post("/mbkauthe/api/verify-2fa", TwoFALimit, csrfProtection, async (req,
 
     // 2FA successful, complete login with optional device trust
     const userForSession = { id, username, role, allowedApps };
-    const redirectUrl = mbkautheVar.loginRedirectURL || '/dashboard';
+    // Prefer redirect stored in preAuthUser or in query/body, fallback to configured default
+    let redirectFromSession = req.session.preAuthUser && req.session.preAuthUser.redirectUrl ? req.session.preAuthUser.redirectUrl : null;
+    if (redirectFromSession && (!(typeof redirectFromSession === 'string') || !redirectFromSession.startsWith('/') || redirectFromSession.startsWith('//'))) {
+      redirectFromSession = null;
+    }
+    const redirectUrl = redirectFromSession || mbkautheVar.loginRedirectURL || '/dashboard';
+    // Clear preAuthUser after successful login
+    if (req.session.preAuthUser) delete req.session.preAuthUser;
     await completeLoginProcess(req, res, userForSession, redirectUrl, shouldTrustDevice);
 
   } catch (err) {
@@ -724,7 +746,7 @@ passport.use('github-login', new GitHubStrategy({
       // Check if user is authorized for this app (same logic as regular login)
       if (user.Role !== "SuperAdmin") {
         const allowedApps = user.AllowedApps;
-        if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+        if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
           const error = new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`);
           error.code = 'NOT_AUTHORIZED';
           return done(error);
@@ -889,13 +911,17 @@ router.get('/mbkauthe/api/github/login/callback',
       // Check 2FA if enabled
       if ((mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLowerCase() === "true" && user.TwoFAStatus) {
         // 2FA is enabled, store pre-auth user and redirect to 2FA
+        // If this was an oauth flow, use oauthRedirect set earlier
+        const oauthRedirect = req.session.oauthRedirect;
+        if (oauthRedirect) delete req.session.oauthRedirect;
         req.session.preAuthUser = {
           id: user.id,
           username: user.UserName,
           UserName: user.UserName,
           role: user.Role,
           Role: user.Role,
-          loginMethod: 'github'
+          loginMethod: 'github',
+          redirectUrl: oauthRedirect || null
         };
         console.log(`[mbkauthe] GitHub login: 2FA required for user: ${githubUser.username}`);
         return res.redirect('/mbkauthe/2fa');

package/lib/validateSessionAndRole.js

@@ -17,6 +17,20 @@ async function validateSession(req, res, next) {
   try {
     const { id, sessionId, role, allowedApps } = req.session.user;
 
+    // Defensive checks for sessionId and allowedApps
+    if (!sessionId) {
+      console.warn(`[mbkauthe] Missing sessionId for user "${req.session.user.username}"`);
+      req.session.destroy();
+      clearSessionCookies(res);
+      return renderError(res, {
+        code: 401,
+        error: "Session Expired",
+        message: "Your Session Has Expired. Please Log In Again.",
+        pagename: "Login",
+        page: `/mbkauthe/login?redirect=${encodeURIComponent(req.originalUrl)}`,
+      });
+    }
+
     // Normalize sessionId to lowercase for consistent comparison
     const normalizedSessionId = sessionId.toLowerCase();
 
@@ -24,7 +38,11 @@ async function validateSession(req, res, next) {
     const query = `SELECT "SessionId", "Active", "Role" FROM "Users" WHERE "id" = $1`;
     const result = await dblogin.query({ name: 'validate-user-session', text: query, values: [id] });
 
-    if (result.rows.length === 0 || result.rows[0].SessionId.toLowerCase() !== normalizedSessionId) {
+    const dbSessionId = result.rows.length > 0 && result.rows[0].SessionId ? String(result.rows[0].SessionId).toLowerCase() : null;
+    if (!dbSessionId || dbSessionId !== normalizedSessionId) {
+      if (result.rows.length > 0 && !result.rows[0].SessionId) {
+        console.warn(`[mbkauthe] DB sessionId is null for user "${req.session.user.username}"`);
+      }
       console.log(`[mbkauthe] Session invalidated for user "${req.session.user.username}"`);
       req.session.destroy();
       clearSessionCookies(res);
@@ -51,7 +69,9 @@ async function validateSession(req, res, next) {
     }
 
     if (role !== "SuperAdmin") {
-      if (!allowedApps || !allowedApps.some(app => app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+      // If allowedApps is not provided or not an array, treat as no access
+      const hasAllowedApps = Array.isArray(allowedApps) && allowedApps.length > 0;
+      if (!hasAllowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
         console.warn(`[mbkauthe] User \"${req.session.user.username}\" is not authorized to use the application \"${mbkautheVar.APP_NAME}\"`);
         req.session.destroy();
         clearSessionCookies(res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "MBKTech's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",

package/views/2fa.handlebars

@@ -87,7 +87,7 @@
                 const data = await response.json();
                 if (data.success) {
                     loginButtonText.textContent = 'Success! Redirecting...';
-                    window.location.href = data.redirectUrl || '{{{ customURL }}}';
+                    window.location.href = data.redirectUrl || '{{ customURL }}';
                 } else {
                     loginButton.disabled = false;
                     loginButtonText.textContent = 'Verify';

package/views/loginmbkauthe.handlebars

@@ -130,6 +130,8 @@
             loginButton.disabled = true;
             loginButtonText.textContent = 'Authenticating...';
 
+            // Pass redirect query param through to server so it can be used by 2FA flow
+            const pageRedirect = new URLSearchParams(window.location.search).get('redirect');
             fetch('/mbkauthe/api/login', {
                 method: 'POST',
                 headers: {
@@ -138,14 +140,17 @@
                 body: JSON.stringify({
                     username,
                     password
+                    , redirect: pageRedirect || null
                 })
             })
                 .then(response => response.json())
                 .then(data => {
                     if (data.success) {
                         if (data.twoFactorRequired) {
-                            // Redirect to 2FA page
-                            window.location.href = '/mbkauthe/2fa';
+                            // Redirect to 2FA page (= pass along redirect target)
+                            const redirectTarget = data.redirectUrl || pageRedirect;
+                            const redirectQuery = redirectTarget ? `?redirect=${encodeURIComponent(redirectTarget)}` : '';
+                            window.location.href = `/mbkauthe/2fa${redirectQuery}`;
                         } else {
                             loginButtonText.textContent = 'Success! Redirecting...';
                             sessionStorage.setItem('sessionId', data.sessionId);

package/views/sharedStyles.handlebars

@@ -279,19 +279,18 @@
             width: 100%;
             padding: 12px 20px;
             border-radius: var(--border-radius);
-            background: #24292e;
+            background: #262b30;
             color: white;
-            font-weight: 500;
-            font-size: 0.95rem;
+            border: solid 0.13rem #262b30;
+            font-weight: 700;
+            font-size: 1rem;
             text-decoration: none;
             transition: var(--transition);
-            box-shadow: var(--box-shadow);
         }
 
         .btn-github:hover {
-            background: #3b4045;
-            box-shadow: 0 6px 15px rgba(0, 0, 0, 0.2);
-            transform: translateY(-2px);
+            background: transparent;
+            box-shadow: var(--box-shadow);
         }
 
         .btn-github i {