mbkauthe 3.1.0 → 3.2.1

package/index.d.ts

@@ -34,10 +34,11 @@ declare global {
         UserName?: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
         Role?: 'SuperAdmin' | 'NormalUser' | 'Guest';
-        loginMethod?: 'password' | 'github';
+        loginMethod?: 'password' | 'github' | 'google';
         redirectUrl?: string | null;
       };
       oauthRedirect?: string;
+      oauthCsrfToken?: string;
     }
   }
 }
@@ -57,10 +58,22 @@ declare module 'mbkauthe' {
     GITHUB_LOGIN_ENABLED?: 'true' | 'false' | 'f';
     GITHUB_CLIENT_ID?: string;
     GITHUB_CLIENT_SECRET?: string;
+    GOOGLE_LOGIN_ENABLED?: 'true' | 'false' | 'f';
+    GOOGLE_CLIENT_ID?: string;
+    GOOGLE_CLIENT_SECRET?: string;
     loginRedirectURL?: string;
     EncPass?: 'true' | 'false' | 'f';
   }
 
+  export interface OAuthConfig {
+    GITHUB_LOGIN_ENABLED?: 'true' | 'false' | 'f';
+    GITHUB_CLIENT_ID?: string;
+    GITHUB_CLIENT_SECRET?: string;
+    GOOGLE_LOGIN_ENABLED?: 'true' | 'false' | 'f';
+    GOOGLE_CLIENT_ID?: string;
+    GOOGLE_CLIENT_SECRET?: string;
+  }
+
   // User Types
   export type UserRole = 'SuperAdmin' | 'NormalUser' | 'Guest';
 
@@ -80,7 +93,7 @@ declare module 'mbkauthe' {
     UserName?: string;
     role: UserRole;
     Role?: UserRole;
-    loginMethod?: 'password' | 'github';
+    loginMethod?: 'password' | 'github' | 'google';
     redirectUrl?: string | null;
   }
 
@@ -127,6 +140,16 @@ declare module 'mbkauthe' {
     updated_at: Date;
   }
 
+  export interface GoogleUser {
+    id: number;
+    user_name: string;
+    google_id: string;
+    google_email: string;
+    access_token: string;
+    created_at: Date;
+    updated_at: Date;
+  }
+
   // API Response Types
   export interface LoginResponse {
     success: boolean;

package/lib/config/index.js

@@ -28,6 +28,38 @@ function validateConfiguration() {
         throw new Error(`[mbkauthe] Configuration Error:\n  - ${errors.join('\n  - ')}`);
     }
 
+    // Parse and validate oAuthVar (optional fallback for OAuth settings)
+    let oAuthVar = null;
+    try {
+        if (process.env.oAuthVar) {
+            oAuthVar = JSON.parse(process.env.oAuthVar);
+            if (oAuthVar && typeof oAuthVar !== 'object') {
+                console.warn('[mbkauthe] oAuthVar is not a valid object, ignoring it');
+                oAuthVar = null;
+            } else {
+                console.log('[mbkauthe] oAuthVar detected and parsed successfully');
+            }
+        }
+    } catch (error) {
+        console.warn('[mbkauthe] Invalid JSON in process.env.oAuthVar, ignoring it');
+        oAuthVar = null;
+    }
+
+    // Merge OAuth settings: use oAuthVar as fallback if values not in mbkautheVar
+    const oAuthKeys = [
+        'GITHUB_LOGIN_ENABLED', 'GITHUB_CLIENT_ID', 'GITHUB_CLIENT_SECRET',
+        'GOOGLE_LOGIN_ENABLED', 'GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET'
+    ];
+    
+    if (oAuthVar) {
+        oAuthKeys.forEach(key => {
+            if ((!mbkautheVar[key] || (typeof mbkautheVar[key] === 'string' && mbkautheVar[key].trim() === '')) && oAuthVar[key]) {
+                mbkautheVar[key] = oAuthVar[key];
+                console.log(`[mbkauthe] Using ${key} from oAuthVar`);
+            }
+        });
+    }
+
     // Validate required keys
     // COOKIE_EXPIRE_TIME is not required but if provided must be valid, COOKIE_EXPIRE_TIME by default is 2 days
     // loginRedirectURL is not required but if provided must be valid, loginRedirectURL by default is /dashboard
@@ -55,6 +87,11 @@ function validateConfiguration() {
         errors.push("mbkautheVar.GITHUB_LOGIN_ENABLED must be either 'true' or 'false' or 'f'");
     }
 
+    // Validate GOOGLE_LOGIN_ENABLED value
+    if (mbkautheVar.GOOGLE_LOGIN_ENABLED && !['true', 'false', 'f'].includes(mbkautheVar.GOOGLE_LOGIN_ENABLED.toLowerCase())) {
+        errors.push("mbkautheVar.GOOGLE_LOGIN_ENABLED must be either 'true' or 'false' or 'f'");
+    }
+
     // Validate EncPass value if provided
     if (mbkautheVar.EncPass && !['true', 'false', 'f'].includes(mbkautheVar.EncPass.toLowerCase())) {
         errors.push("mbkautheVar.EncPass must be either 'true' or 'false' or 'f'");
@@ -70,6 +107,16 @@ function validateConfiguration() {
         }
     }
 
+    // Validate Google login configuration
+    if (mbkautheVar.GOOGLE_LOGIN_ENABLED === "true") {
+        if (!mbkautheVar.GOOGLE_CLIENT_ID || mbkautheVar.GOOGLE_CLIENT_ID.trim() === '') {
+            errors.push("mbkautheVar.GOOGLE_CLIENT_ID is required when GOOGLE_LOGIN_ENABLED is 'true'");
+        }
+        if (!mbkautheVar.GOOGLE_CLIENT_SECRET || mbkautheVar.GOOGLE_CLIENT_SECRET.trim() === '') {
+            errors.push("mbkautheVar.GOOGLE_CLIENT_SECRET is required when GOOGLE_LOGIN_ENABLED is 'true'");
+        }
+    }
+
     // Validate COOKIE_EXPIRE_TIME if provided
     if (mbkautheVar.COOKIE_EXPIRE_TIME !== undefined) {
         const expireTime = parseFloat(mbkautheVar.COOKIE_EXPIRE_TIME);
@@ -133,4 +180,4 @@ try {
     }
 }
 
-export { packageJson, appVersion };
+export { packageJson, appVersion };

package/lib/main.js

@@ -19,6 +19,18 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const router = express.Router();
 
+// Configure Express to trust proxy headers for rate limiting in dev mode only
+// This prevents conflicts with parent project proxy settings in production
+if (process.env.test === "dev") {
+  router.use((req, res, next) => {
+    // Set trust proxy to true for the app instance if not already set
+    if (!req.app.get('trust proxy')) {
+      req.app.set('trust proxy', true);
+    }
+    next();
+  });
+}
+
 // Basic middleware
 router.use(express.json());
 router.use(express.urlencoded({ extended: true }));

package/lib/middleware/index.js

@@ -18,9 +18,11 @@ export const sessionConfig = {
   proxy: true,
   cookie: {
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
-    domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
+    // Don't set domain in development/localhost to avoid cookie issues
+    domain: (mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev') ? `.${mbkautheVar.DOMAIN}` : undefined,
     httpOnly: true,
-    secure: mbkautheVar.IS_DEPLOYED === 'true',
+    // Only use secure cookies in production with HTTPS
+    secure: mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev',
     sameSite: 'lax',
     path: '/'
   },

package/lib/routes/auth.js

@@ -22,19 +22,31 @@ const LoginLimit = rateLimit({
   message: { success: false, message: "Too many attempts, please try again later" },
   skip: (req) => {
     return !!req.session.user;
+  },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
   }
 });
 
 const LogoutLimit = rateLimit({
   windowMs: 1 * 60 * 1000,
   max: 10,
-  message: { success: false, message: "Too many logout attempts, please try again later" }
+  message: { success: false, message: "Too many logout attempts, please try again later" },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
+  }
 });
 
 const TwoFALimit = rateLimit({
   windowMs: 1 * 60 * 1000,
   max: 5,
-  message: { success: false, message: "Too many 2FA attempts, please try again later" }
+  message: { success: false, message: "Too many 2FA attempts, please try again later" },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
+  }
 });
 
 // CSRF protection middleware
@@ -117,8 +129,17 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
     const sessionId = crypto.randomBytes(32).toString("hex");
     console.log(`[mbkauthe] Generated session ID for username: ${username}`);
 
-    // Regenerate session to prevent session fixation attacks
+    // Fix session fixation: Delete old session BEFORE regenerating to prevent timing window
     const oldSessionId = req.sessionID;
+    
+    // Delete old session first to prevent session fixation attacks
+    await dblogin.query({
+      name: 'login-delete-old-session-before-regen',
+      text: 'DELETE FROM "session" WHERE sid = $1',
+      values: [oldSessionId]
+    });
+
+    // Now regenerate with new session ID (timing window closed)
     await new Promise((resolve, reject) => {
       req.session.regenerate((err) => {
         if (err) reject(err);
@@ -509,6 +530,7 @@ router.get("/login", LoginLimit, csrfProtection, (req, res) => {
   return res.render("loginmbkauthe.handlebars", {
     layout: false,
     githubLoginEnabled: mbkautheVar.GITHUB_LOGIN_ENABLED,
+    googleLoginEnabled: mbkautheVar.GOOGLE_LOGIN_ENABLED,
     customURL: mbkautheVar.loginRedirectURL || '/dashboard',
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username || '',

package/lib/routes/misc.js

@@ -22,6 +22,21 @@ const LoginLimit = rateLimit({
   message: { success: false, message: "Too many attempts, please try again later" },
   skip: (req) => {
     return !!req.session.user;
+  },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
+  }
+});
+
+// Rate limiter for admin operations
+const AdminOperationLimit = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 3,
+  message: { success: false, message: "Too many admin operations, please try again later" },
+  validate: {
+    trustProxy: false,
+    xForwardedForHeader: false
   }
 });
 
@@ -232,12 +247,18 @@ router.get(["/info", "/i"], LoginLimit, async (req, res) => {
 });
 
 // Terminate all sessions (admin endpoint)
-router.post("/api/terminateAllSessions", authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
+router.post("/api/terminateAllSessions", AdminOperationLimit, authenticate(mbkautheVar.Main_SECRET_TOKEN), async (req, res) => {
   try {
     // Run both operations in parallel for better performance
     await Promise.all([
-      dblogin.query({ name: 'terminate-all-user-sessions', text: `UPDATE "Users" SET "SessionId" = NULL` }),
-      dblogin.query({ name: 'terminate-all-db-sessions', text: 'DELETE FROM "session"' })
+      dblogin.query({ 
+        name: 'terminate-all-user-sessions', 
+        text: 'UPDATE "Users" SET "SessionId" = NULL WHERE "SessionId" IS NOT NULL'
+      }),
+      dblogin.query({ 
+        name: 'terminate-all-db-sessions', 
+        text: 'DELETE FROM "session" WHERE expire > NOW()'
+      })
     ]);
 
     req.session.destroy((err) => {