mbkauthe 3.2.1 → 3.3.0

package/docs/api.md

@@ -764,9 +764,7 @@ app.get('/protected', validateSession, (req, res) => {
 req.session.user = {
   id: 1,                    // User ID
   username: "john.doe",     // Username
-  UserName: "john.doe",     // Username (alias)
   role: "NormalUser",       // User role
-  Role: "NormalUser",       // User role (alias)
   sessionId: "abc123...",   // 64-char hex session ID
 }
 ```

package/index.d.ts

@@ -11,9 +11,7 @@ declare global {
     interface Request {
       user?: {
         username: string;
-        UserName: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
-        Role: 'SuperAdmin' | 'NormalUser' | 'Guest';
       };
       userRole?: 'SuperAdmin' | 'NormalUser' | 'Guest';
     }
@@ -22,20 +20,17 @@ declare global {
       user?: {
         id: number;
         username: string;
-        UserName: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
-        Role: 'SuperAdmin' | 'NormalUser' | 'Guest';
         sessionId: string;
         allowedApps?: string[];
       };
       preAuthUser?: {
         id: number;
         username: string;
-        UserName?: string;
         role: 'SuperAdmin' | 'NormalUser' | 'Guest';
-        Role?: 'SuperAdmin' | 'NormalUser' | 'Guest';
         loginMethod?: 'password' | 'github' | 'google';
         redirectUrl?: string | null;
+        allowedApps?: string[];
       };
       oauthRedirect?: string;
       oauthCsrfToken?: string;
@@ -80,9 +75,7 @@ declare module 'mbkauthe' {
   export interface SessionUser {
     id: number;
     username: string;
-    UserName: string;
     role: UserRole;
-    Role: UserRole;
     sessionId: string;
     allowedApps?: string[];
   }
@@ -90,9 +83,8 @@ declare module 'mbkauthe' {
   export interface PreAuthUser {
     id: number;
     username: string;
-    UserName?: string;
     role: UserRole;
-    Role?: UserRole;
+    allowedApps?: string[];
     loginMethod?: 'password' | 'github' | 'google';
     redirectUrl?: string | null;
   }

package/lib/middleware/index.js

@@ -81,9 +81,7 @@ export async function sessionRestorationMiddleware(req, res, next) {
         req.session.user = {
           id: user.id,
           username: user.UserName,
-          UserName: user.UserName,
           role: user.Role,
-          Role: user.Role,
           sessionId: normalizedSessionId,
           allowedApps: user.AllowedApps,
         };

package/lib/routes/auth.js

@@ -103,7 +103,6 @@ export async function checkTrustedDevice(req, username) {
         id: deviceUser.id,
         username: username,
         role: deviceUser.Role,
-        Role: deviceUser.Role,
         allowedApps: deviceUser.AllowedApps,
       };
     }
@@ -166,9 +165,7 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
     req.session.user = {
       id: user.id,
       username: username,
-      UserName: username,
       role: user.role || user.Role,
-      Role: user.role || user.Role,
       sessionId,
       allowedApps: user.allowedApps || user.AllowedApps,
     };
@@ -346,7 +343,6 @@ router.post("/api/login", LoginLimit, async (req, res) => {
         id: user.id,
         username: user.UserName,
         role: user.Role,
-        Role: user.Role,
         allowedApps: user.AllowedApps,
       };
       const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
@@ -360,7 +356,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
         id: user.id,
         username: user.UserName,
         role: user.Role,
-        Role: user.Role,
+        allowedApps: user.AllowedApps,
         redirectUrl: requestedRedirect
       };
       console.log(`[mbkauthe] 2FA required for user: ${trimmedUsername}`);
@@ -372,7 +368,6 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       id: user.id,
       username: user.UserName,
       role: user.Role,
-      Role: user.Role,
       allowedApps: user.AllowedApps,
     };
     const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
@@ -443,7 +438,10 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
   const shouldTrustDevice = trustDevice === true || trustDevice === 'true';
 
   try {
-    const query = `SELECT tfa."TwoFASecret", u."AllowedApps" FROM "TwoFA" tfa JOIN "Users" u ON tfa."UserName" = u."UserName" WHERE tfa."UserName" = $1`;
+    // Use cached allowedApps from preAuthUser to avoid extra database join
+    const cachedAllowedApps = req.session.preAuthUser?.allowedApps;
+    
+    const query = `SELECT tfa."TwoFASecret" FROM "TwoFA" tfa WHERE tfa."UserName" = $1`;
     const twoFAResult = await dblogin.query({ name: 'verify-2fa-secret', text: query, values: [username] });
 
     if (twoFAResult.rows.length === 0 || !twoFAResult.rows[0].TwoFASecret) {
@@ -453,7 +451,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
     }
 
     const sharedSecret = twoFAResult.rows[0].TwoFASecret;
-    const allowedApps = twoFAResult.rows[0].AllowedApps;
+    const allowedApps = cachedAllowedApps;
     const tokenValidates = speakeasy.totp.verify({
       secret: sharedSecret,
       encoding: "base32",

package/lib/routes/oauth.js

@@ -355,9 +355,8 @@ const createOAuthCallback = (provider, strategy) => {
           req.session.preAuthUser = {
             id: user.id,
             username: user.UserName,
-            UserName: user.UserName,
             role: user.Role,
-            Role: user.Role,
+            allowedApps: user.AllowedApps,
             loginMethod: provider.toLowerCase(),
             redirectUrl: oauthRedirect || null
           };
@@ -387,9 +386,7 @@ const handleOAuthRedirect = async (req, res, user, type) => {
   const userForSession = {
     id: user.id,
     username: user.UserName,
-    UserName: user.UserName,
     role: user.Role,
-    Role: user.Role,
     allowedApps: user.AllowedApps,
   };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "MBKTech's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",