mbkauthe 4.8.3 → 4.9.0

package/lib/routes/misc.js

@@ -3,10 +3,11 @@ import fetch from 'node-fetch';
 import rateLimit from 'express-rate-limit';
 import { mbkautheVar, packageJson, appVersion } from "#config.js";
 import { renderError, renderPage } from "#response.js";
-import { authenticate, validateSession, validateSessionAndRole } from "../middleware/auth.js";
+import { authenticate, sessVal, sessRole } from "../middleware/auth.js";
 import { ErrorCodes, ErrorMessages, createErrorResponse } from "../utils/errors.js";
 import { dblogin } from "#pool.js";
 import { clearSessionCookies, decryptSessionId, cachedCookieOptions } from "#cookies.js";
+import { AuthRepository } from "../db/AuthRepository.js";
 import { fileURLToPath } from "url";
 import path from "path";
 import fs from "fs";
@@ -18,6 +19,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 
 const router = express.Router();
+const authRepo = new AuthRepository({ db: dblogin });
 // Rate limiter for info/test routes
 const LoginLimit = rateLimit({
   windowMs: 1 * 60 * 1000,
@@ -60,7 +62,7 @@ router.get("/bg.webp", (req, res) => {
   res.setHeader('Cache-Control', 'public, max-age=31536000');
   const stream = fs.createReadStream(imgPath);
   stream.on('error', (err) => {
-    console.error('[mbkauthe] Error streaming bg.webp:', err);
+    console.error(`[mbkauthe] Error streaming bg.webp:`, err);
     res.status(404).send('Image not found');
   });
   stream.pipe(res);
@@ -78,7 +80,7 @@ router.get('/user/profilepic', async (req, res) => {
     }
     const stream = fs.createReadStream(iconPath);
     stream.on('error', (err) => {
-      console.error('[mbkauthe] Error streaming icon.svg:', err);
+      console.error(`[mbkauthe] Error streaming icon.svg:`, err);
       res.status(404).send('Icon not found');
     });
     stream.pipe(res);
@@ -100,14 +102,10 @@ router.get('/user/profilepic', async (req, res) => {
 
     // If not in cache, fetch from DB
     if (!imageUrl) {
-      const result = await dblogin.query({
-        name: 'get-user-profile-pic',
-        text: 'SELECT "Image" FROM "Users" WHERE "UserName" = $1 LIMIT 1',
-        values: [username]
-      });
+      const profile = await authRepo.getUserImageByUsername(username, 'get-user-profile-pic');
 
-      if (result.rows.length > 0 && result.rows[0].Image && result.rows[0].Image.trim() !== '') {
-        imageUrl = result.rows[0].Image;
+      if (profile && profile.Image && profile.Image.trim() !== '') {
+        imageUrl = profile.Image;
       } else {
         imageUrl = 'default';
       }
@@ -152,21 +150,21 @@ router.get('/user/profilepic', async (req, res) => {
 
       imageResponse.body.pipe(res);
     } catch (fetchErr) {
-      console.error('[mbkauthe] Error fetching external profile picture:', fetchErr);
+      console.error(`[mbkauthe] Error fetching external profile picture:`, fetchErr);
       res.cookie('profileImageUrl', 'default', { ...cachedCookieOptions, httpOnly: false });
       res.cookie('profileImageUser', username, { ...cachedCookieOptions, httpOnly: false });
       return serveDefaultIcon();
     }
 
   } catch (err) {
-    console.error('[mbkauthe] Error fetching profile picture:', err);
+    console.error(`[mbkauthe] Error fetching profile picture:`, err);
     return serveDefaultIcon();
   }
 });
 
 if (process.env.env === 'dev') {
   // Dev-only diagnostic endpoint to verify SuperAdmin role enforcement
-  router.get(['/validate-superadmin'], validateSessionAndRole("SuperAdmin"), LoginLimit, async (req, res) => {
+  router.get(['/validate-superadmin'], sessRole("SuperAdmin"), LoginLimit, async (req, res) => {
     try {
       const user = req.session?.user || null;
       return res.json({
@@ -180,14 +178,14 @@ if (process.env.env === 'dev') {
         } : null
       });
     } catch (err) {
-      console.error('[mbkauthe] debug validate-superadmin error:', err);
+      console.error(`[mbkauthe] debug validate-superadmin error:`, err);
       return res.status(500).json(createErrorResponse(500, ErrorCodes.INTERNAL_SERVER_ERROR));
     }
   });
 }
 
 // Test route
-router.get(['/test', '/'], validateSession, LoginLimit, async (req, res) => {
+router.get(['/test', '/'], sessVal, LoginLimit, async (req, res) => {
   const { username, fullname, role, id, sessionId, allowedApps } = req.session.user;
 
   const sessionExpiry = req.session.cookie?.expires
@@ -208,7 +206,7 @@ router.get(['/test', '/'], validateSession, LoginLimit, async (req, res) => {
   });
 });
 
-router.post('/test', validateSession, LoginLimit, async (req, res) => {
+router.post('/test', sessVal, LoginLimit, async (req, res) => {
   if (req.session?.user) {
     return res.json({ success: true, message: "You are logged in" });
   }
@@ -229,31 +227,13 @@ router.get('/api/checkSession', LoginLimit, async (req, res) => {
     }
 
     // Single round-trip: fetch app-session expiry and (if needed) connect-pg-simple expiry.
-    const result = await dblogin.query({
-      name: 'check-session-validity',
-      text: `
-        SELECT
-          s.expires_at,
-          u."Active",
-          CASE
-            WHEN s.expires_at IS NULL THEN (SELECT expire FROM "session" WHERE sid = $2)
-            ELSE NULL
-          END AS connect_expire
-        FROM "Sessions" s
-        JOIN "Users" u ON s."UserName" = u."UserName"
-        WHERE s.id = $1
-        LIMIT 1
-      `,
-      values: [sessionId, req.sessionID]
-    });
+    const row = await authRepo.getSessionValidity(sessionId, req.sessionID, 'check-session-validity');
 
-    if (result.rows.length === 0) {
+    if (!row) {
       req.session.destroy(() => { });
       clearSessionCookies(res);
       return res.status(200).json({ sessionValid: false, expiry: null });
     }
-
-    const row = result.rows[0];
     if ((row.expires_at && new Date(row.expires_at) <= new Date()) || !row.Active) {
       req.session.destroy(() => { });
       clearSessionCookies(res);
@@ -266,7 +246,7 @@ router.get('/api/checkSession', LoginLimit, async (req, res) => {
 
     return res.status(200).json({ sessionValid: true, expiry });
   } catch (err) {
-    console.error('[mbkauthe] checkSession error:', err);
+    console.error(`[mbkauthe] checkSession error:`, err);
     return res.status(200).json({ sessionValid: false, expiry: null });
   }
 });
@@ -298,17 +278,8 @@ function normalizeSessionIdFromBody(body = {}) {
 }
 
 async function getSessionValidationRow(sessionId, queryName = 'check-session-validity-by-id') {
-  const result = await dblogin.query({
-    name: queryName,
-    text: `SELECT s.expires_at, u."Active", u."UserName", u."Role" FROM "Sessions" s JOIN "Users" u ON s."UserName" = u."UserName" WHERE s.id = $1 LIMIT 1`,
-    values: [sessionId]
-  });
-
-  if (result.rows.length === 0) {
-    return null;
-  }
-
-  return result.rows[0];
+  const row = await authRepo.getSessionValidationRow(sessionId, queryName);
+  return row || null;
 }
 
 function isSessionRowValid(row) {
@@ -342,7 +313,7 @@ router.post('/api/checkSession', LoginLimit, async (req, res) => {
     const expiry = row.expires_at ? new Date(row.expires_at).toISOString() : null;
     return res.status(200).json({ sessionValid: true, expiry });
   } catch (err) {
-    console.error('[mbkauthe] checkSession (body) error:', err);
+    console.error(`[mbkauthe] checkSession (body) error:`, err);
     return res.status(200).json({ sessionValid: false, expiry: null });
   }
 });
@@ -374,7 +345,7 @@ router.post('/api/verifySession', LoginLimit, async (req, res) => {
     const expiry = row.expires_at ? new Date(row.expires_at).toISOString() : null;
     return res.status(200).json({ valid: true, expiry, username: row.UserName, role: row.Role });
   } catch (err) {
-    console.error('[mbkauthe] verifySession error:', err);
+    console.error(`[mbkauthe] verifySession error:`, err);
     return res.status(200).json({ valid: false, expiry: null });
   }
 });
@@ -465,7 +436,7 @@ router.get("/ErrorCode", (req, res) => {
       errorCategories: categoriesWithErrors
     });
   } catch (err) {
-    console.error("[mbkauthe] Error rendering error codes page:", err);
+    console.error(`[mbkauthe] Error rendering error codes page:`, err);
     return renderError(res, req, {
       layout: false,
       code: 500,
@@ -488,7 +459,7 @@ export async function getLatestVersion() {
     const latestPackageJson = await response.json();
     return typeof latestPackageJson.version === 'string' ? latestPackageJson.version : null;
   } catch (error) {
-    console.error('[mbkauthe] Error fetching latest version from GitHub');
+    console.error(`[mbkauthe] Error fetching latest version from GitHub`, error);
     return null;
   }
 }
@@ -503,7 +474,7 @@ export async function checkVersion() {
         } else if (hasValidLatest) {
             console.info(`[mbkauthe] Running latest version (${packageJson.version}).`);
         } else {
-            console.info('[mbkauthe] Skipped version check warning: latest version unavailable.');
+            console.info(`[mbkauthe] Skipped version check warning: latest version unavailable.`);
         }
     } catch (error) {
         console.warn(`[mbkauthe] Failed to check for updates: ${error.message}`);
@@ -520,7 +491,7 @@ router.get(["/info", "/i"], LoginLimit, async (req, res) => {
   try {
     latestVersion = await getLatestVersion();
   } catch (err) {
-    console.error("[mbkauthe] Error fetching package-lock.json:", err);
+    console.error(`[mbkauthe] Error fetching package-lock.json:`, err);
   }
 
   try {
@@ -531,7 +502,7 @@ router.get(["/info", "/i"], LoginLimit, async (req, res) => {
       latestVersion
     });
   } catch (err) {
-    console.error("[mbkauthe] Error fetching version information:", err);
+    console.error(`[mbkauthe] Error fetching version information:`, err);
     res.status(500).send(`
             <html>
                 <head>
@@ -551,13 +522,13 @@ router.get(["/info.json", "/i.json"], LoginLimit, async (req, res) => {
   try {
     latestVersion = await getLatestVersion();
   } catch (err) {
-    console.error("[mbkauthe] Error fetching package-lock.json:", err);
+    console.error(`[mbkauthe] Error fetching package-lock.json:`, err);
   }
 
   try {
     res.json({ mbkautheVar: safe_mbkautheVar, CurrentVersion: packageJson.version, APP_VERSION: appVersion, latestVersion });
   } catch (err) {
-    console.error("[mbkauthe] Error fetching version information:", err);
+    console.error(`[mbkauthe] Error fetching version information:`, err);
     res.status(500).json({ success: false, message: "Failed to fetch version information" });
   }
 });
@@ -567,32 +538,26 @@ router.post("/api/terminateAllSessions", AdminOperationLimit, authenticate(mbkau
   try {
     // Run both operations in parallel for better performance
     await Promise.all([
-      dblogin.query({
-        name: 'terminate-all-app-sessions',
-        text: 'DELETE FROM "Sessions"'
-      }),
-      dblogin.query({
-        name: 'terminate-all-db-sessions',
-        text: 'DELETE FROM "session" WHERE expire > NOW()'
-      })
+      authRepo.deleteAllAppSessions('terminate-all-app-sessions'),
+      authRepo.deleteActiveSessionStoreRows('terminate-all-db-sessions')
     ]);
 
     req.session.destroy((err) => {
       if (err) {
-        console.log("[mbkauthe] Error destroying session:", err);
+        console.log(`[mbkauthe] Error destroying session:`, err);
         return res.status(500).json({ success: false, message: "Failed to terminate sessions" });
       }
 
       clearSessionCookies(res);
 
-      console.log("[mbkauthe] All sessions terminated successfully");
+      console.log(`[mbkauthe] All sessions terminated successfully`);
       res.status(200).json({
         success: true,
         message: "All sessions terminated successfully",
       });
     });
   } catch (err) {
-    console.error("[mbkauthe] Database query error during session termination:", err);
+    console.error(`[mbkauthe] Database query error during session termination:`, err);
     res.status(500).json({ success: false, message: "Internal Server Error" });
   }
 });

package/lib/routes/oauth.js

@@ -8,8 +8,10 @@ import { dblogin } from "#pool.js";
 import { mbkautheVar } from "#config.js";
 import { renderError } from "../utils/response.js";
 import { checkTrustedDevice, completeLoginProcess } from "./auth.js";
+import { AuthRepository } from "../db/AuthRepository.js";
 
 const router = express.Router();
+const authRepo = new AuthRepository({ db: dblogin });
 
 // CSRF protection middleware
 const csrfProtection = csurf({ cookie: true });
@@ -42,25 +44,16 @@ const createOAuthStrategy = async (provider, profile, done) => {
         console.log(`[mbkauthe] ${provider} OAuth callback for user: ${profile.emails?.[0]?.value || profile.id}`);
 
         const isGitHub = provider === 'GitHub';
-        const tableName = isGitHub ? 'user_github' : 'user_google';
-        const idField = isGitHub ? 'github_id' : 'google_id';
-        const queryName = isGitHub ? 'github-login-get-user' : 'google-login-get-user';
 
         // Check if this OAuth account is linked to any user
-        const oauthUser = await dblogin.query({
-            name: queryName,
-            text: `SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id" FROM ${tableName} ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.${idField} = $1`,
-            values: [profile.id]
-        });
+        const user = await authRepo.getOAuthUserByProviderId(provider, profile.id);
 
-        if (oauthUser.rows.length === 0) {
+        if (!user) {
             const error = new Error(`${provider} account not linked to any user`);
             error.code = `${provider.toUpperCase()}_NOT_LINKED`;
             return done(error);
         }
 
-        const user = oauthUser.rows[0];
-
         // Check if the user account is active
         if (!user.Active) {
             const error = new Error('Account is inactive');
@@ -300,21 +293,9 @@ const validateOAuthCallback = (req, res) => {
 };
 
 const finishProviderLogin = async (req, res, provider, username, detailValue = '') => {
-    const userQuery = `
-    SELECT u.id, u."UserName", u."Active", u."Role", u."AllowedApps",
-           tfa."TwoFAStatus"
-    FROM "Users" u
-    LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
-    WHERE u."UserName" = $1
-  `;
-
-    const userResult = await dblogin.query({
-        name: `${provider.toLowerCase()}-callback-get-user`,
-        text: userQuery,
-        values: [username]
-    });
-
-    if (userResult.rows.length === 0) {
+    const user = await authRepo.getUserWithTwoFA(username, `${provider.toLowerCase()}-callback-get-user`);
+
+    if (!user) {
         console.error(`[mbkauthe] ${provider} login: User not found: ${username}`);
         return renderError(res, req, {
             code: 404,
@@ -326,8 +307,6 @@ const finishProviderLogin = async (req, res, provider, username, detailValue = '
         });
     }
 
-    const user = userResult.rows[0];
-
     // Check for trusted device
     const trustedDeviceUser = await checkTrustedDevice(req, user.UserName);
     if (trustedDeviceUser && (mbkautheVar.MBKAUTH_TWO_FA_ENABLE || "").toLowerCase() === "true" && user.TwoFAStatus) {

package/lib/utils/timingSafeToken.js

@@ -0,0 +1,35 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
+export function extractAuthorizationToken(authorizationHeader) {
+  if (typeof authorizationHeader !== "string") return "";
+
+  const raw = authorizationHeader.trim();
+  if (!raw) return "";
+
+  const bearerMatch = /^bearer\s+(.+)$/i.exec(raw);
+  if (bearerMatch) return bearerMatch[1].trim();
+
+  return raw;
+}
+
+function sha256Buffer(value) {
+  return createHash("sha256").update(value, "utf8").digest();
+}
+
+/**
+ * Constant-time comparison of two strings by hashing them first.
+ *
+ * Notes:
+ * - Always computes both hashes (32 bytes each) and uses timingSafeEqual.
+ * - Returns false when expectedToken is empty/unset.
+ */
+export function timingSafeTokenMatch(providedToken, expectedToken) {
+  const provided = typeof providedToken === "string" ? providedToken : "";
+  const expected = typeof expectedToken === "string" ? expectedToken : "";
+
+  const providedHash = sha256Buffer(provided);
+  const expectedHash = sha256Buffer(expected);
+
+  const matches = timingSafeEqual(providedHash, expectedHash);
+  return matches && expected.length > 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "4.8.3",
+  "version": "4.9.0",
   "description": "MBKTech's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",

package/public/main.css

@@ -286,6 +286,14 @@ header {
     transition: var(--transition);
 }
 
+.icon-button {
+    appearance: none;
+    border: 0;
+    background: transparent;
+    padding: 0;
+    font: inherit;
+}
+
 .input-icon:hover {
     color: var(--accent);
 }
@@ -304,6 +312,14 @@ header {
     box-shadow: var(--box-shadow);
 }
 
+.btn-social,
+.swi {
+    appearance: none;
+    border: 0.13rem solid;
+    font: inherit;
+    cursor: pointer;
+}
+
 .swi {
     display: flex;
     align-items: center;
@@ -315,7 +331,6 @@ header {
     font-size: var(--text-size-sm);
     text-decoration: none;
     transition: var(--transition);
-    border: 0.13rem solid;
     position: relative;
     z-index: 1;
     overflow: hidden;
@@ -423,6 +438,25 @@ header {
     text-decoration: none;
 }
 
+.btn-message-action {
+    appearance: none;
+    border: 0;
+    border-radius: var(--border-radius);
+    background: var(--accent);
+    color: var(--dark);
+    font: inherit;
+    font-weight: 700;
+    cursor: pointer;
+    padding: 0.7rem 1rem;
+    transition: var(--transition);
+}
+
+.btn-message-action:hover,
+.btn-message-action:focus-visible {
+    background: var(--surface-1);
+    color: var(--accent);
+}
+
 .token-container {
     animation: fadeInUp 0.4s ease-out;
 }
@@ -776,7 +810,6 @@ header {
         font-size: 0.9rem;
         text-decoration: none;
         transition: var(--transition);
-        border: 0.13rem solid;
         position: relative;
         z-index: 1;
         overflow: hidden;

package/public/main.js

@@ -25,7 +25,7 @@ async function logout() {
       alert(result.message);
     }
   } catch (error) {
-    console.error("[mbkauthe] Error during logout:", error);
+    console.error(`[mbkauthe] Error during logout:`, error);
     alert(`Logout failed: ${error.message}`);
   }
 }
@@ -67,7 +67,7 @@ async function selectiveCacheClear() {
     window.location.reload();
 
   } catch (error) {
-    console.error('[mbkauthe] selective cache clear failed:', error);
+    console.error(`[mbkauthe] selective cache clear failed:`, error);
     window.location.reload();
   }
 }
@@ -86,7 +86,7 @@ function checkSession() {
         window.location.reload(); // Reload the page to update the session status
       }
     })
-    .catch((error) => console.error("[mbkauthe] Error checking session:", error));
+    .catch((error) => console.error(`[mbkauthe] Error checking session:`, error));
 }
 // Call validateSession every 2 minutes (120000 milliseconds)
 // setInterval(checkSession, validateSessionInterval);

package/views/Error/dError.handlebars

@@ -312,7 +312,7 @@
                 setTimeout(() => { copyBtn.innerHTML = orig; }, 2000);
               }
             } catch (err) {
-              console.error('[mbkauthe] Failed to copy: ', err);
+              console.error(`[mbkauthe] Failed to copy:`, err);
             }
           });
         }

package/views/header.handlebars

@@ -3,7 +3,7 @@
         <a class="logo">
             <img src="/icon.svg" alt="Logo" class="logo-image"/>
             <span class="logo-text">BK <span>Tech</span></span>
-            <span class="logo-comp">{{#if appName}}{{appName}}{{else}}{{#if app}}{{app}}{{else}}mbkauthe{{/if}}{{/if}}
+            <span class="logo-comp">{{#if appName}}{{appName}}{{else}}{{#if app}}{{app}}{{else}}mbkauthe{{/if}}{{/if}}</span>
         </a>
 
         {{> profilemenu}}

package/views/pages/2fa.handlebars

@@ -31,7 +31,9 @@
                         title="Token must be exactly 6 digits" maxlength="6" minlength="6" autocomplete="off" autofocus
                         required />
                     <label class="form-label">2FA Token</label>
-                    <i class="fas fa-info-circle input-icon" onclick="tokeninfo()"></i>
+                    <button type="button" class="icon-button input-icon" onclick="tokeninfo()" aria-label="What is the 2FA token?">
+                        <i class="fas fa-info-circle"></i>
+                    </button>
                 </div>
 
                 <div class="trust-device-container">
@@ -40,8 +42,10 @@
                         <span class="checkbox-custom"></span>
                         <span class="checkbox-text">Trust this device for {{DEVICE_TRUST_DURATION_DAYS}} days</span>
                     </label>
-                    <i class="fas fa-info-circle trust-device-info" onclick="trustDeviceInfo()"
-                        title="Learn more about trusted devices"></i>
+                    <button type="button" class="icon-button trust-device-info" onclick="trustDeviceInfo()"
+                        title="Learn more about trusted devices" aria-label="Learn more about trusted devices">
+                        <i class="fas fa-info-circle"></i>
+                    </button>
                 </div>
 
                 <button type="submit" class="btn-login" id="loginButton">
@@ -50,10 +54,10 @@
 
                 <p class="terms-info">
                     By logging in, you agree to our
-                    <a href="https://mbktech.org/PrivacyPolicy" target="_blank" class="terms-link">Terms &
+                    <a href="https://mbktech.org/PrivacyPolicy" target="_blank" rel="noopener noreferrer" class="terms-link">Terms &
                         Conditions</a>
                     and
-                    <a href="https://mbktech.org/PrivacyPolicy" target="_blank" class="terms-link">Privacy Policy</a>.
+                    <a href="https://mbktech.org/PrivacyPolicy" target="_blank" rel="noopener noreferrer" class="terms-link">Privacy Policy</a>.
                 </p>
             </form>
         </div>

package/views/pages/accountSwitch.handlebars

@@ -362,7 +362,7 @@
                     emptyStateLink.href = `/mbkauthe/login${encoded ? `?redirect=${encoded}` : ''}`;
                 }
             } catch (err) {
-                console.error('[mbkauthe] Failed to set login hrefs with redirect query param:', err);
+                console.error(`[mbkauthe] Failed to set login hrefs with redirect query param:`, err);
             }
         })();
 
@@ -468,7 +468,7 @@
                 });
 
             } catch (err) {
-                console.error('[mbkauthe] Failed to load accounts:', err);
+                console.error(`[mbkauthe] Failed to load accounts:`, err);
                 list.innerHTML = '<div class="empty-state">Failed to load accounts.</div>';
             }
         }
@@ -501,7 +501,7 @@
                     loadAccounts();
                 }
             } catch (err) {
-                console.error('[mbkauthe] Switch failed:', err);
+                console.error(`[mbkauthe] Switch failed:`, err);
                 showMessage('Could not switch account right now. Please try again.', 'Switch Account');
             }
         }
@@ -521,7 +521,7 @@
                     showMessage(data.message || 'Could not sign out all accounts', 'Sign out');
                 }
             } catch (err) {
-                console.error('[mbkauthe] Sign-out-all failed:', err);
+                console.error(`[mbkauthe] Sign-out-all failed:`, err);
                 showMessage('Could not sign out all accounts right now. Please try again.', 'Sign out');
             }
         }