mbkauthe 5.0.2 → 5.1.0

package/lib/config/index.js

@@ -5,140 +5,181 @@ import { createLogger } from "../utils/logger.js";
 dotenv.config();
 const logConfig = createLogger("config");
 
-// Comprehensive validation function
-function validateConfiguration() {
-    const errors = [];
+const CONFIG_KEYS = [
+    "APP_NAME", "DEVICE_TRUST_DURATION_DAYS", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY",
+    "IS_DEPLOYED", "LOGIN_DB", "MBKAUTH_TWO_FA_ENABLE", "COOKIE_EXPIRE_TIME", "DOMAIN", "loginRedirectURL",
+    "GITHUB_LOGIN_ENABLED", "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET", "GOOGLE_LOGIN_ENABLED", "GOOGLE_CLIENT_ID",
+    "GOOGLE_CLIENT_SECRET", "MAX_SESSIONS_PER_USER"
+];
+
+const DEFAULT_CONFIG = {
+    DEVICE_TRUST_DURATION_DAYS: 7,
+    IS_DEPLOYED: 'false',
+    MBKAUTH_TWO_FA_ENABLE: 'false',
+    COOKIE_EXPIRE_TIME: 2,
+    loginRedirectURL: '/dashboard',
+    GITHUB_LOGIN_ENABLED: 'false',
+    GOOGLE_LOGIN_ENABLED: 'false',
+    MAX_SESSIONS_PER_USER: 5
+};
+
+const BOOLEAN_KEYS = ['GITHUB_LOGIN_ENABLED', 'GOOGLE_LOGIN_ENABLED', 'MBKAUTH_TWO_FA_ENABLE', 'IS_DEPLOYED'];
+const STRING_KEYS = [
+    "APP_NAME", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY", "LOGIN_DB", "DOMAIN", "loginRedirectURL",
+    "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET",
+    "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"
+];
+const REQUIRED_KEYS = ["APP_NAME", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY", "IS_DEPLOYED", "LOGIN_DB",
+    "MBKAUTH_TWO_FA_ENABLE", "DOMAIN"];
+
+const isPlainObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const isBlank = (value) => value === undefined || value === null || (typeof value === 'string' && value.trim() === '');
+const hasValue = (value) => !isBlank(value);
+
+function parseJsonEnv(name, { required = false } = {}) {
+    const raw = process.env[name];
+    if (isBlank(raw)) {
+        if (required) {
+            throw new Error(`[mbkauthe] Configuration Error:\n  - process.env.${name} is not defined`);
+        }
+        return null;
+    }
 
-    // Parse and validate mbkautheVar
-    let mbkautheVar;
     try {
-        if (!process.env.mbkautheVar) {
-            errors.push("process.env.mbkautheVar is not defined");
-            throw new Error("Configuration validation failed");
+        const parsed = JSON.parse(raw);
+        if (!isPlainObject(parsed)) {
+            throw new Error(`${name} must be a valid object`);
         }
-        mbkautheVar = JSON.parse(process.env.mbkautheVar);
+        return parsed;
     } catch (error) {
-        if (error.message === "Configuration validation failed") {
-            throw new Error(`[mbkauthe] Configuration Error:\n  - ${errors.join('\n  - ')}`);
+        const message = error.message === `${name} must be a valid object`
+            ? error.message
+            : `Invalid JSON in process.env.${name}`;
+        if (required) {
+            throw new Error(`[mbkauthe] Configuration Error:\n  - ${message}`);
         }
-        errors.push("Invalid JSON in process.env.mbkautheVar");
-        throw new Error(`[mbkauthe] Configuration Error:\n  - ${errors.join('\n  - ')}`);
+        console.warn(`[mbkauthe] ${message}, ignoring it`);
+        return null;
     }
+}
 
-    if (!mbkautheVar || typeof mbkautheVar !== 'object') {
-        errors.push("mbkautheVar must be a valid object");
-        throw new Error(`[mbkauthe] Configuration Error:\n  - ${errors.join('\n  - ')}`);
-    }
+function applySharedFallbacks(config, sharedConfig, usedFromShared) {
+    if (!sharedConfig) return;
 
-    // Parse and validate mbkauthShared (optional fallback for shared settings)
-    let mbkauthShared = null;
-    try {
-        if (process.env.mbkauthShared) {
-            mbkauthShared = JSON.parse(process.env.mbkauthShared);
-            if (mbkauthShared && typeof mbkauthShared !== 'object') {
-                console.warn(`[mbkauthe] mbkauthShared is not a valid object, ignoring it`);
-                mbkauthShared = null;
-            }
-        }
-    } catch (error) {
-        console.warn(`[mbkauthe] Invalid JSON in process.env.mbkauthShared, ignoring it`);
-        mbkauthShared = null;
-    }
-
-    // Merge fallback settings: for any key missing or empty in mbkautheVar, check mbkauthShared
-    const usedFromShared = [];
-    const usedDefaults = [];
-    const applyFallback = (source, sourceName) => {
-        if (!source) return;
-        Object.keys(source).forEach(key => {
-            const val = source[key];
-            if ((mbkautheVar[key] === undefined || (typeof mbkautheVar[key] === 'string' && mbkautheVar[key].trim() === '')) &&
-                val !== undefined && !(typeof val === 'string' && val.trim() === '')) {
-                mbkautheVar[key] = val;
-                if (sourceName === 'mbkauthShared') usedFromShared.push(key);
-            }
-        });
-    };
-
-    applyFallback(mbkauthShared, 'mbkauthShared');
-
-    // Ensure specific keys are checked in mbkautheVar first, then mbkauthShared, then apply config defaults
-    const keysToCheck = [
-        "APP_NAME", "DEVICE_TRUST_DURATION_DAYS", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY",
-        "IS_DEPLOYED", "LOGIN_DB", "MBKAUTH_TWO_FA_ENABLE", "COOKIE_EXPIRE_TIME", "DOMAIN", "loginRedirectURL",
-        "GITHUB_LOGIN_ENABLED", "GITHUB_APP_SLUG", "GITHUB_APP_CLIENT_ID", "GITHUB_APP_CLIENT_SECRET", "GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET", "GOOGLE_LOGIN_ENABLED", "GOOGLE_CLIENT_ID",
-        "GOOGLE_CLIENT_SECRET", "MAX_SESSIONS_PER_USER"
-    ];
-
-    const defaults = {
-        DEVICE_TRUST_DURATION_DAYS: 7,
-        IS_DEPLOYED: 'false',
-        MBKAUTH_TWO_FA_ENABLE: 'false',
-        COOKIE_EXPIRE_TIME: 2,
-        loginRedirectURL: '/dashboard',
-        GITHUB_LOGIN_ENABLED: 'false',
-        GOOGLE_LOGIN_ENABLED: 'false',
-        MAX_SESSIONS_PER_USER: 5
-    };
-
-    keysToCheck.forEach(key => {
-        const current = mbkautheVar[key];
-        const isEmpty = current === undefined || (typeof current === 'string' && current.trim() === '');
-        if (isEmpty) {
-            if (mbkauthShared && mbkauthShared[key] !== undefined && !(typeof mbkauthShared[key] === 'string' && mbkauthShared[key].trim() === '')) {
-                mbkautheVar[key] = mbkauthShared[key];
-                if (!usedFromShared.includes(key)) usedFromShared.push(key);
-            } else if (defaults[key] !== undefined) {
-                mbkautheVar[key] = defaults[key];
-                usedDefaults.push(key);
-            }
+    Object.entries(sharedConfig).forEach(([key, value]) => {
+        if (isBlank(config[key]) && hasValue(value)) {
+            config[key] = value;
+            usedFromShared.add(key);
         }
     });
+}
 
-    // Normalize boolean-like values to consistent lowercase 'true'/'false' strings
-    ['GITHUB_LOGIN_ENABLED', 'GOOGLE_LOGIN_ENABLED', 'MBKAUTH_TWO_FA_ENABLE', 'IS_DEPLOYED'].forEach(k => {
-        const val = mbkautheVar[k];
-        if (typeof val === 'boolean') {
-            mbkautheVar[k] = val ? 'true' : 'false';
-        } else if (typeof val === 'string') {
-            const norm = val.trim().toLowerCase();
-            // Accept 'f' as shorthand for false but normalize it to 'false'
-            mbkautheVar[k] = (norm === 'f') ? 'false' : norm;
+function applyDefaults(config, usedDefaults) {
+    CONFIG_KEYS.forEach((key) => {
+        if (isBlank(config[key]) && DEFAULT_CONFIG[key] !== undefined) {
+            config[key] = DEFAULT_CONFIG[key];
+            usedDefaults.add(key);
         }
     });
+}
 
-    // Validate required keys
-    // COOKIE_EXPIRE_TIME is not required but if provided must be valid, COOKIE_EXPIRE_TIME by default is 2 days
-    // loginRedirectURL is not required but if provided must be valid, loginRedirectURL by default is /dashboard
-    const requiredKeys = ["APP_NAME", "Main_SECRET_TOKEN", "SESSION_SECRET_KEY", "IS_DEPLOYED", "LOGIN_DB",
-        "MBKAUTH_TWO_FA_ENABLE", "DOMAIN"];
+function normalizeBooleanFlag(config, key, errors) {
+    const value = config[key];
+    if (typeof value === 'boolean') {
+        config[key] = value ? 'true' : 'false';
+        return;
+    }
 
-    requiredKeys.forEach(key => {
-        if (!mbkautheVar[key] || (typeof mbkautheVar[key] === 'string' && mbkautheVar[key].trim() === '')) {
-            errors.push(`mbkautheVar.${key} is required and cannot be empty`);
-        }
-    });
+    const normalized = String(value ?? '').trim().toLowerCase();
+    if (normalized === 'f') {
+        config[key] = 'false';
+        return;
+    }
+
+    if (normalized === 'true' || normalized === 'false') {
+        config[key] = normalized;
+        return;
+    }
+
+    if (!isBlank(value)) {
+        errors.push(`mbkautheVar.${key} must be either 'true' or 'false' or 'f'`);
+    }
+}
+
+function normalizePositiveNumber(config, key, errors) {
+    const numericValue = Number(config[key]);
+    if (!Number.isFinite(numericValue) || numericValue <= 0) {
+        errors.push(`mbkautheVar.${key} must be a valid positive number`);
+        return;
+    }
+    config[key] = numericValue;
+}
+
+function normalizePositiveInteger(config, key, errors) {
+    const numericValue = Number(config[key]);
+    if (!Number.isInteger(numericValue) || numericValue <= 0) {
+        errors.push(`mbkautheVar.${key} must be a valid positive integer`);
+        return;
+    }
+    config[key] = numericValue;
+}
 
-    // Validate IS_DEPLOYED value
-    if (mbkautheVar.IS_DEPLOYED && !['true', 'false', 'f'].includes((mbkautheVar.IS_DEPLOYED + '').toLowerCase())) {
-        errors.push("mbkautheVar.IS_DEPLOYED must be either 'true' or 'false' or 'f'");
+function normalizeString(config, key) {
+    if (hasValue(config[key])) {
+        config[key] = String(config[key]).trim();
     }
+}
+
+function normalizeAndValidateConfig(config, errors) {
+    STRING_KEYS.forEach((key) => normalizeString(config, key));
 
-    // Validate MBKAUTH_TWO_FA_ENABLE value
-    if (mbkautheVar.MBKAUTH_TWO_FA_ENABLE && !['true', 'false', 'f'].includes(mbkautheVar.MBKAUTH_TWO_FA_ENABLE.toLowerCase())) {
-        errors.push("mbkautheVar.MBKAUTH_TWO_FA_ENABLE must be either 'true' or 'false' or 'f'");
+    if (hasValue(config.APP_NAME)) {
+        config.APP_NAME = config.APP_NAME.toLowerCase();
     }
 
-    // Validate GITHUB_LOGIN_ENABLED value
-    if (mbkautheVar.GITHUB_LOGIN_ENABLED && !['true', 'false', 'f'].includes(mbkautheVar.GITHUB_LOGIN_ENABLED.toLowerCase())) {
-        errors.push("mbkautheVar.GITHUB_LOGIN_ENABLED must be either 'true' or 'false' or 'f'");
+    if (hasValue(config.DOMAIN)) {
+        const domain = config.DOMAIN.toLowerCase().replace(/^\.+/, '');
+        config.DOMAIN = domain;
+        if (domain.includes('://') || domain.includes('/') || domain.includes(':')) {
+            errors.push("mbkautheVar.DOMAIN must be a hostname only, without protocol, path, or port");
+        }
     }
 
-    // Validate GOOGLE_LOGIN_ENABLED value
-    if (mbkautheVar.GOOGLE_LOGIN_ENABLED && !['true', 'false', 'f'].includes(mbkautheVar.GOOGLE_LOGIN_ENABLED.toLowerCase())) {
-        errors.push("mbkautheVar.GOOGLE_LOGIN_ENABLED must be either 'true' or 'false' or 'f'");
+    if (hasValue(config.loginRedirectURL)) {
+        const redirectUrl = String(config.loginRedirectURL).trim();
+        config.loginRedirectURL = redirectUrl;
+        if (!redirectUrl.startsWith('/') || redirectUrl.startsWith('//')) {
+            errors.push("mbkautheVar.loginRedirectURL must be a relative path starting with '/'");
+        }
     }
 
+    BOOLEAN_KEYS.forEach((key) => normalizeBooleanFlag(config, key, errors));
+    normalizePositiveNumber(config, "COOKIE_EXPIRE_TIME", errors);
+    normalizePositiveNumber(config, "DEVICE_TRUST_DURATION_DAYS", errors);
+    normalizePositiveInteger(config, "MAX_SESSIONS_PER_USER", errors);
+}
+
+// Comprehensive validation function
+function validateConfiguration() {
+    const errors = [];
+    const usedFromShared = new Set();
+    const usedDefaults = new Set();
+    const mbkautheVar = parseJsonEnv("mbkautheVar", { required: true });
+    const mbkauthShared = parseJsonEnv("mbkauthShared");
+
+    applySharedFallbacks(mbkautheVar, mbkauthShared, usedFromShared);
+    applyDefaults(mbkautheVar, usedDefaults);
+    normalizeAndValidateConfig(mbkautheVar, errors);
+
+    // Validate required keys
+    // COOKIE_EXPIRE_TIME is not required but if provided must be valid, COOKIE_EXPIRE_TIME by default is 2 days
+    // loginRedirectURL is not required but if provided must be valid, loginRedirectURL by default is /dashboard
+    REQUIRED_KEYS.forEach(key => {
+        if (isBlank(mbkautheVar[key])) {
+            errors.push(`mbkautheVar.${key} is required and cannot be empty`);
+        }
+    });
+
     // Validate GitHub login configuration
     if (mbkautheVar.GITHUB_LOGIN_ENABLED === "true") {
         const hasGithubClientId = !!(mbkautheVar.GITHUB_APP_CLIENT_ID || mbkautheVar.GITHUB_CLIENT_ID);
@@ -154,50 +195,14 @@ function validateConfiguration() {
 
     // Validate Google login configuration
     if (mbkautheVar.GOOGLE_LOGIN_ENABLED === "true") {
-        if (!mbkautheVar.GOOGLE_CLIENT_ID || mbkautheVar.GOOGLE_CLIENT_ID.trim() === '') {
+        if (isBlank(mbkautheVar.GOOGLE_CLIENT_ID)) {
             errors.push("mbkautheVar.GOOGLE_CLIENT_ID is required when GOOGLE_LOGIN_ENABLED is 'true'");
         }
-        if (!mbkautheVar.GOOGLE_CLIENT_SECRET || mbkautheVar.GOOGLE_CLIENT_SECRET.trim() === '') {
+        if (isBlank(mbkautheVar.GOOGLE_CLIENT_SECRET)) {
             errors.push("mbkautheVar.GOOGLE_CLIENT_SECRET is required when GOOGLE_LOGIN_ENABLED is 'true'");
         }
     }
 
-    // Validate COOKIE_EXPIRE_TIME if provided
-    if (mbkautheVar.COOKIE_EXPIRE_TIME !== undefined) {
-        const expireTime = parseFloat(mbkautheVar.COOKIE_EXPIRE_TIME);
-        if (isNaN(expireTime) || expireTime <= 0) {
-            errors.push("mbkautheVar.COOKIE_EXPIRE_TIME must be a valid positive number");
-        }
-    } else {
-        // Set default value
-        mbkautheVar.COOKIE_EXPIRE_TIME = 2;
-    }
-
-    // Validate DEVICE_TRUST_DURATION_DAYS if provided
-    if (mbkautheVar.DEVICE_TRUST_DURATION_DAYS !== undefined) {
-        const trustDuration = parseFloat(mbkautheVar.DEVICE_TRUST_DURATION_DAYS);
-        if (isNaN(trustDuration) || trustDuration <= 0) {
-            errors.push("mbkautheVar.DEVICE_TRUST_DURATION_DAYS must be a valid positive number");
-        }
-    } else {
-        // Set default value
-        mbkautheVar.DEVICE_TRUST_DURATION_DAYS = 7;
-    }
-
-    // Validate MAX_SESSIONS_PER_USER if provided (must be positive integer)
-    if (mbkautheVar.MAX_SESSIONS_PER_USER !== undefined) {
-        const maxSessions = parseInt(mbkautheVar.MAX_SESSIONS_PER_USER, 10);
-        if (isNaN(maxSessions) || maxSessions <= 0) {
-            errors.push("mbkautheVar.MAX_SESSIONS_PER_USER must be a valid positive integer");
-        } else {
-            // Normalize to integer
-            mbkautheVar.MAX_SESSIONS_PER_USER = maxSessions;
-        }
-    } else {
-        // Ensure default value is set
-        mbkautheVar.MAX_SESSIONS_PER_USER = 5;
-    }
-
     // Validate LOGIN_DB connection string format
     if (mbkautheVar.LOGIN_DB && !mbkautheVar.LOGIN_DB.startsWith('postgresql://') && !mbkautheVar.LOGIN_DB.startsWith('postgres://')) {
         errors.push("mbkautheVar.LOGIN_DB must be a valid PostgreSQL connection string");
@@ -211,14 +216,14 @@ function validateConfiguration() {
     // Print consolidated configuration summary
     const configParts = [];
     if (mbkauthShared) {
-        configParts.push(`mbkauthShared: ${usedFromShared.length} keys`);
+        configParts.push(`mbkauthShared: ${usedFromShared.size} keys`);
     }
-    if (usedDefaults.length > 0) {
-        configParts.push(`defaults: ${usedDefaults.length} keys`);
+    if (usedDefaults.size > 0) {
+        configParts.push(`defaults: ${usedDefaults.size} keys`);
     }
     const configSummary = configParts.length > 0 ? ` (${configParts.join(', ')})` : '';
     logConfig(`Configuration loaded${configSummary}`);
-    return mbkautheVar;
+    return Object.freeze(mbkautheVar);
 }
 
 // Parse and validate mbkautheVar once
@@ -248,6 +253,10 @@ try {
     }
 }
 
+import { setPasswordPepper } from "./security.js";
+
+setPasswordPepper(mbkautheVar.SESSION_SECRET_KEY);
+
 export { packageJson, appVersion, mbkautheVar };
-export { hashPassword, hashApiToken } from "./security.js";
+export { hashPassword, hashApiToken, verifyPassword } from "./security.js";
 export { TOKEN_SCOPES, DEFAULT_SCOPE, canAccessMethod, isValidScope, getAvailableScopes } from "./tokenScopes.js";

package/lib/config/security.js

@@ -1,15 +1,55 @@
 import crypto from "crypto";
+import { promisify } from "util";
 
-// Password hashing using PBKDF2
+const pbkdf2Async = promisify(crypto.pbkdf2);
+const PBKDF2_ITERATIONS = 100000;
+const PBKDF2_KEYLEN = 64;
+const PBKDF2_DIGEST = "sha512";
+
+let passwordPepper = null;
+
+export function setPasswordPepper(pepper) {
+  passwordPepper = pepper;
+}
+
+const getPasswordPepper = () => {
+  if (!passwordPepper) {
+    throw new Error("[mbkauthe] Password pepper not initialized");
+  }
+  return passwordPepper;
+};
+
+const getPasswordSalt = (username) => `${username}:${getPasswordPepper()}`;
+
+async function derivePasswordHash(password, username) {
+  const derived = await pbkdf2Async(password, getPasswordSalt(username), PBKDF2_ITERATIONS, PBKDF2_KEYLEN, PBKDF2_DIGEST);
+  return derived.toString("hex");
+}
+
+function derivePasswordHashSync(password, username) {
+  return crypto.pbkdf2Sync(password, getPasswordSalt(username), PBKDF2_ITERATIONS, PBKDF2_KEYLEN, PBKDF2_DIGEST).toString("hex");
+}
+
+function timingSafeHashEqual(stored, computed) {
+  const storedBuffer = Buffer.from(String(stored), "utf8");
+  const computedBuffer = Buffer.from(String(computed), "utf8");
+  return storedBuffer.length === computedBuffer.length && crypto.timingSafeEqual(storedBuffer, computedBuffer);
+}
+
+// Password hashing using PBKDF2 with username + application pepper as salt
 export const hashPassword = (password, username) => {
-    const salt = username;
-    // 128 characters returned
-    return crypto.pbkdf2Sync(password, salt, 100000, 64, 'sha512').toString('hex');
+  return derivePasswordHashSync(password, username);
+};
+
+export const verifyPassword = async (password, username, storedHash) => {
+  if (!password || !username || !storedHash) return false;
+
+  const computed = await derivePasswordHash(password, username);
+  return timingSafeHashEqual(storedHash, computed);
 };
 
 // Hash an API token for storage
-// Uses SHA-256 for fast, secure non-reversible hashing
 export const hashApiToken = (token) => {
-    if (!token) return null;
-    return crypto.createHash('sha256').update(token).digest('hex');
-};
+  if (!token) return null;
+  return crypto.createHash("sha256").update(token).digest("hex");
+};

package/lib/db/AuthRepository.js

@@ -18,8 +18,8 @@ export class AuthRepository extends BaseRepository {
     const fields = [
       `s.id as sid`,
       `s.expires_at`,
-      `u.id as uid`,
       `u."UserName"`,
+      `u."UserId"`,
       `u."Active"`,
       `u."Role"`,
       `u."AllowedApps"`
@@ -85,7 +85,7 @@ export class AuthRepository extends BaseRepository {
         AND td."ExpiresAt" > NOW()
         AND u."UserName" = td."UserName"
         AND u."Active" = TRUE
-      RETURNING td."UserName", td."ExpiresAt", u."id" as id, u."Active", u."Role", u."AllowedApps"
+      RETURNING td."UserName", td."ExpiresAt", u."UserId", u."Active", u."Role", u."AllowedApps"
     `;
 
     const result = await this.executeRaw({
@@ -168,12 +168,12 @@ export class AuthRepository extends BaseRepository {
     return result.rows?.[0] || null;
   }
 
-  async updateLastLoginReturnProfile(userId) {
-    const query = `UPDATE "Users" SET "last_login" = NOW() WHERE "id" = $1 RETURNING "FullName", "Image"`;
+  async updateLastLoginReturnProfile(username) {
+    const query = `UPDATE "Users" SET "last_login" = NOW() WHERE "UserName" = $1 RETURNING "FullName", "Image"`;
     const result = await this.executeRaw({
       name: "login-update-last-login-return-profile",
       text: query,
-      values: [userId]
+      values: [username]
     });
     return result.rows?.[0] || null;
   }
@@ -196,7 +196,7 @@ export class AuthRepository extends BaseRepository {
 
   async getUserWithTwoFA(username, queryName = "login-get-user") {
     const query = `
-      SELECT u.id, u."UserName", u."PasswordEnc", u."Active", u."Role", u."AllowedApps",
+      SELECT u."UserName", u."UserId", u."PasswordEnc", u."Active", u."Role", u."AllowedApps",
              tfa."TwoFAStatus", u."FullName", u."Image"
       FROM "Users" u
       LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
@@ -222,7 +222,7 @@ export class AuthRepository extends BaseRepository {
 
   async getOAuthUserByProviderId(provider, providerId) {
     const { table, idColumn, queryName } = this.resolveOAuthProvider(provider);
-    const query = `SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id", tfa."TwoFAStatus"
+    const query = `SELECT ug.*, u."UserName", u."UserId", u."Role", u."Active", u."AllowedApps", tfa."TwoFAStatus"
                    FROM ${table} ug
                    JOIN "Users" u ON ug.user_name = u."UserName"
                    LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
@@ -234,7 +234,7 @@ export class AuthRepository extends BaseRepository {
   async getApiTokenByHash(tokenHash, queryName = "validate-api-token") {
     const query = `
       SELECT t.id, t."UserName", t."ExpiresAt", t."Permissions",
-             u.id as uid, u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
+             u."UserId", u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
       FROM "ApiTokens" t
       JOIN "Users" u ON t."UserName" = u."UserName"
       WHERE t."TokenHash" = $1 LIMIT 1

package/lib/main.js

@@ -5,6 +5,7 @@ import passport from 'passport';
 import {
   sessionConfig,
   corsMiddleware,
+  securityHeadersMiddleware,
   sessionRestorationMiddleware,
   sessionCookieSyncMiddleware,
   requestContextMiddleware
@@ -39,6 +40,7 @@ router.use(express.urlencoded({ extended: true }));
 router.use(cookieParser());
 
 // CORS and security headers
+router.use(securityHeadersMiddleware);
 router.use(corsMiddleware);
 
 // Attach request context as early as possible so session-store queries are tied to the request.

package/lib/middleware/auth.js

@@ -13,10 +13,37 @@ const IS_DEV = process.env.env === 'dev' || process.env.test === 'dev' || proces
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const isUuid = (val) => typeof val === 'string' && UUID_RE.test(val);
 const MAX_API_TOKEN_LENGTH = 4096;
+const API_TOKEN_LAST_USED_INTERVAL_MS = 15 * 60 * 1000;
 const API_TOKEN_SESSION_RESTORE = Symbol('mbkauthe.apiTokenSessionRestore');
+const apiTokenLastUsedCache = new Map();
 const authRepo = new AuthRepository({ db: dblogin });
 const logAuth = createLogger("auth");
 
+function pruneApiTokenLastUsedCache(now) {
+  if (apiTokenLastUsedCache.size < 10000) return;
+  const staleBefore = now - (API_TOKEN_LAST_USED_INTERVAL_MS * 2);
+  for (const [tokenId, lastTouchedAt] of apiTokenLastUsedCache) {
+    if (lastTouchedAt < staleBefore) {
+      apiTokenLastUsedCache.delete(tokenId);
+    }
+  }
+}
+
+function updateApiTokenLastUsedThrottled(tokenId) {
+  if (!tokenId) return;
+
+  const now = Date.now();
+  const lastTouchedAt = apiTokenLastUsedCache.get(tokenId) || 0;
+  if (now - lastTouchedAt < API_TOKEN_LAST_USED_INTERVAL_MS) return;
+
+  pruneApiTokenLastUsedCache(now);
+  apiTokenLastUsedCache.set(tokenId, now);
+  authRepo.updateApiTokenLastUsed(tokenId).catch(e => {
+    apiTokenLastUsedCache.delete(tokenId);
+    console.error(`[mbkauthe] Failed to update token usage:`, e);
+  });
+}
+
 /**
  * Decide if the incoming request should return JSON errors instead of HTML.
  * Non-browser clients (API calls / AJAX) should get JSON.
@@ -80,11 +107,10 @@ async function validateTokenAuthentication(req) {
       allowedApps = tokenAllowedApps;
     }
 
-    // Update usage opportunistically, but not on every request.
-    authRepo.updateApiTokenLastUsed(row.id).catch(e => console.error(`[mbkauthe] Failed to update token usage:`, e));
+    updateApiTokenLastUsedThrottled(row.id);
 
     return {
-      id: row.uid,
+      userId: row.UserId || undefined,
       username: row.UserName,
       fullname: row.FullName,
       role: row.Role,
@@ -101,7 +127,7 @@ async function validateTokenAuthentication(req) {
 
 function attachApiTokenUser(req, res, tokenUser) {
   const user = {
-    id: tokenUser.id,
+    userId: tokenUser.userId,
     username: tokenUser.username,
     fullname: tokenUser.fullname,
     role: tokenUser.role,
@@ -159,7 +185,7 @@ function hasAppAccess(role, allowedApps) {
   if (role === "SuperAdmin") return true;
   return Array.isArray(allowedApps)
     && allowedApps.length > 0
-    && allowedApps.some((app) => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase());
+    && allowedApps.some((app) => app && app.toLowerCase() === mbkautheVar.APP_NAME);
 }
 
 function destroySessionCookies(req, res) {
@@ -308,11 +334,11 @@ async function validateSession(req, res, next, strictTokenValidation = false) {
           }
 
           const hasWildcard = allowedApps.includes('*');
-          const hasSpecificApp = allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase());
+          const hasSpecificApp = allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME);
 
           if (hasWildcard) {
             const userHasApp = Array.isArray(userAllowedApps)
-              && userAllowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase());
+              && userAllowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME);
             if (!userHasApp) {
               return res.status(401).json(createErrorResponse(401, ErrorCodes.APP_NOT_AUTHORIZED));
             }
@@ -372,7 +398,7 @@ async function validateApiSession(req, res, next) {
  * Returns: true if session refreshed and valid, false if session invalidated
  */
 async function reloadSessionUser(req, res) {
-  if (!req.session || !req.session.user || !req.session.user.id) return false;
+  if (!req.session || !req.session.user || !req.session.user.username) return false;
   try {
     const { sessionId: currentSessionId } = req.session.user;
 
@@ -410,7 +436,7 @@ async function reloadSessionUser(req, res) {
     if (row.Role !== 'SuperAdmin') {
       const allowedApps = row.AllowedApps;
       const hasAllowedApps = Array.isArray(allowedApps) && allowedApps.length > 0;
-      if (!hasAllowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+      if (!hasAllowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME)) {
         req.session.destroy(() => { });
         clearSessionCookies(res);
         return false;
@@ -421,6 +447,7 @@ async function reloadSessionUser(req, res) {
     req.session.user.username = row.UserName;
     req.session.user.role = row.Role;
     req.session.user.allowedApps = row.AllowedApps;
+    req.session.user.userId = row.UserId || undefined;
 
     // Obtain fullname from client cookie cache when present else DB
     if (typeof row.FullName === 'string' && row.FullName.trim() !== '') {