mbkauthe 5.0.2 → 5.1.0

package/lib/middleware/index.js

@@ -3,8 +3,9 @@ import pgSession from "connect-pg-simple";
 const PgSession = pgSession(session);
 import { dblogin, runWithRequestContext } from "#pool.js";
 import { mbkautheVar } from "#config.js";
-import { cachedCookieOptions, decryptSessionId, encryptSessionId } from "#cookies.js";
+import { cachedCookieOptions, decryptSessionId, encryptSessionId, cachedClearCookieOptions, getCookieDomain, getCookieSecure, isAllowedOriginHostname } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
+import { isUserAuthorizedForApp } from "../utils/appAccess.js";
 
 // Session configuration
 export const sessionConfig = {
@@ -24,10 +25,10 @@ export const sessionConfig = {
   cookie: {
     maxAge: mbkautheVar.COOKIE_EXPIRE_TIME * 24 * 60 * 60 * 1000,
     // Don't set domain in development/localhost to avoid cookie issues
-    domain: (mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev') ? `.${mbkautheVar.DOMAIN}` : undefined,
+    domain: getCookieDomain(),
     httpOnly: true,
     // Only use secure cookies in production with HTTPS
-    secure: mbkautheVar.IS_DEPLOYED === 'true' && process.env.test !== 'dev',
+    secure: getCookieSecure(),
     sameSite: 'lax',
     path: '/'
   },
@@ -37,16 +38,23 @@ export const sessionConfig = {
 const authRepo = new AuthRepository({ db: dblogin });
 const hasAuthorizationHeader = (req) => typeof req.headers?.authorization === 'string' && req.headers.authorization.trim().length > 0;
 
+export function securityHeadersMiddleware(req, res, next) {
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "SAMEORIGIN");
+  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+  if (getCookieSecure()) {
+    res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+  }
+  next();
+}
+
 // CORS middleware
 export function corsMiddleware(req, res, next) {
   const origin = req.headers.origin;
   if (origin) {
     try {
       const originUrl = new URL(origin);
-      const allowedDomain = `.${mbkautheVar.DOMAIN}`;
-      // Exact match or subdomain match
-      if (originUrl.hostname === mbkautheVar.DOMAIN ||
-        (originUrl.hostname.endsWith(allowedDomain) && originUrl.hostname.charAt(originUrl.hostname.length - allowedDomain.length - 1) !== '.')) {
+      if (isAllowedOriginHostname(originUrl.hostname)) {
         res.header('Access-Control-Allow-Origin', origin);
         res.header('Access-Control-Allow-Credentials', 'true');
         res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');
@@ -73,13 +81,7 @@ export async function sessionRestorationMiddleware(req, res, next) {
     // Early validation to avoid unnecessary processing (expect DB UUID id)
     if (!sessionId || typeof sessionId !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId)) {
       // Clear invalid cookie to prevent repeated attempts
-      res.clearCookie('sessionId', {
-        domain: mbkautheVar.IS_DEPLOYED === 'true' ? `.${mbkautheVar.DOMAIN}` : undefined,
-        path: '/',
-        httpOnly: true,
-        secure: mbkautheVar.IS_DEPLOYED === 'true',
-        sameSite: 'lax'
-      });
+      res.clearCookie('sessionId', cachedClearCookieOptions);
       return next();
     }
 
@@ -91,10 +93,12 @@ export async function sessionRestorationMiddleware(req, res, next) {
         // Reject expired sessions or inactive users
         if ((row.expires_at && new Date(row.expires_at) <= new Date()) || !row.Active) {
           // leave cookies cleared and don't restore session
+        } else if (!isUserAuthorizedForApp(row.Role, row.AllowedApps)) {
+          // Session exists but user is not authorized for this app
         } else {
           const normalizedSessionId = String(sessionId);
           req.session.user = {
-            id: row.uid,
+            userId: row.UserId || undefined,
             username: row.UserName,
             role: row.Role,
             sessionId: normalizedSessionId,
@@ -122,11 +126,7 @@ export function sessionCookieSyncMiddleware(req, res, next) {
   }
 
   if (req.session && req.session.user) {
-    // Decrypt existing cookie to compare with session
-    const currentDecryptedId = decryptSessionId(req.cookies.sessionId);
-
-    // Only set cookies if they're missing or different
-    if (currentDecryptedId !== req.session.user.sessionId) {
+    if (!req.cookies.sessionId) {
       res.cookie("fullName", req.session.user.fullname || req.session.user.username, { ...cachedCookieOptions, httpOnly: false });
       const encryptedSessionId = encryptSessionId(req.session.user.sessionId);
       if (encryptedSessionId) {

package/lib/routes/auth.js

@@ -1,5 +1,4 @@
 import express from "express";
-import crypto from "crypto";
 import csurf from "csurf";
 import speakeasy from "speakeasy";
 import rateLimit from 'express-rate-limit';
@@ -9,10 +8,10 @@ import {
   cachedCookieOptions, cachedClearCookieOptions, clearSessionCookies,
   generateDeviceToken, getDeviceTokenCookieOptions, DEVICE_TRUST_DURATION_MS, hashDeviceToken,
   upsertAccountListCookie, readAccountListFromCookie, removeAccountFromCookie, clearAccountListCookie,
-  encryptSessionId
+  encryptSessionId, getCookieDomain
 } from "#cookies.js";
 import { packageJson } from "#config.js";
-import { hashPassword } from "#config.js";
+import { hashPassword, verifyPassword } from "#config.js";
 import { ErrorCodes, createErrorResponse, logError } from "../utils/errors.js";
 import { AuthRepository } from "../db/AuthRepository.js";
 import { createLogger } from "../utils/logger.js";
@@ -78,7 +77,7 @@ async function fetchActiveSession(sessionId) {
   if (row.Role !== 'SuperAdmin') {
     const allowedApps = row.AllowedApps;
     const hasAllowedApps = Array.isArray(allowedApps) && allowedApps.length > 0;
-    if (!hasAllowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+    if (!hasAllowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME)) {
       return null;
     }
   }
@@ -109,7 +108,6 @@ export async function checkTrustedDevice(req, username) {
   try {
     // Hash the provided device token before querying DB (we store token hashes in DB)
     const deviceTokenHash = hashDeviceToken(deviceToken);
-    // Single round-trip: validate trusted device AND refresh LastUsed.
     const deviceUser = await authRepo.touchTrustedDevice(deviceTokenHash, username);
 
     if (deviceUser) {
@@ -121,7 +119,7 @@ export async function checkTrustedDevice(req, username) {
 
       if (deviceUser.Role !== "SuperAdmin") {
         const allowedApps = deviceUser.AllowedApps;
-        if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+        if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME)) {
           console.warn(`[mbkauthe] Trusted device check: User "${username}" is not authorized to use the application "${mbkautheVar.APP_NAME}"`);
           return null;
         }
@@ -129,7 +127,7 @@ export async function checkTrustedDevice(req, username) {
 
       logAuth(`Trusted device validated for user: ${username}`);
       return {
-        id: deviceUser.id,
+        userId: deviceUser.UserId || undefined,
         username: username,
         role: deviceUser.Role,
         allowedApps: deviceUser.AllowedApps,
@@ -205,13 +203,13 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
     // Update last_login and fetch FullName/Image in a single query.
     let profileRow = null;
     try {
-      profileRow = await authRepo.updateLastLoginReturnProfile(user.id);
+      profileRow = await authRepo.updateLastLoginReturnProfile(username);
     } catch (profileUpdateErr) {
       console.error(`[mbkauthe] Error updating last_login/returning profile:`, profileUpdateErr);
     }
 
     req.session.user = {
-      id: user.id,
+      userId: user.userId || user.UserId || undefined,
       username: username,
       role: user.role || user.Role,
       sessionId: dbSessionId,
@@ -311,7 +309,6 @@ export async function completeLoginProcess(req, res, user, redirectUrl = null, t
       const responsePayload = {
         success: true,
         message: "Login successful",
-        sessionId: dbSessionId,
       };
 
       if (redirectUrl) {
@@ -376,10 +373,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
     // Password verification (hash-only). We never read/compare plaintext passwords.
     let passwordMatches = false;
     if (user.PasswordEnc) {
-      const hashedInputPassword = hashPassword(password, user.UserName);
-      const stored = Buffer.from(String(user.PasswordEnc), 'utf8');
-      const computed = Buffer.from(String(hashedInputPassword), 'utf8');
-      passwordMatches = stored.length === computed.length && crypto.timingSafeEqual(stored, computed);
+      passwordMatches = await verifyPassword(password, user.UserName, user.PasswordEnc);
     }
 
     if (!passwordMatches) {
@@ -398,7 +392,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
 
     if (user.Role !== "SuperAdmin") {
       const allowedApps = user.AllowedApps;
-      if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+      if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME)) {
         logError('Login attempt', ErrorCodes.APP_NOT_AUTHORIZED, {
           username: user.UserName,
           app: mbkautheVar.APP_NAME
@@ -418,7 +412,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       logAuth(`Trusted device login for user: ${trimmedUsername}, skipping 2FA only`);
 
       const userForSession = {
-        id: user.id,
+        userId: user.UserId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,
@@ -431,7 +425,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       // 2FA is enabled, prompt for token on a separate page
       const requestedRedirect = typeof redirect === 'string' && redirect.startsWith('/') && !redirect.startsWith('//') ? redirect : null;
       req.session.preAuthUser = {
-        id: user.id,
+        userId: user.UserId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,
@@ -443,7 +437,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
 
     // If 2FA is not enabled, proceed with login
     const userForSession = {
-      id: user.id,
+      userId: user.UserId || undefined,
       username: user.UserName,
       role: user.Role,
       allowedApps: user.AllowedApps,
@@ -476,7 +470,7 @@ router.get("/2fa", csrfProtection, (req, res) => {
     layout: false,
     customURL: redirectToUse,
     csrfToken: req.csrfToken(),
-    appName: mbkautheVar.APP_NAME.toLowerCase(),
+    appName: mbkautheVar.APP_NAME,
     version: packageJson.version,
     DEVICE_TRUST_DURATION_DAYS: mbkautheVar.DEVICE_TRUST_DURATION_DAYS
   });
@@ -493,7 +487,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
   }
 
   const { token, trustDevice } = req.body;
-  const { username, id, role } = req.session.preAuthUser;
+  const { username, role, userId } = req.session.preAuthUser;
 
   // Validate 2FA token
   if (!token || typeof token !== 'string') {
@@ -541,7 +535,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
     }
 
     // 2FA successful, complete login with optional device trust
-    const userForSession = { id, username, role, allowedApps };
+    const userForSession = { userId, username, role, allowedApps };
     // Prefer redirect stored in preAuthUser or in query/body, fallback to configured default
     let redirectFromSession = req.session.preAuthUser && req.session.preAuthUser.redirectUrl ? req.session.preAuthUser.redirectUrl : null;
     if (redirectFromSession && (!(typeof redirectFromSession === 'string') || !redirectFromSession.startsWith('/') || redirectFromSession.startsWith('//'))) {
@@ -564,7 +558,7 @@ router.post("/api/verify-2fa", TwoFALimit, csrfProtection, async (req, res) => {
 router.post("/api/logout", LogoutLimit, async (req, res) => {
   if (req.session.user) {
     try {
-      const { id, username } = req.session.user;
+      const { username } = req.session.user;
 
       // Clear profile picture cache
       clearProfilePicCache(req, username);
@@ -636,7 +630,7 @@ router.get("/api/account-sessions", LoginLimit, async (req, res) => {
       const expired = row?.expires_at && new Date(row.expires_at) <= new Date();
       const authorized = row && row.Active && (
         row.Role === "SuperAdmin" ||
-        (Array.isArray(row.AllowedApps) && row.AllowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase()))
+        (Array.isArray(row.AllowedApps) && row.AllowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME))
       );
 
       if (!row || expired || !authorized) {
@@ -692,7 +686,7 @@ router.post("/api/switch-session", LoginLimit, async (req, res) => {
     });
 
     req.session.user = {
-      id: row.uid,
+      userId: row.UserId || undefined,
       username: row.UserName,
       role: row.Role,
       sessionId: row.sid,
@@ -771,10 +765,11 @@ router.get("/login", LoginLimit, csrfProtection, (req, res) => {
     githubLoginEnabled: mbkautheVar.GITHUB_LOGIN_ENABLED,
     googleLoginEnabled: mbkautheVar.GOOGLE_LOGIN_ENABLED,
     customURL: mbkautheVar.loginRedirectURL || '/dashboard',
+    cookieDomain: getCookieDomain() || '',
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username || '',
     version: packageJson.version,
-    appName: mbkautheVar.APP_NAME.toLowerCase(),
+    appName: mbkautheVar.APP_NAME,
     csrfToken: req.csrfToken(),
     // Last-login method flags for immediate server-side badge rendering
     lastLoginMethod: lastLogin,
@@ -797,7 +792,7 @@ router.get("/accounts", LoginLimit, csrfProtection, (req, res) => {
     layout: false,
     customURL: safeRedirect,
     version: packageJson.version,
-    appName: mbkautheVar.APP_NAME.toLowerCase(),
+    appName: mbkautheVar.APP_NAME,
     csrfToken: req.csrfToken(),
     userLoggedIn: !!req.session?.user,
     username: req.session?.user?.username,

package/lib/routes/misc.js

@@ -6,8 +6,9 @@ import { renderError, renderPage } from "#response.js";
 import { authenticate, sessVal, sessRole } from "../middleware/auth.js";
 import { ErrorCodes, ErrorMessages, createErrorResponse } from "../utils/errors.js";
 import { dblogin } from "#pool.js";
-import { clearSessionCookies, decryptSessionId, cachedCookieOptions } from "#cookies.js";
+import { clearSessionCookies, decryptSessionId, cachedCookieOptions, getCookieDomain } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
+import { isSafeFetchUrl } from "../utils/urlSafety.js";
 import { fileURLToPath } from "url";
 import path from "path";
 import fs from "fs";
@@ -22,6 +23,23 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const router = express.Router();
 const authRepo = new AuthRepository({ db: dblogin });
 const logMisc = createLogger("misc");
+const PROFILE_IMAGE_CACHE_SECONDS = 300;
+const PROFILE_IMAGE_CACHE_CONTROL = `private, max-age=${PROFILE_IMAGE_CACHE_SECONDS}, stale-while-revalidate=${PROFILE_IMAGE_CACHE_SECONDS}`;
+const LATEST_VERSION_CACHE_TTL_MS = 10 * 60 * 1000;
+const LATEST_VERSION_FAILURE_CACHE_TTL_MS = 60 * 1000;
+const latestVersionCache = {
+  value: null,
+  expiresAt: 0,
+  pending: null
+};
+
+function setProfileImageCacheHeaders(res, eTag = null) {
+  res.setHeader('Cache-Control', PROFILE_IMAGE_CACHE_CONTROL);
+  if (eTag) {
+    res.setHeader('ETag', eTag);
+  }
+}
+
 // Rate limiter for info/test routes
 const LoginLimit = rateLimit({
   windowMs: 1 * 60 * 1000,
@@ -48,9 +66,26 @@ const AdminOperationLimit = rateLimit({
 });
 
 // Static file routes
+const mainJsPath = path.join(__dirname, '..', '..', 'public', 'main.js');
+let mainJsSource = null;
+
+const getMainJsSource = () => {
+  if (mainJsSource === null) {
+    mainJsSource = fs.readFileSync(mainJsPath, 'utf8');
+  }
+  return mainJsSource;
+};
+
 router.get('/main.js', (req, res) => {
+  const clientConfig = JSON.stringify({
+    cookieDomain: getCookieDomain() || null,
+    domain: mbkautheVar.DOMAIN,
+    isDeployed: mbkautheVar.IS_DEPLOYED === 'true'
+  });
+  const injectedSource = `window.mbkautheConfig=${clientConfig};\n${getMainJsSource()}`;
+
   res.setHeader('Cache-Control', 'public, max-age=31536000');
-  res.sendFile(path.join(__dirname, '..', '..', 'public', 'main.js'));
+  res.type('application/javascript').send(injectedSource);
 });
 
 router.get('/main.css', (req, res) => {
@@ -76,9 +111,8 @@ router.get('/user/profilepic', async (req, res) => {
   const serveDefaultIcon = () => {
     const iconPath = path.join(__dirname, "..", "..", "public", "M.png");
     res.setHeader('Content-Type', 'image/png');
-    // Ensure we don't override the Cache-Control we set earlier, or set a default if not set
     if (!res.getHeader('Cache-Control')) {
-      res.setHeader('Cache-Control', 'private, no-cache');
+      setProfileImageCacheHeaders(res);
     }
     const stream = fs.createReadStream(iconPath);
     stream.on('error', (err) => {
@@ -118,9 +152,7 @@ router.get('/user/profilepic', async (req, res) => {
     // Generate ETag based on username and image URL
     const eTag = `"${Buffer.from(username + ':' + imageUrl).toString('base64')}"`;
 
-    // Set caching headers
-    res.setHeader('Cache-Control', 'private, no-cache');
-    res.setHeader('ETag', eTag);
+    setProfileImageCacheHeaders(res, eTag);
 
     // Check for conditional request
     if (req.headers['if-none-match'] === eTag) {
@@ -131,6 +163,13 @@ router.get('/user/profilepic', async (req, res) => {
       return serveDefaultIcon();
     }
 
+    if (!isSafeFetchUrl(imageUrl)) {
+      console.warn(`[mbkauthe] Blocked unsafe profile image URL for user ${username}`);
+      res.cookie('profileImageUrl', 'default', { ...cachedCookieOptions, httpOnly: false });
+      res.cookie('profileImageUser', username, { ...cachedCookieOptions, httpOnly: false });
+      return serveDefaultIcon();
+    }
+
     // Fetch and stream the image
     try {
       const imageResponse = await fetch(imageUrl, {
@@ -173,7 +212,7 @@ if (process.env.env === 'dev') {
         success: true,
         message: 'SuperAdmin access granted',
         user: user ? {
-          id: user.id,
+          userId: user.userId,
           username: user.username,
           role: user.role,
           sessionId: user.sessionId
@@ -188,7 +227,7 @@ if (process.env.env === 'dev') {
 
 // Test route
 router.get(['/test', '/'], sessVal, LoginLimit, async (req, res) => {
-  const { username, fullname, role, id, sessionId, allowedApps } = req.session.user;
+  const { username, fullname, role, userId, sessionId, allowedApps } = req.session.user;
 
   const sessionExpiry = req.session.cookie?.expires
     ? new Date(req.session.cookie.expires).toISOString()
@@ -198,7 +237,7 @@ router.get(['/test', '/'], sessVal, LoginLimit, async (req, res) => {
     username,
     fullname: fullname || 'N/A',
     role,
-    id,
+    userId: userId || 'N/A',
     sessionIdShort: sessionId.slice(0, 8),
     profilePicUrl: encodeURIComponent(username),
     displayName: fullname || username,
@@ -221,7 +260,7 @@ router.get('/api/checkSession', LoginLimit, async (req, res) => {
       return res.status(200).json({ sessionValid: false, expiry: null });
     }
 
-    const { id, sessionId } = req.session.user;
+    const { sessionId } = req.session.user;
     if (!sessionId) {
       req.session.destroy(() => { });
       clearSessionCookies(res);
@@ -345,7 +384,7 @@ router.post('/api/verifySession', LoginLimit, async (req, res) => {
     }
 
     const expiry = row.expires_at ? new Date(row.expires_at).toISOString() : null;
-    return res.status(200).json({ valid: true, expiry, username: row.UserName, role: row.Role });
+    return res.status(200).json({ valid: true, expiry });
   } catch (err) {
     console.error(`[mbkauthe] verifySession error:`, err);
     return res.status(200).json({ valid: false, expiry: null });
@@ -450,20 +489,44 @@ router.get("/ErrorCode", (req, res) => {
   }
 });
 
-// Fetch latest version from GitHub\
-export async function getLatestVersion() {
-  try {
-    const response = await fetch('https://raw.githubusercontent.com/MIbnEKhalid/mbkauthe/main/package.json');
-    if (!response.ok) {
-      console.error(`[mbkauthe] GitHub API responded with status ${response.status}`);
+// Fetch latest version from GitHub with a short in-memory cache.
+export async function getLatestVersion({ forceRefresh = false } = {}) {
+  const now = Date.now();
+
+  if (!forceRefresh && latestVersionCache.expiresAt > now) {
+    return latestVersionCache.value;
+  }
+
+  if (!forceRefresh && latestVersionCache.pending) {
+    return latestVersionCache.pending;
+  }
+
+  latestVersionCache.pending = (async () => {
+    try {
+      const response = await fetch('https://raw.githubusercontent.com/MIbnEKhalid/mbkauthe/main/package.json');
+      if (!response.ok) {
+        console.error(`[mbkauthe] GitHub API responded with status ${response.status}`);
+        latestVersionCache.value = null;
+        latestVersionCache.expiresAt = Date.now() + LATEST_VERSION_FAILURE_CACHE_TTL_MS;
+        return null;
+      }
+
+      const latestPackageJson = await response.json();
+      const latestVersion = typeof latestPackageJson.version === 'string' ? latestPackageJson.version : null;
+      latestVersionCache.value = latestVersion;
+      latestVersionCache.expiresAt = Date.now() + LATEST_VERSION_CACHE_TTL_MS;
+      return latestVersion;
+    } catch (error) {
+      console.error(`[mbkauthe] Error fetching latest version from GitHub`, error);
+      latestVersionCache.value = null;
+      latestVersionCache.expiresAt = Date.now() + LATEST_VERSION_FAILURE_CACHE_TTL_MS;
       return null;
+    } finally {
+      latestVersionCache.pending = null;
     }
-    const latestPackageJson = await response.json();
-    return typeof latestPackageJson.version === 'string' ? latestPackageJson.version : null;
-  } catch (error) {
-    console.error(`[mbkauthe] Error fetching latest version from GitHub`, error);
-    return null;
-  }
+  })();
+
+  return latestVersionCache.pending;
 }
 
 // Version check with error handling

package/lib/routes/oauth.js

@@ -66,7 +66,7 @@ const createOAuthStrategy = async (provider, profile, done) => {
         // Check if user is authorized for this app
         if (user.Role !== "SuperAdmin") {
             const allowedApps = user.AllowedApps;
-            if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME.toLowerCase())) {
+            if (!allowedApps || !allowedApps.some(app => app && app.toLowerCase() === mbkautheVar.APP_NAME)) {
                 const error = new Error(`Not authorized to use ${mbkautheVar.APP_NAME}`);
                 error.code = 'NOT_AUTHORIZED';
                 return done(error);
@@ -75,7 +75,7 @@ const createOAuthStrategy = async (provider, profile, done) => {
 
         // Return user data for login
         const userData = {
-            id: user.id,
+            userId: user.UserId || undefined,
             username: user.UserName,
             role: user.Role,
             allowedApps: user.AllowedApps,
@@ -309,7 +309,7 @@ const finishProviderLogin = async (req, res, provider, user, detailValue = '') =
         const oauthRedirect = req.session.oauthRedirect;
         if (oauthRedirect) delete req.session.oauthRedirect;
         req.session.preAuthUser = {
-            id: user.id,
+            userId: user.UserId || user.userId || undefined,
             username: user.UserName,
             role: user.Role,
             allowedApps: user.AllowedApps,
@@ -364,7 +364,7 @@ const createOAuthCallback = (provider, strategy) => {
                     res,
                     provider,
                     {
-                        id: oauthUser.id,
+                        UserId: oauthUser.userId,
                         UserName: oauthUser.username,
                         Role: oauthUser.role,
                         AllowedApps: oauthUser.allowedApps,
@@ -389,7 +389,7 @@ const createOAuthCallback = (provider, strategy) => {
 // Helper function to handle OAuth redirect flow
 const handleOAuthRedirect = async (req, res, user, type, method = null) => {
     const userForSession = {
-        id: user.id,
+        userId: user.UserId || user.userId || undefined,
         username: user.UserName,
         role: user.Role,
         allowedApps: user.AllowedApps,

package/lib/utils/appAccess.js

@@ -0,0 +1,8 @@
+import { mbkautheVar } from "#config.js";
+
+export function isUserAuthorizedForApp(role, allowedApps) {
+  if (role === "SuperAdmin") return true;
+  return Array.isArray(allowedApps)
+    && allowedApps.length > 0
+    && allowedApps.some((app) => app && app.toLowerCase() === mbkautheVar.APP_NAME);
+}

package/lib/utils/dbQueryLogger.js

@@ -195,7 +195,7 @@ const buildRequestContext = () => {
     method: req.method,
     url: req.originalUrl || req.url,
     ip: req.ip,
-    userId: user?.id || null,
+    userId: user?.userId || null,
     username: user?.username || null,
   };
 };

package/lib/utils/redirect.js

@@ -0,0 +1,14 @@
+/**
+ * Validates that a redirect target is a safe same-origin relative path.
+ */
+export function isSafeRelativeRedirect(value) {
+  if (typeof value !== 'string') return false;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return false;
+  if (trimmed.includes('://') || trimmed.includes('\\')) return false;
+  return true;
+}
+
+export function sanitizeRelativeRedirect(value) {
+  return isSafeRelativeRedirect(value) ? value.trim() : null;
+}

package/lib/utils/urlSafety.js

@@ -0,0 +1,67 @@
+import { mbkautheVar } from "#config.js";
+
+const BLOCKED_HOSTNAMES = new Set([
+  'localhost',
+  '0.0.0.0',
+  'metadata.google.internal',
+  'metadata',
+]);
+
+function isPrivateIpv4(hostname) {
+  const parts = hostname.split('.').map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return false;
+  }
+
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+
+function isPrivateIpv6(hostname) {
+  const normalized = hostname.toLowerCase();
+  if (normalized === '::1' || normalized === '::') return true;
+  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true;
+  if (normalized.startsWith('fe80:')) return true;
+  return false;
+}
+
+function isBlockedHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, '');
+  if (BLOCKED_HOSTNAMES.has(normalized)) return true;
+  if (normalized.endsWith('.localhost') || normalized.endsWith('.local')) return true;
+  if (normalized.includes(':') && isPrivateIpv6(normalized)) return true;
+  if (isPrivateIpv4(normalized)) return true;
+  return false;
+}
+
+/**
+ * Returns true when a URL is safe for server-side fetch (profile images, etc.).
+ */
+export function isSafeFetchUrl(urlString) {
+  if (!urlString || typeof urlString !== 'string' || urlString === 'default') {
+    return false;
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(urlString);
+  } catch {
+    return false;
+  }
+
+  const allowHttpInDev = mbkautheVar.IS_DEPLOYED !== 'true';
+  const allowedProtocols = allowHttpInDev ? ['https:', 'http:'] : ['https:'];
+  if (!allowedProtocols.includes(parsed.protocol)) return false;
+  if (parsed.username || parsed.password) return false;
+  if (!parsed.hostname) return false;
+  if (isBlockedHostname(parsed.hostname)) return false;
+
+  return true;
+}