mbkauthe 5.0.2 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mbkauthe",
-  "version": "5.0.2",
+  "version": "5.1.0",
   "description": "MBKTech's reusable authentication system for Node.js applications.",
   "main": "index.js",
   "type": "module",
@@ -10,8 +10,10 @@
     "create-tables": "node lib/createTable.js",
     "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
     "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",
+    "tets": "npm run test",
     "render:mermaid": "npx @mermaid-js/mermaid-cli -i docs/diagrams/auth-flows.mmd -o docs/images/auth-flows.svg",
-    "render:mermaid:png": "npx @mermaid-js/mermaid-cli -i docs/diagrams/auth-flows.mmd -o docs/images/auth-flows.png -s 20"
+    "render:mermaid:png": "npx @mermaid-js/mermaid-cli -i docs/diagrams/auth-flows.mmd -o docs/images/auth-flows.png -s 20",
+    "install-mermaid": "npm i @mermaid-js/mermaid-cli@11.15.0 --save-dev"
   },
   "imports": {
     "#pool.js": "./lib/pool.js",
@@ -29,10 +31,13 @@
     "nodejs",
     "express",
     "session",
-    "security"
+    "security",
+    "oauth",
+    "2fa",
+    "csrf"
   ],
-  "author": "Muhammad Bin Khalid <support@mbktech.org>",
-  "license": "GPL-2.0",
+  "author": "Muhammad Bin Khalid <support@mbktech.org> <chmuhammadbinkhalid28@gmail.com>",
+  "license": "LGPL-3.0-only",
   "bugs": {
     "url": "https://github.com/MIbnEKhalid/mbkauthe/issues"
   },
@@ -53,7 +58,6 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@mermaid-js/mermaid-cli": "^11.15.0",
     "bytes": "^3.1.2",
     "connect-pg-simple": "^10.0.0",
     "content-type": "^1.0.5",
@@ -99,7 +103,6 @@
     }
   },
   "devDependencies": {
-    "@types/express": "^5.0.6",
     "cross-env": "^7.0.3",
     "jest": "^30.2.0",
     "nodemon": "^3.1.11",

package/public/main.js

@@ -1,115 +1,174 @@
-async function logout() {
-  const confirmation = confirm("Are you sure you want to logout?");
-  if (!confirmation) {
-    return;
-  }
+(() => {
+  const SESSION_KEYS = [
+    'sessionId',
+    'mbkauthe.sid',
+    'fullName',
+    '_csrf',
+    'profileImageUser',
+    'profileImageUrl'
+  ];
+  const LOG_PREFIX = '[mbkauthe]';
+  const EXPIRED_COOKIE = 'expires=Thu, 01 Jan 1970 00:00:00 GMT';
+  const dateFormatter = new Intl.DateTimeFormat('en-GB', {
+    day: '2-digit',
+    month: '2-digit',
+    year: 'numeric',
+    hour: 'numeric',
+    minute: 'numeric',
+    second: 'numeric',
+    hour12: true
+  });
+
+  const reloadPage = () => window.location.reload();
+
+  const getCookieDomains = () => {
+    const hostname = window.location.hostname;
+
+    if (!hostname) {
+      return [];
+    }
 
-  try {
-    // First, logout from server
-    const response = await fetch("/mbkauthe/api/logout", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Cache-Control": "no-cache"
-      },
-      credentials: "include"
-    });
+    const domains = new Set();
+    const configuredDomain = window.mbkautheConfig?.cookieDomain;
 
-    const result = await response.json();
+    if (configuredDomain) {
+      domains.add(configuredDomain);
+    }
 
-    if (response.ok) {
-      // Then clear all caches after successful logout (except rememberedUsername)
-      await selectiveCacheClear();
-      // selectiveCacheClear already redirects, so no need for additional redirect
-    } else {
-      alert(result.message);
+    domains.add(hostname);
+    if (hostname.includes('.')) {
+      domains.add(`.${hostname}`);
     }
-  } catch (error) {
-    console.error(`[mbkauthe] Error during logout:`, error);
-    alert(`Logout failed: ${error.message}`);
-  }
-}
-
-async function selectiveCacheClear() {
-  try {
-
-    const cookiesToClear = [
-      'sessionId',
-      'mbkauthe.sid',
-      'fullName',
-      '_csrf',
-      'profileImageUser',
-      'profileImageUrl'
-    ];
-
-    const localStorageToClear = [
-      'sessionId',
-      'mbkauthe.sid',
-      'fullName',
-      '_csrf',
-      'profileImageUser',
-      'profileImageUrl'
-    ];
-
-    // 1. Clear selected localStorage keys
-    localStorageToClear.forEach(key => {
-      localStorage.removeItem(key);
-    });
 
-    // 2. Clear selected cookies
-    cookiesToClear.forEach(name => {
-      document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
-      document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=${window.location.hostname}`;
-      document.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.${window.location.hostname}`;
+    return [...domains];
+  };
+
+  const clearCookie = (name) => {
+    document.cookie = `${name}=; ${EXPIRED_COOKIE}; path=/`;
+
+    getCookieDomains().forEach((domain) => {
+      document.cookie = `${name}=; ${EXPIRED_COOKIE}; path=/; domain=${domain}`;
     });
+  };
 
-    // 3. Optional reload
-    window.location.reload();
+  const parseJson = async (response) => {
+    try {
+      return await response.json();
+    } catch {
+      return {};
+    }
+  };
 
-  } catch (error) {
-    console.error(`[mbkauthe] selective cache clear failed:`, error);
-    window.location.reload();
-  }
-}
-
-async function logoutuser() {
-  await logout();
-}
-
-const validateSessionInterval = 60000;
-// 1 minutes in milliseconds Function to check session validity by sending a request to the server
-function checkSession() {
-  fetch("/api/validate-session")
-    .then((response) => {
-      if (!response.ok) {
-        // Redirect or handle errors (session expired, user inactive, etc.)
-        window.location.reload(); // Reload the page to update the session status
+  async function logout({ confirmLogout = true } = {}) {
+    if (confirmLogout && !confirm('Are you sure you want to logout?')) {
+      return false;
+    }
+
+    try {
+      const response = await fetch('/mbkauthe/api/logout', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Cache-Control': 'no-cache'
+        },
+        credentials: 'include',
+        cache: 'no-store'
+      });
+      const result = await parseJson(response);
+
+      if (response.ok) {
+        selectiveCacheClear();
+        return true;
       }
+
+      alert(result.message || 'Logout failed. Please try again.');
+    } catch (error) {
+      console.error(`${LOG_PREFIX} Error during logout:`, error);
+      alert(`Logout failed: ${error.message}`);
+    }
+
+    return false;
+  }
+
+  function selectiveCacheClear() {
+    try {
+      SESSION_KEYS.forEach((key) => localStorage.removeItem(key));
+      SESSION_KEYS.forEach(clearCookie);
+    } catch (error) {
+      console.error(`${LOG_PREFIX} selective cache clear failed:`, error);
+    } finally {
+      reloadPage();
+    }
+  }
+
+  async function logoutuser() {
+    return logout();
+  }
+
+  function checkSession() {
+    return fetch('/mbkauthe/api/checkSession', {
+      credentials: 'include',
+      cache: 'no-store'
     })
-    .catch((error) => console.error(`[mbkauthe] Error checking session:`, error));
-}
-// Call validateSession every 2 minutes (120000 milliseconds)
-// setInterval(checkSession, validateSessionInterval);
-
-function getCookieValue(cookieName) {
-  const cookies = document.cookie.split('; ');
-  for (let cookie of cookies) {
-    const [name, value] = cookie.split('=');
-    if (name === cookieName) {
+      .then(async (response) => {
+        if (!response.ok) {
+          reloadPage();
+          return;
+        }
+
+        const session = await parseJson(response);
+        if (session.sessionValid === false) {
+          reloadPage();
+        }
+      })
+      .catch((error) => console.error(`${LOG_PREFIX} Error checking session:`, error));
+  }
+
+  function getCookieValue(cookieName) {
+    if (!cookieName) {
+      return null;
+    }
+
+    const prefix = `${cookieName}=`;
+    const cookie = document.cookie
+      .split('; ')
+      .find((entry) => entry.startsWith(prefix));
+
+    if (!cookie) {
+      return null;
+    }
+
+    const value = cookie.slice(prefix.length);
+
+    try {
       return decodeURIComponent(value);
+    } catch {
+      return value;
     }
   }
-  return null; // Return null if the cookie is not found
-}
 
-function loadpage(url) {
-  window.location.href = url;
-}
+  function loadpage(url) {
+    if (url) {
+      window.location.href = url;
+    }
+  }
 
-function formatDate(date) {
-  return new Date(date).toLocaleString('en-GB', { day: '2-digit', month: '2-digit', year: 'numeric', hour: 'numeric', minute: 'numeric', second: 'numeric', hour12: true });
-}
+  function formatDate(date) {
+    const parsedDate = new Date(date);
+    return Number.isNaN(parsedDate.getTime()) ? 'Invalid Date' : dateFormatter.format(parsedDate);
+  }
 
-function reloadPage() {
-  window.location.reload();
-}
+  const api = {
+    checkSession,
+    formatDate,
+    getCookieValue,
+    loadpage,
+    logout,
+    logoutuser,
+    reloadPage,
+    selectiveCacheClear
+  };
+
+  window.mbkauthe = Object.assign(window.mbkauthe || {}, api);
+  Object.assign(window, api);
+})();

package/test.spec.js

@@ -14,7 +14,13 @@ process.env.dbLogs = 'true';
 process.env.dbLogsCallsite = 'false';
 
 const { default: router } = await import('./lib/main.js');
-const { packageJson } = await import('./lib/config/index.js');
+const { packageJson, mbkautheVar } = await import('./lib/config/index.js');
+const {
+  resolveCookieDomain,
+  isAllowedOriginHostname,
+  getCookieDomain,
+  cachedCookieOptions
+} = await import('./lib/config/cookies.js');
 const { dblogin } = await import('./lib/pool.js');
 const {
   attachDevQueryLogger,
@@ -23,6 +29,11 @@ const {
   runWithRequestContext
 } = await import('./lib/utils/dbQueryLogger.js');
 
+const { isSafeRelativeRedirect, sanitizeRelativeRedirect } = await import('./lib/utils/redirect.js');
+const { isSafeFetchUrl } = await import('./lib/utils/urlSafety.js');
+const { hashPassword, verifyPassword } = await import('./lib/config/index.js');
+const { hashDeviceToken } = await import('./lib/config/cookies.js');
+
 const viewsPath = path.join(__dirname, 'views');
 
 const handlebarsHelpers = {
@@ -252,6 +263,7 @@ describe('mbkauthe Routes', () => {
 
       expect(response.status).toBe(200);
       expect(response.headers['content-type']).toContain('javascript');
+      expect(response.text).toMatch(/^window\.mbkautheConfig=/);
     });
 
     test('GET /icon.svg returns SVG content', async () => {
@@ -680,4 +692,64 @@ describe('mbkauthe Routes', () => {
       }
     });
   });
+
+  describe('Security hardening', () => {
+    test('sanitizeRelativeRedirect accepts safe paths and rejects open redirects', () => {
+      expect(sanitizeRelativeRedirect('/dashboard')).toBe('/dashboard');
+      expect(sanitizeRelativeRedirect('//evil.com')).toBeNull();
+      expect(sanitizeRelativeRedirect('https://evil.com')).toBeNull();
+      expect(isSafeRelativeRedirect('/app/settings')).toBe(true);
+    });
+
+    test('isSafeFetchUrl blocks localhost and allows public https URLs', () => {
+      expect(isSafeFetchUrl('https://avatars.githubusercontent.com/u/1')).toBe(true);
+      expect(isSafeFetchUrl('http://127.0.0.1/secret')).toBe(false);
+      expect(isSafeFetchUrl('https://localhost/admin')).toBe(false);
+      expect(isSafeFetchUrl('ftp://example.com/icon.png')).toBe(false);
+    });
+
+    test('verifyPassword validates peppered password hashes', async () => {
+      const username = 'test.user';
+      const password = 'test-password-123';
+      const stored = hashPassword(password, username);
+
+      expect(stored).toMatch(/^[0-9a-f]{128}$/);
+      expect(await verifyPassword(password, username, stored)).toBe(true);
+      expect(await verifyPassword('wrong-password', username, stored)).toBe(false);
+    });
+
+    test('hashDeviceToken returns a keyed hex digest', () => {
+      const token = 'a'.repeat(64);
+      expect(hashDeviceToken(token)).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    test('security headers are set on API responses', async () => {
+      const response = await request(app).get('/mbkauthe/main.js');
+      expect(response.headers['x-content-type-options']).toBe('nosniff');
+      expect(response.headers['x-frame-options']).toBe('SAMEORIGIN');
+    });
+  });
+
+  describe('Cross-subdomain cookie sharing', () => {
+    test('resolveCookieDomain returns parent domain only when deployed outside test dev', () => {
+      expect(resolveCookieDomain('true', 'mbktech.org', true)).toBeUndefined();
+      expect(resolveCookieDomain('false', 'mbktech.org', false)).toBeUndefined();
+      expect(resolveCookieDomain('true', 'mbktech.org', false)).toBe('.mbktech.org');
+      expect(resolveCookieDomain('true', '.mbktech.org', false)).toBe('.mbktech.org');
+    });
+
+    test('isAllowedOriginHostname accepts root and nested subdomains', () => {
+      expect(isAllowedOriginHostname('mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('auth.mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('app.auth.mbktech.org', 'mbktech.org')).toBe(true);
+      expect(isAllowedOriginHostname('notmbktech.org', 'mbktech.org')).toBe(false);
+      expect(isAllowedOriginHostname('mbktech.org.evil.com', 'mbktech.org')).toBe(false);
+    });
+
+    test('cached cookie options omit domain in test dev environment', () => {
+      expect(getCookieDomain()).toBeUndefined();
+      expect(cachedCookieOptions.domain).toBeUndefined();
+      expect(cachedCookieOptions.secure).toBe(false);
+    });
+  });
 });

package/views/head.handlebars

@@ -29,4 +29,5 @@
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
     {{> sharedStyles}}
     {{#if extraStyles}}{{{extraStyles}}}{{/if}}
+    <script src="/mbkauthe/main.js{{cacheBuster}}" defer></script>
 </head>

package/views/pages/accountSwitch.handlebars

@@ -340,7 +340,15 @@
     </style>
 
     <script>
-        const redirectTarget = new URLSearchParams(window.location.search).get('redirect') || '{{customURL}}';
+        function sanitizeRelativeRedirect(value) {
+            if (typeof value !== 'string') return null;
+            const trimmed = value.trim();
+            if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return null;
+            if (trimmed.includes('://') || trimmed.includes('\\')) return null;
+            return trimmed;
+        }
+
+        const redirectTarget = sanitizeRelativeRedirect(new URLSearchParams(window.location.search).get('redirect')) || '{{customURL}}';
 
         // Ensure login anchors include ?redirect using the redirect query param (not the current page URL)
         (function setLoginHrefFromQuery() {
@@ -485,16 +493,8 @@
                 if (res.ok && data.success) {
                     // Prioritize explicit ?redirect if present and valid, else fall back to server-provided redirect or template
                     const params = new URLSearchParams(window.location.search);
-                    let queryRedirect = null;
-                    if (params.has('redirect')) {
-                        try {
-                            const raw = params.get('redirect');
-                            if (raw) queryRedirect = decodeURIComponent(raw);
-                        } catch (e) {
-                            queryRedirect = null;
-                        }
-                    }
-                    const finalRedirect = queryRedirect || data.redirect || redirectTarget;
+                    const queryRedirect = sanitizeRelativeRedirect(params.get('redirect'));
+                    const finalRedirect = data.redirect || queryRedirect || redirectTarget;
                     if (finalRedirect) window.location.href = finalRedirect;
                 } else {
                     showMessage(data.message || 'Could not switch account', 'Switch Account');

package/views/pages/loginmbkauthe.handlebars

@@ -249,6 +249,14 @@
     {{> versionInfo}}
 
     <script>
+        function sanitizeRelativeRedirect(value) {
+            if (typeof value !== 'string') return null;
+            const trimmed = value.trim();
+            if (!trimmed.startsWith('/') || trimmed.startsWith('//')) return null;
+            if (trimmed.includes('://') || trimmed.includes('\\')) return null;
+            return trimmed;
+        }
+
         // Toggle password visibility
         const togglePassword = document.getElementById('togglePassword');
         const passwordInput = document.getElementById('loginPassword');
@@ -301,7 +309,7 @@
 
             // Pass redirect query param through to server so it can be used by 2FA flow
             const urlParams = new URLSearchParams(window.location.search);
-            const pageRedirect = urlParams.get('redirect');
+            const pageRedirect = sanitizeRelativeRedirect(urlParams.get('redirect'));
             fetch('/mbkauthe/api/login', {
                 method: 'POST',
                 credentials: 'include',
@@ -330,9 +338,8 @@
                                 deleteCookie('rememberedUsername');
                             }
 
-                            // Redirect to the appropriate page
-                            const redirectUrl = new URLSearchParams(window.location.search).get('redirect');
-                            window.location.href = redirectUrl ? decodeURIComponent(redirectUrl) : '{{customURL}}';
+                            // Redirect to the validated target from the server or safe query param
+                            window.location.href = data.redirectUrl || pageRedirect || '{{customURL}}';
                         }
                     } else {
                         // Handle errors
@@ -349,7 +356,9 @@
                 });
         });
 
-        // Cookie helper functions for cross-domain functionality
+        // Cookie helper functions for cross-subdomain sharing
+        const cookieDomain = '{{cookieDomain}}';
+
         function setCookie(name, value, days) {
             let expires = "";
             if (days) {
@@ -357,11 +366,11 @@
                 date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000));
                 expires = "; expires=" + date.toUTCString();
             }
-            // Set cookie for the entire domain (works across all subdomains)
-            const domain = window.location.hostname.includes('.') ?
-                '.' + window.location.hostname.split('.').slice(-2).join('.') :
-                window.location.hostname;
-            document.cookie = name + "=" + (value || "") + expires + "; path=/; domain=" + domain + "; SameSite=Lax";
+            let cookieValue = name + "=" + (value || "") + expires + "; path=/; SameSite=Lax";
+            if (cookieDomain) {
+                cookieValue += "; domain=" + cookieDomain;
+            }
+            document.cookie = cookieValue;
         }
 
         function getCookie(name) {
@@ -376,19 +385,26 @@
         }
 
         function deleteCookie(name) {
-            const domain = window.location.hostname.includes('.') ?
-                '.' + window.location.hostname.split('.').slice(-2).join('.') :
-                window.location.hostname;
-            document.cookie = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/; domain=" + domain;
+            let cookieValue = name + "=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/";
+            if (cookieDomain) {
+                cookieValue += "; domain=" + cookieDomain;
+            }
+            document.cookie = cookieValue;
         }
 
         // Check for URL parameters
         document.addEventListener('DOMContentLoaded', function () {
             const urlParams = new URLSearchParams(window.location.search);
-            const usernameFromUrl = urlParams.get('username');
-            const passwordFromUrl = urlParams.get('password');
             const usernameInput = document.getElementById('loginUsername');
 
+            if (urlParams.has('password')) {
+                urlParams.delete('password');
+                const sanitizedQuery = urlParams.toString();
+                const nextUrl = `${window.location.pathname}${sanitizedQuery ? `?${sanitizedQuery}` : ''}${window.location.hash}`;
+                window.history.replaceState({}, document.title, nextUrl);
+                showMessage('Passwords must not be passed in the URL. Enter your password in the form instead.', 'Security Notice');
+            }
+
             // Check for remembered username in cookies
             const rememberedUsername = getCookie('rememberedUsername');
             if (rememberedUsername) {
@@ -396,14 +412,6 @@
                 document.getElementById('rememberMe').checked = true;
             }
 
-            if (usernameFromUrl) {
-                usernameInput.value = usernameFromUrl;
-            }
-
-            if (passwordFromUrl) {
-                document.getElementById('loginPassword').value = passwordFromUrl;
-            }
-
             // Automatically focus the first empty field
             if (!usernameInput.value) {
                 usernameInput.focus();

package/views/pages/test.handlebars

@@ -194,7 +194,7 @@
                 <div>
                     <div class="session-status">✅ Authentication successful</div>
                     <h3 class="session-title">{{username}} <small class="session-role">· {{role}}</small></h3>
-                    <p class="session-sub">ID: {{id}} · Session: {{sessionIdShort}}…</p>
+                    <p class="session-sub">UserId: {{userId}} · Session: {{sessionIdShort}}…</p>
                 </div>
 
                 <div class="session-details" aria-live="polite">
@@ -205,7 +205,7 @@
                 </div>
 
                 <div class="session-actions">
-                    <button class="btn btn-danger" onclick="logout()" aria-label="Log out">
+                    <button class="btn btn-danger" onclick="mbkauthe.logout()" aria-label="Log out">
                         <i class="fas fa-sign-out-alt"></i> Logout
                     </button>
                     <a class="btn btn-outline" href="https://portal.mbktech.org/">
@@ -233,7 +233,6 @@
         </div>
     </section>
 
-    <script src="/mbkauthe/main.js{{cacheBuster}}"></script>
     {{#if sessionExpiry}}
     <script>
         (function () {

package/views/profilemenu.handlebars

@@ -261,21 +261,7 @@
                 logoutButton.textContent = 'Logging out...';
 
                 try {
-                    const response = await fetch('/mbkauthe/api/logout', {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json'
-                        },
-                        credentials: 'include'
-                    });
-
-                    const result = await response.json().catch(() => ({}));
-
-                    if (response.ok) {
-                        window.location.reload();
-                    } else {
-                        alert(result.message || 'Logout failed. Please try again.');
-                    }
+                    await mbkauthe.logout();
                 } catch (error) {
                     console.error(`[mbkauthe] Error during logout:`, error);
                     alert('Logout failed. Please try again.');