Hello,
-This is your new password: ${password}
- +Hello,
+Use this one-time sign-in link to access your account:
+ +This link expires in ${PASSWORD_TOKEN_TTL_MINUTES} minutes and can only be used once.
+If you did not request this, you can ignore this email.
Blessings
Emmanuel International Ministries
-`) +`); client_logger.capture({ distinctId: user._id, event: 'server@' + req.method + '@' + req.originalUrl, @@ -203,10 +202,30 @@ const resetPassword = async function (req, res) { username: username, } }); - return res.json({ - status: "ok", - details: 'Check your email for new password' // Enum of details? - }); + return res.json(genericResetResponse); +} + +const loginWithPasswordToken = async function (req, res) { + const DB = await MongoDB.getDB; + const token = (req.body.token || "").trim(); + if (!token || token.length < 32) { + return res.status(401).json({ status: "Invalid or expired token" }); + } + const tokenHash = createPasswordTokenHash(token); + const tokenDoc = await DB.consumePasswordLoginToken(tokenHash); + if (!tokenDoc || !tokenDoc.userId) { + return res.status(401).json({ status: "Invalid or expired token" }); + } + const user = await DB.getUserById(tokenDoc.userId); + if (!user || !user._id) { + return res.status(401).json({ status: "Invalid or expired token" }); + } + try { + return res.json(await createSessionFromUser({ DB, user, req, res })); + } catch (error) { + console.error("Token login error", error); + return res.status(500).json({ status: "Internal server error" }); + } } @@ -215,4 +234,5 @@ module.exports = { login, logout, resetPassword, -} \ No newline at end of file + loginWithPasswordToken, +} diff --git a/index.js b/index.js index 22b8d94..9d96721 100644 --- a/index.js +++ b/index.js @@ -9,6 +9,7 @@ require('dotenv').config(); const express = require('express'); const app = express(); const port = process.env.PORT || 3000; +app.set('trust proxy', true); // -- Accept request from other origins const cors = require('cors'); const { corsOptions } = require('./config/corsOptions'); @@ -34,11 +35,11 @@ const limiter = rateLimit({ return ip.includes(":") ? ip.split(":")[0] : ip; // Remove port if present } }); -app.set('trust proxy', true); app.use(limiter); // Authentication -const { signup, login, logout, resetPassword } = require('./auth/authEmail.js'); +const { signup, login, logout, resetPassword, loginWithPasswordToken } = require('./auth/authEmail.js'); +const { authRateLimiter } = require('./middleware/authRateLimiter'); /** * @swagger * /signup: @@ -71,7 +72,7 @@ const { signup, login, logout, resetPassword } = require('./auth/authEmail.js'); * 400: * description: Bad request. */ -app.route('/signup').get(signup).post(signup); +app.post('/signup', signup); /** * @swagger * /login: @@ -104,7 +105,7 @@ app.route('/signup').get(signup).post(signup); * 401: * description: Invalid credentials. */ -app.route('/login').get(login).post(login); +app.post('/login', authRateLimiter('login'), login); /** * @swagger * /logout: @@ -127,7 +128,7 @@ app.get('/logout', logout); * @swagger * /resetPassword: * post: - * summary: Resets a user's password + * summary: Sends a one-time sign-in link if the account exists * tags: [Auth] * requestBody: * required: true @@ -152,7 +153,29 @@ app.get('/logout', logout); * 400: * description: Bad request. */ -app.route('/resetPassword').post(resetPassword); +app.route('/resetPassword').post(authRateLimiter('reset'), resetPassword); +/** + * @swagger + * /password/token-login: + * post: + * summary: Consumes a one-time password token and starts a session + * tags: [Auth] + * requestBody: + * required: true + * content: + * application/json: + * schema: + * type: object + * properties: + * token: + * type: string + * responses: + * 200: + * description: Logged in with one-time token + * 401: + * description: Invalid or expired token + */ +app.post('/password/token-login', authRateLimiter('token'), loginWithPasswordToken); // Routes const profileRoute = require('./routes/profile.js'); @@ -486,4 +509,4 @@ DB.getDB.then((DB) => { }); // Export the app for testing purposes -module.exports = { app, mongoDB: DB }; \ No newline at end of file +module.exports = { app, mongoDB: DB }; diff --git a/middleware/authRateLimiter.js b/middleware/authRateLimiter.js new file mode 100644 index 0000000..f8f86b4 --- /dev/null +++ b/middleware/authRateLimiter.js @@ -0,0 +1,116 @@ +const crypto = require('crypto'); +const { client_logger } = require('../utils/analyticsLogger'); + +const AUTH_ATTEMPT_WINDOW_MS = Math.max(60 * 1000, parseInt(process.env.AUTH_ATTEMPT_WINDOW_MS || `${15 * 60 * 1000}`, 10)); +const AUTH_ATTEMPT_MAX = Math.max(1, parseInt(process.env.AUTH_ATTEMPT_MAX || '5', 10)); +const AUTH_BLOCK_BASE_MS = Math.max(30 * 1000, parseInt(process.env.AUTH_BLOCK_BASE_MS || `${5 * 60 * 1000}`, 10)); +const AUTH_BLOCK_MAX_MS = Math.max(AUTH_BLOCK_BASE_MS, parseInt(process.env.AUTH_BLOCK_MAX_MS || `${60 * 60 * 1000}`, 10)); + +const limiterStore = new Map(); +let lastPruneAt = 0; + +const getClientIp = (req) => { + const forwarded = req.headers['x-forwarded-for']?.split(',')[0]?.trim(); + const rawIp = forwarded || req.ip || req.connection?.remoteAddress || 'unknown'; + return rawIp.replace('::ffff:', ''); +}; + +const hashValue = (value) => + crypto.createHash('sha256').update(String(value)).digest('hex').slice(0, 16); + +const getIdentity = (req, mode) => { + if (mode === 'token') { + const token = (req.body?.token || '').trim(); + return token ? `token:${hashValue(token)}` : 'token:anonymous'; + } + const username = (req.body?.username || req.body?.email || '').trim().toLowerCase(); + return username ? `acct:${hashValue(username)}` : 'acct:anonymous'; +}; + +const getLimiterKey = (req, mode) => `${mode}:${getIdentity(req, mode)}:ip:${getClientIp(req)}`; + +const getOrInitRecord = (key, now) => { + const existing = limiterStore.get(key); + if (existing) { + return existing; + } + const record = { + count: 0, + windowStartedAt: now, + blockedUntil: 0, + blockLevel: 0, + }; + limiterStore.set(key, record); + return record; +}; + +const computeBlockMs = (blockLevel) => + Math.min(AUTH_BLOCK_BASE_MS * (2 ** Math.max(0, blockLevel - 1)), AUTH_BLOCK_MAX_MS); + +const authRateLimiter = (mode) => (req, res, next) => { + const now = Date.now(); + if (now - lastPruneAt > 5 * 60 * 1000) { + for (const [storeKey, storeValue] of limiterStore.entries()) { + const isWindowExpired = now - storeValue.windowStartedAt > AUTH_ATTEMPT_WINDOW_MS; + const isNotBlocked = storeValue.blockedUntil <= now; + if (isWindowExpired && isNotBlocked) { + limiterStore.delete(storeKey); + } + } + lastPruneAt = now; + } + const key = getLimiterKey(req, mode); + const record = getOrInitRecord(key, now); + + if (now - record.windowStartedAt > AUTH_ATTEMPT_WINDOW_MS) { + record.count = 0; + record.windowStartedAt = now; + } + + if (record.blockedUntil > now) { + const retryAfterSec = Math.ceil((record.blockedUntil - now) / 1000); + res.set('Retry-After', retryAfterSec.toString()); + client_logger.capture({ + distinctId: 'app_level', + event: 'security@auth@rate_limited', + properties: { + route: req.originalUrl, + method: req.method, + mode, + keyHash: hashValue(key), + retryAfterSec, + blockLevel: record.blockLevel, + } + }); + return res.status(429).json({ status: 'Too many attempts. Please try again later.' }); + } + + record.count += 1; + if (record.count > AUTH_ATTEMPT_MAX) { + record.blockLevel += 1; + const blockMs = computeBlockMs(record.blockLevel); + record.blockedUntil = now + blockMs; + record.count = 0; + record.windowStartedAt = now; + res.set('Retry-After', Math.ceil(blockMs / 1000).toString()); + client_logger.capture({ + distinctId: 'app_level', + event: 'security@auth@rate_limited', + properties: { + route: req.originalUrl, + method: req.method, + mode, + keyHash: hashValue(key), + retryAfterSec: Math.ceil(blockMs / 1000), + blockLevel: record.blockLevel, + } + }); + return res.status(429).json({ status: 'Too many attempts. Please try again later.' }); + } + + return next(); +}; + +module.exports = { + authRateLimiter, +}; diff --git a/mongoDB.js b/mongoDB.js index f6711d0..d226868 100644 --- a/mongoDB.js +++ b/mongoDB.js @@ -41,6 +41,9 @@ const getDB = new Promise((resolve, reject) => { DB.usersCol = db.db(DBName).collection("users"); DB.tokensCol = db.db(DBName).collection("tokens"); DB.invitationCol = db.db(DBName).collection("invitation"); + DB.passwordLoginTokensCol = db.db(DBName).collection("password_login_tokens"); + DB.passwordLoginTokensCol.createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(console.error); + DB.passwordLoginTokensCol.createIndex({ tokenHash: 1 }, { unique: true }).catch(console.error); DB.checkSessionOnDB = async (session_id, user_sid)=>{ const temp_id = new mongo.ObjectID(session_id); @@ -78,6 +81,42 @@ const getDB = new Promise((resolve, reject) => { return DB.usersCol.findOne({ _id }); } + DB.createPasswordLoginToken = async (userId, tokenHash, expiresAt) => { + const userObjectId = mongo.ObjectID.isValid(userId) ? new mongo.ObjectID(userId) : userId; + const tokenDoc = { + userId: userObjectId, + tokenHash, + createdAt: new Date(), + expiresAt, + usedAt: null, + }; + return DB.passwordLoginTokensCol.insertOne(tokenDoc).catch((err) => { + console.log(err); + return false; + }); + }; + + DB.consumePasswordLoginToken = async (tokenHash) => { + const now = new Date(); + const result = await DB.passwordLoginTokensCol.findOneAndUpdate( + { + tokenHash, + usedAt: null, + expiresAt: { $gt: now } + }, + { + $set: { usedAt: now } + }, + { + returnOriginal: false + } + ).catch((err) => { + console.log(err); + return false; + }); + return result?.value || null; + }; + let usernamesCache = {} DB.getUsernameByIdCache = async (userid)=>{ if(!userid) return {};