Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
1.6 KiB
JavaScript
55 lines
1.6 KiB
JavaScript
const rateLimit = require('express-rate-limit')
|
|
|
|
const log = require('../utils/logger')('ratelimit')
|
|
|
|
function makeLimiter({ windowMs, max, label, message }) {
|
|
return rateLimit({
|
|
windowMs,
|
|
max,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { message },
|
|
handler: (req, res, next, options) => {
|
|
log.warn(`${label} rate limit exceeded`, { ip: req.ip, path: req.originalUrl })
|
|
res.status(options.statusCode).json(options.message)
|
|
},
|
|
})
|
|
}
|
|
|
|
// Brute-force protection on login.
|
|
const loginLimiter = makeLimiter({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 10,
|
|
label: 'login',
|
|
message: 'Too many login attempts. Please try again later.',
|
|
})
|
|
|
|
// Throttle the public contact form.
|
|
const contactLimiter = makeLimiter({
|
|
windowMs: 60 * 60 * 1000,
|
|
max: 5,
|
|
label: 'contact',
|
|
message: 'Too many messages sent. Please try again later.',
|
|
})
|
|
|
|
// Cap mobile refresh-token exchanges per IP. Legitimate apps refresh at most a
|
|
// handful of times per window; a flood is either a bug or an attempt to brute
|
|
// the refresh endpoint.
|
|
const mobileRefreshLimiter = makeLimiter({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 30,
|
|
label: 'mobile-refresh',
|
|
message: 'Too many refresh attempts. Please try again later.',
|
|
})
|
|
|
|
// Throttle SSO redirect starts per IP — cheap to trigger, and a flood is either a
|
|
// bug or an attempt to spin the OAuth flow. Generous enough for real users.
|
|
const ssoStartLimiter = makeLimiter({
|
|
windowMs: 15 * 60 * 1000,
|
|
max: 30,
|
|
label: 'sso-start',
|
|
message: 'Too many sign-in attempts. Please try again later.',
|
|
})
|
|
|
|
module.exports = { loginLimiter, contactLimiter, mobileRefreshLimiter, ssoStartLimiter }
|