Introduction to
Web Authentication

const jwt = require('jsonwebtoken');
const SECRET = process.env.JWT_SECRET;

// Issue tokens after successful login
function issueTokens(user) {
  const accessToken = jwt.sign(
    { sub: user.id, role: user.role },
    SECRET,
    { expiresIn: '15m' }
  );
  const refreshToken = jwt.sign(
    { sub: user.id, type: 'refresh' },
    SECRET,
    { expiresIn: '7d' }
  );
  return { accessToken, refreshToken };
}

app.post('/login', async (req, res) => {
  const user = await authenticate(req.body);
  if (!user) return res.status(401).json({ error: 'Bad credentials' });
  const tokens = issueTokens(user);
  // Store refresh token hash in DB for revocation
  await RefreshToken.create({ userId: user.id,
    hash: hashToken(tokens.refreshToken) });
  res.json(tokens);
});

// Middleware: verify access token
function authenticate(req, res, next) {
  const header = req.headers.authorization;
  if (!header?.startsWith('Bearer '))
    return res.status(401).json({ error: 'No token' });

  try {
    req.user = jwt.verify(header.slice(7), SECRET);
    next();
  } catch (err) {
    if (err.name === 'TokenExpiredError')
      return res.status(401).json({ error: 'Token expired' });
    res.status(401).json({ error: 'Invalid token' });
  }
}

// Refresh endpoint
app.post('/refresh', async (req, res) => {
  const { refreshToken } = req.body;
  const payload = jwt.verify(refreshToken, SECRET);
  const stored = await RefreshToken.findOne({
    userId: payload.sub,
    hash: hashToken(refreshToken)
  });
  if (!stored) return res.status(403).json({ error: 'Revoked' });
  const user = await User.findById(payload.sub);
  res.json(issueTokens(user));
});

const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(new GoogleStrategy({
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/auth/google/callback'
  },
  async (accessToken, refreshToken, profile, done) => {
    // Find or create user in database
    let user = await User.findOne({
      where: { googleId: profile.id }
    });
    if (!user) {
      user = await User.create({
        googleId: profile.id,
        email: profile.emails[0].value,
        name: profile.displayName,
        avatar: profile.photos[0].value
      });
    }
    return done(null, user);
  }
));

// Serialisation for session persistence
passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser(async (id, done) => {
  const user = await User.findByPk(id);
  done(null, user);
});

// Mount middleware
app.use(passport.initialize());
app.use(passport.session());

// Routes
app.get('/auth/google',
  passport.authenticate('google', {
    scope: ['profile', 'email']
  })
);

app.get('/auth/google/callback',
  passport.authenticate('google', {
    failureRedirect: '/login'
  }),
  (req, res) => res.redirect('/dashboard')
);

// GitHub strategy follows the same pattern
// npm install passport-github2
// passport.use(new GitHubStrategy({ ... }))

// bcrypt — most widely used
const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12; // ~250ms on modern hardware

async function register(email, password) {
  const hash = await bcrypt.hash(password, SALT_ROUNDS);
  // hash = $2b$12$LJ3m4ys...(60 chars, salt embedded)
  await User.create({ email, passwordHash: hash });
}

async function login(email, password) {
  const user = await User.findByEmail(email);
  if (!user) return null;
  // Constant-time comparison prevents timing attacks
  const valid = await bcrypt.compare(password, user.passwordHash);
  return valid ? user : null;
}

// argon2 — OWASP first choice
const argon2 = require('argon2');

const hash = await argon2.hash(password, {
  type: argon2.argon2id,
  memoryCost: 65536,  // 64 MB
  timeCost: 3,        // iterations
  parallelism: 4
});
// $argon2id$v=19$m=65536,t=3,p=4$salt$hash

const valid = await argon2.verify(hash, password);

// scrypt — built into Node, no npm package needed
const { scrypt, randomBytes } = require('crypto');
const { promisify } = require('util');
const scryptAsync = promisify(scrypt);

async function hashPassword(password) {
  const salt = randomBytes(16).toString('hex');
  const derived = await scryptAsync(password, salt, 64);
  return `${salt}:${derived.toString('hex')}`;
}

const cors = require('cors');

// Simple: allow specific origin with credentials
app.use(cors({
  origin: 'https://app.example.com',
  credentials: true, // Access-Control-Allow-Credentials
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  maxAge: 86400 // preflight cache (24h)
}));

// Dynamic origin (multiple allowed origins)
const allowedOrigins = [
  'https://app.example.com',
  'https://admin.example.com'
];

app.use(cors({
  origin: (origin, cb) => {
    if (!origin || allowedOrigins.includes(origin))
      cb(null, true);
    else
      cb(new Error('Not allowed by CORS'));
  },
  credentials: true
}));

// Permission model (DB schema)
// users       -> user_roles -> roles -> role_permissions -> permissions
// Many-to-many relationships allow flexible assignment

const ROLES = {
  viewer:     ['read:articles', 'read:comments'],
  editor:     ['read:articles', 'read:comments',
               'write:articles', 'write:comments'],
  admin:      ['read:articles', 'read:comments',
               'write:articles', 'write:comments',
               'manage:users', 'manage:settings'],
};

// Middleware guard factory
function requirePermission(...perms) {
  return (req, res, next) => {
    const userPerms = ROLES[req.user.role] || [];
    const hasAll = perms.every(p =>
      userPerms.includes(p)
    );
    if (!hasAll) {
      return res.status(403).json({
        error: 'Insufficient permissions'
      });
    }
    next();
  };
}

// Usage in routes
app.get('/articles',
  authenticate,
  requirePermission('read:articles'),
  articleController.list
);

app.delete('/users/:id',
  authenticate,
  requirePermission('manage:users'),
  userController.delete
);

// Session rotation after login (prevent fixation)
app.post('/login', async (req, res) => {
  const user = await authenticate(req.body);
  if (!user) return res.status(401).end();

  // Regenerate session ID — old ID is invalidated
  req.session.regenerate((err) => {
    req.session.userId = user.id;
    req.session.role = user.role;
    req.session.loginAt = Date.now();
    req.session.save(() => res.redirect('/dashboard'));
  });
});

// Logout: destroy session
app.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    res.clearCookie('connect.sid');
    res.redirect('/login');
  });
});

// Redis session store with TTL
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient({ url: process.env.REDIS_URL });
await redisClient.connect();

app.use(session({
  store: new RedisStore({
    client: redisClient,
    prefix: 'sess:',
    ttl: 1800 // 30 min TTL, auto-renewed on activity
  }),
  rolling: true, // reset TTL on every request
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true, maxAge: 1800000 }
}));

// Force logout all sessions for a user (e.g., password change)
async function invalidateAllSessions(userId) {
  const keys = await redisClient.keys('sess:*');
  for (const key of keys) {
    const data = JSON.parse(await redisClient.get(key));
    if (data.userId === userId) await redisClient.del(key);
  }
}

// Rate limiting with express-rate-limit
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5,                    // 5 attempts per window
  message: { error: 'Too many login attempts' },
  standardHeaders: true,
  keyGenerator: (req) => req.body.email || req.ip
});

app.post('/login', loginLimiter, loginHandler);