added required code changes, components, and packages for login feature

backend/middleware/auth.js

@@ -0,0 +1,70 @@
+// Authentication Middleware
+
+// Require authenticated user
+function requireAuth(db) {
+    return async (req, res, next) => {
+        const sessionId = req.cookies?.session_id;
+
+        if (!sessionId) {
+            return res.status(401).json({ error: 'Authentication required' });
+        }
+
+        try {
+            const session = await new Promise((resolve, reject) => {
+                db.get(
+                    `SELECT s.*, u.id as user_id, u.username, u.email, u.role, u.is_active
+                     FROM sessions s
+                     JOIN users u ON s.user_id = u.id
+                     WHERE s.session_id = ? AND s.expires_at > datetime('now')`,
+                    [sessionId],
+                    (err, row) => {
+                        if (err) reject(err);
+                        else resolve(row);
+                    }
+                );
+            });
+
+            if (!session) {
+                return res.status(401).json({ error: 'Session expired or invalid' });
+            }
+
+            if (!session.is_active) {
+                return res.status(401).json({ error: 'Account is disabled' });
+            }
+
+            // Attach user to request
+            req.user = {
+                id: session.user_id,
+                username: session.username,
+                email: session.email,
+                role: session.role
+            };
+
+            next();
+        } catch (err) {
+            console.error('Auth middleware error:', err);
+            return res.status(500).json({ error: 'Authentication error' });
+        }
+    };
+}
+
+// Require specific role(s)
+function requireRole(...allowedRoles) {
+    return (req, res, next) => {
+        if (!req.user) {
+            return res.status(401).json({ error: 'Authentication required' });
+        }
+
+        if (!allowedRoles.includes(req.user.role)) {
+            return res.status(403).json({
+                error: 'Insufficient permissions',
+                required: allowedRoles,
+                current: req.user.role
+            });
+        }
+
+        next();
+    };
+}
+
+module.exports = { requireAuth, requireRole };

backend/routes/auth.js

@@ -0,0 +1,184 @@
+// Authentication Routes
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
+
+function createAuthRouter(db) {
+    const router = express.Router();
+
+    // Login
+    router.post('/login', async (req, res) => {
+        const { username, password } = req.body;
+
+        if (!username || !password) {
+            return res.status(400).json({ error: 'Username and password are required' });
+        }
+
+        try {
+            // Find user
+            const user = await new Promise((resolve, reject) => {
+                db.get(
+                    'SELECT * FROM users WHERE username = ?',
+                    [username],
+                    (err, row) => {
+                        if (err) reject(err);
+                        else resolve(row);
+                    }
+                );
+            });
+
+            if (!user) {
+                return res.status(401).json({ error: 'Invalid username or password' });
+            }
+
+            if (!user.is_active) {
+                return res.status(401).json({ error: 'Account is disabled' });
+            }
+
+            // Verify password
+            const validPassword = await bcrypt.compare(password, user.password_hash);
+            if (!validPassword) {
+                return res.status(401).json({ error: 'Invalid username or password' });
+            }
+
+            // Generate session ID
+            const sessionId = crypto.randomBytes(32).toString('hex');
+            const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours
+
+            // Create session
+            await new Promise((resolve, reject) => {
+                db.run(
+                    'INSERT INTO sessions (session_id, user_id, expires_at) VALUES (?, ?, ?)',
+                    [sessionId, user.id, expiresAt.toISOString()],
+                    (err) => {
+                        if (err) reject(err);
+                        else resolve();
+                    }
+                );
+            });
+
+            // Update last login
+            await new Promise((resolve, reject) => {
+                db.run(
+                    'UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?',
+                    [user.id],
+                    (err) => {
+                        if (err) reject(err);
+                        else resolve();
+                    }
+                );
+            });
+
+            // Set cookie
+            res.cookie('session_id', sessionId, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'lax',
+                maxAge: 24 * 60 * 60 * 1000 // 24 hours
+            });
+
+            res.json({
+                message: 'Login successful',
+                user: {
+                    id: user.id,
+                    username: user.username,
+                    email: user.email,
+                    role: user.role
+                }
+            });
+        } catch (err) {
+            console.error('Login error:', err);
+            res.status(500).json({ error: 'Login failed' });
+        }
+    });
+
+    // Logout
+    router.post('/logout', async (req, res) => {
+        const sessionId = req.cookies?.session_id;
+
+        if (sessionId) {
+            // Delete session from database
+            await new Promise((resolve) => {
+                db.run(
+                    'DELETE FROM sessions WHERE session_id = ?',
+                    [sessionId],
+                    () => resolve()
+                );
+            });
+        }
+
+        // Clear cookie
+        res.clearCookie('session_id');
+        res.json({ message: 'Logged out successfully' });
+    });
+
+    // Get current user
+    router.get('/me', async (req, res) => {
+        const sessionId = req.cookies?.session_id;
+
+        if (!sessionId) {
+            return res.status(401).json({ error: 'Not authenticated' });
+        }
+
+        try {
+            const session = await new Promise((resolve, reject) => {
+                db.get(
+                    `SELECT s.*, u.id as user_id, u.username, u.email, u.role, u.is_active
+                     FROM sessions s
+                     JOIN users u ON s.user_id = u.id
+                     WHERE s.session_id = ? AND s.expires_at > datetime('now')`,
+                    [sessionId],
+                    (err, row) => {
+                        if (err) reject(err);
+                        else resolve(row);
+                    }
+                );
+            });
+
+            if (!session) {
+                res.clearCookie('session_id');
+                return res.status(401).json({ error: 'Session expired' });
+            }
+
+            if (!session.is_active) {
+                res.clearCookie('session_id');
+                return res.status(401).json({ error: 'Account is disabled' });
+            }
+
+            res.json({
+                user: {
+                    id: session.user_id,
+                    username: session.username,
+                    email: session.email,
+                    role: session.role
+                }
+            });
+        } catch (err) {
+            console.error('Get user error:', err);
+            res.status(500).json({ error: 'Failed to get user' });
+        }
+    });
+
+    // Clean up expired sessions (can be called periodically)
+    router.post('/cleanup-sessions', async (req, res) => {
+        try {
+            await new Promise((resolve, reject) => {
+                db.run(
+                    "DELETE FROM sessions WHERE expires_at < datetime('now')",
+                    (err) => {
+                        if (err) reject(err);
+                        else resolve();
+                    }
+                );
+            });
+            res.json({ message: 'Expired sessions cleaned up' });
+        } catch (err) {
+            console.error('Session cleanup error:', err);
+            res.status(500).json({ error: 'Cleanup failed' });
+        }
+    });
+
+    return router;
+}
+
+module.exports = createAuthRouter;

backend/routes/users.js

@@ -0,0 +1,217 @@
+// User Management Routes (Admin only)
+const express = require('express');
+const bcrypt = require('bcryptjs');
+
+function createUsersRouter(db, requireAuth, requireRole) {
+    const router = express.Router();
+
+    // All routes require admin role
+    router.use(requireAuth(db), requireRole('admin'));
+
+    // Get all users
+    router.get('/', async (req, res) => {
+        try {
+            const users = await new Promise((resolve, reject) => {
+                db.all(
+                    `SELECT id, username, email, role, is_active, created_at, last_login
+                     FROM users ORDER BY created_at DESC`,
+                    (err, rows) => {
+                        if (err) reject(err);
+                        else resolve(rows);
+                    }
+                );
+            });
+            res.json(users);
+        } catch (err) {
+            console.error('Get users error:', err);
+            res.status(500).json({ error: 'Failed to fetch users' });
+        }
+    });
+
+    // Get single user
+    router.get('/:id', async (req, res) => {
+        try {
+            const user = await new Promise((resolve, reject) => {
+                db.get(
+                    `SELECT id, username, email, role, is_active, created_at, last_login
+                     FROM users WHERE id = ?`,
+                    [req.params.id],
+                    (err, row) => {
+                        if (err) reject(err);
+                        else resolve(row);
+                    }
+                );
+            });
+
+            if (!user) {
+                return res.status(404).json({ error: 'User not found' });
+            }
+
+            res.json(user);
+        } catch (err) {
+            console.error('Get user error:', err);
+            res.status(500).json({ error: 'Failed to fetch user' });
+        }
+    });
+
+    // Create new user
+    router.post('/', async (req, res) => {
+        const { username, email, password, role } = req.body;
+
+        if (!username || !email || !password) {
+            return res.status(400).json({ error: 'Username, email, and password are required' });
+        }
+
+        if (role && !['admin', 'editor', 'viewer'].includes(role)) {
+            return res.status(400).json({ error: 'Invalid role. Must be admin, editor, or viewer' });
+        }
+
+        try {
+            const passwordHash = await bcrypt.hash(password, 10);
+
+            const result = await new Promise((resolve, reject) => {
+                db.run(
+                    `INSERT INTO users (username, email, password_hash, role)
+                     VALUES (?, ?, ?, ?)`,
+                    [username, email, passwordHash, role || 'viewer'],
+                    function(err) {
+                        if (err) reject(err);
+                        else resolve({ id: this.lastID });
+                    }
+                );
+            });
+
+            res.status(201).json({
+                message: 'User created successfully',
+                user: {
+                    id: result.id,
+                    username,
+                    email,
+                    role: role || 'viewer'
+                }
+            });
+        } catch (err) {
+            console.error('Create user error:', err);
+            if (err.message.includes('UNIQUE constraint failed')) {
+                return res.status(409).json({ error: 'Username or email already exists' });
+            }
+            res.status(500).json({ error: 'Failed to create user' });
+        }
+    });
+
+    // Update user
+    router.patch('/:id', async (req, res) => {
+        const { username, email, password, role, is_active } = req.body;
+        const userId = req.params.id;
+
+        // Prevent self-demotion from admin
+        if (userId == req.user.id && role && role !== 'admin') {
+            return res.status(400).json({ error: 'Cannot remove your own admin role' });
+        }
+
+        // Prevent self-deactivation
+        if (userId == req.user.id && is_active === false) {
+            return res.status(400).json({ error: 'Cannot deactivate your own account' });
+        }
+
+        try {
+            const updates = [];
+            const values = [];
+
+            if (username) {
+                updates.push('username = ?');
+                values.push(username);
+            }
+            if (email) {
+                updates.push('email = ?');
+                values.push(email);
+            }
+            if (password) {
+                const passwordHash = await bcrypt.hash(password, 10);
+                updates.push('password_hash = ?');
+                values.push(passwordHash);
+            }
+            if (role) {
+                if (!['admin', 'editor', 'viewer'].includes(role)) {
+                    return res.status(400).json({ error: 'Invalid role' });
+                }
+                updates.push('role = ?');
+                values.push(role);
+            }
+            if (typeof is_active === 'boolean') {
+                updates.push('is_active = ?');
+                values.push(is_active ? 1 : 0);
+            }
+
+            if (updates.length === 0) {
+                return res.status(400).json({ error: 'No fields to update' });
+            }
+
+            values.push(userId);
+
+            await new Promise((resolve, reject) => {
+                db.run(
+                    `UPDATE users SET ${updates.join(', ')} WHERE id = ?`,
+                    values,
+                    function(err) {
+                        if (err) reject(err);
+                        else resolve({ changes: this.changes });
+                    }
+                );
+            });
+
+            // If user was deactivated, delete their sessions
+            if (is_active === false) {
+                await new Promise((resolve) => {
+                    db.run('DELETE FROM sessions WHERE user_id = ?', [userId], () => resolve());
+                });
+            }
+
+            res.json({ message: 'User updated successfully' });
+        } catch (err) {
+            console.error('Update user error:', err);
+            if (err.message.includes('UNIQUE constraint failed')) {
+                return res.status(409).json({ error: 'Username or email already exists' });
+            }
+            res.status(500).json({ error: 'Failed to update user' });
+        }
+    });
+
+    // Delete user
+    router.delete('/:id', async (req, res) => {
+        const userId = req.params.id;
+
+        // Prevent self-deletion
+        if (userId == req.user.id) {
+            return res.status(400).json({ error: 'Cannot delete your own account' });
+        }
+
+        try {
+            // Delete sessions first (foreign key)
+            await new Promise((resolve) => {
+                db.run('DELETE FROM sessions WHERE user_id = ?', [userId], () => resolve());
+            });
+
+            // Delete user
+            const result = await new Promise((resolve, reject) => {
+                db.run('DELETE FROM users WHERE id = ?', [userId], function(err) {
+                    if (err) reject(err);
+                    else resolve({ changes: this.changes });
+                });
+            });
+
+            if (result.changes === 0) {
+                return res.status(404).json({ error: 'User not found' });
+            }
+
+            res.json({ message: 'User deleted successfully' });
+        } catch (err) {
+            console.error('Delete user error:', err);
+            res.status(500).json({ error: 'Failed to delete user' });
+        }
+    });
+
+    return router;
+}
+
+module.exports = createUsersRouter;

backend/server.js

@@ -1,5 +1,5 @@
 // CVE Management Backend API
-// Install: npm install express sqlite3 multer cors dotenv
+// Install: npm install express sqlite3 multer cors dotenv bcryptjs cookie-parser
 
 require('dotenv').config();
 
@@ -7,12 +7,19 @@ const express = require('express');
 const sqlite3 = require('sqlite3').verbose();
 const multer = require('multer');
 const cors = require('cors');
+const cookieParser = require('cookie-parser');
 const path = require('path');
 const fs = require('fs');
 
+// Auth imports
+const { requireAuth, requireRole } = require('./middleware/auth');
+const createAuthRouter = require('./routes/auth');
+const createUsersRouter = require('./routes/users');
+
 const app = express();
 const PORT = process.env.PORT || 3001;
 const API_HOST = process.env.API_HOST || 'localhost';
+const SESSION_SECRET = process.env.SESSION_SECRET || 'default-secret-change-me';
 const CORS_ORIGINS = process.env.CORS_ORIGINS
     ? process.env.CORS_ORIGINS.split(',')
     : ['http://localhost:3000'];
@@ -29,6 +36,7 @@ app.use(cors({
   credentials: true
 }));
 app.use(express.json());
+app.use(cookieParser());
 app.use('/uploads', express.static('uploads'));
 
 // Database connection
@@ -37,6 +45,12 @@ const db = new sqlite3.Database('./cve_database.db', (err) => {
     else console.log('Connected to CVE database');
 });
 
+// Auth routes (public)
+app.use('/api/auth', createAuthRouter(db));
+
+// User management routes (admin only)
+app.use('/api/users', createUsersRouter(db, requireAuth, requireRole));
+
 // Simple storage - upload to temp directory first
 const storage = multer.diskStorage({
     destination: (req, file, cb) => {
@@ -59,8 +73,8 @@ const upload = multer({
 
 // ========== CVE ENDPOINTS ==========
 
-// Get all CVEs with optional filters
-app.get('/api/cves', (req, res) => {
+// Get all CVEs with optional filters (authenticated users)
+app.get('/api/cves', requireAuth(db), (req, res) => {
     const { search, vendor, severity, status } = req.query;
     
     let query = `
@@ -106,8 +120,8 @@ app.get('/api/cves', (req, res) => {
     });
 });
 
-// Check if CVE exists and get its status - UPDATED FOR MULTI-VENDOR
-app.get('/api/cves/check/:cveId', (req, res) => {
+// Check if CVE exists and get its status - UPDATED FOR MULTI-VENDOR (authenticated users)
+app.get('/api/cves/check/:cveId', requireAuth(db), (req, res) => {
     const { cveId } = req.params;
     
     const query = `
@@ -153,8 +167,8 @@ app.get('/api/cves/check/:cveId', (req, res) => {
     });
 });
 
-// NEW ENDPOINT: Get all vendors for a specific CVE
-app.get('/api/cves/:cveId/vendors', (req, res) => {
+// NEW ENDPOINT: Get all vendors for a specific CVE (authenticated users)
+app.get('/api/cves/:cveId/vendors', requireAuth(db), (req, res) => {
     const { cveId } = req.params;
     
     const query = `
@@ -173,8 +187,8 @@ app.get('/api/cves/:cveId/vendors', (req, res) => {
 });
 
 
-// Create new CVE entry - ALLOW MULTIPLE VENDORS
-app.post('/api/cves', (req, res) => {
+// Create new CVE entry - ALLOW MULTIPLE VENDORS (editor or admin)
+app.post('/api/cves', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
     console.log('=== ADD CVE REQUEST ===');
     console.log('Body:', req.body);
     console.log('=======================');
@@ -210,8 +224,8 @@ app.post('/api/cves', (req, res) => {
 });
 
 
-// Update CVE status
-app.patch('/api/cves/:cveId/status', (req, res) => {
+// Update CVE status (editor or admin)
+app.patch('/api/cves/:cveId/status', requireAuth(db), requireRole('editor', 'admin'), (req, res) => {
     const { cveId } = req.params;
     const { status } = req.body;
     
@@ -228,8 +242,8 @@ app.patch('/api/cves/:cveId/status', (req, res) => {
 
 // ========== DOCUMENT ENDPOINTS ==========
 
-// Get documents for a CVE - FILTER BY VENDOR
-app.get('/api/cves/:cveId/documents', (req, res) => {
+// Get documents for a CVE - FILTER BY VENDOR (authenticated users)
+app.get('/api/cves/:cveId/documents', requireAuth(db), (req, res) => {
     const { cveId } = req.params;
     const { vendor } = req.query;  // NEW: Optional vendor filter
     
@@ -251,8 +265,8 @@ app.get('/api/cves/:cveId/documents', (req, res) => {
     });
 });
 
-// Upload document - ADD ERROR HANDLING FOR MULTER
-app.post('/api/cves/:cveId/documents', (req, res, next) => {
+// Upload document - ADD ERROR HANDLING FOR MULTER (editor or admin)
+app.post('/api/cves/:cveId/documents', requireAuth(db), requireRole('editor', 'admin'), (req, res, next) => {
     upload.single('file')(req, res, (err) => {
         if (err) {
             console.error('MULTER ERROR:', err);
@@ -327,8 +341,8 @@ app.post('/api/cves/:cveId/documents', (req, res, next) => {
         });
     });
 });
-// Delete document
-app.delete('/api/documents/:id', (req, res) => {
+// Delete document (admin only)
+app.delete('/api/documents/:id', requireAuth(db), requireRole('admin'), (req, res) => {
     const { id } = req.params;
     
     // First get the file path to delete the actual file
@@ -352,8 +366,8 @@ app.delete('/api/documents/:id', (req, res) => {
 
 // ========== UTILITY ENDPOINTS ==========
 
-// Get all vendors
-app.get('/api/vendors', (req, res) => {
+// Get all vendors (authenticated users)
+app.get('/api/vendors', requireAuth(db), (req, res) => {
     const query = `SELECT DISTINCT vendor FROM cves ORDER BY vendor`;
     
     db.all(query, [], (err, rows) => {
@@ -364,8 +378,8 @@ app.get('/api/vendors', (req, res) => {
     });
 });
 
-// Get statistics
-app.get('/api/stats', (req, res) => {
+// Get statistics (authenticated users)
+app.get('/api/stats', requireAuth(db), (req, res) => {
     const query = `
         SELECT 
             COUNT(DISTINCT c.id) as total_cves,

backend/setup.js

@@ -2,6 +2,7 @@
 // This creates a fresh database with multi-vendor support built-in
 
 const sqlite3 = require('sqlite3').verbose();
+const bcrypt = require('bcryptjs');
 const fs = require('fs');
 const path = require('path');
 
@@ -59,6 +60,34 @@ function initializeDatabase() {
             CREATE INDEX IF NOT EXISTS idx_doc_vendor ON documents(vendor);
             CREATE INDEX IF NOT EXISTS idx_doc_type ON documents(type);
 
+            -- Users table for authentication
+            CREATE TABLE IF NOT EXISTS users (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                username VARCHAR(50) UNIQUE NOT NULL,
+                email VARCHAR(255) UNIQUE NOT NULL,
+                password_hash VARCHAR(255) NOT NULL,
+                role VARCHAR(20) NOT NULL DEFAULT 'viewer',
+                is_active BOOLEAN DEFAULT 1,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                last_login TIMESTAMP,
+                CHECK (role IN ('admin', 'editor', 'viewer'))
+            );
+
+            -- Sessions table for session management
+            CREATE TABLE IF NOT EXISTS sessions (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                session_id VARCHAR(255) UNIQUE NOT NULL,
+                user_id INTEGER NOT NULL,
+                expires_at TIMESTAMP NOT NULL,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+
+            CREATE INDEX IF NOT EXISTS idx_sessions_session_id ON sessions(session_id);
+            CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
+            CREATE INDEX IF NOT EXISTS idx_sessions_expires ON sessions(expires_at);
+            CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
+
             INSERT OR IGNORE INTO required_documents (vendor, document_type, is_mandatory, description) VALUES
             ('Microsoft', 'advisory', 1, 'Official Microsoft Security Advisory'),
             ('Microsoft', 'screenshot', 0, 'Proof of patch application'),
@@ -109,6 +138,42 @@ function createUploadsDirectory() {
     }
 }
 
+// Create default admin user
+async function createDefaultAdmin(db) {
+    return new Promise((resolve, reject) => {
+        // Check if admin already exists
+        db.get('SELECT id FROM users WHERE username = ?', ['admin'], async (err, row) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+
+            if (row) {
+                console.log('✓ Default admin user already exists');
+                resolve();
+                return;
+            }
+
+            // Create admin user with password 'admin123'
+            const passwordHash = await bcrypt.hash('admin123', 10);
+
+            db.run(
+                `INSERT INTO users (username, email, password_hash, role, is_active)
+                 VALUES (?, ?, ?, ?, ?)`,
+                ['admin', 'admin@localhost', passwordHash, 'admin', 1],
+                (err) => {
+                    if (err) {
+                        reject(err);
+                    } else {
+                        console.log('✓ Created default admin user (admin/admin123)');
+                        resolve();
+                    }
+                }
+            );
+        });
+    });
+}
+
 // Add sample CVE data (optional - for testing)
 async function addSampleData(db) {
     console.log('\n📝 Adding sample CVE data for testing...');
@@ -179,12 +244,14 @@ function displaySummary() {
     console.log('╚════════════════════════════════════════════════════════╝');
     console.log('\n📊 What was created:');
     console.log('   ✓ SQLite database (cve_database.db)');
-    console.log('   ✓ Tables: cves, documents, required_documents');
+    console.log('   ✓ Tables: cves, documents, required_documents, users, sessions');
     console.log('   ✓ Multi-vendor support with UNIQUE(cve_id, vendor)');
     console.log('   ✓ Vendor column in documents table');
+    console.log('   ✓ User authentication with session-based auth');
     console.log('   ✓ Indexes for fast queries');
     console.log('   ✓ Document compliance view');
     console.log('   ✓ Uploads directory for file storage');
+    console.log('   ✓ Default admin user (admin/admin123)');
     console.log('\n📁 File structure will be:');
     console.log('   uploads/');
     console.log('     └── CVE-XXXX-XXXX/');
@@ -219,7 +286,10 @@ async function main() {
         
         // Initialize database
         const db = await initializeDatabase();
-        
+
+        // Create default admin user
+        await createDefaultAdmin(db);
+
         // Add sample data
         await addSampleData(db);