cve-dashboard/backend/routes/auth.js

// Authentication Routes
const express = require('express');
const bcrypt = require('bcryptjs');
const crypto = require('crypto');
const rateLimit = require('express-rate-limit');
const { requireAuth, requireGroup } = require('../middleware/auth');

const loginLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 20, // 20 attempts per window
    standardHeaders: true,
    legacyHeaders: false,
    message: { error: 'Too many login attempts. Please try again in 15 minutes.' }
});

function createAuthRouter(db, logAudit) {
    const router = express.Router();

    // Login
    router.post('/login', loginLimiter, async (req, res) => {
        const { username, password } = req.body;

        if (!username || !password) {
            return res.status(400).json({ error: 'Username and password are required' });
        }

        try {
            // Find user
            const user = await new Promise((resolve, reject) => {
                db.get(
                    'SELECT * FROM users WHERE username = ?',
                    [username],
                    (err, row) => {
                        if (err) reject(err);
                        else resolve(row);
                    }
                );
            });

            if (!user) {
                logAudit(db, {
                    userId: null,
                    username: username,
                    action: 'login_failed',
                    entityType: 'auth',
                    entityId: null,
                    details: { reason: 'user_not_found' },
                    ipAddress: req.ip
                });
                return res.status(401).json({ error: 'Invalid username or password' });
            }

            if (!user.is_active) {
                logAudit(db, {
                    userId: user.id,
                    username: username,
                    action: 'login_failed',
                    entityType: 'auth',
                    entityId: null,
                    details: { reason: 'account_disabled' },
                    ipAddress: req.ip
                });
                return res.status(401).json({ error: 'Account is disabled' });
            }

            // Verify password
            const validPassword = await bcrypt.compare(password, user.password_hash);
            if (!validPassword) {
                logAudit(db, {
                    userId: user.id,
                    username: username,
                    action: 'login_failed',
                    entityType: 'auth',
                    entityId: null,
                    details: { reason: 'invalid_password' },
                    ipAddress: req.ip
                });
                return res.status(401).json({ error: 'Invalid username or password' });
            }

            // Generate session ID
            const sessionId = crypto.randomBytes(32).toString('hex');
            const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours

            // Create session
            await new Promise((resolve, reject) => {
                db.run(
                    'INSERT INTO sessions (session_id, user_id, expires_at) VALUES (?, ?, ?)',
                    [sessionId, user.id, expiresAt.toISOString()],
                    (err) => {
                        if (err) reject(err);
                        else resolve();
                    }
                );
            });

            // Update last login
            await new Promise((resolve, reject) => {
                db.run(
                    'UPDATE users SET last_login = CURRENT_TIMESTAMP WHERE id = ?',
                    [user.id],
                    (err) => {
                        if (err) reject(err);
                        else resolve();
                    }
                );
            });

            // Set cookie
            res.cookie('session_id', sessionId, {
                httpOnly: true,
                secure: process.env.NODE_ENV === 'production',
                sameSite: 'lax',
                maxAge: 24 * 60 * 60 * 1000 // 24 hours
            });

            logAudit(db, {
                userId: user.id,
                username: user.username,
                action: 'login',
                entityType: 'auth',
                entityId: null,
                details: { group: user.user_group },
                ipAddress: req.ip
            });

            res.json({
                message: 'Login successful',
                user: {
                    id: user.id,
                    username: user.username,
                    email: user.email,
                    group: user.user_group
                }
            });
        } catch (err) {
            console.error('Login error:', err);
            res.status(500).json({ error: 'Login failed' });
        }
    });

    // Logout
    router.post('/logout', async (req, res) => {
        const sessionId = req.cookies?.session_id;

        if (sessionId) {
            // Look up user before deleting session
            const session = await new Promise((resolve) => {
                db.get(
                    `SELECT u.id as user_id, u.username FROM sessions s
                     JOIN users u ON s.user_id = u.id
                     WHERE s.session_id = ?`,
                    [sessionId],
                    (err, row) => resolve(row || null)
                );
            });

            // Delete session from database
            await new Promise((resolve) => {
                db.run(
                    'DELETE FROM sessions WHERE session_id = ?',
                    [sessionId],
                    () => resolve()
                );
            });

            if (session) {
                logAudit(db, {
                    userId: session.user_id,
                    username: session.username,
                    action: 'logout',
                    entityType: 'auth',
                    entityId: null,
                    details: null,
                    ipAddress: req.ip
                });
            }
        }

        // Clear cookie
        res.clearCookie('session_id');
        res.json({ message: 'Logged out successfully' });
    });

    // Get current user
    router.get('/me', async (req, res) => {
        const sessionId = req.cookies?.session_id;

        if (!sessionId) {
            return res.status(401).json({ error: 'Not authenticated' });
        }

        try {
            const session = await new Promise((resolve, reject) => {
                db.get(
                    `SELECT s.*, u.id as user_id, u.username, u.email, u.user_group, u.is_active
                     FROM sessions s
                     JOIN users u ON s.user_id = u.id
                     WHERE s.session_id = ? AND s.expires_at > datetime('now')`,
                    [sessionId],
                    (err, row) => {
                        if (err) reject(err);
                        else resolve(row);
                    }
                );
            });

            if (!session) {
                res.clearCookie('session_id');
                return res.status(401).json({ error: 'Session expired' });
            }

            if (!session.is_active) {
                res.clearCookie('session_id');
                return res.status(401).json({ error: 'Account is disabled' });
            }

            res.json({
                user: {
                    id: session.user_id,
                    username: session.username,
                    email: session.email,
                    group: session.user_group
                }
            });
        } catch (err) {
            console.error('Get user error:', err);
            res.status(500).json({ error: 'Failed to get user' });
        }
    });

    // Clean up expired sessions (admin only)
    router.post('/cleanup-sessions', requireAuth(db), requireGroup('Admin'), async (req, res) => {
        try {
            await new Promise((resolve, reject) => {
                db.run(
                    "DELETE FROM sessions WHERE expires_at < datetime('now')",
                    (err) => {
                        if (err) reject(err);
                        else resolve();
                    }
                );
            });
            res.json({ message: 'Expired sessions cleaned up' });
        } catch (err) {
            console.error('Session cleanup error:', err);
            res.status(500).json({ error: 'Cleanup failed' });
        }
    });

    return router;
}

module.exports = createAuthRouter;