feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-13 00:40:05 +02:00
parent 0d33f21ee6
commit e35ac6a41c
36 changed files with 4152 additions and 20 deletions
@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+
+/**
+ * Check Docker deployment status for security fixes
+ */
+
+console.log('=== Docker Deployment Status Check ===\n');
+
+// Color codes
+const GREEN = '\x1b[32m';
+const RED = '\x1b[31m';
+const YELLOW = '\x1b[33m';
+const RESET = '\x1b[0m';
+
+let allGood = true;
+
+// Check SQL Security
+console.log('1. SQL Injection Fixes:');
+try {
+  const { sanitizeDays, escapeLikePattern } = require('../src/utils/sqlSecurity');
+  console.log(`${GREEN}✓${RESET} sqlSecurity.js exists`);
+  console.log(`${GREEN}✓${RESET} Security functions available`);
+} catch (e) {
+  console.log(`${RED}✗${RESET} sqlSecurity.js missing`);
+  allGood = false;
+}
+
+// Check Auth Security
+console.log('\n2. Authentication Security:');
+try {
+  const authSec = require('../src/utils/authSecurity');
+  console.log(`${GREEN}✓${RESET} authSecurity.js exists`);
+  
+  const authEnhanced = require('../src/middleware/auth-enhanced');
+  console.log(`${GREEN}✓${RESET} auth-enhanced middleware exists`);
+  
+  const authRoutes = require('../src/routes/auth-enhanced');
+  console.log(`${GREEN}✓${RESET} auth-enhanced routes exist`);
+} catch (e) {
+  console.log(`${YELLOW}!${RESET} Auth security files exist but not active`);
+}
+
+// Check Database
+console.log('\n3. Database Status:');
+const { db } = require('../src/database/db');
+
+async function checkDatabase() {
+  try {
+    // Check login_attempts table
+    await db('login_attempts').count();
+    console.log(`${GREEN}✓${RESET} login_attempts table exists`);
+  } catch (e) {
+    console.log(`${YELLOW}!${RESET} login_attempts table not created (run migrations)`);
+  }
+  
+  try {
+    // Check admin_users columns
+    await db('admin_users').select('password_changed_at').limit(1);
+    console.log(`${GREEN}✓${RESET} Auth security columns exist`);
+  } catch (e) {
+    console.log(`${YELLOW}!${RESET} Auth security columns missing (run migrations)`);
+  }
+  
+  // Close database connection
+  await db.destroy();
+}
+
+// Check server configuration
+console.log('\n4. Server Configuration:');
+const fs = require('fs');
+const serverContent = fs.readFileSync('./server.js', 'utf8');
+
+if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
+  console.log(`${GREEN}✓${RESET} Using enhanced auth routes`);
+} else if (serverContent.includes("require('./src/routes/auth')")) {
+  console.log(`${YELLOW}!${RESET} Using original auth routes (enhanced not active)`);
+}
+
+if (serverContent.includes('initializeCleanupJob')) {
+  console.log(`${GREEN}✓${RESET} Auth cleanup job initialized`);
+} else {
+  console.log(`${YELLOW}!${RESET} Auth cleanup job not initialized`);
+}
+
+// Run async checks
+checkDatabase().then(() => {
+  console.log('\n=== Summary ===');
+  if (allGood) {
+    console.log(`${GREEN}All security fixes are deployed!${RESET}`);
+  } else {
+    console.log(`${YELLOW}Some security features need activation:${RESET}`);
+    console.log('1. Run migrations: npx knex migrate:latest');
+    console.log('2. Update server.js to use auth-enhanced routes');
+    console.log('3. Restart the container');
+  }
+});