feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/src/middleware/auth-enhanced.js

@@ -0,0 +1,237 @@
+const jwt = require('jsonwebtoken');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+
+/**
+ * Enhanced admin authentication middleware
+ * Adds additional security checks beyond basic JWT validation
+ */
+async function adminAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload; // Extract payload when using complete: true
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'admin') {
+      logger.warn('Non-admin token used for admin endpoint', { 
+        userId: decoded.id,
+        tokenType: decoded.type 
+      });
+      return res.status(403).json({ error: 'Insufficient permissions' });
+    }
+    
+    // IP validation (optional - can be strict or just log)
+    const currentIp = req.ip || req.connection.remoteAddress;
+    if (decoded.ip && decoded.ip !== currentIp) {
+      logger.warn('Token used from different IP', {
+        userId: decoded.id,
+        tokenIp: decoded.ip,
+        currentIp: currentIp
+      });
+      // Optional: Reject if IP doesn't match
+      // return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if admin still exists and is active
+    const admin = await db('admin_users')
+      .where({ id: decoded.id, is_active: true })
+      .first();
+    
+    if (!admin) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Check if password was changed after token was issued
+    if (admin.password_changed_at) {
+      const passwordChangedTime = new Date(admin.password_changed_at).getTime() / 1000;
+      if (decoded.iat < passwordChangedTime) {
+        logger.warn('Token used after password change', { userId: decoded.id });
+        return res.status(401).json({ 
+          error: 'Token invalid due to password change',
+          code: 'PASSWORD_CHANGED'
+        });
+      }
+    }
+    
+    // Add user info to request
+    req.admin = {
+      id: admin.id,
+      username: admin.username,
+      email: admin.email
+    };
+    
+    next();
+  } catch (error) {
+    logger.error('Auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Enhanced gallery authentication middleware
+ */
+async function galleryAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET, {
+        issuer: 'picpeak-auth',
+        complete: true
+      });
+      decoded = decoded.payload;
+    } catch (err) {
+      if (err.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Session expired', code: 'TOKEN_EXPIRED' });
+      }
+      return res.status(401).json({ error: 'Invalid session' });
+    }
+    
+    // Verify token type
+    if (decoded.type !== 'gallery') {
+      return res.status(403).json({ error: 'Invalid access token' });
+    }
+    
+    // Check if event still exists and is active
+    const event = await db('events')
+      .where({ 
+        id: decoded.eventId, 
+        is_active: true, 
+        is_archived: false 
+      })
+      .first();
+    
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found or expired' });
+    }
+    
+    // Check if gallery has expired
+    if (new Date(event.expires_at) < new Date()) {
+      return res.status(410).json({ 
+        error: 'Gallery has expired',
+        code: 'GALLERY_EXPIRED'
+      });
+    }
+    
+    // Add event info to request
+    req.event = event;
+    req.galleryToken = decoded;
+    
+    next();
+  } catch (error) {
+    logger.error('Gallery auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Photo access authentication
+ * Validates both admin and gallery tokens for photo access
+ */
+async function photoAuth(req, res, next) {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (err) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    // Allow both admin and gallery tokens
+    if (decoded.type === 'admin') {
+      const admin = await db('admin_users')
+        .where({ id: decoded.id, is_active: true })
+        .first();
+      
+      if (!admin) {
+        return res.status(401).json({ error: 'Invalid token' });
+      }
+      
+      req.auth = { type: 'admin', user: admin };
+    } else if (decoded.type === 'gallery') {
+      const event = await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: true, 
+          is_archived: false 
+        })
+        .first();
+      
+      if (!event) {
+        return res.status(404).json({ error: 'Gallery not found' });
+      }
+      
+      // For gallery tokens, ensure they can only access their event's photos
+      req.auth = { type: 'gallery', event: event };
+    } else {
+      return res.status(403).json({ error: 'Invalid token type' });
+    }
+    
+    next();
+  } catch (error) {
+    logger.error('Photo auth middleware error:', error);
+    res.status(401).json({ error: 'Authentication failed' });
+  }
+}
+
+/**
+ * Verify gallery access for specific operations
+ */
+async function verifyGalleryAccess(req, res, next) {
+  try {
+    if (!req.auth) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    
+    const { eventId } = req.params;
+    
+    // Admins can access any gallery
+    if (req.auth.type === 'admin') {
+      return next();
+    }
+    
+    // Gallery tokens can only access their own event
+    if (req.auth.type === 'gallery') {
+      if (req.auth.event.id !== parseInt(eventId)) {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      return next();
+    }
+    
+    res.status(403).json({ error: 'Access denied' });
+  } catch (error) {
+    res.status(500).json({ error: 'Access verification failed' });
+  }
+}
+
+module.exports = { 
+  adminAuth, 
+  galleryAuth,
+  photoAuth,
+  verifyGalleryAccess
+};

backend/src/routes/adminDashboard.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
+const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
 const router = express.Router();
 
 // Get dashboard statistics
@@ -14,11 +15,15 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Get events expiring within 7 days
+    const sevenDaysFromNow = new Date();
+    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+    const now = new Date();
+    
     const expiringEvents = await db('events')
       .where('is_active', true)
       .where('is_archived', false)
-      .whereRaw('expires_at <= datetime("now", "+7 days")')
-      .whereRaw('expires_at > datetime("now")')
+      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+      .where('expires_at', '>', now.toISOString())
       .count('id as count')
       .first();
 
@@ -33,16 +38,19 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Get total views (last 30 days)
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
     const totalViews = await db('access_logs')
       .where('action', 'view')
-      .whereRaw('timestamp >= datetime("now", "-30 days")')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
     // Get total downloads (last 30 days)
     const totalDownloads = await db('access_logs')
       .where('action', 'download')
-      .whereRaw('timestamp >= datetime("now", "-30 days")')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
@@ -53,17 +61,20 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Calculate trends (compare with previous 30 days)
+    const sixtyDaysAgo = new Date();
+    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
+    
     const previousViews = await db('access_logs')
       .where('action', 'view')
-      .whereRaw('timestamp >= datetime("now", "-60 days")')
-      .whereRaw('timestamp < datetime("now", "-30 days")')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
     const previousDownloads = await db('access_logs')
       .where('action', 'download')
-      .whereRaw('timestamp >= datetime("now", "-60 days")')
-      .whereRaw('timestamp < datetime("now", "-30 days")')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
@@ -140,9 +151,12 @@ router.get('/health', adminAuth, async (req, res) => {
       .where('status', 'pending')
       .count('* as count');
     
+    const twentyFourHoursAgo = new Date();
+    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
+    
     const [failedEmails] = await db('email_queue')
       .where('status', 'failed')
-      .whereRaw('created_at >= datetime("now", "-24 hours")')
+      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
       .count('* as count');
 
     const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
@@ -194,7 +208,7 @@ router.get('/health', adminAuth, async (req, res) => {
 // Get analytics data for charts
 router.get('/analytics', adminAuth, async (req, res) => {
   try {
-    const days = parseInt(req.query.days) || 7;
+    const days = sanitizeDays(req.query.days || 7);
     
     // Generate date range
     const dates = [];
@@ -207,24 +221,29 @@ router.get('/analytics', adminAuth, async (req, res) => {
       });
     }
 
+    // Calculate the start date for queries
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - days);
+    const startDateStr = startDate.toISOString();
+
     // Get views per day
     const viewsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
       .where('action', 'view')
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Get downloads per day
     const downloadsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
       .where('action', 'download')
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Get unique visitors per day
     const visitorsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Merge data into dates array
@@ -249,7 +268,7 @@ router.get('/analytics', adminAuth, async (req, res) => {
       .select(db.raw('COUNT(*) as views'))
       .join('events', 'access_logs.event_id', 'events.id')
       .where('access_logs.action', 'view')
-      .whereRaw(`access_logs.timestamp >= datetime("now", "-${days} days")`)
+      .where('access_logs.timestamp', '>=', startDateStr)
       .groupBy('events.id')
       .orderBy('views', 'desc')
       .limit(5);
@@ -266,7 +285,7 @@ router.get('/analytics', adminAuth, async (req, res) => {
         `),
         db.raw('COUNT(*) as count')
       )
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupBy('device_type');
 
     const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);

backend/src/routes/adminEvents.js

@@ -8,6 +8,7 @@ const crypto = require('crypto');
 const fs = require('fs').promises;
 const path = require('path');
 const { archiveEvent } = require('../services/archiveService');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { formatDate } = require('../utils/dateFormatter');
 
 // Create new event
@@ -152,10 +153,11 @@ router.get('/', adminAuth, async (req, res) => {
     
     // Apply search filter
     if (search) {
+      const escapedSearch = escapeLikePattern(search);
       query = query.where((builder) => {
-        builder.where('event_name', 'like', `%${search}%`)
-          .orWhere('admin_email', 'like', `%${search}%`)
-          .orWhere('slug', 'like', `%${search}%`);
+        builder.where('event_name', 'like', `%${escapedSearch}%`)
+          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
+          .orWhere('slug', 'like', `%${escapedSearch}%`);
       });
     }
 

backend/src/routes/adminPhotos.js

@@ -6,6 +6,7 @@ const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { generateThumbnail } = require('../services/imageProcessor');
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
 const router = express.Router();
 
 // Get storage path from environment or default
@@ -473,7 +474,8 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     
     // Search by filename
     if (search) {
-      query = query.where('photos.filename', 'like', `%${search}%`);
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
     }
     
     // Sorting

backend/src/routes/auth-enhanced.js

@@ -0,0 +1,265 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+module.exports = router;

backend/src/utils/authSecurity.js

@@ -0,0 +1,189 @@
+/**
+ * Authentication Security Utilities
+ * Provides enhanced security features for authentication
+ */
+
+const { db } = require('../database/db');
+const logger = require('./logger');
+
+// Configuration constants
+const MAX_LOGIN_ATTEMPTS = 5;
+const LOCKOUT_DURATION = 30 * 60 * 1000; // 30 minutes in milliseconds
+const ATTEMPT_WINDOW = 15 * 60 * 1000; // 15 minutes window for counting attempts
+
+/**
+ * Track failed login attempt
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address of the attempt
+ * @param {string} userAgent - User agent string
+ */
+async function trackFailedAttempt(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: false
+    });
+
+    // Log security event
+    logger.warn('Failed login attempt', {
+      identifier,
+      ipAddress,
+      userAgent,
+      timestamp: new Date().toISOString()
+    });
+  } catch (error) {
+    logger.error('Error tracking failed login attempt:', error);
+  }
+}
+
+/**
+ * Track successful login
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - IP address
+ * @param {string} userAgent - User agent string
+ */
+async function trackSuccessfulLogin(identifier, ipAddress, userAgent) {
+  try {
+    await db('login_attempts').insert({
+      identifier,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      attempt_time: new Date().toISOString(),
+      success: true
+    });
+
+    // Clear old failed attempts for this user
+    const cutoffTime = new Date(Date.now() - ATTEMPT_WINDOW);
+    await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', false)
+      .where('attempt_time', '<', cutoffTime.toISOString())
+      .delete();
+  } catch (error) {
+    logger.error('Error tracking successful login:', error);
+  }
+}
+
+/**
+ * Check if account is locked due to too many failed attempts
+ * @param {string} identifier - Username or email
+ * @returns {Promise<{isLocked: boolean, remainingTime?: number}>}
+ */
+async function checkAccountLockout(identifier) {
+  try {
+    const recentWindow = new Date(Date.now() - ATTEMPT_WINDOW);
+    
+    // Get recent failed attempts
+    const failedAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('success', false)
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .orderBy('attempt_time', 'desc')
+      .limit(MAX_LOGIN_ATTEMPTS);
+
+    if (failedAttempts.length >= MAX_LOGIN_ATTEMPTS) {
+      // Check if still within lockout period
+      const oldestAttempt = failedAttempts[failedAttempts.length - 1];
+      const lockoutEnd = new Date(oldestAttempt.attempt_time).getTime() + LOCKOUT_DURATION;
+      const now = Date.now();
+
+      if (now < lockoutEnd) {
+        return {
+          isLocked: true,
+          remainingTime: Math.ceil((lockoutEnd - now) / 1000) // seconds
+        };
+      }
+    }
+
+    return { isLocked: false };
+  } catch (error) {
+    logger.error('Error checking account lockout:', error);
+    return { isLocked: false }; // Fail open to avoid locking users out due to errors
+  }
+}
+
+/**
+ * Check for suspicious login patterns
+ * @param {string} identifier - Username or email
+ * @param {string} ipAddress - Current IP address
+ * @returns {Promise<boolean>} - True if suspicious
+ */
+async function checkSuspiciousActivity(identifier, ipAddress) {
+  try {
+    // Check for rapid attempts from different IPs
+    const recentWindow = new Date(Date.now() - 5 * 60 * 1000); // 5 minutes
+    
+    const recentAttempts = await db('login_attempts')
+      .where('identifier', identifier)
+      .where('attempt_time', '>=', recentWindow.toISOString())
+      .select('ip_address')
+      .distinct('ip_address');
+
+    // If more than 3 different IPs in 5 minutes, it's suspicious
+    if (recentAttempts.length > 3) {
+      logger.warn('Suspicious login activity detected', {
+        identifier,
+        uniqueIPs: recentAttempts.length,
+        currentIP: ipAddress
+      });
+      return true;
+    }
+
+    return false;
+  } catch (error) {
+    logger.error('Error checking suspicious activity:', error);
+    return false;
+  }
+}
+
+/**
+ * Get generic error message to prevent user enumeration
+ * @returns {string}
+ */
+function getGenericAuthError() {
+  return 'Invalid credentials';
+}
+
+/**
+ * Clean up old login attempts (should be run periodically)
+ */
+async function cleanupOldAttempts() {
+  try {
+    const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 7 days
+    
+    const deleted = await db('login_attempts')
+      .where('attempt_time', '<', cutoffDate.toISOString())
+      .delete();
+
+    if (deleted > 0) {
+      logger.info(`Cleaned up ${deleted} old login attempts`);
+    }
+  } catch (error) {
+    logger.error('Error cleaning up login attempts:', error);
+  }
+}
+
+/**
+ * Initialize cleanup job
+ */
+function initializeCleanupJob() {
+  // Run cleanup every 24 hours
+  setInterval(cleanupOldAttempts, 24 * 60 * 60 * 1000);
+  
+  // Run initial cleanup
+  cleanupOldAttempts();
+}
+
+module.exports = {
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError,
+  initializeCleanupJob,
+  MAX_LOGIN_ATTEMPTS,
+  LOCKOUT_DURATION
+};

backend/src/utils/sqlSecurity.js

@@ -0,0 +1,117 @@
+/**
+ * SQL Security Utilities
+ * Provides safe methods for handling user input in SQL queries
+ */
+
+/**
+ * Validate and sanitize days parameter for date range queries
+ * @param {any} days - The days parameter from user input
+ * @returns {number} Safe integer between 1 and 365
+ */
+function sanitizeDays(days) {
+  const parsed = parseInt(days);
+  
+  // Check if it's a valid number
+  if (isNaN(parsed)) {
+    return 7; // Default to 7 days
+  }
+  
+  // Ensure it's within reasonable bounds
+  if (parsed < 1) {
+    return 1;
+  }
+  
+  if (parsed > 365) {
+    return 365; // Maximum 1 year
+  }
+  
+  return parsed;
+}
+
+/**
+ * Escape special characters in LIKE queries
+ * @param {string} input - The search string from user input
+ * @returns {string} Escaped string safe for LIKE queries
+ */
+function escapeLikePattern(input) {
+  if (!input || typeof input !== 'string') {
+    return '';
+  }
+  
+  // Escape special LIKE pattern characters
+  // In SQL LIKE patterns:
+  // % matches any sequence of characters
+  // _ matches any single character
+  // \ is the escape character
+  return input
+    .replace(/\\/g, '\\\\') // Escape backslashes first
+    .replace(/%/g, '\\%')   // Escape percent signs
+    .replace(/_/g, '\\_')   // Escape underscores
+    .replace(/'/g, "''");   // Escape single quotes for safety
+}
+
+/**
+ * Create a safe date range condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The timestamp column name
+ * @param {number} days - Number of days to go back
+ * @returns {object} Modified query with safe date range condition
+ */
+function addDateRangeCondition(query, column, days) {
+  const safeDays = sanitizeDays(days);
+  const startDate = new Date();
+  startDate.setDate(startDate.getDate() - safeDays);
+  
+  // Use Knex's built-in date comparison which handles parameterization
+  return query.where(column, '>=', startDate.toISOString());
+}
+
+/**
+ * Create a safe LIKE condition using Knex
+ * @param {object} query - Knex query builder instance
+ * @param {string} column - The column to search
+ * @param {string} pattern - The search pattern
+ * @returns {object} Modified query with safe LIKE condition
+ */
+function addLikeCondition(query, column, pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return query;
+  }
+  
+  const escapedPattern = escapeLikePattern(pattern);
+  // Knex handles parameterization of the LIKE value
+  return query.where(column, 'like', `%${escapedPattern}%`);
+}
+
+/**
+ * Validate sort column against whitelist
+ * @param {string} column - The column name to sort by
+ * @param {string[]} allowedColumns - Array of allowed column names
+ * @param {string} defaultColumn - Default column if invalid
+ * @returns {string} Safe column name
+ */
+function validateSortColumn(column, allowedColumns, defaultColumn) {
+  if (!column || !allowedColumns.includes(column)) {
+    return defaultColumn;
+  }
+  return column;
+}
+
+/**
+ * Validate sort order
+ * @param {string} order - The sort order (asc/desc)
+ * @returns {string} Safe sort order
+ */
+function validateSortOrder(order) {
+  const lowerOrder = (order || '').toLowerCase();
+  return lowerOrder === 'asc' ? 'asc' : 'desc';
+}
+
+module.exports = {
+  sanitizeDays,
+  escapeLikePattern,
+  addDateRangeCondition,
+  addLikeCondition,
+  validateSortColumn,
+  validateSortOrder
+};