paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
80 lines
2.8 KiB
JavaScript
80 lines
2.8 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Activate enhanced authentication in server.js
|
|
* This script safely updates the server configuration
|
|
*/
|
|
|
|
const fs = require('fs').promises;
|
|
const path = require('path');
|
|
|
|
async function activateEnhancedAuth() {
|
|
console.log('=== Activating Enhanced Authentication ===\n');
|
|
|
|
try {
|
|
const serverPath = path.join(__dirname, '../server.js');
|
|
|
|
// Read current server.js
|
|
let serverContent = await fs.readFile(serverPath, 'utf8');
|
|
|
|
// Backup current server.js
|
|
const backupPath = `${serverPath}.backup.${Date.now()}`;
|
|
await fs.writeFile(backupPath, serverContent);
|
|
console.log(`✓ Created backup: ${path.basename(backupPath)}`);
|
|
|
|
// Check current state
|
|
if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
|
|
console.log('! Enhanced auth already active');
|
|
return;
|
|
}
|
|
|
|
// Replace auth routes import
|
|
const originalLine = "const authRoutes = require('./src/routes/auth');";
|
|
const enhancedLine = "const authRoutes = require('./src/routes/auth-enhanced');";
|
|
|
|
if (!serverContent.includes(originalLine)) {
|
|
console.log('✗ Could not find original auth import line');
|
|
console.log('Please manually update server.js');
|
|
return;
|
|
}
|
|
|
|
serverContent = serverContent.replace(originalLine, enhancedLine);
|
|
console.log('✓ Updated auth routes import');
|
|
|
|
// Add cleanup job initialization after database init
|
|
const dbInitLine = 'initializeDatabase()';
|
|
const cleanupAddition = `
|
|
// Initialize auth security cleanup job
|
|
const { initializeCleanupJob } = require('./src/utils/authSecurity');
|
|
initializeCleanupJob();
|
|
`;
|
|
|
|
if (!serverContent.includes('initializeCleanupJob')) {
|
|
const dbInitIndex = serverContent.indexOf(dbInitLine);
|
|
if (dbInitIndex !== -1) {
|
|
const insertPoint = serverContent.indexOf('\n', dbInitIndex) + 1;
|
|
serverContent = serverContent.slice(0, insertPoint) + cleanupAddition + serverContent.slice(insertPoint);
|
|
console.log('✓ Added cleanup job initialization');
|
|
}
|
|
}
|
|
|
|
// Write updated server.js
|
|
await fs.writeFile(serverPath, serverContent);
|
|
console.log('✓ Updated server.js');
|
|
|
|
console.log('\n✅ Enhanced authentication activated!');
|
|
console.log('\nNext steps:');
|
|
console.log('1. Restart the backend:');
|
|
console.log(' docker-compose restart backend');
|
|
console.log('\n2. Monitor auth health:');
|
|
console.log(' node scripts/monitor-auth-health.js');
|
|
console.log('\n3. To rollback if needed:');
|
|
console.log(` cp ${path.basename(backupPath)} server.js`);
|
|
console.log(' docker-compose restart backend');
|
|
|
|
} catch (error) {
|
|
console.error('❌ Error activating enhanced auth:', error);
|
|
}
|
|
}
|
|
|
|
activateEnhancedAuth(); |