picpeak/backend/ACTIVATE_AUTH_V2.md

Quick Guide: Activate Authentication V2 Fixes

Step 1: Install Dependency

cd backend
npm install zxcvbn@4.4.2

Step 2: Add to Docker & Run Migration

# Rebuild Docker with new dependency
docker-compose down
docker-compose up -d --build

# Run migration for token revocation
docker exec wedding-photo-sharing-backend-1 node /app/scripts/add-token-revocation-tables.js

Step 3: Update server.js

3.1 Fix Rate Limiting (Line ~10)

// Add after other requires
const { createSecureSkipFunction, logRateLimitHit } = require('./src/utils/rateLimitSecurity');

3.2 Update Rate Limiter (Line ~59)

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: process.env.NODE_ENV === 'development' ? 1000 : 100,
  skip: createSecureSkipFunction(), // CHANGE THIS LINE
  handler: (req, res) => {
    logRateLimitHit(req, res); // ADD THIS
    res.status(429).json({
      error: 'Too many requests from this IP, please try again later.'
    });
  }
});

3.3 Update Auth Limiter (Line ~81)

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  skipSuccessfulRequests: true, // ADD THIS
  handler: (req, res) => {
    logRateLimitHit(req, res); // ADD THIS
    res.status(429).json({
      error: 'Too many login attempts, please try again later.',
      retryAfter: res.getHeader('Retry-After')
    });
  }
});

3.4 Change Auth Routes (Line ~22)

// Change from:
const authRoutes = require('./src/routes/auth-enhanced');
// To:
const authRoutes = require('./src/routes/auth-enhanced-v2');

3.5 Add Token Revocation (After line ~147)

// After initializeCleanupJob();
const { initializeRevocationCleanup } = require('./src/utils/tokenRevocation');
initializeRevocationCleanup();

Step 4: Update Middleware Imports

In files that import adminAuth:

// Change from:
const { adminAuth } = require('../middleware/auth-enhanced');
// To:
const { adminAuth } = require('../middleware/auth-enhanced-v2');

Step 5: Update adminEvents.js

Add password validation to event creation:

// At top of file
const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');

// In POST route, after extracting password, add:
const passwordValidation = validatePasswordInContext(password, 'gallery', {
  eventName: event_name
});

if (!passwordValidation.valid) {
  return res.status(400).json({ 
    error: 'Password does not meet security requirements',
    details: passwordValidation.errors,
    score: passwordValidation.score,
    feedback: passwordValidation.feedback
  });
}

// Change password hashing to:
const password_hash = await bcrypt.hash(password, getBcryptRounds());

Step 6: Add Environment Variable

# In .env file
BCRYPT_ROUNDS=12

Step 7: Restart & Test

docker-compose restart backend

# Test rate limiting
curl -H "Authorization: Bearer invalid" http://localhost:3001/api/admin/events

# Test password validation  
node scripts/test-auth-v2-fixes.js

Verification Checklist

• zxcvbn installed
• Token revocation tables created
• Rate limiting can't be bypassed
• Weak passwords rejected
• Password change works
• No errors in logs

Rollback

If issues occur:

1. Revert server.js changes
2. Restart backend
3. All new features are additive, so existing functionality remains