picpeak/backend/ACTIVATE_AUTH_V2.md

# Quick Guide: Activate Authentication V2 Fixes

## Step 1: Install Dependency
```bash
cd backend
npm install zxcvbn@4.4.2
```

## Step 2: Add to Docker & Run Migration
```bash
# Rebuild Docker with new dependency
docker-compose down
docker-compose up -d --build

# Run migration for token revocation
docker exec wedding-photo-sharing-backend-1 node /app/scripts/add-token-revocation-tables.js
```

## Step 3: Update server.js

### 3.1 Fix Rate Limiting (Line ~10)
```javascript
// Add after other requires
const { createSecureSkipFunction, logRateLimitHit } = require('./src/utils/rateLimitSecurity');
```

### 3.2 Update Rate Limiter (Line ~59)
```javascript
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: process.env.NODE_ENV === 'development' ? 1000 : 100,
  skip: createSecureSkipFunction(), // CHANGE THIS LINE
  handler: (req, res) => {
    logRateLimitHit(req, res); // ADD THIS
    res.status(429).json({
      error: 'Too many requests from this IP, please try again later.'
    });
  }
});
```

### 3.3 Update Auth Limiter (Line ~81)
```javascript
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  skipSuccessfulRequests: true, // ADD THIS
  handler: (req, res) => {
    logRateLimitHit(req, res); // ADD THIS
    res.status(429).json({
      error: 'Too many login attempts, please try again later.',
      retryAfter: res.getHeader('Retry-After')
    });
  }
});
```

### 3.4 Change Auth Routes (Line ~22)
```javascript
// Change from:
const authRoutes = require('./src/routes/auth-enhanced');
// To:
const authRoutes = require('./src/routes/auth-enhanced-v2');
```

### 3.5 Add Token Revocation (After line ~147)
```javascript
// After initializeCleanupJob();
const { initializeRevocationCleanup } = require('./src/utils/tokenRevocation');
initializeRevocationCleanup();
```

## Step 4: Update Middleware Imports

In files that import adminAuth:
```javascript
// Change from:
const { adminAuth } = require('../middleware/auth-enhanced');
// To:
const { adminAuth } = require('../middleware/auth-enhanced-v2');
```

## Step 5: Update adminEvents.js

Add password validation to event creation:
```javascript
// At top of file
const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');

// In POST route, after extracting password, add:
const passwordValidation = validatePasswordInContext(password, 'gallery', {
  eventName: event_name
});

if (!passwordValidation.valid) {
  return res.status(400).json({ 
    error: 'Password does not meet security requirements',
    details: passwordValidation.errors,
    score: passwordValidation.score,
    feedback: passwordValidation.feedback
  });
}

// Change password hashing to:
const password_hash = await bcrypt.hash(password, getBcryptRounds());
```

## Step 6: Add Environment Variable
```bash
# In .env file
BCRYPT_ROUNDS=12
```

## Step 7: Restart & Test
```bash
docker-compose restart backend

# Test rate limiting
curl -H "Authorization: Bearer invalid" http://localhost:3001/api/admin/events

# Test password validation  
node scripts/test-auth-v2-fixes.js
```

## Verification Checklist
- [ ] zxcvbn installed
- [ ] Token revocation tables created
- [ ] Rate limiting can't be bypassed
- [ ] Weak passwords rejected
- [ ] Password change works
- [ ] No errors in logs

## Rollback
If issues occur:
1. Revert server.js changes
2. Restart backend
3. All new features are additive, so existing functionality remains