picpeak/backend/AUTH_SECURITY_ROLLBACK.md

# Authentication Security Enhancement Rollback Plan

## Quick Rollback Steps

### Immediate Rollback (< 2 minutes)

If auth issues occur after deployment, follow these steps:

```bash
# 1. SSH into production server
ssh your-server

# 2. Navigate to backend directory
cd /path/to/picpeak/backend

# 3. Revert route changes in server.js
# Change from:
# const authRoutes = require('./src/routes/auth-enhanced');
# Back to:
# const authRoutes = require('./src/routes/auth');

# 4. Revert middleware if changed
# Change from:
# const { adminAuth } = require('./src/middleware/auth-enhanced');
# Back to:
# const { adminAuth } = require('./src/middleware/auth');

# 5. Restart application
docker-compose restart backend
# OR
pm2 restart picpeak-backend
```

## Rollback Scenarios

### Scenario 1: Users Can't Login

**Symptoms**:
- All login attempts fail
- Generic "Invalid credentials" error
- Admin panel inaccessible

**Quick Fix**:
```bash
# Revert to original auth routes
cd backend
git checkout HEAD -- server.js
docker-compose restart backend
```

### Scenario 2: Account Lockout Issues

**Symptoms**:
- Legitimate users locked out
- "Account temporarily locked" errors

**Quick Fix**:
```sql
-- Clear all lockouts
DELETE FROM login_attempts WHERE success = false;

-- Or clear specific user
DELETE FROM login_attempts 
WHERE identifier = 'username_or_email' 
AND success = false;
```

### Scenario 3: Token Validation Errors

**Symptoms**:
- "Invalid token" errors
- Existing sessions broken
- API calls failing

**Quick Fix**:
```javascript
// In auth middleware, temporarily disable strict validation
// Comment out issuer validation:
// issuer: 'picpeak-auth'

// Just use basic verification:
const decoded = jwt.verify(token, process.env.JWT_SECRET);
```

### Scenario 4: Database Migration Issues

**Symptoms**:
- Application won't start
- Database errors in logs

**Rollback Migration**:
```bash
# Rollback last 2 migrations
npx knex migrate:rollback --all
npx knex migrate:up 014_add_default_welcome_message.js

# Or manually fix:
sqlite3 database.db
DROP TABLE IF EXISTS login_attempts;
ALTER TABLE admin_users DROP COLUMN password_changed_at;
ALTER TABLE admin_users DROP COLUMN last_login_ip;
```

## Verification After Rollback

1. **Test Admin Login**:
   ```bash
   curl -X POST http://your-domain/api/auth/admin/login \
     -H "Content-Type: application/json" \
     -d '{"username":"admin","password":"your-password"}'
   ```

2. **Test Gallery Access**:
   ```bash
   curl -X POST http://your-domain/api/auth/gallery/verify \
     -H "Content-Type: application/json" \
     -d '{"slug":"test-gallery","password":"gallery-password"}'
   ```

3. **Check Logs**:
   ```bash
   # No auth errors should appear
   docker-compose logs backend | tail -100 | grep -i error
   ```

## File Restoration

If files were modified, restore from backup:

```bash
# List of files that can be safely reverted
git checkout HEAD -- src/middleware/auth.js
git checkout HEAD -- src/routes/auth.js
git checkout HEAD -- server.js

# Remove new files (safe to delete)
rm -f src/utils/authSecurity.js
rm -f src/middleware/auth-enhanced.js
rm -f src/routes/auth-enhanced.js
rm -f migrations/015_add_login_attempts_table.js
rm -f migrations/016_add_auth_security_columns.js
```

## Emergency SQL Fixes

```sql
-- Clear all security restrictions
DELETE FROM login_attempts;

-- Reset admin password if locked out
UPDATE admin_users 
SET password_hash = '$2b$10$YourKnownGoodHashHere'
WHERE username = 'admin';

-- Remove security columns if causing issues
-- (SQLite doesn't support DROP COLUMN easily, so ignore)
```

## Monitoring After Rollback

```bash
# Watch for stability
watch -n 5 'docker-compose logs backend | tail -20'

# Check active connections
netstat -an | grep :3001 | wc -l

# Monitor CPU/Memory
docker stats wedding-photo-sharing-backend-1
```

## Prevention for Next Attempt

Before re-attempting the security enhancement:

1. **Test in staging environment first**
2. **Implement gradual rollout with feature flags**
3. **Add backwards compatibility for tokens**
4. **Create admin bypass for lockouts**
5. **Set up monitoring alerts**

## Contact

If rollback fails:
1. Check `backend/logs/error.log`
2. Restore from last known good backup
3. Use original auth implementation as reference