paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
132 lines
4.0 KiB
Bash
Executable File
132 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Authentication Security Enhancement Deployment Script
|
|
# This script helps safely deploy auth security enhancements
|
|
|
|
set -e
|
|
|
|
echo "=== PicPeak Authentication Security Deployment ==="
|
|
echo ""
|
|
|
|
# Color codes
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Check if we're in the backend directory
|
|
if [ ! -f "package.json" ] || [ ! -d "src" ]; then
|
|
echo -e "${RED}Error: Must run from backend directory${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Function to prompt for confirmation
|
|
confirm() {
|
|
read -p "$1 (y/n): " -n 1 -r
|
|
echo
|
|
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
|
echo -e "${YELLOW}Deployment cancelled${NC}"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
echo "This script will help deploy authentication security enhancements"
|
|
echo ""
|
|
echo "Current deployment phase options:"
|
|
echo "1. Run database migrations only (safe)"
|
|
echo "2. Test enhanced auth endpoints"
|
|
echo "3. Switch to enhanced auth (full deployment)"
|
|
echo "4. Rollback to original auth"
|
|
echo ""
|
|
|
|
read -p "Select phase (1-4): " PHASE
|
|
|
|
case $PHASE in
|
|
1)
|
|
echo -e "${GREEN}Phase 1: Running database migrations${NC}"
|
|
confirm "Run migrations?"
|
|
|
|
echo "Creating backup..."
|
|
cp database.db database.db.backup.$(date +%Y%m%d_%H%M%S) 2>/dev/null || true
|
|
|
|
echo "Running migrations..."
|
|
npx knex migrate:latest
|
|
|
|
echo -e "${GREEN}✓ Migrations completed${NC}"
|
|
echo "New tables added: login_attempts"
|
|
echo "New columns added to admin_users: password_changed_at, last_login_ip"
|
|
;;
|
|
|
|
2)
|
|
echo -e "${GREEN}Phase 2: Testing enhanced auth${NC}"
|
|
|
|
# Check if server is running
|
|
if ! curl -s http://localhost:3001/health > /dev/null; then
|
|
echo -e "${RED}Server not running on port 3001${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Running auth security tests..."
|
|
node scripts/test-auth-security.js
|
|
|
|
echo ""
|
|
echo "Test endpoints manually:"
|
|
echo "- Login: POST /api/auth/admin/login"
|
|
echo "- Logout: POST /api/auth/logout"
|
|
echo "- Session: GET /api/auth/session"
|
|
;;
|
|
|
|
3)
|
|
echo -e "${YELLOW}Phase 3: Full deployment${NC}"
|
|
echo "This will switch to enhanced authentication"
|
|
confirm "Deploy enhanced auth?"
|
|
|
|
# Check if migrations are run
|
|
if ! npx knex migrate:status | grep -q "015_add_login_attempts_table"; then
|
|
echo -e "${RED}Error: Migrations not run. Run phase 1 first.${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Updating server.js to use enhanced auth..."
|
|
# This is where you'd update the imports
|
|
# For safety, we'll just show what needs to be done
|
|
|
|
echo -e "${YELLOW}Manual steps required:${NC}"
|
|
echo "1. Edit server.js"
|
|
echo "2. Change: const authRoutes = require('./src/routes/auth');"
|
|
echo " To: const authRoutes = require('./src/routes/auth-enhanced');"
|
|
echo "3. Restart the application"
|
|
echo ""
|
|
echo "After restart, the enhanced auth will be active with:"
|
|
echo "- Account lockout protection"
|
|
echo "- Login attempt tracking"
|
|
echo "- Enhanced security logging"
|
|
;;
|
|
|
|
4)
|
|
echo -e "${RED}Phase 4: Rollback${NC}"
|
|
confirm "Rollback auth changes?"
|
|
|
|
echo "Rolling back to original auth..."
|
|
echo ""
|
|
echo -e "${YELLOW}Manual steps required:${NC}"
|
|
echo "1. Edit server.js"
|
|
echo "2. Change: const authRoutes = require('./src/routes/auth-enhanced');"
|
|
echo " To: const authRoutes = require('./src/routes/auth');"
|
|
echo "3. Restart the application"
|
|
echo ""
|
|
echo "Optional: Clear lockouts"
|
|
echo "sqlite3 database.db \"DELETE FROM login_attempts WHERE success = 0\""
|
|
;;
|
|
|
|
*)
|
|
echo -e "${RED}Invalid option${NC}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo ""
|
|
echo -e "${GREEN}Done!${NC}"
|
|
echo ""
|
|
echo "Monitor logs after any changes:"
|
|
echo "docker-compose logs -f backend | grep -i auth" |