Authentication & Security: Defense-in-Depth

import bcrypt from 'bcrypt';

// Work factor: 12 salt rounds = 2^12 (4,096 iterations) ~250ms on modern servers
const SALT_ROUNDS = 12;

export async function registerUserAccount(email, rawPassword) {
  // 1. Enforce strict password entropy standards
  if (!rawPassword || rawPassword.length < 10) {
    throw new Error('Password must be at least 10 characters long.');
  }

  // 2. Cryptographic Salt Generation & Hashing
  const passwordHash = await bcrypt.hash(rawPassword, SALT_ROUNDS);

  // 3. Store in Database (rawPassword is discarded and never logged!)
  return { email, passwordHash, createdAt: new Date() };
}

export async function verifyUserCredentials(incomingPassword, storedHash) {
  // Constant-time comparison defeats side-channel timing attacks
  const isValid = await bcrypt.compare(incomingPassword, storedHash);
  return isValid;
}

import express from 'express';
import jwt from 'jsonwebtoken';

const router = express.Router();

router.post('/refresh', async (req, res) => {
  // Read refresh token strictly from HttpOnly cookie
  const incomingRefreshToken = req.cookies?.refreshToken;
  
  if (!incomingRefreshToken) {
    return res.status(401).json({ error: 'Unauthorized: Missing refresh token.' });
  }

  try {
    const payload = jwt.verify(incomingRefreshToken, process.env.JWT_REFRESH_SECRET);
    
    // 1. Generate fresh 15-minute Access Token
    const newAccessToken = jwt.sign(
      { userId: payload.userId, role: payload.role },
      process.env.JWT_ACCESS_SECRET,
      { expiresIn: '15m' }
    );

    // 2. Generate new 7-day Refresh Token (Rotation)
    const newRefreshToken = jwt.sign(
      { userId: payload.userId },
      process.env.JWT_REFRESH_SECRET,
      { expiresIn: '7d' }
    );

    // 3. Overwrite cookie with rotated refresh token
    res.cookie('refreshToken', newRefreshToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'Strict',
      maxAge: 7 * 24 * 60 * 60 * 1000
    });

    return res.status(200).json({ accessToken: newAccessToken });
  } catch (err) {
    return res.status(403).json({ error: 'Forbidden: Invalid or expired refresh token.' });
  }
});

export default router;

import { z } from 'zod';

// 1. Declare Strict Validation Schema
export const UserRegistrationSchema = z.object({
  body: z.object({
    email: z.string().email('Invalid email format').toLowerCase().trim(),
    password: z.string()
      .min(10, 'Password must be at least 10 characters')
      .regex(/[A-Z]/, 'Must contain at least 1 uppercase letter')
      .regex(/[0-9]/, 'Must contain at least 1 digit'),
    username: z.string().min(3).max(30).regex(/^[a-zA-Z0-9_-]+$/, 'Alphanumeric only')
  })
});

// 2. Generic Validation Middleware Factory
export const validateRequest = (schema) => async (req, res, next) => {
  try {
    // Validates and strips unauthorized keys
    const parsed = await schema.parseAsync({
      body: req.body,
      query: req.query,
      params: req.params
    });
    req.body = parsed.body; // Assign sanitized, validated payload
    next();
  } catch (err) {
    return res.status(400).json({
      error: 'Validation Failure',
      issues: err.errors.map(e => ({ field: e.path.join('.'), message: e.message }))
    });
  }
};

import express from 'express';
import helmet from 'helmet';
import cors from 'cors';
import cookieParser from 'cookie-parser';
import rateLimit from 'express-rate-limit';

const app = express();

// 1. Helmet: Sets 15+ Secure HTTP Headers (CSP, HSTS, X-Content-Type-Options)
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "https://fonts.googleapis.com"],
      imgSrc: ["'self'", "data:", "https://images.devascent.me"],
    }
  },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true }
}));

// 2. Hardened Dynamic CORS Configuration with Credentials
const ALLOWED_ORIGINS = ['https://app.devascent.me', 'https://admin.devascent.me'];
app.use(cors({
  origin: (origin, callback) => {
    // Allow requests with no origin (like mobile apps or curl) or matching origins
    if (!origin || ALLOWED_ORIGINS.indexOf(origin) !== -1) {
      callback(null, true);
    } else {
      callback(new Error('CORS Blocked: Origin unauthorized.'));
    }
  },
  credentials: true, // Permits transmission of HttpOnly cookies
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization']
}));

// 3. Middleware Stack
app.use(express.json({ limit: '10kb' })); // Defends against large payload Denial-of-Service
app.use(cookieParser());

// 4. Global Anti-Brute Force Rate Limiter
app.use('/api/', rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: { error: 'Too many requests. Back off.' }
}));

// Protected Endpoint
app.get('/api/v1/secure-vault', (req, res) => {
  res.status(200).json({ message: 'Welcome to the hardened telemetry vault.' });
});

const PORT = 5500;
app.listen(PORT, () => console.log(`🛡️ Security Shield Server online at port ${PORT}`));