73 lines
2.2 KiB
JavaScript
73 lines
2.2 KiB
JavaScript
// shared/auth/requireAuth.js
|
|
import jwt from 'jsonwebtoken';
|
|
import pool from '../config/mysqlPool.js';
|
|
|
|
const {
|
|
JWT_SECRET,
|
|
TOKEN_MAX_AGE_MS,
|
|
SESSION_COOKIE_NAME
|
|
} = process.env;
|
|
|
|
const MAX_AGE = Number(TOKEN_MAX_AGE_MS || 0); // 0 = disabled
|
|
const COOKIE_NAME = SESSION_COOKIE_NAME || 'aptiva_session';
|
|
|
|
// Fallback cookie parser if cookie-parser middleware isn't present
|
|
function readSessionCookie(req) {
|
|
// Prefer cookie-parser, if installed
|
|
if (req.cookies && req.cookies[COOKIE_NAME]) return req.cookies[COOKIE_NAME];
|
|
|
|
// Manual parse from header
|
|
const raw = req.headers.cookie || '';
|
|
for (const part of raw.split(';')) {
|
|
const [k, ...rest] = part.trim().split('=');
|
|
if (k === COOKIE_NAME) return decodeURIComponent(rest.join('='));
|
|
}
|
|
return null;
|
|
}
|
|
|
|
export async function requireAuth(req, res, next) {
|
|
try {
|
|
// 1) Try Bearer (legacy) then cookie (current)
|
|
const authz = req.headers.authorization || '';
|
|
let token =
|
|
authz.startsWith('Bearer ')
|
|
? authz.slice(7)
|
|
: readSessionCookie(req);
|
|
|
|
if (!token) return res.status(401).json({ error: 'Auth required' });
|
|
|
|
// 2) Verify JWT
|
|
let payload;
|
|
try { payload = jwt.verify(token, JWT_SECRET); }
|
|
catch { return res.status(401).json({ error: 'Invalid or expired token' }); }
|
|
|
|
const userId = payload.id;
|
|
const iatMs = (payload.iat || 0) * 1000;
|
|
|
|
// 3) Absolute max token age (optional)
|
|
if (MAX_AGE && Date.now() - iatMs > MAX_AGE) {
|
|
return res.status(401).json({ error: 'Session expired. Please sign in again.' });
|
|
}
|
|
|
|
// 4) Invalidate tokens issued before last password change
|
|
const sql = pool.raw || pool;
|
|
const [rows] = await sql.query(
|
|
'SELECT password_changed_at FROM user_auth WHERE user_id = ? ORDER BY id DESC LIMIT 1',
|
|
[userId]
|
|
);
|
|
const changedAtMs = rows?.[0]?.password_changed_at
|
|
? new Date(rows[0].password_changed_at).getTime()
|
|
: 0;
|
|
|
|
if (changedAtMs && iatMs < changedAtMs) {
|
|
return res.status(401).json({ error: 'Session invalidated. Please sign in again.' });
|
|
}
|
|
|
|
req.userId = userId;
|
|
next();
|
|
} catch (e) {
|
|
console.error('[requireAuth]', e?.message || e);
|
|
return res.status(500).json({ error: 'Server error' });
|
|
}
|
|
}
|