Authentication & Sessions

export const lucia = new Lucia(adapter, {
  sessionCookie: {
    expires: true,
    attributes: {
      secure: true, // HTTPS only in production
      sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",
    },
  },
  getUserAttributes: (attributes) => ({
    email: attributes.email,
    username: attributes.username,
    firstName: attributes.firstName,
    lastName: attributes.lastName,
    githubId: attributes.githubId,
    googleId: attributes.googleId,
    role: attributes.role,
    provider: attributes.provider,
  }),
});

const MAX_AGE = 60 * 60 * 24 * 30; // 30 days

// Request
{ email: string, password: string }

// Flow
1. Validate input with Zod schema
2. Rate limit check (10 requests/60 seconds)
3. Find user by email
4. Verify password: bcrypt.compare(password, user.password)
5. Create session: lucia.createSession(user.id, {})
6. Set HTTP-only cookie
7. Return user object

GET /auth/github
├─ Generate random state
├─ Store state in cookie (httpOnly)
└─ Redirect to GitHub authorization URL

GET /auth/github/callback?code=CODE&state=STATE
├─ Validate state matches cookie
├─ Exchange code for access token
├─ Fetch user from GitHub API
├─ Create/update user
├─ Create session
└─ Redirect to APP_HOST

GET /auth/google
├─ Generate state + code verifier
├─ Store both in cookies
└─ Redirect to Google authorization

GET /auth/google/callback
├─ Validate state
├─ Exchange code + verifier for token
├─ Fetch user from Google OpenID
└─ Create session

// Request
{ authToken: string, providerName?: string }

// Flow
1. Get provider: getExternalAuthProvider(providerName)
2. Validate token: provider.validateToken(authToken)
3. Find/create user by externalUserId
4. Encrypt and store authToken
5. Create session

1. Get session ID from cookie
2. Invalidate: lucia.invalidateSession(sessionId)
3. Clear session cookie (maxAge: 0)

POST /auth/forgot-password { email }
├─ Find user by email
├─ Create reset token with expiration
├─ Send email with reset link
└─ Return generic success (don't reveal user existence)

POST /auth/reset-password { token, newPassword }
├─ Validate token not expired/used
├─ Hash new password (bcrypt, 12 rounds)
├─ Update user password
└─ Mark token as used

export const sessionMiddleware = (routeRole: EUserRole = EUserRole.GUEST) => {
  return async (req: Request, res: Response, next: NextFunction) => {
    const sessionToken = req.cookies?.session;

    if (!sessionToken) {
      return res.status(401).json({ error: "Unauthorized: No session found" });
    }

    const { session, user } = await lucia.validateSession(sessionToken);

    if (!user || !session) {
      return res.status(401).json({ error: "Unauthorized: Invalid session" });
    }

    // Role-based access control
    if (routeRole === EUserRole.ADMIN && user.role !== EUserRole.ADMIN) {
      return res.status(403).json({ error: "Forbidden: Requires Admin role" });
    }

    req.user = user;
    req.session = session;
    next();
  };
};

export const flexibleSessionMiddleware = (requiredRole = EUserRole.ADMIN) => {
  const cookieToken = req.cookies?.session;
  const headerToken =
    req.headers.authorization?.replace("Bearer ", "") || req.headers.session;

  const sessionToken = headerToken || cookieToken;
  // ... validation
};

export const optionalSessionMiddleware = async (req, res, next) => {
  const sessionToken = req.cookies?.session;

  if (sessionToken) {
    try {
      const { session, user } = await lucia.validateSession(sessionToken);
      if (user && session) {
        req.user = user;
        req.session = session;
      }
    } catch {
      /* ignore */
    }
  }
  next();
};

// On registration/reset
const hashedPassword = await bcrypt.hash(newPassword, 12);

// On login
const isValid = await bcrypt.compare(password, user.password);

class EncryptionService {
  private algorithm = "aes-256-gcm";

  async encrypt(text: string): Promise<string> {
    const salt = randomBytes(32);
    const iv = randomBytes(16);
    const key = await this.deriveKey(masterKey, salt);
    const cipher = createCipheriv("aes-256-gcm", key, iv);
    // ... encryption logic
  }
}

res.cookie("session", sessionId, {
  secure: true, // HTTPS only
  httpOnly: true, // No JS access
  sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",
  maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
});

const authLimiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 10, // 10 requests
});

// Applied to OAuth and auth endpoints
router.use("/github", authLimiter);
router.use("/google", authLimiter);

export interface IExternalAuthProvider {
  name: string;

  validateToken(authToken: string): Promise<{
    isValid: boolean;
    userData?: {
      externalUserId: string;
      email: string;
      firstName?: string;
      lastName?: string;
      isAdmin?: boolean;
    };
    error?: string;
  }>;

  getUserLimits?(
    externalUserId: string,
    authToken: string,
  ): Promise<{
    maxMessages?: number;
    resetDate?: Date;
  }>;
}

// Registry functions
export function registerExternalAuthProvider(
  provider: IExternalAuthProvider,
): void;
export function getExternalAuthProvider(name: string): IExternalAuthProvider;

ENCRYPTION_MASTER_KEY=<required>
APP_HOST=http://localhost:3000
API_HOST=http://localhost:3001

GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

// Require any authenticated user (guest or admin)
router.use(sessionMiddleware(EUserRole.GUEST));

// Require admin role
router.use(sessionMiddleware(EUserRole.ADMIN));

// Optional authentication
router.use(optionalSessionMiddleware);

router.get("/profile", async (req: Request, res: Response) => {
  const { id, email, role } = req.user;
  res.json({ id, email, role });
});

// Token is automatically sent via cookies
const response = await fetch("/api/threads", {
  credentials: "include",
});

// Or via header for cross-origin
const response = await fetch("/api/threads", {
  headers: {
    Authorization: `Bearer ${sessionToken}`,
  },
});