feat: Refactor user management to replace email with username across the application

2025-07-28 22:25:23 +02:00
parent 6fc2e6703b
commit 07b4af5f24
14 changed files with 298 additions and 96 deletions
--- a/src/lib/auth_backup.js
+++ b/src/lib/auth_backup.js
@@ -0,0 +1,156 @@
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import bcrypt from "bcryptjs";
+import { z } from "zod";
+
+const loginSchema = z.object({
+	username: z.string().min(1, "Username is required"),
+	password: z.string().min(6, "Password must be at least 6 characters"),
+});
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+	providers: [
+		Credentials({
+			name: "credentials",
+			credentials: {
+				username: { label: "Username", type: "text" },
+				password: { label: "Password", type: "password" },
+			},
+			async authorize(credentials) {
+				try {
+					// Import database here to avoid edge runtime issues
+					const { default: db } = await import("./db.js");
+
+					// Validate input
+					const validatedFields = loginSchema.parse(credentials);
+
+					// Check if user exists and is active
+					const user = db
+						.prepare(
+							`
+            SELECT id, username, name, password_hash, role, is_active, 
+                   failed_login_attempts, locked_until
+            FROM users 
+            WHERE username = ? AND is_active = 1
+          `
+						)
+						.get(validatedFields.username);
+
+					if (!user) {
+						throw new Error("Invalid credentials");
+					}
+
+					// Check if account is locked
+					if (user.locked_until && new Date(user.locked_until) > new Date()) {
+						throw new Error("Account temporarily locked");
+					}
+
+					// Verify password
+					const isValidPassword = await bcrypt.compare(
+						validatedFields.password,
+						user.password_hash
+					);
+
+					if (!isValidPassword) {
+						// Increment failed attempts
+						db.prepare(
+							`
+              UPDATE users 
+              SET failed_login_attempts = failed_login_attempts + 1,
+                  locked_until = CASE 
+                    WHEN failed_login_attempts >= 4 
+                    THEN datetime('now', '+15 minutes')
+                    ELSE locked_until 
+                  END
+              WHERE id = ?
+            `
+						).run(user.id);
+
+						// Log failed login attempt (only in Node.js runtime)
+						try {
+							const { logAuditEventSafe, AUDIT_ACTIONS, RESOURCE_TYPES } =
+								await import("./auditLogSafe.js");
+							await logAuditEventSafe({
+								action: AUDIT_ACTIONS.LOGIN_FAILED,
+								userId: user.id,
+								resourceType: RESOURCE_TYPES.SESSION,
+								details: {
+									username: validatedFields.username,
+									reason: "invalid_password",
+									failed_attempts: user.failed_login_attempts + 1,
+								},
+							});
+						} catch (auditError) {
+							console.error("Failed to log audit event:", auditError);
+						}
+
+						throw new Error("Invalid credentials");
+					}
+
+					// Reset failed attempts and update last login
+					db.prepare(
+						`
+            UPDATE users 
+            SET failed_login_attempts = 0, 
+                locked_until = NULL,
+                last_login = CURRENT_TIMESTAMP
+            WHERE id = ?
+          `
+					).run(user.id);
+
+					// Log successful login (only in Node.js runtime)
+					try {
+						const { logAuditEventSafe, AUDIT_ACTIONS, RESOURCE_TYPES } =
+							await import("./auditLogSafe.js");
+						await logAuditEventSafe({
+							action: AUDIT_ACTIONS.LOGIN,
+							userId: user.id,
+							resourceType: RESOURCE_TYPES.SESSION,
+							details: {
+								username: user.username,
+								role: user.role,
+							},
+						});
+					} catch (auditError) {
+						console.error("Failed to log audit event:", auditError);
+					}
+
+					return {
+						id: user.id,
+						username: user.username,
+						name: user.name,
+						role: user.role,
+					};
+				} catch (error) {
+					console.error("Login error:", error);
+					return null;
+				}
+			},
+		}),
+	],
+	callbacks: {
+		async jwt({ token, user }) {
+			if (user) {
+				token.role = user.role;
+				token.username = user.username;
+			}
+			return token;
+		},
+		async session({ session, token }) {
+			if (token) {
+				session.user.id = token.sub;
+				session.user.role = token.role;
+				session.user.username = token.username;
+			}
+			return session;
+		},
+	},
+	pages: {
+		signIn: "/auth/signin",
+	},
+	session: {
+		strategy: "jwt",
+		maxAge: 24 * 60 * 60, // 24 hours
+	},
+	secret: process.env.NEXTAUTH_SECRET,
+});