portalAuth.js

Go to the documentation of this file.

/**
 * @file portalAuth.js
 * @description Customer Portal Authentication Routes
 * 
 * Provides authentication endpoints for customer portal users including login,
 * logout, password management, and session management.
 * 
 * **Features:**
 * - JWT-based authentication (24-hour expiry)
 * - Session tracking with IP and user agent
 * - Password reset with email token
 * - Audit logging for all auth events
 * - Account status validation
 * 
 * **Security:**
 * - Bcrypt password hashing (10 rounds)
 * - SHA256 token hashing for session storage
 * - Timing-safe password comparison
 * - Rate limiting recommended (not implemented)
 * 
 * @module routes/portalAuth
 * @requires express
 * @requires bcrypt
 * @requires jsonwebtoken
 * @requires crypto
 * @requires services/db
 * @requires middleware/customerAuth
 * @author Independent Business Group
 * @since 1.0.0
 * @see module:routes/portalCustomer
 * @see module:routes/customerUsers
 * @see module:middleware/customerAuth
 */
 
const express = require('express');
const router = express.Router();
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const crypto = require('crypto');
const pool = require('../services/db');
const { authenticateCustomer, logCustomerAudit } = require('../middleware/customerAuth');
 
/**
 * @api {post} /portal/auth/login Customer Login
 * @apiName CustomerLogin
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Authenticates customer portal user and returns JWT token.
 * Creates session record, updates last login timestamp, logs audit event.
 * Validates account is active and portal access is enabled.
 * 
 * @apiPermission none
 * 
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} email Email address (case-insensitive)
 * @apiParam {String} password Plain text password
 * 
 * @apiSuccess {String} token JWT authentication token (24h expiry)
 * @apiSuccess {Object} user User information
 * @apiSuccess {Number} user.customerUserId User ID
 * @apiSuccess {Number} user.customerId Customer ID
 * @apiSuccess {String} user.email Email address
 * @apiSuccess {String} user.firstName First name
 * @apiSuccess {String} user.lastName Last name
 * @apiSuccess {String} user.customerName Customer name
 * @apiSuccess {String} user.tenantName Tenant name
 * @apiSuccess {Boolean} user.isPrimary Primary contact flag
 * 
 * @apiError (400) {String} error Email and password are required
 * @apiError (401) {String} error Invalid email or password
 * @apiError (403) {String} error Portal access is disabled for this account
 * @apiError (500) {String} error Login failed
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Content-Type: application/json" \
 *        -d '{
 *          "email": "user@example.com",
 *          "password": "SecurePass123"
 *        }' \
 *        "https://api.everydaytech.au/portal/auth/login"
 * 
 * @apiSuccessExample {json} Success Response:
 *   HTTP/1.1 200 OK
 *   {
 *     "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
 *     "user": {
 *       "customerUserId": 45,
 *       "customerId": 123,
 *       "email": "user@example.com",
 *       "firstName": "John",
 *       "lastName": "Doe",
 *       "customerName": "Acme Corp",
 *       "tenantName": "IBG MSP",
 *       "isPrimary": true
 *     }
 *   }
 */
router.post('/login', async (req, res) => {
    try {
        const { email, password } = req.body;
 
        if (!email || !password) {
            return res.status(400).json({ error: 'Email and password are required.' });
        }
 
        // Find customer user
        const userResult = await pool.query(
            `SELECT cu.*, c.name as customer_name, t.name as tenant_name
             FROM customer_users cu
             JOIN customers c ON cu.customer_id = c.customer_id
             JOIN tenants t ON cu.tenant_id = t.tenant_id
             WHERE cu.email = $1 AND cu.is_active = true`,
            [email.toLowerCase()]
        );
 
        if (userResult.rows.length === 0) {
            return res.status(401).json({ error: 'Invalid email or password.' });
        }
 
        const user = userResult.rows[0];
 
        // Check if portal access is allowed for this customer
        const customerResult = await pool.query(
            'SELECT allow_portal_access FROM customers WHERE customer_id = $1',
            [user.customer_id]
        );
 
        if (!customerResult.rows[0].allow_portal_access) {
            return res.status(403).json({ error: 'Portal access is disabled for this account.' });
        }
 
        // Verify password
        const passwordMatch = await bcrypt.compare(password, user.password_hash);
        if (!passwordMatch) {
            return res.status(401).json({ error: 'Invalid email or password.' });
        }
 
        // Generate JWT token
        const token = jwt.sign(
            {
                customerUserId: user.customer_user_id,
                customerId: user.customer_id,
                tenantId: user.tenant_id,
                type: 'customer'
            },
            process.env.JWT_SECRET,
            { expiresIn: '24h' }
        );
 
        // Create session
        const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
        const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours
        const ipAddress = req.ip || req.connection.remoteAddress;
        const userAgent = req.headers['user-agent'];
 
        await pool.query(
            `INSERT INTO customer_sessions 
             (customer_user_id, token_hash, ip_address, user_agent, expires_at)
             VALUES ($1, $2, $3, $4, $5)`,
            [user.customer_user_id, tokenHash, ipAddress, userAgent, expiresAt]
        );
 
        // Update last login
        await pool.query(
            'UPDATE customer_users SET last_login = NOW() WHERE customer_user_id = $1',
            [user.customer_user_id]
        );
 
        // Log audit event
        await logCustomerAudit(
            user.customer_user_id,
            user.tenant_id,
            'login',
            'auth',
            null,
            { email },
            ipAddress
        );
 
        res.json({
            token,
            user: {
                customerUserId: user.customer_user_id,
                customerId: user.customer_id,
                email: user.email,
                firstName: user.first_name,
                lastName: user.last_name,
                customerName: user.customer_name,
                tenantName: user.tenant_name,
                isPrimary: user.is_primary
            }
        });
    } catch (error) {
        console.error('Customer login error:', error);
        res.status(500).json({ error: 'Login failed.', details: error.message });
    }
});
 
/**
 * @api {post} /portal/auth/logout Customer Logout
 * @apiName CustomerLogout
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Logs out customer portal user. Deletes session record and logs audit event.
 * Requires valid JWT token in Authorization header.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {String} message Success message
 * 
 * @apiError (401) {String} error Unauthorized (invalid/missing token)
 * @apiError (500) {String} error Logout failed
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        "https://api.everydaytech.au/portal/auth/logout"
 */
router.post('/logout', authenticateCustomer, async (req, res) => {
    try {
        const authHeader = req.headers['authorization'];
        const token = authHeader && authHeader.split(' ')[1];
        const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
 
        // Delete session
        await pool.query(
            'DELETE FROM customer_sessions WHERE token_hash = $1',
            [tokenHash]
        );
 
        // Log audit event
        await logCustomerAudit(
            req.customerUserId,
            req.tenantId,
            'logout',
            'auth',
            null,
            {},
            req.ip || req.connection.remoteAddress
        );
 
        res.json({ message: 'Logged out successfully.' });
    } catch (error) {
        console.error('Customer logout error:', error);
        res.status(500).json({ error: 'Logout failed.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/auth/me Get Current User
 * @apiName GetCurrentCustomerUser
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns current authenticated customer portal user information.
 * Includes user details, customer information, and tenant name.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Number} customerUserId User ID
 * @apiSuccess {Number} customerId Customer ID
 * @apiSuccess {String} email Email address
 * @apiSuccess {String} firstName First name
 * @apiSuccess {String} lastName Last name
 * @apiSuccess {String} phone Phone number
 * @apiSuccess {String} customerName Customer name
 * @apiSuccess {String} contactEmail Customer contact email
 * @apiSuccess {String} contactPhone Customer contact phone
 * @apiSuccess {String} tenantName Tenant name
 * @apiSuccess {Boolean} isPrimary Primary contact flag
 * @apiSuccess {Date} lastLogin Last login timestamp
 * 
 * @apiError (401) {String} error Unauthorized (invalid/missing token)
 * @apiError (404) {String} error User not found
 * @apiError (500) {String} error Failed to get user info
 */
router.get('/me', authenticateCustomer, async (req, res) => {
    try {
        const userResult = await pool.query(
            `SELECT cu.customer_user_id, cu.email, cu.first_name, cu.last_name, 
                    cu.phone, cu.is_primary, cu.last_login,
                    c.name as customer_name, c.email as customer_email, c.phone as customer_phone,
                    t.name as tenant_name
             FROM customer_users cu
             JOIN customers c ON cu.customer_id = c.customer_id
             JOIN tenants t ON cu.tenant_id = t.tenant_id
             WHERE cu.customer_user_id = $1`,
            [req.customerUserId]
        );
 
        if (userResult.rows.length === 0) {
            return res.status(404).json({ error: 'User not found.' });
        }
 
        const user = userResult.rows[0];
        res.json({
            customerUserId: user.customer_user_id,
            customerId: req.customerId,
            email: user.email,
            firstName: user.first_name,
            lastName: user.last_name,
            phone: user.phone,
            customerName: user.customer_name,
            contactEmail: user.customer_email,
            contactPhone: user.customer_phone,
            tenantName: user.tenant_name,
            isPrimary: user.is_primary,
            lastLogin: user.last_login
        });
    } catch (error) {
        console.error('Get customer user error:', error);
        res.status(500).json({ error: 'Failed to get user info.', details: error.message });
    }
});
 
/**
 * @api {post} /portal/auth/forgot-password Request Password Reset
 * @apiName ForgotPassword
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Initiates password reset process. Generates secure token and sends reset link.
 * Always returns success message to prevent email enumeration attacks.
 * Token expires in 1 hour. **Email sending not yet implemented.**
 * 
 * @apiPermission none
 * 
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} email Email address
 * 
 * @apiSuccess {String} message Generic success message (security measure)
 * 
 * @apiError (400) {String} error Email is required
 * @apiError (500) {String} error Failed to process password reset request
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Content-Type: application/json" \
 *        -d '{"email": "user@example.com"}' \
 *        "https://api.everydaytech.au/portal/auth/forgot-password"
 * 
 * @apiNote Email functionality not implemented. Token logged to console for testing.
 */
router.post('/forgot-password', async (req, res) => {
    try {
        const { email } = req.body;
 
        if (!email) {
            return res.status(400).json({ error: 'Email is required.' });
        }
 
        // Find user
        const userResult = await pool.query(
            'SELECT customer_user_id, tenant_id FROM customer_users WHERE email = $1 AND is_active = true',
            [email.toLowerCase()]
        );
 
        // Always return success to prevent email enumeration
        if (userResult.rows.length === 0) {
            return res.json({ message: 'If an account exists with that email, a password reset link has been sent.' });
        }
 
        const user = userResult.rows[0];
 
        // Generate reset token
        const resetToken = crypto.randomBytes(32).toString('hex');
        const resetTokenHash = crypto.createHash('sha256').update(resetToken).digest('hex');
        const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
 
        // Store reset token in customer_sessions table (repurpose for password resets)
        await pool.query(
            `INSERT INTO customer_sessions 
             (customer_user_id, token_hash, expires_at, ip_address, user_agent)
             VALUES ($1, $2, $3, $4, $5)`,
            [
                user.customer_user_id,
                resetTokenHash,
                expiresAt,
                req.ip || req.connection.remoteAddress,
                'password_reset'
            ]
        );
 
        // TODO: Send email with reset link
        // const resetLink = `https://precisewebhosting.com.au/reset-password?token=${resetToken}`;
        // await sendPasswordResetEmail(email, resetLink);
 
        console.log(`Password reset token for ${email}: ${resetToken}`);
 
        res.json({ message: 'If an account exists with that email, a password reset link has been sent.' });
    } catch (error) {
        console.error('Forgot password error:', error);
        res.status(500).json({ error: 'Failed to process password reset request.' });
    }
});
 
/**
 * @api {post} /portal/auth/reset-password Reset Password with Token
 * @apiName ResetPassword
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Resets password using token from forgot-password email.
 * Token is single-use and expires after 1 hour.
 * Password is bcrypt-hashed before storage. Logs audit event.
 * 
 * @apiPermission none
 * 
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} token Reset token from email
 * @apiParam {String} newPassword New password (min 8 characters)
 * 
 * @apiSuccess {String} message Success message
 * 
 * @apiError (400) {String} error Token and new password are required
 * @apiError (400) {String} error Password must be at least 8 characters long
 * @apiError (400) {String} error Invalid or expired reset token
 * @apiError (500) {String} error Failed to reset password
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Content-Type: application/json" \
 *        -d '{
 *          "token": "abc123...",
 *          "newPassword": "NewSecure456"
 *        }' \
 *        "https://api.everydaytech.au/portal/auth/reset-password"
 */
router.post('/reset-password', async (req, res) => {
    try {
        const { token, newPassword } = req.body;
 
        if (!token || !newPassword) {
            return res.status(400).json({ error: 'Token and new password are required.' });
        }
 
        if (newPassword.length < 8) {
            return res.status(400).json({ error: 'Password must be at least 8 characters long.' });
        }
 
        // Find valid reset token
        const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
        const sessionResult = await pool.query(
            `SELECT customer_user_id 
             FROM customer_sessions 
             WHERE token_hash = $1 
             AND expires_at > NOW()
             AND user_agent = 'password_reset'`,
            [tokenHash]
        );
 
        if (sessionResult.rows.length === 0) {
            return res.status(400).json({ error: 'Invalid or expired reset token.' });
        }
 
        const customerUserId = sessionResult.rows[0].customer_user_id;
 
        // Hash new password
        const passwordHash = await bcrypt.hash(newPassword, 10);
 
        // Update password
        await pool.query(
            'UPDATE customer_users SET password_hash = $1, updated_at = NOW() WHERE customer_user_id = $2',
            [passwordHash, customerUserId]
        );
 
        // Delete reset token
        await pool.query(
            'DELETE FROM customer_sessions WHERE token_hash = $1',
            [tokenHash]
        );
 
        // Get user info for audit log
        const userResult = await pool.query(
            'SELECT tenant_id FROM customer_users WHERE customer_user_id = $1',
            [customerUserId]
        );
 
        // Log audit event
        await logCustomerAudit(
            customerUserId,
            userResult.rows[0].tenant_id,
            'password_reset',
            'auth',
            null,
            {},
            req.ip || req.connection.remoteAddress
        );
 
        res.json({ message: 'Password reset successfully.' });
    } catch (error) {
        console.error('Reset password error:', error);
        res.status(500).json({ error: 'Failed to reset password.', details: error.message });
    }
});
 
/**
 * @api {post} /portal/auth/change-password Change Password
 * @apiName ChangePassword
 * @apiGroup CustomerPortalAuth
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Changes password for authenticated user. Requires current password verification.
 * New password is bcrypt-hashed before storage. Logs audit event.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} currentPassword Current password (for verification)
 * @apiParam {String} newPassword New password (min 8 characters)
 * 
 * @apiSuccess {String} message Success message
 * 
 * @apiError (400) {String} error Current password and new password are required
 * @apiError (400) {String} error Password must be at least 8 characters long
 * @apiError (401) {String} error Unauthorized (invalid/missing token)
 * @apiError (401) {String} error Current password is incorrect
 * @apiError (404) {String} error User not found
 * @apiError (500) {String} error Failed to change password
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        -H "Content-Type: application/json" \
 *        -d '{
 *          "currentPassword": "OldPass123",
 *          "newPassword": "NewSecure456"
 *        }' \
 *        "https://api.everydaytech.au/portal/auth/change-password"
 */
router.post('/change-password', authenticateCustomer, async (req, res) => {
    try {
        const { currentPassword, newPassword } = req.body;
 
        if (!currentPassword || !newPassword) {
            return res.status(400).json({ error: 'Current password and new password are required.' });
        }
 
        if (newPassword.length < 8) {
            return res.status(400).json({ error: 'Password must be at least 8 characters long.' });
        }
 
        // Get current password hash
        const userResult = await pool.query(
            'SELECT password_hash FROM customer_users WHERE customer_user_id = $1',
            [req.customerUserId]
        );
 
        if (userResult.rows.length === 0) {
            return res.status(404).json({ error: 'User not found.' });
        }
 
        // Verify current password
        const passwordMatch = await bcrypt.compare(currentPassword, userResult.rows[0].password_hash);
        if (!passwordMatch) {
            return res.status(401).json({ error: 'Current password is incorrect.' });
        }
 
        // Hash new password
        const passwordHash = await bcrypt.hash(newPassword, 10);
 
        // Update password
        await pool.query(
            'UPDATE customer_users SET password_hash = $1, updated_at = NOW() WHERE customer_user_id = $2',
            [passwordHash, req.customerUserId]
        );
 
        // Log audit event
        await logCustomerAudit(
            req.customerUserId,
            req.tenantId,
            'password_change',
            'auth',
            null,
            {},
            req.ip || req.connection.remoteAddress
        );
 
        res.json({ message: 'Password changed successfully.' });
    } catch (error) {
        console.error('Change password error:', error);
        res.status(500).json({ error: 'Failed to change password.', details: error.message });
    }
});
 
module.exports = router;