d147ebbca7
Implement complete JWT-based authentication system with comprehensive security features:
Database:
- Migration 005: Add 4 new tables (refresh_tokens, password_reset_tokens, audit_log, entity_permissions)
- Enhanced users table with email verification, account status, lockout protection
Services:
- auth.service.js: Full authentication lifecycle (register, login, refresh, logout, password reset, email verification)
- audit.service.js: Comprehensive security event logging and tracking
Routes:
- auth.routes.js: 9 authentication endpoints (register, login, refresh, logout, profile, password operations, email verification)
Middleware:
- auth.middleware.js: Token authentication, email verification, account status checks
Security Features:
- bcrypt password hashing (cost 12)
- JWT access tokens (15-minute expiry)
- Refresh tokens (7-day expiry, SHA256 hashed, revocable)
- Account lockout (5 failed attempts = 15 minutes)
- Token rotation on password reset
- Email verification workflow
- Comprehensive audit logging
Scripts:
- run-migration.js: Automated database migration runner
- test-auth.js: Comprehensive test suite (10 tests)
- check-audit-log.js: Audit log verification tool
All tests passing. Production-ready implementation.
🤖 Generated with Claude Code
30 lines
1.1 KiB
SQL
30 lines
1.1 KiB
SQL
-- Rollback Migration: Multi-Tenancy Authentication System
|
|
-- Date: 2025-10-21
|
|
|
|
-- Drop new tables in reverse order
|
|
DROP INDEX IF EXISTS idx_audit_resource;
|
|
DROP INDEX IF EXISTS idx_audit_status;
|
|
DROP INDEX IF EXISTS idx_audit_created;
|
|
DROP INDEX IF EXISTS idx_audit_event;
|
|
DROP INDEX IF EXISTS idx_audit_user;
|
|
DROP TABLE IF EXISTS audit_log;
|
|
|
|
DROP INDEX IF EXISTS idx_reset_tokens_used;
|
|
DROP INDEX IF EXISTS idx_reset_tokens_expires;
|
|
DROP INDEX IF EXISTS idx_reset_tokens_user;
|
|
DROP TABLE IF EXISTS password_reset_tokens;
|
|
|
|
DROP INDEX IF EXISTS idx_refresh_tokens_revoked;
|
|
DROP INDEX IF EXISTS idx_refresh_tokens_expires;
|
|
DROP INDEX IF EXISTS idx_refresh_tokens_user;
|
|
DROP TABLE IF EXISTS refresh_tokens;
|
|
|
|
DROP INDEX IF EXISTS idx_entity_perms_expires;
|
|
DROP INDEX IF EXISTS idx_entity_perms_entity;
|
|
DROP INDEX IF EXISTS idx_entity_perms_user;
|
|
DROP TABLE IF EXISTS entity_permissions;
|
|
|
|
-- Note: Cannot easily drop ALTER TABLE columns in SQLite
|
|
-- Would require recreating table without those columns
|
|
-- For now, leaving the new columns (they won't break existing functionality)
|
|
-- If strict rollback is needed, would require table recreation with data migration
|