Merge pull request #108 from SOURAV-ROY/sentinel/add-user-details-and-password-validation-9377877397732449616

🛡️ Sentinel: Add Joi input validation for auth update details and password endpoints

Author: SOURAV-ROY

index.js

@@ -115,10 +115,16 @@ app.use(hpp());
 app.use(cors());
 
 // Enforce secret presence in production; provide safe fallback in dev/test
-if (process.env.NODE_ENV === "production" && (!process.env.SESSION_SECRET || !process.env.JWT_SECRET)) {
-  throw new Error("FATAL SECURITY ERROR: SESSION_SECRET and JWT_SECRET must be defined in production mode.");
+if (
+  process.env.NODE_ENV === "production" &&
+  (!process.env.SESSION_SECRET || !process.env.JWT_SECRET)
+) {
+  throw new Error(
+    "FATAL SECURITY ERROR: SESSION_SECRET and JWT_SECRET must be defined in production mode.",
+  );
 }
-const sessionSecret = process.env.SESSION_SECRET || "dev_session_secret_fallback_key_32_chars";
+const sessionSecret =
+  process.env.SESSION_SECRET || "dev_session_secret_fallback_key_32_chars";
 
 // Set up session middleware
 app.use(

routes/authRoute.js

@@ -21,7 +21,8 @@ const forgotPasswordLimiter = expressRateLimit({
   validate: { trustProxy: false },
   message: {
     success: false,
-    error: "Too many password reset requests from this IP, please try again after 15 minutes",
+    error:
+      "Too many password reset requests from this IP, please try again after 15 minutes",
   },
 });
 
@@ -35,6 +36,8 @@ const {
     loginSchema,
     resetPasswordSchema,
     forgotPasswordSchema,
+    updateDetailsSchema,
+    updatePasswordSchema,
   },
 } = require("../utils/validators");
 
@@ -44,8 +47,18 @@ router.get("/logout", logout);
 router.get("/csrf-token", getCsrfToken);
 router.get("/me", protect, getMe);
 
-router.put("/updatedetails", protect, updateDetails);
-router.put("/updatepassword", protect, updatePassword);
+router.put(
+  "/updatedetails",
+  protect,
+  validate(updateDetailsSchema),
+  updateDetails,
+);
+router.put(
+  "/updatepassword",
+  protect,
+  validate(updatePasswordSchema),
+  updatePassword,
+);
 
 router.post(
   "/forgotpassword",

utils/validators/authValidator.js

@@ -20,9 +20,21 @@ const forgotPasswordSchema = Joi.object({
   email: Joi.string().email().required(),
 }).unknown(true);
 
+const updateDetailsSchema = Joi.object({
+  name: Joi.string().optional(),
+  email: Joi.string().email().optional(),
+}).unknown(true);
+
+const updatePasswordSchema = Joi.object({
+  currentPassword: Joi.string().required(),
+  newPassword: Joi.string().min(6).required(),
+}).unknown(true);
+
 module.exports = {
   registerSchema,
   loginSchema,
   resetPasswordSchema,
   forgotPasswordSchema,
+  updateDetailsSchema,
+  updatePasswordSchema,
 };