Merge pull request #178 from nanaf6203-bit/fix/nanaf6203-security-hardening

Harden JWT validation, rate limiter, and token storage

Author: dzekojohn4

backend/.env.example

@@ -0,0 +1,21 @@
+# Required — the application will NOT start without this.
+# Generate a strong random string (e.g. openssl rand -hex 32).
+JWT_SECRET=
+
+# Optional overrides (defaults shown).
+# JWT_EXPIRES_IN=15m
+
+# Database
+# DATABASE_HOST=localhost
+# DATABASE_PORT=5432
+# DATABASE_USER=postgres
+# DATABASE_PASSWORD=
+# DATABASE_NAME=stellarshunts
+# DATABASE_SYNC=true
+
+# Stellar / Soroban
+# STELLAR_MODE=mock
+# STELLAR_NETWORK=testnet
+# SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
+# STELLAR_HUNTS_CONTRACT_ID=
+# STELLAR_HUNTS_NFT_CONTRACT_ID=

backend/src/auth/auth.module.ts

@@ -8,16 +8,26 @@ import { AuthController } from "./controllers/auth.controller"
 import { AuthService } from "./services/auth.service"
 import { JwtStrategy } from "./strategies/jwt.strategy"
 import { JwtAuthGuard } from "./guards/jwt-auth.guard"
+import * as Joi from "joi"
 
 @Module({
   imports: [
     TypeOrmModule.forFeature([User]),
     PassportModule.register({ defaultStrategy: "jwt" }),
+    ConfigModule.forRoot({
+      isGlobal: true,
+      validationSchema: Joi.object({
+        JWT_SECRET: Joi.string().required().messages({
+          "any.required": "JWT_SECRET is required. Set it in your .env file.",
+          "string.empty": "JWT_SECRET cannot be empty. Set it in your .env file.",
+        }),
+      }),
+    }),
     JwtModule.registerAsync({
       imports: [ConfigModule],
       inject: [ConfigService],
       useFactory: (configService: ConfigService) => ({
-        secret: configService.get("JWT_SECRET") || "your-secret-key",
+        secret: configService.get<string>("JWT_SECRET"),
         signOptions: {
           expiresIn: configService.get("JWT_EXPIRES_IN") || "15m",
         },

backend/src/rate-limiter/rate-limit.guard.ts

@@ -25,8 +25,14 @@ export class RateLimitGuard implements CanActivate {
     if (!config) return true;
 
     const request = context.switchToHttp().getRequest();
-    const ip = request.ip || request.connection.remoteAddress;
-    const key = `rate:${ip}:${context.getHandler().name}`;
+    const ip =
+      (request.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() ||
+      request.ip ||
+      request.connection.remoteAddress;
+    const userId = request.user?.id;
+    const key = userId
+      ? `rate:${userId}:${context.getHandler().name}`
+      : `rate:${ip}:${context.getHandler().name}`;
 
     const isLimited = this.rateLimiterService.isRateLimited(
       key,

backend/src/rate-limiter/rate-limiter.service.ts

@@ -1,8 +1,17 @@
-import { Injectable } from '@nestjs/common';
+import { Injectable, OnModuleInit, OnModuleDestroy } from '@nestjs/common';
 
 @Injectable()
-export class RateLimiterService {
+export class RateLimiterService implements OnModuleInit, OnModuleDestroy {
   private requestsMap = new Map<string, { count: number; expiresAt: number }>();
+  private evictionTimer: ReturnType<typeof setInterval> | null = null;
+
+  onModuleInit() {
+    this.evictionTimer = setInterval(() => this.evictExpired(), 30_000);
+  }
+
+  onModuleDestroy() {
+    if (this.evictionTimer) clearInterval(this.evictionTimer);
+  }
 
   isRateLimited(key: string, ttl: number, limit: number): boolean {
     const now = Date.now();
@@ -19,4 +28,13 @@ export class RateLimiterService {
     this.requestsMap.set(key, entry);
     return false;
   }
+
+  private evictExpired() {
+    const now = Date.now();
+    for (const [key, entry] of this.requestsMap) {
+      if (now > entry.expiresAt) {
+        this.requestsMap.delete(key);
+      }
+    }
+  }
 }

frontend/store/auth/auth-store.js

@@ -1,92 +1,149 @@
-import create from "zustand";
+import { create } from "zustand";
 import { persist } from "zustand/middleware";
+import { devtools } from "zustand/middleware";
+
+const ENCRYPTION_KEY_NAME = "stellar-hunts-ek";
+
+async function getOrCreateEncryptionKey() {
+	const stored = sessionStorage.getItem(ENCRYPTION_KEY_NAME);
+	if (stored) {
+		const raw = Uint8Array.from(atob(stored), (c) => c.charCodeAt(0));
+		return crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, true, [
+			"encrypt",
+			"decrypt",
+		]);
+	}
+	const key = await crypto.subtle.generateKey(
+		{ name: "AES-GCM", length: 256 },
+		true,
+		["encrypt", "decrypt"]
+	);
+	const exported = await crypto.subtle.exportKey("raw", key);
+	sessionStorage.setItem(
+		ENCRYPTION_KEY_NAME,
+		btoa(String.fromCharCode(...new Uint8Array(exported)))
+	);
+	return key;
+}
+
+async function encryptToken(token) {
+	if (!token) return null;
+	const key = await getOrCreateEncryptionKey();
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const encoded = new TextEncoder().encode(token);
+	const ciphertext = await crypto.subtle.encrypt(
+		{ name: "AES-GCM", iv },
+		key,
+		encoded
+	);
+	const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+	combined.set(iv);
+	combined.set(new Uint8Array(ciphertext), iv.length);
+	return btoa(String.fromCharCode(...combined));
+}
+
+async function decryptToken(encrypted) {
+	if (!encrypted) return null;
+	try {
+		const key = await getOrCreateEncryptionKey();
+		const raw = Uint8Array.from(atob(encrypted), (c) => c.charCodeAt(0));
+		const iv = raw.slice(0, 12);
+		const ciphertext = raw.slice(12);
+		const decrypted = await crypto.subtle.decrypt(
+			{ name: "AES-GCM", iv },
+			key,
+			ciphertext
+		);
+		return new TextDecoder().decode(decrypted);
+	} catch {
+		return null;
+	}
+}
 
 const useAuthStore = create(
 	devtools(
 		persist(
-			(set) => ({
+			(set, get) => ({
 				user: null,
 				token: null,
 				isAuthenticated: false,
+
 				register: async (userData) => {
 					try {
 						const response = await fetch("/api/register", {
 							method: "POST",
-							headers: {
-								"Content-Type": "application/json",
-							},
+							headers: { "Content-Type": "application/json" },
 							body: JSON.stringify(userData),
 						});
 
-						if (!response.ok) {
-							throw new Error("Registration failed");
-						}
+						if (!response.ok) throw new Error("Registration failed");
 
 						const data = await response.json();
 						const { user, token } = data;
-						set({ user, token, isAuthenticated: true });
-						// Optionally, store the token in localStorage or set it in headers for future requests
+						const encrypted = await encryptToken(token);
+						set({ user, token: encrypted, isAuthenticated: true });
 					} catch (error) {
 						console.error("Registration error:", error);
-						// Handle registration error (e.g., show notification)
 					}
 				},
+
 				login: async (credentials) => {
 					try {
 						const response = await fetch("/api/login", {
 							method: "POST",
-							headers: {
-								"Content-Type": "application/json",
-							},
+							headers: { "Content-Type": "application/json" },
 							body: JSON.stringify(credentials),
 						});
 
-						if (!response.ok) {
-							throw new Error("Login failed");
-						}
+						if (!response.ok) throw new Error("Login failed");
 
 						const data = await response.json();
 						const { user, token } = data;
-						set({ user, token, isAuthenticated: true });
-						// Optionally, store the token in localStorage or set it in headers for future requests
+						const encrypted = await encryptToken(token);
+						set({ user, token: encrypted, isAuthenticated: true });
 					} catch (error) {
 						console.error("Login error:", error);
-						// Handle login error (e.g., show notification)
 					}
 				},
+
 				logout: () => {
 					set({ user: null, token: null, isAuthenticated: false });
-					// Optionally, remove the token from localStorage or headers
 				},
+
+				getDecryptedToken: async () => {
+					const { token } = get();
+					return decryptToken(token);
+				},
+
 				fetchUser: async () => {
 					try {
+						const decryptedToken = await get().getDecryptedToken();
 						const response = await fetch("/api/user", {
 							method: "GET",
 							headers: {
 								"Content-Type": "application/json",
-								// Include authorization header with the token if required
+								...(decryptedToken
+									? { Authorization: `Bearer ${decryptedToken}` }
+									: {}),
 							},
 						});
 
-						if (!response.ok) {
-							throw new Error("Fetching user failed");
-						}
+						if (!response.ok) throw new Error("Fetching user failed");
 
 						const user = await response.json();
 						set({ user, isAuthenticated: true });
 					} catch (error) {
 						console.error("Fetching user error:", error);
-						// Handle error (e.g., redirect to login)
 					}
 				},
 			}),
 			{
 				name: "auth-storage",
 				getStorage: () => localStorage,
-			},
+			}
 		),
-		{ name: "AuthStore" },
-	),
+		{ name: "AuthStore" }
+	)
 );
 
 export default useAuthStore;