first commit

backend/middleware/auth.js

@@ -0,0 +1,109 @@
+const crypto = require('crypto');
+const { query } = require('../database/db');
+
+/**
+ * Hash an API key using SHA-256
+ */
+function hashApiKey(key) {
+    return crypto.createHash('sha256').update(key).digest('hex');
+}
+
+/**
+ * Generate a new API key with 'cpa_' prefix
+ */
+function generateApiKey() {
+    const randomBytes = crypto.randomBytes(24);
+    return 'cpa_' + randomBytes.toString('hex');
+}
+
+/**
+ * Middleware to validate API key from X-API-Key header
+ */
+async function validateApiKey(req, res, next) {
+    const apiKey = req.headers['x-api-key'];
+
+    if (!apiKey) {
+        return res.status(401).json({
+            success: false,
+            error: 'API key is required. Provide X-API-Key header.'
+        });
+    }
+
+    if (!apiKey.startsWith('cpa_')) {
+        return res.status(401).json({
+            success: false,
+            error: 'Invalid API key format'
+        });
+    }
+
+    try {
+        const keyHash = hashApiKey(apiKey);
+
+        const result = await query(
+            `SELECT id, name, is_active, expires_at, rate_limit, allowed_ips
+             FROM api_keys
+             WHERE key_hash = $1`,
+            [keyHash]
+        );
+
+        const keyRecord = result.rows[0];
+
+        if (!keyRecord) {
+            return res.status(401).json({
+                success: false,
+                error: 'Invalid API key'
+            });
+        }
+
+        if (!keyRecord.is_active) {
+            return res.status(401).json({
+                success: false,
+                error: 'API key is inactive'
+            });
+        }
+
+        if (keyRecord.expires_at) {
+            const expiryDate = new Date(keyRecord.expires_at);
+            if (expiryDate < new Date()) {
+                return res.status(401).json({
+                    success: false,
+                    error: 'API key has expired'
+                });
+            }
+        }
+
+        if (keyRecord.allowed_ips) {
+            const allowedIps = keyRecord.allowed_ips.split(',').map(ip => ip.trim());
+            const clientIp = req.ip || req.connection.remoteAddress;
+            if (!allowedIps.includes(clientIp)) {
+                return res.status(403).json({
+                    success: false,
+                    error: 'IP address not allowed for this API key'
+                });
+            }
+        }
+
+        // Update last_used_at
+        await query('UPDATE api_keys SET last_used_at = CURRENT_TIMESTAMP WHERE id = $1', [keyRecord.id]);
+
+        req.apiKey = {
+            id: keyRecord.id,
+            name: keyRecord.name,
+            rateLimit: keyRecord.rate_limit
+        };
+
+        next();
+    } catch (error) {
+        console.error('API key validation error:', error);
+        return res.status(500).json({
+            success: false,
+            error: 'Authentication error'
+        });
+    }
+}
+
+module.exports = {
+    validateApiKey,
+    generateApiKey,
+    hashApiKey
+};