Auth Locked

Auth Locked

Skill Purpose: Authentication and authorization security patterns with access control

---

Core Skill Pattern

Objective: Establish comprehensive authentication and authorization patterns with role-based access control, security policies, and cross-system integration.

Universal Pattern:

1. Define authentication requirements and security policies
2. Create authorization patterns and role-based access control
3. Set up session management and token security
4. Establish cross-department access verification
5. Create security monitoring and audit procedures

Key Decisions (Project-Specific):

• Authentication methods and security requirements
• Role-based access control complexity
• Session management and token lifecycle
• Cross-system integration depth
• Security monitoring and audit requirements

---

Project-Specific Implementation Notes

Customize per project:

• Authentication methods based on user requirements
• Access control complexity based on data sensitivity
• Session security based on compliance requirements
• Cross-checks based on system integration needs
• Monitoring depth based on security requirements

---

Example Implementation (Authentication Security Pattern)

Note: This is an example pattern for authentication and authorization. Adapt security methods and access control based on your specific project requirements and compliance needs.

Prerequisites (Example)

• Authentication service configured
• User roles and permissions defined
• Security requirements established
• Cross-system integration points identified

---

Example: Authentication Security Implementation

Framework-Specific Example: This demonstrates authentication patterns. Adapt for your auth service and security requirements.

1. Authentication Configuration

// Authentication configuration
interface AuthConfig {
  providers: AuthProvider[];
  sessionDuration: number;
  tokenRefreshThreshold: number;
  mfaRequired: boolean;
  passwordPolicy: PasswordPolicy;
}

interface AuthProvider {
  name: string;
  type: 'email' | 'oauth' | 'sso';
  config: Record<string, any>;
}

interface PasswordPolicy {
  minLength: number;
  requireUppercase: boolean;
  requireLowercase: boolean;
  requireNumbers: boolean;
  requireSymbols: boolean;
  preventReuse: number;
}

// Example configuration
const authConfig: AuthConfig = {
  providers: [
    { name: 'email', type: 'email', config: {} },
    { name: 'google', type: 'oauth', config: { clientId: process.env.GOOGLE_CLIENT_ID } }
  ],
  sessionDuration: 24 * 60 * 60 * 1000, // 24 hours
  tokenRefreshThreshold: 5 * 60 * 1000, // 5 minutes
  mfaRequired: false,
  passwordPolicy: {
    minLength: 8,
    requireUppercase: true,
    requireLowercase: true,
    requireNumbers: true,
    requireSymbols: false,
    preventReuse: 5
  }
};

2. Role-Based Access Control

// Role and permission definitions
interface Role {
  id: string;
  name: string;
  permissions: Permission[];
  inherits?: string[];
}

interface Permission {
  resource: string;
  actions: ('create' | 'read' | 'update' | 'delete')[];
  conditions?: AccessCondition[];
}

interface AccessCondition {
  field: string;
  operator: 'eq' | 'ne' | 'in' | 'nin';
  value: any;
}

// Example roles
const roles: Role[] = [
  {
    id: 'admin',
    name: 'Administrator',
    permissions: [
      { resource: '*', actions: ['create', 'read', 'update', 'delete'] }
    ]
  },
  {
    id: 'user',
    name: 'User',
    permissions: [
      { resource: 'profile', actions: ['read', 'update'] },
      { resource: 'content', actions: ['read'] }
    ]
  },
  {
    id: 'moderator',
    name: 'Moderator',
    permissions: [
      { resource: 'profile', actions: ['read', 'update'] },
      { resource: 'content', actions: ['read', 'update'] },
      { resource: 'comments', actions: ['create', 'read', 'update', 'delete'] }
    ]
  }
];

// Permission checking
function hasPermission(
  userRole: Role,
  resource: string,
  action: string,
  context?: Record<string, any>
): boolean {
  // Check direct permissions
  const permission = userRole.permissions.find(p => 
    p.resource === resource || p.resource === '*'
  );
  
  if (!permission) return false;
  
  if (!permission.actions.includes(action as any)) return false;
  
  // Check conditions
  if (permission.conditions && context) {
    for (const condition of permission.conditions) {
      const contextValue = context[condition.field];
      if (!evaluateCondition(contextValue, condition)) {
        return false;
      }
    }
  }
  
  return true;
}

function evaluateCondition(value: any, condition: AccessCondition): boolean {
  switch (condition.operator) {
    case 'eq': return value === condition.value;
    case 'ne': return value !== condition.value;
    case 'in': return Array.isArray(condition.value) && condition.value.includes(value);
    case 'nin': return Array.isArray(condition.value) && !condition.value.includes(value);
    default: return false;
  }
}

3. Session Management

// Session management
interface Session {
  id: string;
  userId: string;
  token: string;
  refreshToken: string;
  expiresAt: Date;
  createdAt: Date;
  lastActivity: Date;
  ipAddress: string;
  userAgent: string;
}

class SessionManager {
  private sessions = new Map<string, Session>();
  
  createSession(userId: string, token: string, refreshToken: string): Session {
    const session: Session = {
      id: generateId(),
      userId,
      token,
      refreshToken,
      expiresAt: new Date(Date.now() + authConfig.sessionDuration),
      createdAt: new Date(),
      lastActivity: new Date(),
      ipAddress: '',
      userAgent: ''
    };
    
    this.sessions.set(session.id, session);
    return session;
  }
  
  validateSession(sessionId: string): Session | null {
    const session = this.sessions.get(sessionId);
    
    if (!session || session.expiresAt < new Date()) {
      this.sessions.delete(sessionId);
      return null;
    }
    
    session.lastActivity = new Date();
    return session;
  }
  
  refreshSession(refreshToken: string): Session | null {
    const session = Array.from(this.sessions.values())
      .find(s => s.refreshToken === refreshToken);
    
    if (!session) return null;
    
    // Generate new tokens
    const newToken = generateToken();
    const newRefreshToken = generateRefreshToken();
    
    session.token = newToken;
    session.refreshToken = newRefreshToken;
    session.expiresAt = new Date(Date.now() + authConfig.sessionDuration);
    
    return session;
  }
  
  revokeSession(sessionId: string): void {
    this.sessions.delete(sessionId);
  }
  
  revokeAllUserSessions(userId: string): void {
    Array.from(this.sessions.entries())
      .forEach(([id, session]) => {
        if (session.userId === userId) {
          this.sessions.delete(id);
        }
      });
  }
}

4. Cross-Department Access Verification

// Cross-department access checks
interface CrossDepartmentCheck {
  department: string;
  resource: string;
  requiredPermissions: string[];
  checkFunction: (user: User, context: any) => Promise<boolean>;
}

class AccessController {
  private crossChecks: CrossDepartmentCheck[] = [];
  
  registerCrossCheck(check: CrossDepartmentCheck): void {
    this.crossChecks.push(check);
  }
  
  async verifyCrossDepartmentAccess(
    user: User,
    department: string,
    resource: string,
    context: any
  ): Promise<boolean> {
    const checks = this.crossChecks.filter(
      check => check.department === department && check.resource === resource
    );
    
    for (const check of checks) {
      const hasAccess = await check.checkFunction(user, context);
      if (!hasAccess) {
        return false;
      }
    }
    
    return true;
  }
}

// Example cross-department checks
const accessController = new AccessController();

// UI routes access check
accessController.registerCrossCheck({
  department: 'ui',
  resource: 'routes',
  requiredPermissions: ['read'],
  checkFunction: async (user, context) => {
    // Check if user can access UI routes
    const routePermissions = await getUserRoutePermissions(user.id);
    return routePermissions.some(rp => rp.route === context.route && rp.canAccess);
  }
});

// API endpoints access check
accessController.registerCrossCheck({
  department: 'api',
  resource: 'endpoints',
  requiredPermissions: ['execute'],
  checkFunction: async (user, context) => {
    // Check if user can access API endpoints
    const endpointPermissions = await getUserEndpointPermissions(user.id);
    return endpointPermissions.some(ep => ep.endpoint === context.endpoint && ep.canExecute);
  }
});

5. Security Monitoring

// Security monitoring and audit
interface SecurityEvent {
  id: string;
  type: 'login' | 'logout' | 'access_denied' | 'permission_change' | 'suspicious_activity';
  userId?: string;
  ipAddress: string;
  userAgent: string;
  timestamp: Date;
  details: Record<string, any>;
}

class SecurityMonitor {
  private events: SecurityEvent[] = [];
  private suspiciousPatterns = new Map<string, number>();
  
  logEvent(event: Omit<SecurityEvent, 'id' | 'timestamp'>): void {
    const securityEvent: SecurityEvent = {
      ...event,
      id: generateId(),
      timestamp: new Date()
    };
    
    this.events.push(securityEvent);
    this.analyzeForSuspiciousActivity(securityEvent);
  }
  
  private analyzeForSuspiciousActivity(event: SecurityEvent): void {
    // Check for failed login attempts
    if (event.type === 'access_denied') {
      const key = `${event.ipAddress}:${event.type}`;
      const count = (this.suspiciousPatterns.get(key) || 0) + 1;
      this.suspiciousPatterns.set(key, count);
      
      if (count > 5) { // Threshold for suspicious activity
        this.handleSuspiciousActivity(event);
      }
    }
  }
  
  private handleSuspiciousActivity(event: SecurityEvent): void {
    // Log suspicious activity
    console.warn('Suspicious activity detected:', event);
    
    // Could trigger additional security measures:
    // - Lock account temporarily
    // - Require additional authentication
    // - Notify security team
    // - Block IP address
  }
  
  getSecurityReport(timeRange: { start: Date; end: Date }): SecurityReport {
    const eventsInRange = this.events.filter(
      event => event.timestamp >= timeRange.start && event.timestamp <= timeRange.end
    );
    
    return {
      totalEvents: eventsInRange.length,
      eventsByType: this.groupEventsByType(eventsInRange),
      suspiciousActivities: eventsInRange.filter(e => e.type === 'suspicious_activity'),
      topIPAddresses: this.getTopIPAddresses(eventsInRange)
    };
  }
  
  private groupEventsByType(events: SecurityEvent[]): Record<string, number> {
    return events.reduce((acc, event) => {
      acc[event.type] = (acc[event.type] || 0) + 1;
      return acc;
    }, {} as Record<string, number>);
  }
  
  private getTopIPAddresses(events: SecurityEvent[]): Array<{ ip: string; count: number }> {
    const ipCounts = events.reduce((acc, event) => {
      acc[event.ipAddress] = (acc[event.ipAddress] || 0) + 1;
      return acc;
    }, {} as Record<string, number>);
    
    return Object.entries(ipCounts)
      .map(([ip, count]) => ({ ip, count }))
      .sort((a, b) => b.count - a.count)
      .slice(0, 10);
  }
}

interface SecurityReport {
  totalEvents: number;
  eventsByType: Record<string, number>;
  suspiciousActivities: SecurityEvent[];
  topIPAddresses: Array<{ ip: string; count: number }>;
}

6. Middleware Integration

// Authentication middleware for Next.js
import { NextRequest, NextResponse } from 'next/​server';

export async function authMiddleware(request: NextRequest) {
  const token = request.headers.get('authorization')?.replace('Bearer ', '');
  
  if (!token) {
    return NextResponse.json({ error: 'No token provided' }, { status: 401 });
  }
  
  try {
    const user = await verifyToken(token);
    const session = sessionManager.validateSession(user.sessionId);
    
    if (!session) {
      return NextResponse.json({ error: 'Invalid session' }, { status: 401 });
    }
    
    // Add user to request context
    request.headers.set('x-user-id', user.id);
    request.headers.set('x-user-role', user.role);
    
    return NextResponse.next();
  } catch (error) {
    return NextResponse.json({ error: 'Invalid token' }, { status: 401 });
  }
}

// Authorization middleware
export function authorizationMiddleware(requiredPermissions: string[]) {
  return async (request: NextRequest) => {
    const userId = request.headers.get('x-user-id');
    const userRole = request.headers.get('x-user-role');
    
    if (!userId || !userRole) {
      return NextResponse.json({ error: 'Authentication required' }, { status: 401 });
    }
    
    const role = roles.find(r => r.id === userRole);
    if (!role) {
      return NextResponse.json({ error: 'Invalid role' }, { status: 403 });
    }
    
    // Check permissions
    for (const permission of requiredPermissions) {
      const [resource, action] = permission.split(':');
      if (!hasPermission(role, resource, action)) {
        return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 });
      }
    }
    
    return NextResponse.next();
  };
}

---

Integration Patterns

UI Department Integration

• Route protection and access control
• Component-level authorization
• User interface permission checks

API Department Integration

• Endpoint protection and authorization
• Request-level access control
• API rate limiting and security

Data Department Integration

• Row Level Security (RLS) policies
• Database access control
• Data encryption and privacy

---

Stop Conditions

STOP operations and escalate if:

• Authentication service compromised
• Unauthorized access patterns detected
• Security breach suspected
• Cross-department access conflicts
• Session hijacking detected

PAUSE operations if:

• Security audit in progress
• Authentication system maintenance
• Security policy updates
• Compliance review in progress

---

Security Best Practices

Authentication Security:

• Multi-factor authentication
• Strong password policies
• Session timeout management
• Token rotation and refresh

Authorization Security:

• Principle of least privilege
• Role-based access control
• Regular permission audits
• Cross-department access verification

Monitoring Security:

• Real-time threat detection
• Anomaly detection algorithms
• Security event logging
• Automated incident response