fix: patch critical security vulnerabilities across the backend

backend/.env.example

@@ -0,0 +1,17 @@
+# Server
+PORT=5000
+NODE_ENV=development
+
+# Database
+DB_HOST=localhost
+DB_PORT=3306
+DB_NAME=smartqueue
+DB_USER=root
+DB_PASSWORD=
+
+# Auth
+JWT_SECRET=change-me-to-a-strong-random-value
+JWT_EXPIRES_IN=24h
+
+# CORS — comma-separated allowed origins
+CORS_ORIGIN=http://localhost:5173

backend/package.json

@@ -16,6 +16,8 @@
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.5.2",
+    "helmet": "^8.2.0",
     "jsonwebtoken": "^9.0.3",
     "morgan": "^1.11.0",
     "mysql2": "^3.22.4",

backend/server.js

@@ -1,19 +1,31 @@
 // 1. Load the environment variables FIRST
 require('dotenv').config();
-console.log("DEBUG -> JWT_SECRET VALUE IS:", process.env.JWT_SECRET);
-// 2. NOW load your app, database, and models
+
+// 2. Validate required secrets before booting
+if (!process.env.JWT_SECRET) {
+  console.error('FATAL: JWT_SECRET environment variable is not set. Aborting.');
+  process.exit(1);
+}
+
+// 3. NOW load your app, database, and models
 const app = require('./src/app');
 const sequelize = require('./src/config/database');
 require('./src/models');
 
 const PORT = process.env.PORT || 5000;
+const isDev = process.env.NODE_ENV !== 'production';
 
 async function startServer() {
   try {
     await sequelize.authenticate();
     console.log('Database connected successfully');
 
-    await sequelize.sync({ alter: true });
+    // Only auto-alter schema in development; use migrations in production
+    if (isDev) {
+      await sequelize.sync({ alter: true });
+    } else {
+      await sequelize.sync();
+    }
     console.log('Models synchronized');
 
     app.listen(PORT, () => {

backend/src/app.js

@@ -1,17 +1,44 @@
 const express = require('express');
 const cors = require('cors');
+const helmet = require('helmet');
 const morgan = require('morgan');
 const app = express();
 
 const authRoutes = require('./routes/auth.routes');
 
-// Global Middleware
-app.use(cors());
-app.use(express.json());
-app.use(morgan('dev'));
+// Security headers
+app.use(helmet());
+
+// CORS — restrict to known frontend origin
+const allowedOrigins = process.env.CORS_ORIGIN
+  ? process.env.CORS_ORIGIN.split(',')
+  : [];
+
+app.use(
+  cors({
+    origin(origin, callback) {
+      // Allow server-to-server requests (no origin) and allowed origins
+      if (!origin || allowedOrigins.includes(origin)) {
+        return callback(null, true);
+      }
+      return callback(new Error('Not allowed by CORS'));
+    },
+    credentials: true,
+  })
+);
+
+// Body parser with size limit to prevent large-payload DoS
+app.use(express.json({ limit: '10kb' }));
+
+// Request logging — verbose in dev, minimal in production
+if (process.env.NODE_ENV === 'production') {
+  app.use(morgan('combined'));
+} else {
+  app.use(morgan('dev'));
+}
 
 // API Routes
-app.use('/api/auth', authRoutes); // Handles both /api/auth/register and /api/auth/login
+app.use('/api/auth', authRoutes);
 
 // Health Check
 app.get('/api/health', (req, res) => {

backend/src/middleware/auth.middleware.js

@@ -0,0 +1,27 @@
+const jwt = require('jsonwebtoken');
+
+const authenticate = (req, res, next) => {
+  const header = req.headers.authorization;
+
+  if (!header || !header.startsWith('Bearer ')) {
+    return res.status(401).json({
+      success: false,
+      message: 'Authentication required.',
+    });
+  }
+
+  const token = header.split(' ')[1];
+
+  try {
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    req.user = decoded;
+    return next();
+  } catch (err) {
+    return res.status(401).json({
+      success: false,
+      message: 'Invalid or expired token.',
+    });
+  }
+};
+
+module.exports = { authenticate };

backend/src/models/user.js

@@ -21,6 +21,10 @@ module.exports = (sequelize) => {
           notEmpty: {
             msg: 'Name is required',
           },
+          len: {
+            args: [1, 100],
+            msg: 'Name must be between 1 and 100 characters',
+          },
         },
       },
 

backend/src/routes/auth.routes.js

@@ -1,14 +1,22 @@
 const express = require('express');
+const rateLimit = require('express-rate-limit');
 const router = express.Router();
 
-// 1. Add 'login' to the destructured import
 const { register, login } = require('../controllers/auth.controller');
 
-// POST /api/auth/register
-router.post('/register', register);
+// Rate-limit auth endpoints to mitigate brute-force attacks
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 20, // 20 attempts per window per IP
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: {
+    success: false,
+    message: 'Too many requests, please try again later.',
+  },
+});
 
-// 2. Add the login route definition
-// This maps to: POST /api/auth/login
-router.post('/login', login);
+router.post('/register', authLimiter, register);
+router.post('/login', authLimiter, login);
 
 module.exports = router;