implement authentication and authorization system mern migration task 3 (#40)

* feat(backend): Implement authentication and authorization system

- Add cookie-parser middleware for session management
- Implement user model and authentication service with JWT and session-based authentication
- Create authentication and authorization middleware for role-based access control
- Develop project and user models to manage user roles and permissions
- Integrate Redis for session storage and improve database connection handling
- Add comprehensive unit and integration tests for authentication flows
- Update documentation to reflect new authentication implementation and usage

This commit establishes a robust authentication and authorization framework, enhancing security and user management capabilities across the application.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* fix(backend): Update user ID handling in project service and improve integration test timeouts

- Modify getUserProjects method to convert userId to ObjectId for accurate MongoDB queries.
- Increase timeout for container startup in integration tests to 120 seconds to ensure reliable test execution.
- Adjust cookie handling in authentication tests to support both single and array formats for improved robustness.

These changes enhance the reliability of user project retrieval and improve the stability of integration tests.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* fix(backend): Enhance project model middleware and improve integration test cleanup

- Update project model middleware to ensure `next()` is called only if it's a function, preventing potential errors.
- Refactor integration tests to improve cleanup order for Redis and MongoDB containers, ensuring proper resource management and reducing test flakiness.

These changes enhance the reliability of the project model and improve the stability of integration tests.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* chore(pre-commit): Update Prettier hook to use local npm script for consistent formatting

- Refactor Prettier hook to utilize a local command that runs `npm run format`, ensuring the same Prettier version and configuration as used in npm scripts.
- Adjust hook settings to always run and exclude passing filenames, improving integration with the project's formatting workflow.

These changes enhance the reliability of code formatting across the project.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(backend): Implement CSRF protection and enhance authentication tests

- Introduced CSRF protection middleware using Lusca, ensuring secure handling of state-changing requests.
- Updated authentication integration tests to include CSRF token handling for login requests, improving security during testing.
- Added helper functions to facilitate CSRF token retrieval for both unauthenticated and authenticated requests.
- Updated package dependencies to include Lusca and its type definitions.

These changes enhance the security of the application by implementing CSRF protection and improving the robustness of authentication tests.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(backend): Replace Lusca with CSRF protection and enhance middleware

- Removed Lusca dependency and integrated CSRF protection using the csrf package.
- Updated middleware to handle CSRF token generation and validation for state-changing requests.
- Refactored related tests to accommodate the new CSRF implementation.
- Updated package dependencies to reflect the removal of Lusca and addition of csrf.

These changes improve the security posture of the application by implementing a more flexible CSRF protection mechanism.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* Potential fix for code scanning alert no. 1: Missing rate limiting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix: build shared package before type-check in CI

The type-check step was failing because backend imports from @hashhive/shared,
but the shared package's dist output wasn't built yet. Added build-shared as a
dependency before type-check in the ci-check recipe.

Co-Authored-By: Warp <agent@warp.dev>

* fix: extract magic numbers in rate limiter to named constants

Resolve ESLint @typescript-eslint/no-magic-numbers violations by
extracting rate limiter configuration values into descriptive constants.

Co-Authored-By: Warp <agent@warp.dev>

* feat(backend): Enhance rate limiting and database connection settings

- Added express-rate-limit package to implement rate limiting on sensitive authentication endpoints.
- Updated Jest configuration to improve coverage thresholds for various files.
- Enhanced MongoDB connection settings with server selection and socket timeouts for better reliability.
- Updated .prettierignore to exclude Next.js generated files.

These changes improve the security and performance of the application by enforcing request limits and optimizing database connectivity.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(backend): Refactor CSRF handling and enhance project service with transactions

- Updated CSRF token handling in the middleware to reuse existing secrets, improving token validity across requests.
- Enhanced project creation in ProjectService to use MongoDB transactions, ensuring atomicity when creating projects and associated users.
- Improved error logging in optional authentication middleware to capture and log authentication errors.
- Refactored CSRF token retrieval in tests to align with the new header-based approach.

These changes enhance security and reliability in CSRF handling and project management processes.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* fix(ci): use npx to run eslint in workspace packages

The lint command in backend, frontend, and shared packages was failing
because eslint was not found. The eslint package is installed at the
root level as a devDependency, but workspace packages need to use 'npx'
to resolve binaries from the workspace tree.

This change updates all workspace package.json files to use 'npx eslint'
instead of 'eslint' directly.

Co-Authored-By: Warp <agent@warp.dev>

* feat(workflow): add GitHub Copilot setup workflow

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* Address PR #40 review feedback: CORS, CSRF middleware, and role aggregation (#41)

* Initial plan

* fix: Apply PR review feedback - CORS, CSRF, and role aggregation improvements

Co-authored-by: unclesp1d3r <251112+unclesp1d3r@users.noreply.github.com>

* refactor: Simplify CSRF middleware logic and remove redundant await

Co-authored-by: unclesp1d3r <251112+unclesp1d3r@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: unclesp1d3r <251112+unclesp1d3r@users.noreply.github.com>

* Update backend/src/routes/auth.routes.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* chore(ci): update node version file references and add .nvmrc

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* chore(models): remove redundant index declarations to avoid duplication

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(auth): enhance password handling and upgrade flag logic

- Added password_requires_upgrade field to IUser model.
- Updated login logic to flag users with weak passwords for upgrade.
- Improved error messages for Redis client status.
- Enhanced tests for login functionality and session management.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(csrf): implement encryption for CSRF secrets in cookies

- Added functions to encrypt and decrypt CSRF secrets using AES-256-GCM.
- Updated CSRF cookie handling to store encrypted secrets, enhancing security.
- Improved error handling for encryption and decryption processes.

These changes strengthen the protection of CSRF tokens by ensuring sensitive information is not stored in plaintext.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* feat(auth): improve user mapping and enhance CSRF key handling

- Added a utility function to map Mongoose IUser documents to a User object for request context, improving code readability and maintainability.
- Cached the CSRF encryption key at application startup to optimize performance by avoiding repeated PBKDF2 computations.
- Updated project model to change the pre-save hook to a pre-validate hook for slug generation, ensuring validation requirements are met.

These changes enhance the efficiency and clarity of user authentication and CSRF handling processes.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* Fix failing checks for run 19625498172 (#47)

Co-authored-by: Warp Agent <agent@warp.dev>
Co-authored-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

* docs: add ci-check reminder before committing changes in AGENTS.md and copilot-instructions.md

- Included a note to run `just ci-check` to ensure all checks and tests pass before committing changes, emphasizing the importance of task completion.

This update enhances the development workflow documentation for better adherence to quality checks.

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>

---------

Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Warp Agent <agent@warp.dev>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: 6 people

.github/copilot-instructions.md

@@ -34,6 +34,8 @@ HashHive is a greenfield MERN (MongoDB, Express, React, Node.js) platform orches
 
 ## Development Workflow
 
+> Before committing any changes, always run `just ci-check` and ensure all checks and tests pass; a task is not complete until `just ci-check` succeeds.
+
 ```bash
 # Quick start
 npm install                    # Install all workspace deps

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version-file: 'package.json'
+          node-version-file: '.node-version'
           cache: npm
 
       - name: Install just

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,56 @@
+name: Copilot Setup
+'on':
+  workflow_dispatch:
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+    env:
+      # Testcontainers configuration for GitHub Copilot
+      # Ryuk is a container that cleans up resources; enable it for proper cleanup
+      TESTCONTAINERS_RYUK_DISABLED: false
+      # Use the local Docker daemon
+      DOCKER_HOST: unix:///var/run/docker.sock
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version-file: '.node-version'
+          cache: npm
+
+      - name: Install just
+        uses: extractions/setup-just@v1
+
+      - name: Install root dependencies
+        run: npm install
+
+      - name: Install workspace dependencies
+        run: npm install --workspaces
+
+      - name: Build shared package
+        run: npm run build -w shared
+
+      - name: Run type checking
+        run: npm run type-check --workspaces
+
+      - name: Verify Docker is available for Testcontainers
+        run: |
+          docker --version
+          docker info
+          echo "Docker socket permissions:"
+          ls -la /var/run/docker.sock
+
+      - name: Pre-pull Docker images for Testcontainers
+        run: |
+          echo "Pulling Docker images used by integration tests..."
+          docker pull mongo:7 &
+          docker pull redis:7-alpine &
+          docker pull minio/minio:latest &
+          wait
+          echo "All images pulled successfully"
+
+      - name: Validate setup
+        run: just validate
+
+      - name: Display environment info
+        run: just info

.gitignore

@@ -43,4 +43,4 @@ temp/
 
 # Test results
 frontend/test-results/
-frontend/playwright-report/index.html
+frontend/playwright-report/

.kiro/specs/mern-migration/tasks.md

@@ -38,29 +38,29 @@
     - Add presigned URL generation for secure downloads
     - _Requirements: 1.4, 7.1_
 
-- [ ] 3. Authentication and authorization system
-  - [ ] 3.1 Implement user model and authentication service
+- [x] 3. Authentication and authorization system
+  - [x] 3.1 Implement user model and authentication service
     - Create User Mongoose model with password hashing
     - Implement AuthService with login, logout, and token generation
     - Add JWT token generation and validation
     - Implement session management with HttpOnly cookies
     - _Requirements: 2.1, 2.2, 2.5_
 
-  - [ ] 3.2 Create authentication middleware
+  - [x] 3.2 Create authentication middleware
     - Implement JWT validation middleware for API routes
     - Create session validation middleware for web routes
     - Add request user context injection
     - Implement token refresh logic
     - _Requirements: 2.1, 2.2_
 
-  - [ ] 3.3 Implement role-based access control
+  - [x] 3.3 Implement role-based access control
     - Create Role and ProjectUser models
     - Implement authorization middleware with role checking
     - Add project-scoped permission validation
     - Create permission helper utilities
     - _Requirements: 2.3, 2.4_
 
-  - [ ] 3.4 Write authentication tests
+  - [x] 3.4 Write authentication tests
     - Test login flow with valid and invalid credentials
     - Test JWT token generation and validation
     - Test session cookie management

.node-version

@@ -0,0 +1 @@
+20

.nvmrc

@@ -0,0 +1 @@
+20

.pre-commit-config.yaml

@@ -32,18 +32,20 @@ repos:
       - id: check-xml
       - id: check-yaml
 
-  # Format code with Prettier
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v4.0.0-alpha.8
+  # Local hooks for npm scripts
+  - repo: local
     hooks:
+      # Format code with Prettier
+      # Use local hook to ensure same Prettier version and config as npm scripts
       - id: prettier
-        # Only run Prettier on code/config files, not Markdown or JSONC
+        name: Prettier
+        entry: bash -c 'npm run format'
+        language: system
+        types: [file]
         types_or: [javascript, jsx, ts, tsx, json, yaml]
-        exclude: ^(node_modules/|dist/|\.next/|coverage/|\.git/|package-lock\.json|.*\.md$|.*\.jsonc$)
+        pass_filenames: false
+        always_run: true
 
-  # Local hooks for npm scripts
-  - repo: local
-    hooks:
       # ESLint linting
       # Note: Using local hook to respect project's ESLint config
       # Alternative: https://github.com/pre-commit/mirrors-eslint (requires additional setup)

.prettierignore

@@ -10,3 +10,5 @@ test-results
 # Ignore markdown docs from Prettier checks (per project preference)
 *.md
 **/*.md
+# Ignore Next.js generated files
+frontend/next-env.d.ts

AGENTS.md

@@ -148,6 +148,8 @@ Updates are generally non-destructive, relying on explicit status fields and met
 
 ## Development and runtime commands (planned)
 
+> Before committing any changes, always run `just ci-check` and ensure all checks and tests pass; a task is not complete until `just ci-check` succeeds.
+
 At the time of writing, this repository primarily contains design documents; actual `package.json` scripts and Docker configurations may not yet exist. The commands below are taken from `.kiro/steering/tech.md` and represent the intended interface once backend and frontend packages are in place.
 
 ### Backend (inside `backend/`)