first init

server/dist/middleware/auth.d.ts

@@ -0,0 +1,15 @@
+import { Request, Response, NextFunction } from 'express';
+import { Role } from '../types/index.js';
+export interface AuthenticatedRequest extends Request {
+    boardAuth?: {
+        boardId: string;
+        role: Role;
+        board: any;
+    };
+}
+/**
+ * Middleware to require board authorization.
+ * Role parameter defaults to allowing both 'admin' and 'member'.
+ * Pass 'admin' to restrict to superadmin only.
+ */
+export declare function requireBoardAuth(requiredRole?: Role): (req: AuthenticatedRequest, res: Response, next: NextFunction) => Promise<void>;

server/dist/middleware/auth.js

@@ -0,0 +1,55 @@
+import { BoardService } from '../services/boardService.js';
+/**
+ * Middleware to require board authorization.
+ * Role parameter defaults to allowing both 'admin' and 'member'.
+ * Pass 'admin' to restrict to superadmin only.
+ */
+export function requireBoardAuth(requiredRole) {
+    return async (req, res, next) => {
+        try {
+            const boardId = (req.params.boardId || req.params.id || req.body.boardId || req.query.boardId);
+            if (!boardId) {
+                res.status(400).json({ error: 'Missing board ID' });
+                return;
+            }
+            // Extract key from header, query, or body
+            let key = '';
+            const authHeader = req.headers.authorization;
+            if (authHeader && authHeader.startsWith('Bearer ')) {
+                key = authHeader.substring(7).trim();
+            }
+            else if (req.headers['x-board-key']) {
+                key = String(req.headers['x-board-key']).trim();
+            }
+            else if (req.query.key) {
+                key = String(req.query.key).trim();
+            }
+            else if (req.body.key) {
+                key = String(req.body.key).trim();
+            }
+            if (!key) {
+                res.status(401).json({ error: 'Unauthorized: Key is missing in request headers' });
+                return;
+            }
+            const authResult = await BoardService.authenticateKey(boardId, key);
+            if (!authResult) {
+                res.status(403).json({ error: 'Forbidden: Invalid key for this board' });
+                return;
+            }
+            if (requiredRole && requiredRole === 'admin' && authResult.role !== 'admin') {
+                res.status(403).json({ error: 'Forbidden: Superadmin access required' });
+                return;
+            }
+            req.boardAuth = {
+                boardId,
+                role: authResult.role,
+                board: authResult.board,
+            };
+            next();
+        }
+        catch (error) {
+            console.error('Error in auth middleware:', error);
+            res.status(500).json({ error: 'Internal Server Error during authentication' });
+        }
+    };
+}

server/dist/middleware/rateLimit.d.ts

@@ -0,0 +1 @@
+export declare const createBoardLimiter: import("express-rate-limit").RateLimitRequestHandler;

server/dist/middleware/rateLimit.js

@@ -0,0 +1,12 @@
+import rateLimit from 'express-rate-limit';
+import { config } from '../config.js';
+export const createBoardLimiter = rateLimit({
+    windowMs: 60 * 60 * 1000, // 1 hour window
+    max: config.rateLimitMaxBoardsPerHour, // max 5 boards per IP per hour
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: {
+        error: 'Rate Limit Exceeded',
+        message: `You have reached the limit of ${config.rateLimitMaxBoardsPerHour} boards per hour. Please wait before creating another board.`,
+    },
+});