AuthPool — Plug-and-Play Authentication Server

AuthPool is a plug-and-play Node.js authentication package that provides a complete, secure, and configurable authentication system with OAuth, JWT tokens, role-based access, CSRF protection, rate limiting, and more — all out of the box.

---

Features

• Plug & Play Auth Server — Start a full authentication backend in one line of code.
• Google OAuth Integration — Pre-configured with Google strategy (others coming soon).
• JWT-based Authentication — Secure access and refresh token management.
• Session Support — Express session management for OAuth providers.
• Role-Based Access Control (RBAC) — Secure routes with admin/user roles.
• CSRF Protection — Built-in CSRF tokens for safe cross-origin operations.
• Rate Limiting & Slowdown — Prevent brute-force and DDoS attacks.
• MongoDB Integration — Built-in schema for users and refresh tokens.
• Custom User Transformation — Modify or enrich OAuth user data before saving.
• CORS Support — Easily integrate with any frontend.
• Secure Logout & Logout-All Sessions — For full session lifecycle management.

---

Installation

npm install authpool

or

yarn add authpool

---

Basic Setup Example

Create a new file, for example server.js:

const { startAuthServer } = require("authpool");

startAuthServer({
  mongoURI: "mongodb://localhost:27017/authpool",
  googleClientID: "YOUR_GOOGLE_CLIENT_ID",
  googleClientSecret: "YOUR_GOOGLE_CLIENT_SECRET",
  googleCallbackURL: "http://localhost:5000/auth/google/callback",
  jwtSecret: "YOUR_JWT_SECRET",
  sessionSecret: "YOUR_SESSION_SECRET",
  port: 5000,
  corsOptions: {
    origin: "http://localhost:3000",
    methods: ["GET", "POST"],
    credentials: true,
  },
});

Then run:

node server.js

Output:

MongoDB connected
Auth server running at http://localhost:5000

---

Available Routes

Method	Route	Description
GET	/auth/google	Start Google OAuth login
GET	/auth/google/callback	OAuth callback handler
GET	/auth/protected	Protected route (JWT required)
GET	/auth/admin	Admin-only route (RBAC example)
POST	/auth/refresh	Refresh access token
GET	/auth/logout	Logout current session
POST	/auth/logout-all	Logout from all sessions
GET	/auth/csrf	Get CSRF token for frontend

---

Example: Custom User Transformation

You can customize user data before it’s stored in MongoDB:

startAuthServer({
  // ... other configs
  transformUser: (profile, provider) => {
    if (provider === "google") {
      return {
        googleId: profile.id,
        email: profile.emails[0].value,
        name: profile.displayName,
        profilePic: profile.photos[0].value,
        roles: ["user"],
      };
    }
  },
});

---

Token Management

AuthPool issues two types of tokens after successful login:

Token	Description	Expiry
Access Token	Short-lived (used for API requests)	15 minutes
Refresh Token	Stored as an HTTP-only cookie, used to generate new access tokens	30 days

To refresh a token:

POST /auth/refresh
Body: { "refreshToken": "..." }

To logout all devices (invalidate all tokens):

POST /auth/logout-all
Authorization: Bearer <access_token>

---

Role-Based Access Control (RBAC)

You can restrict routes to specific roles (like admin, user, etc.):

router.get("/admin", verifyJWT(JWT_SECRET), authorizeRoles(["admin"]), (req, res) => {
  res.json({ message: "Welcome, admin!" });
});

• Each user has a roles array stored in the database.
• The middleware checks if the logged-in user has the required role.

---

Security Layers

Feature	Purpose
CSRF Protection	Prevents cross-site request forgery attacks
Rate Limiting	Blocks repeated failed attempts
Slowdown Middleware	Adds artificial delay after multiple failed requests
Brute-Force Lockout	Temporarily locks users after repeated login failures
JWT Verification	Ensures tokens are valid and untampered
Role Authorization	Restricts sensitive routes
Refresh Token Rotation	Prevents token replay attacks

---

Environment Variables (.env)

You can use a .env file or pass variables directly in code.

MONGO_URI=mongodb://localhost:27017/authpool
GOOGLE_CLIENT_ID=your_google_client_id
GOOGLE_CLIENT_SECRET=your_google_client_secret
GOOGLE_CALLBACK_URL=http://localhost:5000/auth/google/callback
JWT_SECRET=your_jwt_secret
SESSION_SECRET=your_session_secret
PORT=5000

---

Advanced Configuration

CORS Options

corsOptions: {
  origin: "http://localhost:3000",
  methods: ["GET", "POST"],
  credentials: true,
}

Rate Limiting

rateLimit: {
  global: { windowMs: 15 * 60 * 1000, max: 300 },
  auth: { windowMs: 60 * 1000, max: 5 },
  slowdown: { windowMs: 60 * 1000, delayAfter: 3, delayMs: 250 },
}

CSRF Protection

csrf: {
  enabled: true,
  headerName: "x-csrf-token"
}

---

MongoDB Models

User Model

{
  googleId: String,
  name: String,
  email: String,
  profilePic: String,
  roles: ["user"],
  tokenVersion: Number,
}

Refresh Token Model

{
  jti: String,
  userId: ObjectId,
  hashedToken: String,
  expiresAt: Date,
  revokedAt: Date,
}

---

Example Integration (Frontend)

You can easily use AuthPool with React, Next.js, or any frontend.

Example with Next.js:

fetch("http://localhost:5000/auth/google", {
  credentials: "include"
});

Then, after login:

• The backend sends access and refresh tokens.
• The access token is stored in memory or secure storage.
• Use /auth/refresh for silent renewal.

---

Example Protected API Usage

fetch("http://localhost:5000/auth/protected", {
  headers: {
    Authorization: `Bearer ${accessToken}`,
  },
});

Response:

{
  "message": "Token is valid",
  "user": {
    "id": "66c7f3d...",
    "name": "John Doe",
    "roles": ["user"]
  }
}

---

Architecture Overview

                ┌──────────────────────┐
                │    Frontend App      │
                │ (React / Next.js)    │
                └─────────┬────────────┘
                          │
             OAuth        │
         (Google, GitHub) │
                          ▼
                ┌──────────────────────┐
                │     AuthPool Server  │
                │  Express + Passport  │
                ├──────────────────────┤
                │  Rate Limiting       │
                │  CSRF Protection     │
                │  JWT / Refresh Flow  │
                │  MongoDB (User + RT) │
                └──────────────────────┘
                          │
                    Secure API Calls
                          │
                          ▼
                ┌──────────────────────┐
                │   Your Application   │
                └──────────────────────┘

Upcoming Features

Feature	Status	Description
Multi-Provider OAuth (GitHub, Facebook)	🚧 Open	Add support for more providers
TypeScript Support	🚧 Open	Rewrite in TypeScript for better typings
Multi-Database Support	🚧 Open	Add support for different DBs (Postgres, MySQL, etc.)

---

Contributing

Contributions are welcome! If you’d like to improve or add providers, open a PR or issue.

---

License

MIT License © 2025 Ashish Bhati

---

Author

Ashish Bhati

• GitHub: ashbhati26
• NPM: authpool
• Project Type: Research & Developer Tool
• Keywords: Authentication, OAuth, Passport, JWT, Node.js, MongoDB