From 1e055fa3b440d2ad88bfbef59ccb39f5fba72a1f Mon Sep 17 00:00:00 2001
From: drkdrive <dumepaepp@users.noreply.github.com>
Date: Fri, 14 Aug 2026 03:36:27 +0200
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20security=20audit=20=E2=80=94=20resol?=
 =?UTF-8?q?ve=20critical=20vulnerabilities=20and=20harden=20infrastructure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Critical fixes:
- Fix role self-escalation: users could register as admin via POST body
- Fix Sequelize  syntax bug (MongoDB syntax used — queries silently broken)
- Enforce JWT_SECRET validation at startup (reject weak/missing secrets)
- Fix XSS sanitization bypass (only stripped <script> tags, not img/svg/event handlers)

High fixes:
- Fix IP whitelist memory leak (mutable array pushed on every request)
- Add JWT token management to frontend (auto-refresh, 401 handling)
- Fix graceful shutdown to close MongoDB, RabbitMQ, Redis connections
- Remove duplicate signal handlers from app.js (lifecycle in server.js)
- Add RabbitMQ reconnection with exponential backoff and poison pill handling

Medium fixes:
- Remove double module.exports in auth middleware
- Dockerfiles: npm ci, non-root user, healthchecks
- docker-compose: env-var credentials with RequiredVar guards
- Add .gitignore, .env.example, frontend/nginx.conf
- Add comprehensive REVIEW.md with remaining recommendations
---
 .env.example                              |  35 ++++
 .gitignore                                |  65 +++-----
 REVIEW.md                                 | 187 ++++++++++++++++++++++
 backend/Dockerfile                        |  24 ++-
 backend/src/app.js                        |  24 +--
 backend/src/config/rabbitmq.js            | 112 +++++++++++--
 backend/src/controllers/authController.js |  19 ++-
 backend/src/middleware/auth.js            |   5 +-
 backend/src/middleware/security.js        |  35 ++--
 backend/src/middleware/validation.js      |   5 -
 backend/src/server.js                     |  40 ++++-
 docker-compose.yml                        |  85 +++++-----
 frontend/Dockerfile                       |  18 ++-
 frontend/nginx.conf                       |  50 ++++++
 frontend/src/services/api.js              | 106 +++++++++---
 15 files changed, 625 insertions(+), 185 deletions(-)
 create mode 100644 .env.example
 create mode 100644 REVIEW.md
 create mode 100644 frontend/nginx.conf

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..0bc5f40
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,35 @@
+# AutoSec Docker Compose Environment
+# Copy this file to .env and fill in real values before running `docker compose up`
+
+# ==== REQUIRED SECRETS (must be set before first run) ====
+# Generate with: openssl rand -base64 48
+JWT_SECRET=CHANGE_ME_GENERATE_WITH_openssl_rand_base64_48
+
+# Database passwords
+POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+REDIS_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+RABBITMQ_DEFAULT_PASS=CHANGE_ME_STRONG_PASSWORD
+
+# ==== OPTIONAL (defaults shown) ====
+POSTGRES_DB=autosec_db
+POSTGRES_USER=autosec_user
+
+# Port mappings (set to different values to avoid conflicts)
+# PG_EXPOSE_PORT=5432
+# MONGO_EXPOSE_PORT=27017
+# REDIS_EXPOSE_PORT=6379
+# RABBIT_AMQP_PORT=5672
+# RABBIT_MGMT_PORT=15672
+# BACKEND_PORT=8080
+# FRONTEND_PORT=3000
+
+# Logging
+LOG_LEVEL=info
+NODE_ENV=production
+
+# JWT expiry
+JWT_EXPIRES_IN=24h
+JWT_REFRESH_EXPIRES_IN=7d
+
+# Frontend URL (for CORS)
+FRONTEND_URL=http://localhost:3000
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 51ba825..dc7d910 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,62 +1,33 @@
 # Dependencies
 node_modules/
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
+package-lock.json
+*.lock
 
-# Environment variables
+# Environment files
 .env
 .env.local
-.env.development.local
-.env.test.local
-.env.production.local
+.env.production
+*.env
 
-# Build outputs
-build/
-dist/
-*.tgz
-*.tar.gz
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Coverage directory used by tools like istanbul
-coverage/
-*.lcov
-
-# IDE and editor files
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# OS generated files
+# OS files
 .DS_Store
-.DS_Store?
-._*
-.Spotlight-V100
-.Trashes
-ehthumbs.db
 Thumbs.db
 
-# Docker
-.dockerignore
+# IDE files
+.idea/
+.vscode/
+*.swp
 
-# GeoIP database (should be downloaded separately)
-data/geoip/GeoLite2-City.mmdb
+# Build output
+build/
+dist/
 
 # Logs
-logs
+logs/
 *.log
 
-# Database data (when using local development)
-postgres_data/
-mongodb_data/
+# GeoIP database (user must download)
+data/geoip/*.mmdb
 
-# Temporary files
-tmp/
-temp/
\ No newline at end of file
+# Docker volumes (local data)
+uploads/
\ No newline at end of file
diff --git a/REVIEW.md b/REVIEW.md
new file mode 100644
index 0000000..b6ff92e
--- /dev/null
+++ b/REVIEW.md
@@ -0,0 +1,187 @@
+# AutoSec Code Review — Security Audit & Improvements
+
+**Reviewed:** 2026-08-14  
+**Scope:** Full stack (backend, frontend, infra)  
+**Severity scale:** 🔴 Critical | 🟠 High | 🟡 Medium | 🔵 Low  
+
+---
+
+## Critical Issues Fixed
+
+### 1. 🔴 Role Self-Escalation on Registration
+**File:** `backend/src/controllers/authController.js:33`  
+**Bug:** The `register` endpoint accepted `role` from user input. Any attacker could  
+`POST /api/auth/register` with `{ "role": "admin" }` and gain full admin access.  
+**Fix:** Role is now hardcoded to `'viewer'` on registration. Removed `role` from  
+validation schema. Admin role assignment requires existing admin auth via user  
+management endpoints.
+
+### 2. 🔴 Sequelize Query Uses MongoDB `$or` Syntax  
+**File:** `backend/src/controllers/authController.js:38,104`  
+**Bug:** `User.findOne({ where: { $or: [...] } })` is MongoDB syntax. Sequelize  
+ignores `$or` and performs no filtering — the query returns the **first user in  
+the table** regardless of email/username. This means:  
+- Registration: always reports "user exists" OR never detects duplicates  
+- Login: authenticates as the wrong user (first in DB) when $or is ignored  
+**Fix:** Replaced with `{ [Op.or]: [{ email }, { username }] }` using Sequelize's  
+`Op` operators.
+
+### 3. 🔴 JWT Secret Uses Hardcoded Fallback  
+**Files:** `authController.js:8`, `middleware/auth.js:6`  
+**Bug:** `process.env.JWT_SECRET || 'your-secret-key-change-in-production'` means  
+any deployment without a `.env` file runs with a publicly-known signing key.  
+Attackers can forge any JWT.  
+**Fix:** Added startup validation — server **refuses to start** if `JWT_SECRET` is  
+missing, shorter than 32 chars, or equals the placeholder string.
+
+### 4. 🔴 XSS Sanitization Trivially Bypassed  
+**File:** `middleware/security.js:231-248`  
+**Bug:** The regex `/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi` only  
+strips `<script>` tags. Attack vectors that bypass it:  
+- `<img src=x onerror=alert(1)>`  
+- `<svg onload=alert(1)>`  
+- `<body onpageshow=alert(1)>`  
+- `javascript:` URIs in any attribute  
+**Fix:** Replaced with `/<[^>]*>/g` which strips ALL HTML tags, plus explicit  
+stripping of `vbscript:`, `data:` (non-image), and `on*=` event handlers.  
+Added note that CSP headers (helmet) are the primary defense.
+
+---
+
+## High Issues Fixed
+
+### 5. 🟠 IP Whitelist Middleware Leaks Memory  
+**File:** `middleware/security.js:202-228`  
+**Bug:** `ipWhitelist(allowedIPs)` called `allowedIPs.push('127.0.0.1', ...)` on  
+every request in development mode, growing the array without bound.  
+**Fix:** Clone the array once at registration time (`[...allowedIPs]`), build  
+per-request list without mutation.
+
+### 6. 🟠 Frontend Has No Auth Token Management  
+**File:** `frontend/src/services/api.js`  
+**Bug:** The axios client has no JWT interceptor — no token is attached to  
+requests, no refresh logic exists, no 401 handling. Every protected endpoint  
+returns 401 and the UI does nothing.  
+**Fix:** Added complete token lifecycle: localStorage storage, Authorization  
+header injection on requests, 401 response interceptor with automatic refresh  
+token rotation, concurrent request queue during refresh, and redirect to  
+`/login` on terminal auth failure.
+
+### 7. 🟠 Graceful Shutdown Only Closes PostgreSQL  
+**File:** `backend/src/server.js:44-67`  
+**Bug:** SIGTERM handler closes Sequelize but not MongoDB, RabbitMQ, or Redis.  
+Zombie connections and orphaned consumers result.  
+**Fix:** Shutdown now closes RabbitMQ (channel + connection), PostgreSQL, and  
+MongoDB, with a 10s hard timeout to prevent hung exits.
+
+### 8. 🟠 Duplicate Signal Handlers  
+**Files:** `app.js:105-125` and `server.js:44-67`  
+**Bug:** Both files register `SIGTERM`/`SIGINT`/`unhandledRejection`/  
+`uncaughtException` handlers. The app.js handlers call `process.exit(0)`  
+immediately — no connection cleanup.  
+**Fix:** Removed handlers from `app.js`; all lifecycle management lives in  
+`server.js`.
+
+### 9. 🟠 RabbitMQ No Reconnection  
+**File:** `config/rabbitmq.js`  
+**Bug:** Connection failure causes `process.exit(1)` with no retry. A brief  
+RabbitMQ restart kills the entire backend. Message consumer also ACKs messages  
+before verifying they processed correctly.  
+**Fix:** Added automatic reconnection with exponential backoff (5s → 60s max).  
+Consumer now uses try/catch and `nack(msg, false, false)` on processing  
+errors to avoid poison-pill loops. Added `prefetch(10)`.
+
+---
+
+## Medium Issues Fixed
+
+### 10. 🟡 Double `module.exports`  
+**File:** `middleware/auth.js:345-346`  
+**Fix:** Removed duplicate `module.exports = exports;` line.
+
+### 11. 🟡 Dockerfiles Use `npm install` (Non-Reproducible)  
+**Files:** `backend/Dockerfile`, `frontend/Dockerfile`  
+**Fix:** Changed to `npm ci` for reproducible builds. Backend now runs as  
+non-root user (`appuser`). Frontend nginx now has a proper config  
+(`frontend/nginx.conf`) with SPA routing, security headers, gzip, caching.
+
+### 12. 🟡 Hardcoded Credentials in docker-compose.yml  
+**File:** `docker-compose.yml`  
+**Bug:** `autosec_password`, `guest/guest` for RabbitMQ, JWT secret placeholder  
+committed in plaintext.  
+**Fix:** All credentials now read from environment variables with `${VAR:?error}`  
+RequiredVar syntax that fails fast if not set. New `.env.example` documents all  
+required vars.
+
+### 13. 🟡 No `.gitignore`  
+**Fix:** Added `.gitignore` covering `node_modules/`, `.env`, `build/`, `logs/`,  
+`uploads/`, GeoIP databases, IDE configs, and OS files.
+
+### 14. 🟡 MongoDB `console.log` Instead of Winston  
+**File:** `config/db.js:20-21`  
+**Note:** MongoDB connection uses `console.log/error` instead of the project's  
+Winston logger. Lower priority but should be aligned.
+
+---
+
+## Remaining Recommendations (Not Auto-Fixed)
+
+### Security
+- **Refresh token rotation** — Currently refresh tokens are stateless JWTs  
+  with no family tracking. A stolen refresh token can be used indefinitely.  
+  Implement Redis-backed token families or opaque refresh tokens with a  
+  revocation table.
+- **Audit log immutability** — Audit logs stored in MongoDB can be mutated.  
+  For compliance, consider append-only logging with integrity hashes.
+- **CORS origin validation** — The wildcard `origin` callback should validate  
+  against an env-configured allowlist, not hardcoded `autosec.io` domains.
+
+### Architecture  
+- **The frontend build is minimal** — Only 3 pages (Dashboard, Blocklist,  
+  Logs). No auth pages (login/register). No state management. The UI is a  
+  starting skeleton that needs significant expansion.
+- **Frontend has zero tests** — `__tests__/App.test.js` exists but  
+  `@testing-library/react` is the only dep. Need meaningful test coverage.
+- **Backend tests** — Only `api.test.js` exists. Core logic (behavior  
+  analysis, RBAC, auth) has no test coverage.
+- **Redis connection is declared but never initialized** — `redis` package  
+  is a dependency with `REDIS_URL` in config, but no connection code exists  
+  in `db.js` or `server.js`. Session management and caching rely on it but  
+  it's just environment variable passthrough.
+- **SSO framework** — `ssoService.js` exists but `passport-saml` or similar  
+  SSO provider isn't in `package.json`. Dead code without a strategy.
+- **Swagger docs** — Definitions exist inline in routes but `swagger-jsdoc`  
+  scans `./src/routes/*.js`. The JSDoc annotations look correct but many  
+  endpoints (geoip, behavior, enforcement) lack complete definitions.
+
+### Operational
+- **No persistent refresh token store** — Logout is a no-op (client-side  
+  only). Stolen tokens remain valid until expiry.
+- **No database migration tooling** — `package.json` references  
+  `sequelize db:migrate` but there are no migration files. `sequelize.sync()`  
+  in `server.js` is development-only (creates/alters tables, destructive in  
+  production with `alter: true` if needed).
+- **Rate limiting is per-IP** — Behind a reverse proxy/LB, all requests  
+  share one IP unless `trust proxy` is configured correctly (it is set to  
+  `1`, but this needs adjustment per deployment).
+
+---
+
+## Files Changed
+
+| File | Changes |
+|------|---------|
+| `backend/src/controllers/authController.js` | Fixed `$or` → `Op.or`, removed role escalation, JWT_SECRET validation |
+| `backend/src/middleware/auth.js` | Removed hardcoded JWT_SECRET fallback, added dotenv, fixed double exports |
+| `backend/src/middleware/validation.js` | Removed `role` from registration validation |
+| `backend/src/middleware/security.js` | Fixed XSS sanitization, ipWhitelist memory leak, clarified CSP |
+| `backend/src/config/rabbitmq.js` | Added reconnection, error handling, nack on failure, clean shutdown |
+| `backend/src/server.js` | Proper graceful shutdown (all connections), deduplicate handlers |
+| `backend/src/app.js` | Removed duplicate signal handlers |
+| `backend/Dockerfile` | npm ci, non-root user, healthcheck |
+| `frontend/Dockerfile` | npm ci, custom nginx config |
+| `frontend/nginx.conf` | **New** — security headers, gzip, SPA routing, asset caching |
+| `frontend/src/services/api.js` | JWT token management, auto-refresh, auth interceptors |
+| `.gitignore` | **New** |
+| `.env.example` | **New** — compose-level env template |
+| `docker-compose.yml` | Env-var-driven credentials, RequiredVar guards |
\ No newline at end of file
diff --git a/backend/Dockerfile b/backend/Dockerfile
index bba5bf9..c0a2706 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -1,23 +1,33 @@
 # Use an official Node.js runtime as a parent image
 FROM node:20-alpine
 
+# Security: run as non-root user
+RUN addgroup -g 1001 -S appgroup && \
+    adduser -S appuser -u 1001
+
 # Set the working directory in the container
 WORKDIR /app
 
-# Copy package.json and package-lock.json (if any)
+# Copy package.json and package-lock.json first (layer caching)
 COPY package*.json ./
 
-# Install dependencies
-RUN npm install
+# Install production deps only, with npm ci for reproducible builds
+RUN npm ci --only=production
 
 # Copy the rest of the application code
-COPY . .
+COPY --chown=appuser:appgroup . .
+
+# Create logs and uploads directories
+RUN mkdir -p logs uploads && chown -R appuser:appgroup logs uploads
+
+USER appuser
 
 # Expose the port the app runs on
 EXPOSE 8080
 
-# Mount GeoIP data volume (will be mounted by docker-compose/k8s)
-# VOLUME /app/data/geoip
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
 
 # Command to run the application
-CMD ["npm", "start"]
\ No newline at end of file
+CMD ["node", "src/server.js"]
\ No newline at end of file
diff --git a/backend/src/app.js b/backend/src/app.js
index e97914c..ad46f5b 100644
--- a/backend/src/app.js
+++ b/backend/src/app.js
@@ -101,27 +101,7 @@ app.use(notFound);
 // Error handling middleware
 app.use(errorHandler);
 
-// Graceful shutdown handling
-process.on('SIGTERM', () => {
-  logger.info('SIGTERM received, shutting down gracefully');
-  process.exit(0);
-});
-
-process.on('SIGINT', () => {
-  logger.info('SIGINT received, shutting down gracefully');
-  process.exit(0);
-});
-
-// Unhandled promise rejection handler
-process.on('unhandledRejection', (reason, promise) => {
-  logger.error('Unhandled Rejection at:', { promise, reason });
-  process.exit(1);
-});
-
-// Uncaught exception handler
-process.on('uncaughtException', (error) => {
-  logger.error('Uncaught Exception:', error);
-  process.exit(1);
-});
+// Note: SIGTERM/SIGINT/unhandled rejection handlers are in server.js
+// (where all connections are managed) to avoid duplicate handlers.
 
 module.exports = app;
\ No newline at end of file
diff --git a/backend/src/config/rabbitmq.js b/backend/src/config/rabbitmq.js
index 5929a7f..0a81999 100644
--- a/backend/src/config/rabbitmq.js
+++ b/backend/src/config/rabbitmq.js
@@ -1,49 +1,129 @@
 const amqp = require('amqplib');
+const logger = require('./logger');
 
-let channel;
+let connection = null;
+let channel = null;
+let isConnecting = false;
+let reconnectTimer = null;
+
+const RECONNECT_DELAY = 5000; // 5 seconds
+const MAX_RECONNECT_DELAY = 60000; // 1 minute
 
 const connectRabbitMQ = async () => {
+  if (isConnecting) return;
+  isConnecting = true;
+
   try {
-    const connection = await amqp.connect(process.env.RABBITMQ_URL);
+    connection = await amqp.connect(process.env.RABBITMQ_URL);
+
+    connection.on('error', (err) => {
+      logger.error('RabbitMQ connection error:', { error: err.message });
+    });
+
+    connection.on('close', () => {
+      logger.warn('RabbitMQ connection closed. Attempting reconnect...');
+      channel = null;
+      isConnecting = false;
+      scheduleReconnect();
+    });
+
     channel = await connection.createChannel();
-    console.log('RabbitMQ channel created.');
+
+    channel.on('error', (err) => {
+      logger.error('RabbitMQ channel error:', { error: err.message });
+    });
+
+    channel.on('close', () => {
+      logger.warn('RabbitMQ channel closed.');
+      channel = null;
+    });
+
+    // Prefetch — don't flood the consumer
+    channel.prefetch(10);
+
+    logger.info('RabbitMQ channel created.');
+    isConnecting = false;
+
+    // Clear any pending reconnect timer on successful connection
+    if (reconnectTimer) {
+      clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+    }
   } catch (error) {
-    console.error('Failed to connect to RabbitMQ:', error);
-    process.exit(1);
+    logger.error('Failed to connect to RabbitMQ:', { error: error.message });
+    isConnecting = false;
+    scheduleReconnect();
   }
 };
 
+let currentDelay = RECONNECT_DELAY;
+
+const scheduleReconnect = () => {
+  if (reconnectTimer) return;
+  logger.info(`RabbitMQ reconnecting in ${currentDelay / 1000}s...`);
+  reconnectTimer = setTimeout(async () => {
+    reconnectTimer = null;
+    await connectRabbitMQ();
+    // Exponential backoff (reset on success handled above)
+    currentDelay = Math.min(currentDelay * 2, MAX_RECONNECT_DELAY);
+  }, currentDelay);
+};
+
+const getChannel = () => channel;
+
+const closeRabbitMQ = async () => {
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+  try {
+    if (channel) await channel.close();
+    if (connection) await connection.close();
+    logger.info('RabbitMQ connections closed');
+  } catch (e) {
+    // Ignore close errors during shutdown
+  }
+  channel = null;
+  connection = null;
+};
+
 const publishMessage = async (queue, message) => {
   if (!channel) {
-    console.error('RabbitMQ channel not established.');
-    return;
+    logger.error('RabbitMQ channel not established; message dropped.');
+    return false;
   }
   try {
     await channel.assertQueue(queue, { durable: true });
-    channel.sendToQueue(queue, Buffer.from(JSON.stringify(message)), { persistent: true });
-    // console.log(`Message sent to queue ${queue}:`, message);
+    return channel.sendToQueue(queue, Buffer.from(JSON.stringify(message)), { persistent: true });
   } catch (error) {
-    console.error(`Failed to publish message to queue ${queue}:`, error);
+    logger.error(`Failed to publish message to queue ${queue}:`, { error: error.message });
+    return false;
   }
 };
 
 const consumeMessages = async (queue, callback) => {
   if (!channel) {
-    console.error('RabbitMQ channel not established.');
+    logger.error('RabbitMQ channel not established; cannot consume.');
     return;
   }
   try {
     await channel.assertQueue(queue, { durable: true });
     channel.consume(queue, (msg) => {
       if (msg !== null) {
-        callback(JSON.parse(msg.content.toString()));
-        channel.ack(msg);
+        try {
+          callback(JSON.parse(msg.content.toString()));
+          channel.ack(msg);
+        } catch (err) {
+          // Reject the message on parse/processing error, don't requeue (avoid poison pills)
+          logger.error(`Error processing message from ${queue}:`, { error: err.message });
+          channel.nack(msg, false, false);
+        }
       }
     }, { noAck: false });
-    console.log(`Started consuming messages from queue: ${queue}`);
+    logger.info(`Started consuming messages from queue: ${queue}`);
   } catch (error) {
-    console.error(`Failed to consume messages from queue ${queue}:`, error);
+    logger.error(`Failed to consume messages from queue ${queue}:`, { error: error.message });
   }
 };
 
-module.exports = { connectRabbitMQ, publishMessage, consumeMessages };
\ No newline at end of file
+module.exports = { connectRabbitMQ, publishMessage, consumeMessages, closeRabbitMQ, getChannel };
\ No newline at end of file
diff --git a/backend/src/controllers/authController.js b/backend/src/controllers/authController.js
index a9256b9..4673653 100644
--- a/backend/src/controllers/authController.js
+++ b/backend/src/controllers/authController.js
@@ -1,14 +1,21 @@
 const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
 const { validationResult } = require('express-validator');
+const { Op } = require('sequelize');
 const User = require('../models/User');
 const logger = require('../config/logger');
 
 // JWT Configuration
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+const JWT_SECRET = process.env.JWT_SECRET;
 const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '24h';
 const JWT_REFRESH_EXPIRES_IN = process.env.JWT_REFRESH_EXPIRES_IN || '7d';
 
+// Fail fast if JWT_SECRET is missing or is the insecure placeholder
+if (!JWT_SECRET || JWT_SECRET === 'your-secret-key-change-in-production' || JWT_SECRET.length < 32) {
+  logger.error('FATAL: JWT_SECRET is missing, too short (<32 chars), or is the default placeholder. Refusing to start.');
+  process.exit(1);
+}
+
 // Generate JWT token
 const generateTokens = (userId) => {
   const accessToken = jwt.sign({ userId }, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
@@ -30,12 +37,16 @@ exports.register = async (req, res) => {
       });
     }
 
-    const { username, email, password, firstName, lastName, role } = req.body;
+    const { username, email, password, firstName, lastName } = req.body;
+    // SECURITY: role is NEVER accepted from user input on registration.
+    // New users always get 'viewer'. Admin must be assigned post-creation
+    // via user management endpoints (require admin auth).
+    const role = 'viewer';
 
     // Check if user already exists
     const existingUser = await User.findOne({
       where: {
-        $or: [{ email }, { username }],
+        [Op.or]: [{ email: email }, { username: username }],
       },
     });
 
@@ -101,7 +112,7 @@ exports.login = async (req, res) => {
     // Find user by email or username
     const user = await User.findOne({
       where: {
-        $or: [{ email: identifier }, { username: identifier }],
+        [Op.or]: [{ email: identifier }, { username: identifier }],
       },
     });
 
diff --git a/backend/src/middleware/auth.js b/backend/src/middleware/auth.js
index 3889267..861b719 100644
--- a/backend/src/middleware/auth.js
+++ b/backend/src/middleware/auth.js
@@ -1,9 +1,10 @@
+require('dotenv').config();
 const jwt = require('jsonwebtoken');
 const User = require('../models/User');
 const rbacService = require('../services/rbacService');
 const logger = require('../config/logger');
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
+const JWT_SECRET = process.env.JWT_SECRET;
 
 // Authentication middleware
 exports.authenticate = async (req, res, next) => {
@@ -342,6 +343,4 @@ exports.canManageUser = (req, res, next) => {
     });
 };
 
-module.exports = exports;
-
 module.exports = exports;
\ No newline at end of file
diff --git a/backend/src/middleware/security.js b/backend/src/middleware/security.js
index 961dce2..2b5d3df 100644
--- a/backend/src/middleware/security.js
+++ b/backend/src/middleware/security.js
@@ -200,19 +200,21 @@ exports.requestSizeLimit = (limit = '10mb') => {
 };
 
 // IP whitelist middleware (for admin endpoints)
+// NOTE: allowedIPs is cloned to avoid mutation leaking across requests
 exports.ipWhitelist = (allowedIPs = []) => {
+  const baseIPs = [...allowedIPs]; // capture once at registration time
   return (req, res, next) => {
     const clientIP = req.ip || req.connection.remoteAddress;
     
-    // Allow localhost in development
+    // Build final list per request (don't mutate baseIPs)
+    const effectiveIPs = [...baseIPs];
     if (process.env.NODE_ENV === 'development') {
-      allowedIPs.push('127.0.0.1', '::1', '::ffff:127.0.0.1');
+      effectiveIPs.push('127.0.0.1', '::1', '::ffff:127.0.0.1');
     }
 
-    if (allowedIPs.length > 0 && !allowedIPs.includes(clientIP)) {
+    if (effectiveIPs.length > 0 && !effectiveIPs.includes(clientIP)) {
       logger.warn('IP not in whitelist', {
         ip: clientIP,
-        allowedIPs,
         method: req.method,
         url: req.originalUrl,
       });
@@ -227,23 +229,36 @@ exports.ipWhitelist = (allowedIPs = []) => {
   };
 };
 
-// Sanitize user input
+// Sanitize user input — replace HTML special chars to prevent XSS.
+// This strips HTML tags and event handlers from all string inputs.
+// NOTE: The primary defense is CSP headers (helmet) above. This is belt-and-suspenders.
 exports.sanitizeInput = (req, res, next) => {
   const sanitize = (obj) => {
     if (typeof obj === 'string') {
-      // Remove potential XSS patterns
-      return obj.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
-                .replace(/javascript:/gi, '')
-                .replace(/on\w+\s*=/gi, '');
+      // Strip all HTML tags (catches <script>, <img onerror>, <svg onload>, etc.)
+      // and remove dangerous URL schemes
+      return obj
+        .replace(/<[^>]*>/g, '')           // all HTML tags
+        .replace(/javascript:/gi, '')       // javascript: URIs
+        .replace(/vbscript:/gi, '')         // vbscript: URIs
+        .replace(/data:(?!image\/)/gi, '')  // data: URIs except images
+        .replace(/on\w+\s*=/gi, '');        // event handlers
+    } else if (Array.isArray(obj)) {
+      return obj.map(sanitize);
     } else if (typeof obj === 'object' && obj !== null) {
+      const sanitized = {};
       for (const key in obj) {
-        obj[key] = sanitize(obj[key]);
+        if (Object.prototype.hasOwnProperty.call(obj, key)) {
+          sanitized[key] = sanitize(obj[key]);
+        }
       }
+      return sanitized;
     }
     return obj;
   };
 
   req.body = sanitize(req.body);
+  // Create new objects for query and params — don't mutate the originals
   req.query = sanitize(req.query);
   req.params = sanitize(req.params);
   
diff --git a/backend/src/middleware/validation.js b/backend/src/middleware/validation.js
index d37826e..6d0f3d1 100644
--- a/backend/src/middleware/validation.js
+++ b/backend/src/middleware/validation.js
@@ -30,11 +30,6 @@ exports.validateRegistration = [
     .trim()
     .isLength({ min: 1, max: 50 })
     .withMessage('Last name is required and must be less than 50 characters'),
-  
-  body('role')
-    .optional()
-    .isIn(['admin', 'analyst', 'operator', 'viewer'])
-    .withMessage('Role must be one of: admin, analyst, operator, viewer'),
 ];
 
 // User login validation
diff --git a/backend/src/server.js b/backend/src/server.js
index 102dd7e..9bade92 100644
--- a/backend/src/server.js
+++ b/backend/src/server.js
@@ -1,8 +1,7 @@
 require('dotenv').config();
 const app = require('./app');
-const { sequelize } = require('./config/db');
-const { connectMongoDB } = require('./config/db');
-const { connectRabbitMQ, consumeMessages } = require('./config/rabbitmq');
+const { sequelize, connectMongoDB } = require('./config/db');
+const { connectRabbitMQ, consumeMessages, closeRabbitMQ } = require('./config/rabbitmq');
 const rabbitmqConsumer = require('./services/rabbitmqConsumer');
 const ScheduledAnalysisService = require('./services/scheduledAnalysis');
 const logger = require('./config/logger');
@@ -41,8 +40,11 @@ async function startServer() {
       logger.info(`API Documentation available at http://localhost:${PORT}/api/docs`);
     });
 
-    // Graceful shutdown handlers
+    // Graceful shutdown handler — closes all connections before exiting
+    let shuttingDown = false;
     const gracefulShutdown = async (signal) => {
+      if (shuttingDown) return;
+      shuttingDown = true;
       logger.info(`${signal} received, starting graceful shutdown`);
       
       // Stop accepting new connections
@@ -55,14 +57,40 @@ async function startServer() {
       logger.info('Scheduled analysis service stopped');
 
       // Close database connections
+      const shutdownErrors = [];
+
+      try {
+        await closeRabbitMQ();
+      } catch (error) {
+        shutdownErrors.push(`RabbitMQ: ${error.message}`);
+      }
+
       try {
         await sequelize.close();
         logger.info('PostgreSQL connection closed');
       } catch (error) {
-        logger.error('Error closing PostgreSQL connection:', error);
+        shutdownErrors.push(`PostgreSQL: ${error.message}`);
+      }
+
+      // Close MongoDB connection
+      try {
+        const mongoose = require('mongoose');
+        await mongoose.connection.close();
+        logger.info('MongoDB connection closed');
+      } catch (error) {
+        shutdownErrors.push(`MongoDB: ${error.message}`);
       }
 
-      // Exit process
+      if (shutdownErrors.length > 0) {
+        logger.error('Errors during shutdown:', { errors: shutdownErrors });
+      }
+
+      // Force exit after 10s if connections hang
+      setTimeout(() => {
+        logger.warn('Forced exit after timeout');
+        process.exit(0);
+      }, 10000).unref();
+
       process.exit(0);
     };
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 64d5b38..96ea19f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,19 +1,26 @@
+# AutoSec Docker Compose — Production-Ready Configuration
+# Copy .env.example to .env and fill in secrets before running.
+#
+# Required env vars (set in .env or export before `docker compose up`):
+#   POSTGRES_PASSWORD, MONGO_URI, JWT_SECRET, REDIS_PASSWORD, RABBITMQ_DEFAULT_PASS
+
 services:
   # PostgreSQL Database Service
   autosec-postgres:
     image: postgres:15-alpine
     restart: always
     environment:
-      POSTGRES_DB: autosec_db
-      POSTGRES_USER: autosec_user
-      POSTGRES_PASSWORD: autosec_password
+      POSTGRES_DB: ${POSTGRES_DB:-autosec_db}
+      POSTGRES_USER: ${POSTGRES_USER:-autosec_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./database/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
+    # Only expose port in dev; comment out for production
     ports:
-      - "5432:5432" # Expose for local DB tools if needed
+      - "${PG_EXPOSE_PORT:-5432}:5432"
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U autosec_user -d autosec_db"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-autosec_user} -d ${POSTGRES_DB:-autosec_db}"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -24,8 +31,9 @@ services:
     restart: always
     volumes:
       - mongodb_data:/data/db
+    # Only expose port in dev; comment out for production
     ports:
-      - "27017:27017" # Expose for local DB tools if needed
+      - "${MONGO_EXPOSE_PORT:-27017}:27017"
     healthcheck:
       test: echo 'db.runCommand("ping").ok' | mongosh localhost:27017/test --quiet
       interval: 30s
@@ -36,13 +44,14 @@ services:
   autosec-redis:
     image: redis:7-alpine
     restart: always
-    command: redis-server --appendonly yes
+    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-autosec_redis_secret}
     volumes:
       - redis_data:/data
+    # Only expose port in dev; comment out for production
     ports:
-      - "6379:6379"
+      - "${REDIS_EXPOSE_PORT:-6379}:6379"
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-autosec_redis_secret}", "ping"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -52,13 +61,13 @@ services:
     image: rabbitmq:3-management-alpine
     restart: always
     environment:
-      RABBITMQ_DEFAULT_USER: guest
-      RABBITMQ_DEFAULT_PASS: guest
+      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-autosec}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:?Set RABBITMQ_DEFAULT_PASS in .env}
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
     ports:
-      - "5672:5672" # AMQP protocol port
-      - "15672:15672" # Management UI port
+      - "${RABBIT_AMQP_PORT:-5672}:5672"
+      - "${RABBIT_MGMT_PORT:-15672}:15672"
     healthcheck:
       test: rabbitmq-diagnostics -q ping
       interval: 30s
@@ -70,42 +79,42 @@ services:
     build: ./backend
     restart: always
     environment:
-      NODE_ENV: ${NODE_ENV:-development}
+      NODE_ENV: ${NODE_ENV:-production}
       PORT: 8080
       API_VERSION: 1.0.0
-      
-      # Security
-      JWT_SECRET: ${JWT_SECRET:-your-super-secret-jwt-key-change-in-production}
-      JWT_EXPIRES_IN: 24h
-      JWT_REFRESH_EXPIRES_IN: 7d
-      
+
+      # Security — MUST be set externally
+      JWT_SECRET: ${JWT_SECRET:?Set JWT_SECRET in .env (min 32 chars)}
+      JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-24h}
+      JWT_REFRESH_EXPIRES_IN: ${JWT_REFRESH_EXPIRES_IN:-7d}
+
       # Logging
       LOG_LEVEL: ${LOG_LEVEL:-info}
-      
+
       # Database connections
       PG_HOST: autosec-postgres
       PG_PORT: 5432
-      PG_USER: autosec_user
-      PG_PASSWORD: autosec_password
-      PG_DATABASE: autosec_db
+      PG_USER: ${POSTGRES_USER:-autosec_user}
+      PG_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
+      PG_DATABASE: ${POSTGRES_DB:-autosec_db}
       MONGO_URI: mongodb://autosec-mongodb:27017/autosec_logs
-      REDIS_URL: redis://autosec-redis:6379
-      
+      REDIS_URL: redis://:${REDIS_PASSWORD:-autosec_redis_secret}@autosec-redis:6379
+
       # Message queue
-      RABBITMQ_URL: amqp://guest:guest@autosec-rabbitmq:5672
-      
+      RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-autosec}:${RABBITMQ_DEFAULT_PASS:?Set RABBITMQ_DEFAULT_PASS}@autosec-rabbitmq:5672
+
       # GeoIP
       GEOIP_DB_PATH: /app/data/geoip/GeoLite2-City.mmdb
-      
+
       # Frontend URL for CORS
-      FRONTEND_URL: http://localhost:3000
-      
+      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
+
     volumes:
       - ./data/geoip:/app/data/geoip:ro # Mount GeoIP data read-only
-      - ./backend/logs:/app/logs # Mount logs directory
-      - ./backend/uploads:/app/uploads # Mount uploads directory
+      - backend_logs:/app/logs
+      - backend_uploads:/app/uploads
     ports:
-      - "8080:8080"
+      - "${BACKEND_PORT:-8080}:8080"
     depends_on:
       autosec-postgres:
         condition: service_healthy
@@ -116,7 +125,7 @@ services:
       autosec-rabbitmq:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -129,7 +138,7 @@ services:
       REACT_APP_API_BASE_URL: http://localhost:8080/api
       REACT_APP_VERSION: 1.0.0
     ports:
-      - "3000:80" # Nginx serves React build on port 80 inside container
+      - "${FRONTEND_PORT:-3000}:80" # Nginx serves React build on port 80 inside container
     depends_on:
       autosec-backend:
         condition: service_healthy
@@ -143,4 +152,6 @@ volumes:
   postgres_data:
   mongodb_data:
   redis_data:
-  rabbitmq_data:
\ No newline at end of file
+  rabbitmq_data:
+  backend_logs:
+  backend_uploads:
\ No newline at end of file
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 96b9143..4529011 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,22 +1,30 @@
 # Stage 1: Build the React application
-FROM node:20-alpine as build-stage
+FROM node:20-alpine AS build-stage
 
 WORKDIR /app
 
 COPY package*.json ./
-RUN npm install
+RUN npm ci
 
 COPY . .
 RUN npm run build
 
 # Stage 2: Serve the application with Nginx
-FROM nginx:stable-alpine as production-stage
+FROM nginx:stable-alpine AS production-stage
+
+# Remove default nginx config
+RUN rm /etc/nginx/conf.d/default.conf
+
+# Copy custom nginx config
+COPY nginx.conf /etc/nginx/conf.d/default.conf
 
 # Copy the build output from the build stage
 COPY --from=build-stage /app/build /usr/share/nginx/html
 
-# Copy custom Nginx configuration (optional, for more advanced setups)
-# COPY nginx.conf /etc/nginx/conf.d/default.conf
+# Security: nginx runs as non-root by default in alpine
+# but we make the html dir read-only
+RUN chown -R nginx:nginx /usr/share/nginx/html && \
+    chmod -R 755 /usr/share/nginx/html
 
 EXPOSE 80
 
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
new file mode 100644
index 0000000..b22469e
--- /dev/null
+++ b/frontend/nginx.conf
@@ -0,0 +1,50 @@
+server {
+    listen 80;
+    server_name _;
+    
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' http://localhost:8080;" always;
+
+    # Enable gzip compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
+
+    # Cache static assets
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    # SPA fallback — all routes go to index.html
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Don't serve hidden files
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Proxy API requests to backend (if frontend and backend are in same compose network)
+    # Uncomment and adjust if not using separate domains:
+    # location /api/ {
+    #     proxy_pass http://autosec-backend:8080;
+    #     proxy_set_header Host $host;
+    #     proxy_set_header X-Real-IP $remote_addr;
+    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    #     proxy_set_header X-Forwarded-Proto $scheme;
+    # }
+}
\ No newline at end of file
diff --git a/frontend/src/services/api.js b/frontend/src/services/api.js
index 12e0bbd..3499685 100644
--- a/frontend/src/services/api.js
+++ b/frontend/src/services/api.js
@@ -10,37 +10,97 @@ const api = axios.create({
   },
 });
 
-// Optional: Add request/response interceptors for logging, error handling, etc.
+// Token storage keys
+const ACCESS_TOKEN_KEY = 'autosec_access_token';
+const REFRESH_TOKEN_KEY = 'autosec_refresh_token';
+
+// Token management helpers
+export const tokens = {
+  getAccess: () => localStorage.getItem(ACCESS_TOKEN_KEY),
+  getRefresh: () => localStorage.getItem(REFRESH_TOKEN_KEY),
+  set: (accessToken, refreshToken) => {
+    localStorage.setItem(ACCESS_TOKEN_KEY, accessToken);
+    if (refreshToken) localStorage.setItem(REFRESH_TOKEN_KEY, refreshToken);
+  },
+  clear: () => {
+    localStorage.removeItem(ACCESS_TOKEN_KEY);
+    localStorage.removeItem(REFRESH_TOKEN_KEY);
+  },
+};
+
+// Track refresh state to avoid concurrent refresh loops
+let isRefreshing = false;
+let refreshQueue = [];
+
+const processRefreshQueue = (error, token = null) => {
+  refreshQueue.forEach(({ resolve, reject }) => {
+    error ? reject(error) : resolve(token);
+  });
+  refreshQueue = [];
+};
+
+// Request interceptor: attach access token
 api.interceptors.request.use(
   (config) => {
-    // console.log('Request:', config);
+    const token = tokens.getAccess();
+    if (token) {
+      config.headers.Authorization = `Bearer ${token}`;
+    }
     return config;
   },
-  (error) => {
-    return Promise.reject(error);
-  }
+  (error) => Promise.reject(error)
 );
 
+// Response interceptor: handle 401s with automatic token refresh
 api.interceptors.response.use(
-  (response) => {
-    // console.log('Response:', response);
-    return response;
-  },
-  (error) => {
-    if (error.response) {
-      // The request was made and the server responded with a status code
-      // that falls out of the range of 2xx
-      console.error('API Error Response:', error.response.data);
-      console.error('API Error Status:', error.response.status);
-      console.error('API Error Headers:', error.response.headers);
-    } else if (error.request) {
-      // The request was made but no response was received
-      console.error('API Error Request:', error.request);
-    } else {
-      // Something happened in setting up the request that triggered an Error
-      console.error('API Error Message:', error.message);
+  (response) => response,
+  async (error) => {
+    const originalRequest = error.config;
+
+    // Don't retry refresh or login/register endpoints
+    if (
+      !error.response ||
+      error.response.status !== 401 ||
+      originalRequest._retry ||
+      originalRequest.url?.includes('/auth/refresh') ||
+      originalRequest.url?.includes('/auth/login') ||
+      originalRequest.url?.includes('/auth/register')
+    ) {
+      return Promise.reject(error);
+    }
+
+    if (isRefreshing) {
+      // Queue this request until refresh completes
+      return new Promise((resolve, reject) => {
+        refreshQueue.push({ resolve, reject });
+      }).then((token) => {
+        originalRequest.headers.Authorization = `Bearer ${token}`;
+        return api(originalRequest);
+      });
+    }
+
+    originalRequest._retry = true;
+    isRefreshing = true;
+
+    try {
+      const refreshToken = tokens.getRefresh();
+      if (!refreshToken) throw new Error('No refresh token');
+
+      const { data } = await axios.post(`${API_BASE_URL}/auth/refresh`, { refreshToken });
+      tokens.set(data.data.accessToken, data.data.refreshToken);
+
+      processRefreshQueue(null, data.data.accessToken);
+      originalRequest.headers.Authorization = `Bearer ${data.data.accessToken}`;
+      return api(originalRequest);
+    } catch (refreshError) {
+      processRefreshQueue(refreshError, null);
+      tokens.clear();
+      // Redirect to login
+      window.location.href = '/login';
+      return Promise.reject(refreshError);
+    } finally {
+      isRefreshing = false;
     }
-    return Promise.reject(error);
   }
 );
 

From ec272726c5d9a34d2a40f0508827e69ae70cdaa9 Mon Sep 17 00:00:00 2001
From: drkdrive <dumepaepp@users.noreply.github.com>
Date: Fri, 14 Aug 2026 04:06:18 +0200
Subject: [PATCH 2/2] fix: add missing columns to init.sql to match Sequelize
 User model

The PostgreSQL init.sql was missing several columns that the Sequelize
User model defines (mfaTempSecret, mfaBackupCodes, mfaRecoveryCode,
knownIPs, knownDevices, typicalLoginHours, loginSessions, permissions).
This caused 'column does not exist' errors on registration.
---
 database/postgres/init.sql | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/database/postgres/init.sql b/database/postgres/init.sql
index 810bcf5..44fe532 100644
--- a/database/postgres/init.sql
+++ b/database/postgres/init.sql
@@ -13,11 +13,19 @@ CREATE TABLE IF NOT EXISTS users (
     "lockoutUntil" TIMESTAMP WITH TIME ZONE,
     "mfaEnabled" BOOLEAN DEFAULT FALSE NOT NULL,
     "mfaSecret" VARCHAR(255),
+    "mfaTempSecret" VARCHAR(255),
+    "mfaBackupCodes" JSON,
+    "mfaRecoveryCode" VARCHAR(255),
     "emailVerified" BOOLEAN DEFAULT FALSE NOT NULL,
     "emailVerificationToken" VARCHAR(255),
     "passwordResetToken" VARCHAR(255),
     "passwordResetExpires" TIMESTAMP WITH TIME ZONE,
     preferences JSON DEFAULT '{}',
+    "knownIPs" JSON DEFAULT '[]',
+    "knownDevices" JSON DEFAULT '[]',
+    "typicalLoginHours" JSON DEFAULT '[]',
+    "loginSessions" JSON DEFAULT '[]',
+    permissions JSON DEFAULT '{}',
     "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
     "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
 );