@njoga/vehicle-auth-system

A complete JWT-based Multi-Factor Authentication system for vehicle e-commerce platforms built with RESTful architecture.

Implements OWASP A07:2025 and NIST SP 800-63-4 authentication standards.

Features

• JWT authentication with refresh token rotation
• Email OTP multi-factor authentication
• TOTP (Google Authenticator) MFA — RFC 6238
• Role-Based Access Control (Buyer, Seller, Admin)
• Rate limiting and brute force protection
• bcrypt password hashing (cost factor 12)
• Immutable audit trail logging
• Stateless RESTful API architecture

Demonstrated Through

AutoKenya — a vehicle marketplace platform
Live: https://vehicle-marketplace-auth.vercel.app
API: https://vehicle-marketplace-auth-production.up.railway.app

Installation

npm install @njoga/vehicle-auth-system

Quick Start

const express = require('express');
const { 
  authRoutes, 
  mfaRoutes, 
  protect, 
  requireRole 
} = require('@njoga/vehicle-auth-system');

const app = express();
app.use(express.json());

// Mount auth routes
app.use('/api/auth', authRoutes);
app.use('/api/mfa', mfaRoutes);

// Protect your routes
app.get('/dashboard', protect, yourController);
app.post('/listings', protect, requireRole('seller'), createListing);
app.get('/admin', protect, requireRole('admin'), adminController);

Environment Variables

JWT_SECRET=your_jwt_secret
JWT_REFRESH_SECRET=your_refresh_secret
RESEND_API_KEY=your_resend_key
[email protected]
TOTP_ISSUER=YourPlatformName
DATABASE_URL=your_postgresql_url

API Endpoints

POST /api/auth/register        Register new user
POST /api/auth/login           Login with email + password
POST /api/auth/logout          Logout and revoke token
POST /api/auth/refresh-token   Rotate refresh token
POST /api/auth/forgot-password Request password reset
POST /api/auth/reset-password  Reset password with token

POST /api/mfa/send-otp         Send email OTP
POST /api/mfa/verify-otp       Verify email OTP
POST /api/mfa/setup-totp       Generate TOTP QR code
POST /api/mfa/verify-totp-setup Confirm TOTP setup
POST /api/mfa/verify-totp-login Verify TOTP at login
POST /api/mfa/disable-totp     Disable TOTP

Middleware

protect                    Requires valid JWT (401 if missing)
requireRole('admin')       Requires role (403 if wrong role)
rateLimiter                5 attempts per 15 min per IP

Security Standards

• OWASP A07:2025 — Identification and Authentication Failures
• NIST SP 800-63-4 — Digital Identity Guidelines
• RFC 6238 — TOTP standard
• RFC 7519 — JWT standard

Research

This package was developed as part of a BSc IT research project at Jomo Kenyatta University of Agriculture and Technology (JKUAT), Kenya.

Research Title: Implementation of a JWT-Based Multi-Factor Authentication System for Vehicle E-Commerce Platform Using RESTful Architecture

Author: Benjamin Otieno Njoga (SCT221-0402/2022)

License

MIT