Secure Asset Management API

A RESTful API built with Express.js and MongoDB for managing company IT assets with role-based access control, JWT authentication, and comprehensive security hardening.

🎯 Overview

This project demonstrates secure backend API development practices, implementing authentication, authorization, input validation, and defense-in-depth security measures. Built as a learning project to master modern backend development and security best practices.

✨ Features

Core Functionality

User Authentication - Signup and login with bcrypt password hashing
JWT Authorization - Stateless token-based authentication
Role-Based Access Control - Admin and employee roles with different permissions
Asset Management - Full CRUD operations for IT assets (laptops, monitors, routers, etc.)
User Promotion - Admins can promote employees to admin role

Security Features

Password Hashing - bcrypt with 12 salt rounds (one-way hashing)
JWT Tokens - 1-hour expiry, payload contains only userId and role
Security Headers - Helmet middleware sets secure HTTP headers
Rate Limiting - Login endpoint limited to 3 attempts per 15 minutes
Input Sanitization - Prevents NoSQL injection attacks
Input Validation - Validates username, password, and asset fields
Defense in Depth - Multiple security layers at every level

🛠️ Tech Stack

Technology	Purpose
Node.js	JavaScript runtime environment
Express.js 5.2	Web application framework
MongoDB	NoSQL document database
Mongoose	MongoDB ODM with schema validation
bcrypt	Password hashing library
jsonwebtoken	JWT creation and verification
helmet	Security HTTP headers
express-rate-limit	Rate limiting middleware
express-mongo-sanitize	NoSQL injection prevention
dotenv	Environment variable management

📋 Prerequisites

Node.js 18+ installed
MongoDB 7.0+ running locally or Atlas connection string
npm or yarn package manager

🚀 Installation

Clone the repository

git clone https://github.com/aheedhul/SecureAssetManagementAPI.git
cd SecureAssetManagementAPI

Install dependencies
```
npm install
```

Configure environment variables

Create a .env file in the root directory:

JWT_SECRET=your-super-secret-jwt-key-here
MONGO_URI=mongodb://localhost:27017/secure
PORT=3000

Start the server
```
npm run dev
```
Server will run on http://localhost:3000

📚 API Endpoints

Authentication

Method	Endpoint	Auth	Role	Description
POST	`/auth/signup`	❌	-	Register new user (default: employee)
POST	`/auth/login`	❌	-	Authenticate and receive JWT
GET	`/auth/profile`	✅	Any	Get current user info
GET	`/auth/admin`	✅	Admin	Access admin dashboard
PUT	`/auth/promote/:id`	✅	Admin	Promote user to admin role

Assets

Method	Endpoint	Auth	Role	Description
POST	`/asset/create`	✅	Admin	Create new asset
GET	`/asset/fetch`	✅	Any	Get assets assigned to current user
PUT	`/asset/update/:id`	✅	Admin	Update asset details
DELETE	`/asset/delete/:id`	✅	Admin	Delete asset

🔐 Authentication Flow

1. POST /auth/signup
   → Password hashed with bcrypt (12 rounds)
   → User saved to database
   → Returns: 201 Created

2. POST /auth/login
   → Verify password against bcrypt hash
   → Generate JWT with { userId, role }
   → Returns: { token: "eyJhbG..." }

3. Protected Routes
   → Send: Authorization: Bearer <token>
   → Middleware verifies JWT
   → Attaches user to req.user
   → Controller executes

🏗️ Project Structure

SecureAssetManagementAPI/
├── app.js                      # Entry point, middleware setup
├── config/
│   └── database.js             # MongoDB connection
├── controllers/
│   ├── authController.js       # Auth business logic
│   └── assetController.js      # Asset CRUD logic
├── middlewares/
│   ├── authMiddleware.js       # JWT verification
│   ├── adminMiddleware.js      # Role-based authorization
│   └── validateMiddleware.js   # Input validation
├── models/
│   ├── user.js                 # User schema
│   └── asset.js                # Asset schema
├── routes/
│   ├── authRoutes.js           # Auth endpoints
│   └── assetRoutes.js          # Asset endpoints
├── .env                        # Environment variables (gitignored)
├── .gitignore
├── package.json
└── README.md

🧪 Testing with Postman

1. Create a User

POST http://localhost:3000/auth/signup
{
    "username": "john",
    "password": "john1234"
}

2. Login

POST http://localhost:3000/auth/login
{
    "username": "john",
    "password": "john1234"
}
// Copy the token from response

3. Access Protected Route

GET http://localhost:3000/auth/profile
Headers:
    Authorization: Bearer <your-token-here>

4. Create Asset (Admin Only)

POST http://localhost:3000/asset/create
Headers:
    Authorization: Bearer <admin-token>
{
    "assetName": "MacBook Pro",
    "type": "laptop",
    "serialNum": "MBP001",
    "assignedTo": "<user-objectid>"
}

🔒 Security Implementation

Defense in Depth

Layer	Protection	Purpose
1	Helmet	Security HTTP headers
2	Input Validation	Validate data format and constraints
3	Mongo Sanitize	Prevent NoSQL injection
4	Rate Limiting	Prevent brute force attacks
5	JWT Authentication	Verify user identity
6	Role Authorization	Enforce access control
7	bcrypt Hashing	Protect stored passwords

OWASP Top 10 Coverage

✅ Broken Access Control - Role-based middleware
✅ Cryptographic Failures - bcrypt hashing, JWT secret in .env
✅ Injection - Input sanitization and validation
✅ Security Misconfiguration - Helmet security headers
✅ Authentication Failures - Password validation, JWT expiry
✅ Logging Failures - Error logging (console.error)

🎓 Learning Outcomes

This project demonstrates understanding of:

RESTful API design principles
JWT-based stateless authentication
Password security with bcrypt
Role-based access control (RBAC)
Middleware chains in Express
MongoDB with Mongoose ODM
Input validation and sanitization
Security best practices (OWASP)
Environment variable management
Error handling patterns

🚧 Future Enhancements

Built with security-first mindset | Demonstrating backend fundamentals for cybersecurity

FilesExpand file tree

README.md

Latest commit

History