Comprehensive comparison for Authentication technology in Software Development applications

// Drata SDK Integration for Software Development Authentication
// This example demonstrates API authentication with Drata compliance monitoring

const express = require('express');
const jwt = require('jsonwebtoken');
const { DrataClient } = require('@drata/sdk');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(express.json());

// Initialize Drata client for compliance monitoring
const drataClient = new DrataClient({
  apiKey: process.env.DRATA_API_KEY,
  environment: process.env.NODE_ENV || 'production'
});

// Rate limiting for authentication endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: 'Too many authentication attempts'
});

// Middleware to log authentication events to Drata
async function logAuthEventToDrata(userId, event, success, metadata = {}) {
  try {
    await drataClient.logEvent({
      eventType: 'authentication',
      userId: userId,
      action: event,
      success: success,
      timestamp: new Date().toISOString(),
      ipAddress: metadata.ipAddress,
      userAgent: metadata.userAgent,
      mfaUsed: metadata.mfaUsed || false,
      sessionId: metadata.sessionId
    });
  } catch (error) {
    console.error('Failed to log event to Drata:', error);
  }
}

// Authentication middleware with Drata compliance tracking
const authenticateToken = async (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) {
    await logAuthEventToDrata(null, 'token_missing', false, {
      ipAddress: req.ip,
      userAgent: req.get('user-agent')
    });
    return res.status(401).json({ error: 'Access token required' });
  }
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;
    
    // Log successful authentication to Drata
    await logAuthEventToDrata(decoded.userId, 'token_verified', true, {
      ipAddress: req.ip,
      userAgent: req.get('user-agent'),
      sessionId: decoded.sessionId,
      mfaUsed: decoded.mfaVerified
    });
    
    // Track session activity for Drata compliance
    await drataClient.trackUserSession({
      userId: decoded.userId,
      sessionId: decoded.sessionId,
      lastActivity: new Date().toISOString()
    });
    
    next();
  } catch (error) {
    await logAuthEventToDrata(null, 'token_invalid', false, {
      ipAddress: req.ip,
      userAgent: req.get('user-agent'),
      errorType: error.name
    });
    
    if (error.name === 'TokenExpiredError') {
      return res.status(401).json({ error: 'Token expired' });
    }
    return res.status(403).json({ error: 'Invalid token' });
  }
};

// Login endpoint with Drata compliance monitoring
app.post('/api/auth/login', authLimiter, async (req, res) => {
  const { email, password, mfaCode } = req.body;
  
  try {
    // Validate credentials (simplified for example)
    const user = await validateUserCredentials(email, password);
    
    if (!user) {
      await logAuthEventToDrata(email, 'login_failed', false, {
        ipAddress: req.ip,
        userAgent: req.get('user-agent'),
        reason: 'invalid_credentials'
      });
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    
    // Verify MFA if enabled
    const mfaVerified = user.mfaEnabled ? await verifyMFA(user.id, mfaCode) : false;
    
    if (user.mfaEnabled && !mfaVerified) {
      await logAuthEventToDrata(user.id, 'mfa_failed', false, {
        ipAddress: req.ip,
        userAgent: req.get('user-agent')
      });
      return res.status(401).json({ error: 'Invalid MFA code' });
    }
    
    // Generate JWT token
    const sessionId = generateSessionId();
    const token = jwt.sign(
      { 
        userId: user.id, 
        email: user.email,
        sessionId: sessionId,
        mfaVerified: mfaVerified
      },
      process.env.JWT_SECRET,
      { expiresIn: '1h' }
    );
    
    // Log successful login to Drata
    await logAuthEventToDrata(user.id, 'login_success', true, {
      ipAddress: req.ip,
      userAgent: req.get('user-agent'),
      sessionId: sessionId,
      mfaUsed: mfaVerified
    });
    
    res.json({ 
      token,
      expiresIn: 3600,
      userId: user.id
    });
  } catch (error) {
    console.error('Login error:', error);
    await logAuthEventToDrata(email, 'login_error', false, {
      ipAddress: req.ip,
      userAgent: req.get('user-agent'),
      errorMessage: error.message
    });
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Protected endpoint example
app.get('/api/user/profile', authenticateToken, async (req, res) => {
  res.json({ userId: req.user.userId, email: req.user.email });
});

// Helper functions (simplified)
async function validateUserCredentials(email, password) {
  // Database lookup and password verification
  return { id: '12345', email, mfaEnabled: true };
}

async function verifyMFA(userId, code) {
  // MFA verification logic
  return code === '123456';
}

function generateSessionId() {
  return require('crypto').randomBytes(32).toString('hex');
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});