Authentication Foundations: Sessions, Tokens, and Trust

2 collapsed lines
1
const bcrypt = require("bcrypt")
2

3
class PasswordManager {
4
  constructor() {
5
    this.saltRounds = 12 // OWASP minimum as of 2025; adjust based on hardware
6
  }
7

8
  async hashPassword(plainPassword) {
9
    try {
10
      const salt = await bcrypt.genSalt(this.saltRounds)
11
      const hashedPassword = await bcrypt.hash(plainPassword, salt)
12
      return hashedPassword
13
    } catch (error) {
14
      throw new Error("Password hashing failed")
15
    }
16
  }
17

18
  async verifyPassword(plainPassword, hashedPassword) {
19
    try {
20
      return await bcrypt.compare(plainPassword, hashedPassword)
21
    } catch (error) {
22
      throw new Error("Password verification failed")
23
    }
24
  }
25
}
8 collapsed lines
26

27
// Usage example
28
const passwordManager = new PasswordManager()
29

30
// During registration
31
const hashedPassword = await passwordManager.hashPassword("userPassword123")
32

33
// During login
34
const isValid = await passwordManager.verifyPassword("userPassword123", hashedPassword)

3 collapsed lines
1
const speakeasy = require("speakeasy")
2
const QRCode = require("qrcode")
3

4
class TOTPManager {
5
  generateSecret(userEmail, serviceName) {
6
    return speakeasy.generateSecret({
7
      name: userEmail,
8
      issuer: serviceName,
9
      length: 32,
10
    })
11
  }
12

13
  async generateQRCode(secret) {
14
    const otpauthURL = speakeasy.otpauthURL({
15
      secret: secret.ascii,
16
      label: secret.name,
17
      issuer: secret.issuer,
18
      algorithm: "sha1",
19
    })
20

21
    return await QRCode.toDataURL(otpauthURL)
22
  }
23

24
  verifyTOTP(token, secret) {
25
    return speakeasy.totp.verify({
26
      secret: secret,
27
      encoding: "ascii",
28
      token: token,
29
      window: 2, // Allow 2-step tolerance for clock drift
30
    })
31
  }
32
}
26 collapsed lines
33

34
// Usage in Express middleware
35
const totpManager = new TOTPManager()
36

37
app.post("/enable-mfa", async (req, res) => {
38
  const { userId } = req.body
39
  const secret = totpManager.generateSecret(req.user.email, "YourServiceName")
40

41
  // Store secret in database associated with user
42
  await User.updateOne({ _id: userId }, { totpSecret: secret.base32, mfaEnabled: false })
43

44
  const qrCode = await totpManager.generateQRCode(secret)
45
  res.json({ qrCode, secret: secret.base32 })
46
})
47

48
app.post("/verify-mfa", async (req, res) => {
49
  const { token } = req.body
50
  const user = await User.findById(req.user.id)
51

52
  const verified = totpManager.verifyTOTP(token, user.totpSecret)
53

54
  if (verified) {
55
    await User.updateOne({ _id: req.user.id }, { mfaEnabled: true })
56
    res.json({ success: true })
57
  } else {
58
    res.status(400).json({ error: "Invalid token" })
59
  }
60
})

2 collapsed lines
1
// Client-side WebAuthn registration
2
class WebAuthnManager {
3
  async registerCredential(userInfo) {
4
    try {
5
      // Get challenge from server
6
      const challengeResponse = await fetch("/webauthn/register/begin", {
7
        method: "POST",
8
        headers: { "Content-Type": "application/json" },
9
        body: JSON.stringify({ username: userInfo.username }),
10
      })
11

12
      const challenge = await challengeResponse.json()
13

14
      // Create credential - origin-bound, preventing phishing attacks
15
      const credential = await navigator.credentials.create({
16
        publicKey: {
17
          challenge: new Uint8Array(challenge.challenge),
18
          rp: { name: "Your Service" },
19
          user: {
20
            id: new TextEncoder().encode(userInfo.username),
21
            name: userInfo.username,
22
            displayName: userInfo.displayName,
23
          },
24
          pubKeyCredParams: [{ alg: -7, type: "public-key" }], // ES256
25
          authenticatorSelection: {
26
            authenticatorAttachment: "platform",
27
            userVerification: "required",
28
          },
29
        },
30
      })
31

32
      return credential
33
    } catch (error) {
34
      console.error("WebAuthn registration failed:", error)
18 collapsed lines
35
      throw error
36
    }
37
  }
38

39
  // Send credential to server for storage
40
  async completeRegistration(credential) {
41
    const registrationResponse = await fetch("/webauthn/register/finish", {
42
      method: "POST",
43
      headers: { "Content-Type": "application/json" },
44
      body: JSON.stringify({
45
        id: credential.id,
46
        rawId: Array.from(new Uint8Array(credential.rawId)),
47
        response: {
48
          clientDataJSON: Array.from(new Uint8Array(credential.response.clientDataJSON)),
49
          attestationObject: Array.from(new Uint8Array(credential.response.attestationObject)),
50
        },
51
      }),
52
    })
53
    return await registrationResponse.json()
54
  }
55
}

6 collapsed lines
1
class RBACManager {
2
  constructor() {
3
    this.roles = new Map()
4
    this.userRoles = new Map()
5
    this.permissions = new Map()
6
  }
7

8
  defineRole(roleName, permissions = []) {
9
    this.roles.set(roleName, new Set(permissions))
10
    return this
11
  }
12

13
  assignRoleToUser(userId, roleName) {
14
    if (!this.userRoles.has(userId)) {
15
      this.userRoles.set(userId, new Set())
16
    }
17
    this.userRoles.get(userId).add(roleName)
18
    return this
19
  }
20

21
  getUserPermissions(userId) {
22
    const userRoles = this.userRoles.get(userId) || new Set()
23
    const permissions = new Set()
24

25
    for (const role of userRoles) {
26
      const rolePermissions = this.roles.get(role) || new Set()
27
      for (const permission of rolePermissions) {
28
        permissions.add(permission)
29
      }
30
    }
31

32
    return permissions
33
  }
34

35
  hasPermission(userId, requiredPermission) {
36
    const userPermissions = this.getUserPermissions(userId)
37
    return userPermissions.has(requiredPermission)
38
  }
39

40
  middleware(requiredPermission) {
41
    return (req, res, next) => {
42
      const userId = req.user?.id
43

44
      if (!userId) {
45
        return res.status(401).json({ error: "Authentication required" })
46
      }
47

48
      if (!this.hasPermission(userId, requiredPermission)) {
49
        return res.status(403).json({ error: "Insufficient permissions" })
50
      }
51

52
      next()
53
    }
54
  }
55
}
21 collapsed lines
56

57
// Usage example
58
const rbac = new RBACManager()
59

60
// Define roles and permissions
61
rbac
62
  .defineRole("admin", ["user:create", "user:read", "user:update", "user:delete"])
63
  .defineRole("moderator", ["user:read", "user:update"])
64
  .defineRole("user", ["user:read"])
65

66
// Assign roles to users
67
rbac.assignRoleToUser("user123", "admin").assignRoleToUser("user456", "moderator")
68

69
// Use in Express routes
70
app.get("/admin/users", rbac.middleware("user:read"), (req, res) => {
71
  // Handle admin user listing
72
})
73

74
app.delete("/admin/users/:id", rbac.middleware("user:delete"), (req, res) => {
75
  // Handle user deletion
76
})

4 collapsed lines
1
class ABACPolicyEngine {
2
  constructor() {
3
    this.policies = []
4
  }
5

6
  addPolicy(policy) {
7
    this.policies.push(policy)
8
    return this
9
  }
10

11
  evaluate(subject, resource, action, environment = {}) {
12
    for (const policy of this.policies) {
13
      const result = this.evaluatePolicy(policy, subject, resource, action, environment)
14
      if (result === "PERMIT") return true
15
      if (result === "DENY") return false
16
    }
17
    return false // Default deny - fail closed
18
  }
19

20
  evaluatePolicy(policy, subject, resource, action, environment) {
21
    try {
22
      const context = {
23
        subject,
24
        resource,
25
        action,
26
        environment,
27
        time: new Date(),
28
        hasAttribute: (obj, attr) => obj && obj[attr] !== undefined,
29
        inRange: (value, min, max) => value >= min && value <= max,
30
      }
31

32
      return policy.condition(context) ? policy.effect : "NOT_APPLICABLE"
33
    } catch (error) {
34
      console.error("Policy evaluation error:", error)
35
      return "DENY" // Fail closed on error
36
    }
37
  }
38

39
  // ... middleware implementation
40
}
41

25 collapsed lines
42
  middleware() {
43
    return (req, res, next) => {
44
      const subject = {
45
        id: req.user?.id,
46
        role: req.user?.role,
47
        department: req.user?.department,
48
        clearanceLevel: req.user?.clearanceLevel,
49
      }
50

51
      const resource = {
52
        type: req.route?.path,
53
        owner: req.params?.userId,
54
        classification: req.body?.classification,
55
      }
56

57
      const action = req.method.toLowerCase()
58

59
      const environment = {
60
        ipAddress: req.ip,
61
        time: new Date(),
62
        userAgent: req.get("User-Agent"),
63
      }
64

65
      if (this.evaluate(subject, resource, action, environment)) {
66
        next()
67
      } else {
68
        res.status(403).json({ error: "Access denied by policy" })
69
      }
70
    }
71
  }
26 collapsed lines
72

73
// Usage example - policy definitions
74
const abac = new ABACPolicyEngine()
75

76
abac.addPolicy({
77
  name: "AdminFullAccess",
78
  condition: ({ subject }) => subject.role === "admin",
79
  effect: "PERMIT",
80
})
81

82
abac.addPolicy({
83
  name: "UserSelfAccess",
84
  condition: ({ subject, resource, action }) =>
85
    subject.role === "user" && resource.owner === subject.id && ["get", "put"].includes(action),
86
  effect: "PERMIT",
87
})
88

89
abac.addPolicy({
90
  name: "WorkingHoursOnly",
91
  condition: ({ environment }) => {
92
    const hour = environment.time.getHours()
93
    return hour >= 9 && hour <= 17
94
  },
95
  effect: "DENY",
96
})
97

98
app.use("/api/sensitive", abac.middleware())

3 collapsed lines
1
const jwt = require("jsonwebtoken")
2
const crypto = require("crypto")
3

4
class JWTManager {
5
  constructor(options = {}) {
6
    this.accessTokenSecret = options.accessTokenSecret || process.env.JWT_ACCESS_SECRET
7
    this.refreshTokenSecret = options.refreshTokenSecret || process.env.JWT_REFRESH_SECRET
8
    this.accessTokenExpiry = options.accessTokenExpiry || "15m" // Short-lived
9
    this.refreshTokenExpiry = options.refreshTokenExpiry || "7d"
10
    this.issuer = options.issuer || "your-service"
11
    this.audience = options.audience || "your-app"
12
  }
13

14
  // Token generation with jti for revocation tracking
37 collapsed lines
15
  generateTokenPair(payload) {
16
    const jti = crypto.randomUUID()
17
    const now = Math.floor(Date.now() / 1000)
18

19
    const accessToken = jwt.sign(
20
      {
21
        ...payload,
22
        type: "access",
23
        jti,
24
        iat: now,
25
        iss: this.issuer,
26
        aud: this.audience,
27
      },
28
      this.accessTokenSecret,
29
      {
30
        expiresIn: this.accessTokenExpiry,
31
        algorithm: "HS256",
32
      },
33
    )
34

35
    const refreshToken = jwt.sign(
36
      {
37
        userId: payload.userId,
38
        type: "refresh",
39
        jti,
40
        iat: now,
41
        iss: this.issuer,
42
        aud: this.audience,
43
      },
44
      this.refreshTokenSecret,
45
      {
46
        expiresIn: this.refreshTokenExpiry,
47
        algorithm: "HS256",
48
      },
49
    )
50

51
    return { accessToken, refreshToken, jti }
52
  }
53

54
  verifyAccessToken(token) {
55
    try {
56
      const decoded = jwt.verify(token, this.accessTokenSecret, {
57
        issuer: this.issuer,
58
        audience: this.audience,
59
        algorithms: ["HS256"], // Explicitly allowlist algorithm
60
      })
61

62
      if (decoded.type !== "access") {
63
        throw new Error("Invalid token type")
64
      }
65

66
      return decoded
67
    } catch (error) {
21 collapsed lines
68
      throw new Error("Invalid access token")
69
    }
70
  }
71

72
  middleware() {
73
    return (req, res, next) => {
74
      const authHeader = req.headers.authorization
75

76
      if (!authHeader || !authHeader.startsWith("Bearer ")) {
77
        return res.status(401).json({ error: "No token provided" })
78
      }
79

80
      const token = authHeader.substring(7)
81

82
      try {
83
        const decoded = this.verifyAccessToken(token)
84
        req.user = decoded
85
        next()
86
      } catch (error) {
87
        return res.status(401).json({ error: "Invalid token" })
88
      }
89
    }
90
  }
91
}
39 collapsed lines
92

93
// Refresh token rotation - issue new refresh token on each use
94
const jwtManager = new JWTManager()
95

96
app.post("/auth/refresh", async (req, res) => {
97
  const { refreshToken } = req.body
98

99
  if (!refreshToken) {
100
    return res.status(401).json({ error: "Refresh token required" })
101
  }
102

103
  try {
104
    const decoded = jwtManager.verifyRefreshToken(refreshToken)
105

106
    // Check revocation - detect token reuse attacks
107
    const isRevoked = await checkTokenRevocation(decoded.jti)
108
    if (isRevoked) {
109
      return res.status(401).json({ error: "Token revoked" })
110
    }
111

112
    const user = await User.findById(decoded.userId)
113
    if (!user) {
114
      return res.status(401).json({ error: "User not found" })
115
    }
116

117
    const { accessToken, refreshToken: newRefreshToken } = jwtManager.generateTokenPair({
118
      userId: user._id,
119
      email: user.email,
120
      role: user.role,
121
    })
122

123
    // Revoke old refresh token - rotation prevents reuse
124
    await revokeToken(decoded.jti)
125

126
    res.json({
127
      accessToken,
128
      refreshToken: newRefreshToken,
129
    })
130
  } catch (error) {
131
    res.status(401).json({ error: "Invalid refresh token" })
132
  }
133
})

4 collapsed lines
1
const express = require("express")
2
const crypto = require("crypto")
3
const axios = require("axios")
4

5
class OAuth2Provider {
6
  constructor(options) {
7
    this.clientId = options.clientId
8
    this.clientSecret = options.clientSecret
9
    this.redirectUri = options.redirectUri
10
    this.authorizationEndpoint = options.authorizationEndpoint
11
    this.tokenEndpoint = options.tokenEndpoint
12
    this.userInfoEndpoint = options.userInfoEndpoint
13
    this.scope = options.scope || "openid profile email"
14
  }
15

16
  // Generate auth URL with PKCE and CSRF protection
2 collapsed lines
17
  generateAuthorizationUrl() {
18
    const state = crypto.randomBytes(16).toString("hex")
19
    const nonce = crypto.randomBytes(16).toString("hex")
20

21
    // PKCE: Generate code verifier and challenge
22
    const codeVerifier = crypto.randomBytes(32).toString("base64url")
23
    const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url")
24

25
    const params = new URLSearchParams({
26
      response_type: "code",
27
      client_id: this.clientId,
28
      redirect_uri: this.redirectUri,
29
      scope: this.scope,
30
      state, // CSRF protection
31
      nonce, // Replay protection (OIDC)
32
      code_challenge: codeChallenge,
33
      code_challenge_method: "S256",
34
    })
35

36
    return {
37
      url: `${this.authorizationEndpoint}?${params}`,
38
      state,
39
      nonce,
40
      codeVerifier, // Store server-side for token exchange
41
    }
42
  }
43

44
  async exchangeCodeForTokens(code, state, savedState, codeVerifier) {
45
    // Verify state to prevent CSRF
46
    if (state !== savedState) {
47
      throw new Error("Invalid state parameter")
48
    }
49

50
    try {
51
      const response = await axios.post(
52
        this.tokenEndpoint,
53
        new URLSearchParams({
54
          grant_type: "authorization_code",
55
          client_id: this.clientId,
56
          client_secret: this.clientSecret,
57
          code,
58
          redirect_uri: this.redirectUri,
59
          code_verifier: codeVerifier, // PKCE
60
        }),
61
        {
62
          headers: {
16 collapsed lines
63
            "Content-Type": "application/x-www-form-urlencoded",
64
          },
65
        },
66
      )
67

68
      return response.data
69
    } catch (error) {
70
      throw new Error("Token exchange failed")
71
    }
72
  }
73
}
74

75
// Express routes for OAuth flow
76
const oauth2 = new OAuth2Provider({
77
  clientId: process.env.OAUTH_CLIENT_ID,
78
  clientSecret: process.env.OAUTH_CLIENT_SECRET,
79
  redirectUri: process.env.OAUTH_REDIRECT_URI,
80
  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
81
  tokenEndpoint: "https://oauth2.googleapis.com/token",
82
  userInfoEndpoint: "https://www.googleapis.com/oauth2/v2/userinfo",
83
})
84

85
app.get("/auth/oauth/login", (req, res) => {
86
  const { url, state, nonce, codeVerifier } = oauth2.generateAuthorizationUrl()
87
  req.session.oauthState = state
88
  req.session.oauthNonce = nonce
89
  req.session.codeVerifier = codeVerifier // Store for PKCE
90
  res.redirect(url)
91
})

5 collapsed lines
1
const passport = require("passport")
2
const LocalStrategy = require("passport-local").Strategy
3
const JwtStrategy = require("passport-jwt").Strategy
4
const ExtractJwt = require("passport-jwt").ExtractJwt
5

6
class AuthenticationManager {
7
  constructor(options = {}) {
8
    this.jwtManager = options.jwtManager
9
    this.rbacManager = options.rbacManager
10
    this.setupStrategies()
11
  }
12

13
  setupStrategies() {
14
    // Local Strategy - username/password authentication
15
    passport.use(
27 collapsed lines
16
      new LocalStrategy(
17
        {
18
          usernameField: "email",
19
          passwordField: "password",
20
        },
21
        async (email, password, done) => {
22
          try {
23
            const user = await User.findOne({ email }).select("+password")
24
            if (!user) {
25
              return done(null, false, { message: "Invalid credentials" })
26
            }
27

28
            const isValid = await user.comparePassword(password)
29
            if (!isValid) {
30
              return done(null, false, { message: "Invalid credentials" })
31
            }
32

33
            return done(null, user)
34
          } catch (error) {
35
            return done(error)
36
          }
37
        },
38
      ),
39
    )
40

41
    // JWT Strategy - token-based authentication
42
    passport.use(
43
      new JwtStrategy(
44
        {
45
          jwtFromRequest: ExtractJwt.fromExtractors([
46
            ExtractJwt.fromAuthHeaderAsBearerToken(),
47
            ExtractJwt.fromBodyField("token"),
48
            this.extractFromCookie,
49
          ]),
50
          secretOrKey: process.env.JWT_ACCESS_SECRET,
51
          issuer: "your-service",
52
          audience: "your-app",
53
          algorithms: ["HS256"], // Explicitly allowlist
54
        },
55
        async (payload, done) => {
56
          try {
57
            const user = await User.findById(payload.userId)
58
            if (user) {
59
              return done(null, user)
60
            }
61
            return done(null, false)
62
          } catch (error) {
63
            return done(error, false)
64
          }
65
        },
66
      ),
67
    )
9 collapsed lines
68
  }
69

70
  extractFromCookie(req) {
71
    return req.cookies?.accessToken || null
72
  }
73

74
  requireAuth(strategy = "jwt") {
75
    return passport.authenticate(strategy, { session: false })
76
  }
77

78
  requirePermission(permission) {
79
    return [
80
      this.requireAuth(),
81
      (req, res, next) => {
82
        if (this.rbacManager.hasPermission(req.user.id, permission)) {
83
          next()
84
        } else {
85
          res.status(403).json({ error: "Insufficient permissions" })
86
        }
87
      },
88
    ]
89
  }
90
}

4 collapsed lines
1
const helmet = require("helmet")
2
const cors = require("cors")
3
const compression = require("compression")
4

5
class SecurityMiddleware {
6
  static getStack(options = {}) {
7
    return [
8
      // Security headers via Helmet
9
      helmet({
10
        contentSecurityPolicy: {
11
          directives: {
12
            defaultSrc: ["'self'"],
13
            styleSrc: ["'self'", "'unsafe-inline'"],
14
            scriptSrc: ["'self'"],
15
            imgSrc: ["'self'", "data:", "https:"],
16
          },
17
        },
18
        hsts: {
19
          maxAge: 31536000, // 1 year
20
          includeSubDomains: true,
21
          preload: true,
22
        },
23
      }),
24

25
      // CORS - restrict allowed origins
26
      cors({
27
        origin: options.allowedOrigins || ["http://localhost:3000"],
28
        credentials: true,
29
        optionsSuccessStatus: 200,
30
      }),
31

32
      compression(),
33

34
      // Request size limits - prevent DoS
35
      express.json({ limit: options.jsonLimit || "10mb" }),
36
      express.urlencoded({
37
        extended: false,
38
        limit: options.urlEncodedLimit || "10mb",
39
      }),
40

41
      this.xssProtection(),
42
    ]
32 collapsed lines
43
  }
44

45
  static xssProtection() {
46
    return (req, res, next) => {
47
      const xss = require("xss")
48

49
      if (req.body && typeof req.body === "object") {
50
        req.body = this.sanitizeObject(req.body, xss)
51
      }
52

53
      if (req.query && typeof req.query === "object") {
54
        req.query = this.sanitizeObject(req.query, xss)
55
      }
56

57
      next()
58
    }
59
  }
60

61
  static sanitizeObject(obj, xss) {
62
    const sanitized = {}
63
    for (const [key, value] of Object.entries(obj)) {
64
      if (typeof value === "string") {
65
        sanitized[key] = xss(value)
66
      } else if (typeof value === "object" && value !== null) {
67
        sanitized[key] = this.sanitizeObject(value, xss)
68
      } else {
69
        sanitized[key] = value
70
      }
71
    }
72
    return sanitized
73
  }
74
}

2 collapsed lines
1
const joi = require("joi")
2

3
class ValidationMiddleware {
4
  static validate(schema, property = "body") {
5
    return (req, res, next) => {
6
      const { error, value } = schema.validate(req[property])
7

8
      if (error) {
9
        const details = error.details.map((detail) => ({
10
          field: detail.path.join("."),
11
          message: detail.message,
12
        }))
13

14
        return res.status(400).json({
15
          error: "Validation failed",
16
          details,
17
        })
18
      }
19

20
      req[property] = value
21
      next()
22
    }
23
  }
24
}
25

26
// Schema definitions
20 collapsed lines
27
const schemas = {
28
  login: joi.object({
29
    email: joi.string().email().required(),
30
    password: joi.string().min(8).required(),
31
    rememberMe: joi.boolean().optional(),
32
  }),
33

34
  register: joi.object({
35
    email: joi.string().email().required(),
36
    password: joi
37
      .string()
38
      .min(12) // NIST recommends 8+; 12+ for sensitive systems
39
      .required(),
40
    confirmPassword: joi.ref("password"),
41
    name: joi.string().min(2).max(50).required(),
42
  }),
43
}
44

45
// Apply validation
46
app.post("/auth/login", ValidationMiddleware.validate(schemas.login), authController.login)

7 collapsed lines
1
class ZeroTrustGateway {
2
  constructor(options = {}) {
3
    this.riskEngine = options.riskEngine
4
    this.policyEngine = options.policyEngine
5
    this.contextAnalyzer = options.contextAnalyzer
6
  }
7

8
  async evaluateRequest(req, res, next) {
9
    try {
10
      const context = await this.contextAnalyzer.analyze(req)
11
      const riskScore = await this.riskEngine.calculate(context)
12
      const policyDecision = await this.policyEngine.evaluate(context, riskScore)
13

14
      switch (policyDecision.action) {
15
        case "allow":
16
          req.zeroTrust = { riskScore, context }
17
          next()
18
          break
19

20
        case "challenge":
21
          // Step-up authentication required
22
          this.requireAdditionalAuth(req, res, policyDecision)
23
          break
24

25
        case "deny":
26
          res.status(403).json({
27
            error: "Access denied",
28
            reason: policyDecision.reason,
29
          })
30
          break
31

32
        default:
33
          res.status(500).json({ error: "Policy evaluation failed" })
34
      }
35
    } catch (error) {
36
      console.error("Zero Trust evaluation error:", error)
37
      res.status(500).json({ error: "Security evaluation failed" })
38
    }
39
  }
40
}
41

42
// Risk scoring based on multiple signals
43
class RiskEngine {
26 collapsed lines
44
  async calculate(context) {
45
    let riskScore = 0
46

47
    // Location anomaly
48
    if (context.geolocation?.isUnusualLocation) {
49
      riskScore += 30
50
    }
51

52
    // Unrecognized device
53
    if (!context.device?.isRecognized) {
54
      riskScore += 25
55
    }
56

57
    // Behavioral anomaly (unusual access patterns)
58
    if (context.behavior?.isAnomalous) {
59
      riskScore += 35
60
    }
61

62
    // Network risk (TOR, VPN, known bad IP)
63
    if (context.network?.isSuspicious) {
64
      riskScore += 40
65
    }
66

67
    return Math.min(riskScore, 100)
68
  }
69
}