A reusable authentication and authorization subsystem for enterprise & mission-critical applications.
🏆 Originally built during a Hackathon
SecureIT is a military-themed Zero-Trust security subsystem built to be integrated into larger enterprise and mission-critical applications.
Instead of stopping at authentication, SecureIT continuously validates identity, device trust, authorization, tenant boundaries, and threat signals before granting access.
- 🔐 Multi-Tenant Authentication
- 🖥 Hardware-Bound Sessions
- 🛡 Graph-Based RBAC
- 🚨 Permission Escalation Firewall
- 🏢 Multi-Tenant Isolation
- 🔒 Trusted Device Lockdown
- 📊 Threat Detection Dashboard
- 📝 Audit Logging
- JWT Authentication
- bcrypt Password Hashing
- Session Tracking
- Active Session Validation
- Session Revocation
- Middleware Protection
SecureIT binds every JWT session to a hardware/browser fingerprint.
Security Flow
- Generate secure nonce
- SHA-256(deviceFingerprint + nonce)
- Store fingerprint hash
- Validate every request
- Revoke session on mismatch
SecureIT represents roles as a directed graph.
Algorithms Used
- Permission Resolution
- Shortest Inheritance Path
- Cycle Detection
- Graph Validation
Supports:
- Explainable permissions
- Risk analysis
- Permission inheritance
Instead of only checking whether a permission exists, SecureIT validates how it was obtained.
Checks include:
- Direct vs inherited permission
- Inheritance depth
- High-risk permission rules
- Tenant firewall policies
Violations are blocked before business logic executes.
Restricted accounts (Brigadier) can only authenticate from registered devices.
Validation:
- Registered IP
- Device Registry
- Active Status
Failure Result
DEVICE_LOCKDOWN_VIOLATION
Every resource is tenant scoped.
SecureIT prevents:
- Cross tenant reads
- Cross tenant writes
- Cross tenant sharing
- Tenant impersonation
The Threat Analyzer continuously scans authorization events.
Current Detection Rule
5 DENY events
within 60 seconds
↓
THREAT_ACTOR
Automatically
- Creates Audit Log
- Raises Critical Alert
- Displays Dashboard Warning
Brigadier
│
Colonel
│
Officer
│
Soldier
Higher ranks inherit permissions from lower ranks while remaining protected by firewall policies.
Client
│
Authentication
│
JWT Verification
│
Device Fingerprint
│
Trusted Device Check
│
Permission Graph
│
Permission Firewall
│
Tenant Validation
│
Audit Logger
│
Threat Analyzer
│
Database
Main Tables
- users
- roles
- permissions
- role_permissions
- tenants
- user_sessions
- trusted_devices
- firewall_rules
- audit_log
- resource_shares
SecureIT/
├── client/
├── server/
├── middleware/
├── routes/
├── controllers/
├── services/
├── utils/
├── models/
├── database/
├── docs/
├── README.md
└── .env.example
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /api/auth/login | Login |
| POST | /api/auth/logout | Logout |
| GET | /api/auth/me | Current User |
| GET | /api/resources | Fetch Resources |
| POST | /api/resources/share | Share Resource |
| GET | /api/audit | Audit Logs |
| GET | /api/threats | Threat Dashboard |
git clone https://github.com/imjoe77/secureIT.git
cd secureIT
npm install
npm run devPORT=
JWT_SECRET=
DB_HOST=
DB_PORT=
DB_USER=
DB_PASSWORD=
DB_NAME=
CLIENT_URL=This section demonstrates how to explore every core feature of SecureIT.
Use one of the demo accounts below.
| Role | Username | Password |
|---|---|---|
| Soldier | soldier_user |
password123 |
| Officer | officer_user |
password123 |
| Colonel | colonel_user |
password123 |
| Brigadier | brigadier_user |
password123 |
⚠ The Brigadier account requires a registered trusted device before login.
After logging in:
- JWT Token is generated
- Session is created
- User Session is stored
- Device fingerprint is validated
- Tenant context is attached
If successful, the user is redirected to their dashboard.
Each military role has different permissions.
- View assigned resources
- Basic access only
- Additional operational permissions
- Resource management
- Administrative permissions
- User oversight
- Highest privilege
- Security administration
- Trusted Device Management
Navigate to the Permission Graph section.
Here you can:
- View role inheritance
- Inspect permission paths
- Observe BFS permission resolution
- Understand DFS cycle validation
Attempt an operation beyond your assigned permissions.
Example:
- Login as Soldier
- Try deleting an administrative resource
Expected Result:
403 Forbidden
Audit Log:
PERMISSION_DENIED
Login using:
brigadier_user
If your IP has not been registered:
DEVICE_LOCKDOWN_VIOLATION
Navigate to:
Admin HQ
↓
Trusted Devices
↓
Register Current Device
Try logging in again.
Login normally.
Now copy your JWT and attempt to use it from another browser or device with a different fingerprint.
Expected Result
403 Forbidden
Audit Log
SESSION_SPLIT_DETECTED
The session is immediately revoked.
Login as Tenant A.
Attempt to access resources belonging to Tenant B.
Expected Result
CROSS_TENANT_VIOLATION
No data is returned.
Repeatedly perform unauthorized actions.
Example:
- Open a protected endpoint
- Refresh several times
After 5 denied requests within 60 seconds, SecureIT automatically classifies the account as a threat actor.
Dashboard Event:
🚨 THREAT_ACTOR
Audit Log:
Critical Security Event
| Error | Cause | Solution |
|---|---|---|
| Invalid Credentials | Wrong username/password | Verify demo credentials |
| JWT Expired | Session expired | Login again |
| SESSION_SPLIT_DETECTED | Token used on another device | Login again |
| DEVICE_LOCKDOWN_VIOLATION | Device not trusted | Register current device in Admin HQ |
| PERMISSION_DENIED | Missing role permission | Login with higher role |
| CROSS_TENANT_VIOLATION | Attempted cross-tenant access | Use resources belonging to your tenant |
| THREAT_ACTOR | Too many denied requests | Wait before retrying or clear the session |
If you're exploring SecureIT for the first time, follow this order:
- Login as Soldier
- Explore the dashboard
- Attempt an unauthorized action
- View the Audit Log
- Login as Officer
- Compare available permissions
- Login as Colonel
- Observe inherited permissions
- Register a trusted device
- Login as Brigadier
- Test device restrictions
- Trigger threat detection
- Explore the Permission Graph
- Review the Security Dashboard
This walkthrough covers every major feature implemented in SecureIT.
- MFA Support
- OAuth2 / SSO
- WebAuthn Passkeys
- SIEM Integration
- Geolocation Risk Analysis
- Adaptive Authentication
- Email Alerts
- Docker Deployment
- Kubernetes Support
- Redis Session Cache
- PostgreSQL Support
Contributions are welcome.
- Fork the repository
- Create a feature branch
- Commit changes
- Open a Pull Request
Licensed under the MIT License.
See the LICENSE file for details.
MIT License Template: https://opensource.org/licenses/MIT
Nathaniel Bandi
GitHub: https://github.com/imjoe77
Website : https://secureit-backend-6y6k.onrender.com