DEV Community: susheel kumar

Introducing Sakshsky-Auth: Secure Passwordless Email Authentication for Node.js

susheel kumar — Sat, 12 Jul 2025 06:12:42 +0000

In today's fast-paced digital world, traditional password-based authentication is increasingly seen as a vulnerability—prone to breaches, phishing, and user frustration. Enter passwordless authentication, a modern approach that leverages secure, one-time verification methods like email codes. At Sakshsky, we're excited to release sakshsky-auth, a lightweight Node.js package designed to make implementing robust, tamper-resistant email-based authentication simple and secure.

Whether you're building a web app, API, or internal tool, sakshsky-auth handles the heavy lifting: generating verification codes, binding them to device fingerprints, and verifying incoming emails with built-in IMAP/POP3 monitoring. Let's dive into what makes this package a game-changer for developers prioritizing security without complexity.

Why Passwordless Authentication?

Passwords are a pain point. Users forget them, attackers crack them, and managing them securely requires hashing, salting, and constant updates. Passwordless systems, like those used by companies such as Slack or GitHub, shift the burden to trusted channels like email or biometrics.

Sakshsky-auth focuses on email verification, enhanced with device fingerprinting to prevent common attacks like code interception or replay. It's ideal for apps where email is a primary identifier, offering a seamless user experience: Enter your email, get a code, send it back, and you're in—no passwords required.

Key Features

Sakshsky-auth is built with security and ease-of-use in mind. Here's what sets it apart:

Passwordless Flow: Users initiate login with their email, receive a pre-filled verification email, and send it to complete auth.
Device Fingerprinting: Collects session data (IP, UA, browser, etc.) to create a unique "fingerprint" bound to the code, reducing cross-device tampering risks.
Tamper Detection: Uses salted SHA-256 hashes to verify email integrity—any alteration to the code or hash fails authentication.
Built-in Email Monitoring: Supports IMAP and POP3 for real-time or polled inbox checking, with auto-protocol detection.
Customizable Code Generation: Use the default UUID or provide your own generator for shorter/OTP-style codes.
MongoDB Integration: Stores temporary verification records via Mongoose for easy expiry and cleanup.
Socket.IO Support: Real-time notifications for successful verifications, perfect for live apps.

The package is modular, lightweight (under 50KB installed), and has no external runtime dependencies beyond what's needed for your stack.

How It Works Under the Hood

Initiation: On login request, the package generates a code, collects a device fingerprint, salts and hashes it, and prepares a pre-filled email (using mailto: for client-side compose).
Email Sending: The user sends the email with the code and hash.
Verification: The package monitors the inbox (IMAP/IDLE for real-time or POP3/polling), parses incoming emails, extracts code/hash, rebuilds the hash from stored data, and checks for matches. On success, it triggers a callback (e.g., Socket.IO emit) and deletes the record.
Security Checks: Expiry, sender match, and hash validation ensure safety.

This flow minimizes attack surfaces while keeping things user-friendly.

Installation and Quick Start

Get started in minutes:

npm install sakshsky-auth

In your Node.js app (e.g., Express):

const express = require('express');
const http = require('http');
const socketIo = require('socket.io');
const mongoose = require('mongoose');
const path = require('path');
const { sakshskyInitLoginHandler, sakshskyStartAuthMonitor } = require('sakshsky-auth');

const app = express();
const server = http.createServer(app);
const io = socketIo(server);

app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(express.static(path.join(__dirname, 'public')));

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/emailAuth');

// Define schemas
const verificationSchema = new mongoose.Schema({
  email: String,
  code: String,
  expiry: Date,
  socketId: String,
  hashedFingerprint: String,
  salt: String
});
const Verification = mongoose.model('Verification', verificationSchema);

// Login initiation route
app.post('/api/init-login', async (req, res) => {
  const serverEmail = 'verify@yourdomain.com'; // Your inbound email
  await sakshskyInitLoginHandler(req, res, serverEmail);
});

// Serve frontend
app.get('/', (req, res) => {
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

// Dashboard (protect in production)
app.get('/dashboard', (req, res) => {
  res.send('Logged in!');
});

// Email config
const emailConfig = {
  host: 'imap.gmail.com',
  port: 993,
  user: 'your-inbox@gmail.com',
  pass: 'app-password'
};

// Start monitor
sakshskyStartAuthMonitor(emailConfig, (verification) => {
  io.to(verification.socketId).emit('verified', { email: verification.email });
});

server.listen(3000, () => console.log('Server on port 3000'));

Detailed Example: Copy-Paste and Run

To help you get started quickly, here's a complete, copy-pasteable example. This includes a basic Express server, MongoDB setup, and a simple frontend HTML file. Save the server code as server.js, the HTML as public/index.html, and run node server.js.

Server Code (server.js)

const express = require('express');
const http = require('http');
const socketIo = require('socket.io');
const path = require('path');
const mongoose = require('mongoose');
const { sakshskyInitLoginHandler, sakshskyStartAuthMonitor } = require('sakshsky-auth');

const app = express();
const server = http.createServer(app);
const io = socketIo(server);

app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(express.static(path.join(__dirname, 'public')));

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/emailAuth', { useNewUrlParser: true, useUnifiedTopology: true })
  .then(() => console.log('MongoDB connected'))
  .catch(err => console.error('MongoDB error:', err));

// Define verification schema
const verificationSchema = new mongoose.Schema({
  email: String,
  code: String,
  expiry: Date,
  socketId: String,
  hashedFingerprint: String,
  salt: String
});
const Verification = mongoose.model('Verification', verificationSchema);

// Login initiation route
app.post('/api/init-login', async (req, res) => {
  const serverEmail = 'your-server-email@example.com'; // Replace with your inbound email
  await sakshskyInitLoginHandler(req, res, serverEmail);
});

// Serve frontend
app.get('/', (req, res) => {
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

// Dashboard example
app.get('/dashboard', (req, res) => {
  res.send('Welcome to the dashboard! You are logged in.');
});

// Email config (replace with your details)
const emailConfig = {
  host: 'imap.gmail.com',
  port: 993,
  user: 'your-inbox@gmail.com',
  pass: 'your-app-password' // Use Gmail app password
};

// Start auth monitor
sakshskyStartAuthMonitor(emailConfig, (verification) => {
  io.to(verification.socketId).emit('verified', { email: verification.email });
});

server.listen(3000, () => console.log('Server running on http://localhost:3000'));

Frontend Code (public/index.html)

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Sakshsky Auth Example</title>
  <script src="/socket.io/socket.io.js"></script>
</head>
<body>
  <h1>Passwordless Email Login</h1>
  <input type="email" id="email" placeholder="Your Email" required>
  <button onclick="initLogin()">Login</button>

  <script>
    const socket = io();
    function initLogin() {
      const email = document.getElementById('email').value;
      if (!email) return alert('Enter email');
      fetch('/api/init-login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, socketId: socket.id })
      }).then(res => res.json()).then(data => {
        window.location.href = `mailto:${data.toEmail}?subject=${encodeURIComponent(data.subject)}&body=${encodeURIComponent(data.body)}`;
        socket.on('verified', (data) => {
          alert(`Logged in as ${data.email}`);
          window.location.href = '/dashboard';
        });
      }).catch(err => alert('Error'));
    }
  </script>
</body>
</html>

Run node server.js, visit http://localhost:3000, enter an email, send the pre-filled message, and watch for the verification alert!

Security Considerations

While robust, email auth has limitations (e.g., inbox compromise). Sakshsky-auth mitigates with hashes and fingerprints, but for high-stakes apps, combine with 2FA or WebAuthn. Always use HTTPS, rate-limit requests, and monitor for anomalies.

Future Plans

We're planning support for SMS fallback, WebAuthn integration, and customizable fingerprints. Feedback welcome on GitHub!

At Sakshsky, we're committed to secure, simple tools. Try sakshsky-auth today and let us know what you think!

Announcing Laravel API Resource Optimizer: Supercharge Your Laravel APIs

susheel kumar — Mon, 12 May 2025 08:51:31 +0000

I'm thrilled to introduce Laravel API Resource Optimizer, a new open-source package designed to make your Laravel APIs faster, lighter, and more flexible. Whether you're building a REST API for a mobile app, a SaaS platform, or a microservices architecture, this package streamlines API development by enhancing Laravel's built-in API Resource classes with powerful optimization features.

In this post, I'll walk you through what the package does, why it matters, and how you can start using it today to level up your Laravel APIs.

Why Laravel API Resource Optimizer?

Laravel's API Resources are fantastic for transforming Eloquent models into JSON responses, but they lack advanced optimization features out of the box. Developers often find themselves writing repetitive code to handle tasks like:

Allowing clients to request specific fields to reduce payload size.
Dynamically including related data without over-fetching.
Caching responses to improve performance.

The Laravel API Resource Optimizer package addresses these pain points by providing a drop-in solution that makes your APIs more efficient and developer-friendly. Built with performance and simplicity in mind, it’s compatible with Laravel 8.x, 9.x, and 10.x, and it’s ready to use in your next project.

Key Features

Here’s what makes this package stand out:

Sparse Fieldsets: Let clients request only the fields they need (e.g., GET /users?fields=id,name), reducing response sizes and improving performance.
Conditional Relationship Loading: Include related data on demand (e.g., GET /users?include=posts) to avoid unnecessary database queries.
Response Caching: Cache API responses with configurable TTL to minimize server load and speed up requests.
Schema Validation: Ensure requested fields and relationships are valid, enhancing security and reliability.
Rate-Limiting: Protect your API with built-in throttling to prevent abuse.

These features are designed to work seamlessly with Laravel’s ecosystem, leveraging familiar conventions and requiring minimal setup.

Getting Started

Installing and using the package is a breeze. Here’s a quick guide to get you up and running.

Installation

Install the package via Composer:

composer require sakshsky/laravel-api-optimizer

Optionally, publish the configuration file to customize settings:

php artisan vendor:publish --provider="Sakshsky\ApiOptimizer\ApiOptimizerServiceProvider"

The configuration file (config/api-optimizer.php) lets you tweak options like cache duration and default fields:

return [
    'cache_ttl' => 60, // Cache responses for 60 seconds
    'default_fields' => ['id', 'name'],
    'max_nesting_depth' => 3,
    'rate_limit' => '60,1', // 60 requests per minute
];

Creating an Optimized Resource

Extend the OptimizedResource class to define your API resource:

namespace App\Http\Resources;

use Sakshsky\ApiOptimizer\OptimizedResource;

class UserResource extends OptimizedResource
{
    protected $allowedFields = ['id', 'name', 'email', 'created_at'];
    protected $allowedIncludes = ['posts'];

    public function toArray($request)
    {
        return [
            'id' => $this->id,
            'name' => $this->name,
            'email' => $this->email,
            'created_at' => $this->created_at,
            'posts' => PostResource::collection($this->whenLoaded('posts')),
        ];
    }
}

Using in a Controller

Use the resource in your controller like any Laravel API Resource:

namespace App\Http\Controllers;

use App\Http\Resources\UserResource;
use App\Models\User;

class UserController extends Controller
{
    public function index()
    {
        $users = User::query()->paginate();
        return UserResource::collection($users);
    }
}

Example API Requests

Here’s what you can do with the package:

Fetch all fields:

   GET /api/users

   [
       {
           "id": 1,
           "name": "John Doe",
           "email": "john@example.com",
           "created_at": "2025-05-12T12:00:00Z"
       },
       ...
   ]

Request specific fields:

   GET /api/users?fields=id,name

   [
       {
           "id": 1,
           "name": "John Doe"
       },
       ...
   ]

Include relationships:

   GET /api/users?include=posts

   [
       {
           "id": 1,
           "name": "John Doe",
           "email": "john@example.com",
           "posts": [
               {
                   "id": 1,
                   "title": "My First Post"
               },
               ...
           ]
       },
       ...
   ]

Applying Middleware

The package includes an api-optimizer middleware to parse query parameters. Apply it to your routes:

Route::middleware('api-optimizer')->group(function () {
    Route::resource('users', UserController::class);
});

Why This Package Matters

In today’s API-driven world, performance and flexibility are critical. Clients—whether mobile apps or web frontends—expect fast, tailored responses. By supporting sparse fieldsets and conditional includes, Laravel API Resource Optimizer reduces payload sizes and database queries, leading to faster responses and lower server costs. The caching feature is a game-changer for high-traffic APIs, and the schema validation ensures your endpoints stay secure.

Plus, it’s built with Laravel’s developer experience in mind. You don’t need to rewrite your existing resources or learn a new paradigm—just extend OptimizedResource and start optimizing.

What’s Next?

This is just the beginning for Laravel API Resource Optimizer. Future updates may include:

GraphQL-like Query Support: Allow structured queries (e.g., ?query={id,name,posts{id,title}}) for even more flexibility.
Response Compression: Compress responses to further reduce payload sizes.
OpenAPI Integration: Generate Swagger documentation for optimized resources.
Multi-Tenancy Support: Optimize APIs for SaaS applications.

I’m excited to hear your feedback and ideas for new features. If you have suggestions, feel free to open an issue or submit a pull request!

Contribute and Connect

Laravel API Resource Optimizer is open-source under the MIT License, and contributions are welcome! Whether you’re fixing bugs, adding features, or improving documentation, your help will make this package even better.

GitHub: github.com/sakshsky/laravel-api-optimizer
Packagist: packagist.org/packages/sakshsky/laravel-api-optimizer
Issues: github.com/sakshsky/laravel-api-optimizer/issues
X: Follow me at @sakshsky for updates

To get started, check out the CONTRIBUTING.md file for guidelines.

Try It Today

Ready to supercharge your Laravel APIs? Install Laravel API Resource Optimizer and see the difference for yourself:

composer require sakshsky/laravel-api-optimizer

I can’t wait to see how you use this package in your projects. Share your experiences, success stories, or questions on X with the hashtag #LaravelApiOptimizer, or drop a comment below.

Happy coding, and let’s make Laravel APIs faster together!

If you enjoyed this post, please share it with the Laravel community and star the GitHub repository. Stay tuned for more updates!

Introducing Saksh Wallet: A Simple Wallet System for Laravel

susheel kumar — Mon, 12 May 2025 08:14:25 +0000

Are you building a Laravel application that needs to manage user wallets, handle transactions, or track balances across multiple currencies? Look no further! I’m thrilled to announce the release of sakshsky/saksh-wallet, a lightweight, open-source Laravel package designed to simplify wallet functionality with a clean and intuitive API. Whether you’re creating an e-commerce platform, a freelance marketplace, or a gaming app, Saksh Wallet has you covered.

In this post, I’ll walk you through what Saksh Wallet is, its key features, how to install and use it, and why it’s a great addition to your Laravel projects. Let’s dive in!

What is Saksh Wallet?

Saksh Wallet is a Laravel package that provides a robust and flexible wallet system for managing user transactions and balances. Built with Laravel 12 in mind, it leverages two database tables—wallet_transactions for transaction history and balances for current balances—to deliver a performant and scalable solution. The package is open-source, licensed under MIT, and available on Packagist at sakshsky/saksh-wallet.

Whether you need to credit funds, debit with fees, or retrieve balance summaries, Saksh Wallet offers a straightforward API that integrates seamlessly into your Laravel application.

Key Features

Saksh Wallet is designed to be simple yet powerful. Here’s what it offers:

Dual-Table Architecture: Uses wallet_transactions for tracking every credit and debit and balances for instant balance queries, ensuring performance and reliability.
Multi-Currency Support: Handle transactions in any currency (e.g., USD, EUR, GBP) with per-currency balance tracking.
Secure User Association: Links transactions and balances to users via user_id with foreign key constraints for data integrity.
Flexible Transactions: Supports credits, debits with optional fees, references, and descriptions for detailed transaction records.
Integrity Verification: Includes an Artisan command (saksh-wallet:verify) to check balance consistency against transaction history.
Comprehensive Tests: Comes with PHPUnit tests to ensure reliability and ease of contribution.
Open-Source Ready: Includes .gitignore, .gitattributes, CONTRIBUTING.md, and CHANGELOG.md for a complete package.

Whether you’re managing in-game currencies, processing payments, or tracking user funds, Saksh Wallet provides the tools you need with minimal setup.

Why Choose Saksh Wallet?

There are several wallet packages for Laravel, like bavix/laravel-wallet, but Saksh Wallet stands out for its simplicity and focus on core functionality. Here’s why it’s worth considering:

Lightweight: Minimal dependencies and a clean codebase make it easy to integrate and maintain.
Performant: The balances table ensures O(1) balance queries, ideal for high-traffic applications.
Developer-Friendly: Intuitive methods like addFunds, deductFunds, and getBalance make development a breeze.
Extensible: Built with Laravel conventions, it’s easy to extend for custom features like transaction reversals or payment gateway integration.
Open-Source: Licensed under MIT, it’s free to use and welcomes contributions from the community.

Installation

Getting started with Saksh Wallet is quick and easy. Follow these steps to add it to your Laravel 12 project:

Install via Composer:

   composer require sakshsky/saksh-wallet

Publish Migrations: The package includes a single migration to create the wallet_transactions and balances tables:

   php artisan vendor:publish --tag=saksh-wallet-migrations

Run Migrations: Apply the migrations to set up the database schema:

   php artisan migrate

That’s it! Your Laravel application is now ready to manage wallets.

Note: Ensure your users table exists (standard in Laravel) and contains at least one user, as the package uses user_id with foreign key constraints.

Usage

Saksh Wallet provides a simple API for managing wallet operations. Here’s how you can use it in your Laravel application:

Example: Controller Setup

Create a controller to handle wallet operations:

<?php

namespace App\Http\Controllers;

use Saksh\Wallet\Services\SakshWallet;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class WalletController extends Controller
{
    protected $wallet;

    public function __construct(SakshWallet $wallet)
    {
        $this->wallet = $wallet;
    }

    public function manageWallet(Request $request)
    {
        try {
            $userId = Auth::id();
            if (!$userId) {
                return response()->json(['error' => 'User not authenticated'], 401);
            }

            // Credit 500 USD
            $creditResult = $this->wallet->addFunds(
                $userId,
                500,
                'USD',
                'ref123',
                'Salary payment'
            );

            // Debit 200 USD with a 5 USD fee
            $debitResult = $this->wallet->deductFunds(
                $userId,
                200,
                'USD',
                'ref124',
                'Grocery shopping',
                5
            );

            // Get balance for USD
            $balance = $this->wallet->getBalance($userId, 'USD');

            // Get balance summary across all currencies
            $summary = $this->wallet->sakshGetBalanceSummary($userId);

            return response()->json([
                'credit' => $creditResult,
                'debit' => $debitResult,
                'balance' => $balance,
                'summary' => $summary,
            ]);
        } catch (\Exception $e) {
            return response()->json(['error' => $e->getMessage()], 400);
        }
    }
}

Define Routes

Add a route to access the wallet functionality (e.g., in routes/api.php):

use App\Http\Controllers\WalletController;

Route::get('/wallet', [WalletController::class, 'manageWallet'])->middleware('auth')->name('wallet.manage');

Example Output

Visiting /wallet (with an authenticated user) might return:

{
    "credit": "Credited 500 USD. New balance is 500",
    "debit": "Debited 200 USD. New balance is 295",
    "balance": {
        "user_id": 1,
        "currency": "USD",
        "balance": 295
    },
    "summary": {
        "user_id": 1,
        "balance": {
            "USD": 295
        }
    }
}

Verify Wallet Integrity

Run the included Artisan command to ensure balances match transaction history:

php artisan saksh-wallet:verify

This command checks for discrepancies and is useful for debugging or auditing.

Use Cases

Saksh Wallet is versatile and can be used in various scenarios:

E-commerce: Allow customers to maintain a wallet for quick checkouts or refunds.
Freelance Platforms: Manage payments to freelancers with platform fees.
Gaming Apps: Handle in-game currencies for purchases or rewards.
Financial Apps: Track user funds for budgeting or investment platforms.

The package’s multi-currency support makes it ideal for global applications, while its simple API ensures developers can integrate it quickly.

How Solidity Gas Saver Reduces Your Ethereum Costs 🚀

susheel kumar — Wed, 02 Apr 2025 08:26:03 +0000

Introduction

Gas fees are one of the biggest challenges for Ethereum developers. Every transaction consumes gas, and inefficient smart contracts can result in unnecessarily high fees. To solve this, I’ve built Solidity Gas Saver, an npm package that provides optimized Solidity contracts to help reduce gas costs while maintaining functionality.

Why Gas Optimization Matters

Ethereum operates on a gas-based fee model, where every computation, storage operation, and transaction costs gas. Optimizing Solidity code can:

Reduce contract execution costs
Lower user fees for dApps
Improve transaction speeds by minimizing computational overhead

How Solidity Gas Saver Works

The Solidity Gas Saver package includes several powerful contracts and libraries:

1️⃣ GasEfficientMath

This library optimizes arithmetic operations by utilizing unchecked Solidity blocks, reducing gas costs for operations like multiplication and addition.

uint256 result = GasEfficientMath.mul(5, 10); // More efficient than default Solidity math

2️⃣ BatchExecutor

BatchExecutor allows multiple contract calls to be executed in a single transaction, reducing redundant gas costs.

batchExecutor.execute([call1, call2, call3]);

3️⃣ GasOptimizedTokenTransfer

Token transfers can be optimized by reducing redundant operations, making ERC-20 transactions cheaper.

token.transferOptimized(recipient, amount);

How to Use Solidity Gas Saver

Install the Package

npm install solidity-gas-saver

Import and Use in Your Smart Contracts

import "solidity-gas-saver/contracts/GasEfficientMath.sol";

Deploy Optimized Contracts

npx hardhat run scripts/deploy.js --network goerli

Who Can Benefit?

DeFi Developers building gas-efficient protocols
dApp Creators looking to minimize costs for users
Smart Contract Developers who want optimized Solidity functions

Conclusion

The Solidity Gas Saver package is designed to help developers write more efficient smart contracts, reducing gas fees and improving overall performance. 🚀

👉 Try it now: Solidity Gas Saver on npm