Zero Trust Authentication — Auth Patterns for Zero Trust Security

// Continuous verification middleware
async function continuousVerification(req, res, next) {
  // Verify device posture
  const deviceToken = req.headers['x-device-token'];
  if (deviceToken) {
    const deviceStatus = await deviceService.checkPosture(deviceToken);
    if (!deviceStatus.healthy) {
      return res.status(403).json({
        error: 'device_not_healthy',
        reasons: deviceStatus.issues
      });
    }
    req.device = deviceStatus;
  }

  // Verify location
  const geo = req.geo;
  const user = req.user;
  if (geo && user.allowedRegions && !user.allowedRegions.includes(geo.region)) {
    return res.status(403).json({ error: 'access_denied_region' });
  }

  // Just-in-time access elevation
  req.jitElevation = {
    requestedAt: Date.now(),
    duration: 300000, // 5 minutes
    scope: req.route?.path?.includes('admin') ? ['admin:access'] : []
  };

  // Log access decision
  await auditService.logAccess({
    user: req.user.sub,
    resource: req.path,
    action: req.method,
    device: req.device?.id,
    location: geo?.country,
    allowed: true,
    timestamp: new Date().toISOString()
  });

  next();
}

// Micro-perimeter security
app.use('/api/internal', authenticate({ required: true, mfaRequired: true }));
app.use('/api/internal', networkPolicy({ allow: ['10.0.0.0/8', '172.16.0.0/12'] }));