@accounter/scraper-app 0.0.1

package/src/server/validate-payload.ts

@@ -0,0 +1,74 @@
+import { z, ZodError } from 'zod';
+import type { IsracardCardsTransactionsList } from '@accounter/modern-poalim-scraper';
+import { AmexPayloadSchema } from './payload-schemas/amex.schema.js';
+import { CalPayloadSchema } from './payload-schemas/cal.schema.js';
+import type { CalPayload } from './payload-schemas/cal.schema.js';
+import { CurrencyRatesPayloadSchema } from './payload-schemas/currency-rates.schema.js';
+import type { CurrencyRatesPayload } from './payload-schemas/currency-rates.schema.js';
+import { DiscountPayloadSchema } from './payload-schemas/discount.schema.js';
+import type { DiscountPayload } from './payload-schemas/discount.schema.js';
+import { IsracardPayloadSchema } from './payload-schemas/isracard.schema.js';
+import { MaxPayloadSchema } from './payload-schemas/max.schema.js';
+import type { MaxPayload } from './payload-schemas/max.schema.js';
+import { PoalimForeignPayloadSchema } from './payload-schemas/poalim-foreign.schema.js';
+import type { PoalimForeignPayload } from './payload-schemas/poalim-foreign.schema.js';
+import { PoalimIlsPayloadSchema } from './payload-schemas/poalim-ils.schema.js';
+import type { PoalimIlsPayload } from './payload-schemas/poalim-ils.schema.js';
+import { PoalimSwiftPayloadSchema } from './payload-schemas/poalim-swift.schema.js';
+import type { PoalimSwiftPayload } from './payload-schemas/poalim-swift.schema.js';
+
+export type PayloadType =
+  | 'poalim-ils'
+  | 'poalim-foreign'
+  | 'poalim-swift'
+  | 'isracard'
+  | 'amex'
+  | 'cal'
+  | 'discount'
+  | 'max'
+  | 'currency-rates';
+
+type PayloadMap = {
+  'poalim-ils': PoalimIlsPayload;
+  'poalim-foreign': PoalimForeignPayload;
+  'poalim-swift': PoalimSwiftPayload;
+  isracard: IsracardCardsTransactionsList;
+  amex: IsracardCardsTransactionsList;
+  cal: CalPayload;
+  discount: DiscountPayload;
+  max: MaxPayload;
+  'currency-rates': CurrencyRatesPayload;
+};
+
+export class PayloadValidationError extends Error {
+  constructor(
+    public readonly payloadType: PayloadType,
+    public readonly zodError: ZodError,
+  ) {
+    super(`[${payloadType}] payload validation failed: ${zodError.message}`);
+    this.name = 'PayloadValidationError';
+    this.cause = zodError;
+  }
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const schemas: Record<PayloadType, z.ZodType<any>> = {
+  'poalim-ils': PoalimIlsPayloadSchema,
+  'poalim-foreign': PoalimForeignPayloadSchema,
+  'poalim-swift': PoalimSwiftPayloadSchema,
+  isracard: IsracardPayloadSchema,
+  amex: AmexPayloadSchema,
+  cal: CalPayloadSchema,
+  discount: DiscountPayloadSchema,
+  max: MaxPayloadSchema,
+  'currency-rates': CurrencyRatesPayloadSchema,
+};
+
+export function validatePayload<T extends PayloadType>(type: T, raw: unknown): PayloadMap[T] {
+  const schema = schemas[type];
+  const result = schema.safeParse(raw);
+  if (!result.success) {
+    throw new PayloadValidationError(type, result.error);
+  }
+  return result.data as PayloadMap[T];
+}

package/src/server/vault-routes.ts

@@ -0,0 +1,99 @@
+import type { FastifyInstance } from 'fastify';
+import { registerAccountsRoutes } from './accounts-routes.js';
+import { registerSettingsRoutes } from './settings-routes.js';
+import { registerSourcesRoutes } from './sources-routes.js';
+import { getVault, hasVaultFile, isLocked, lockVault, unlockVault } from './vault-store.js';
+import { defaultVault, getVaultPath, saveVaultFile } from './vault.js';
+
+type UnlockBody = { password: string };
+type CreateBody = { password: string; serverUrl: string; apiKey: string };
+
+export async function registerVaultRoutes(app: FastifyInstance): Promise<void> {
+  app.get('/api/vault/status', async () => ({
+    locked: isLocked(),
+    hasFile: await hasVaultFile(),
+  }));
+
+  app.post<{ Body: UnlockBody }>(
+    '/api/vault/unlock',
+    {
+      schema: {
+        body: {
+          type: 'object',
+          required: ['password'],
+          properties: { password: { type: 'string' } },
+        },
+      },
+    },
+    async (req, reply) => {
+      const result = await unlockVault(req.body.password);
+      if (result === 'ok') return { ok: true };
+      const status = result === 'not-found' ? 404 : 401;
+      return reply.status(status).send({ error: result });
+    },
+  );
+
+  app.post<{ Body: CreateBody }>(
+    '/api/vault/create',
+    {
+      schema: {
+        body: {
+          type: 'object',
+          required: ['password', 'serverUrl', 'apiKey'],
+          properties: {
+            password: { type: 'string' },
+            serverUrl: { type: 'string' },
+            apiKey: { type: 'string' },
+          },
+        },
+      },
+    },
+    async (req, reply) => {
+      if (await hasVaultFile()) return reply.status(409).send({ error: 'vault-already-exists' });
+      const { password, serverUrl, apiKey } = req.body;
+      lockVault();
+      const vault = defaultVault();
+      vault.settings.serverUrl = serverUrl;
+      vault.settings.apiKey = apiKey;
+      await saveVaultFile(getVaultPath(), vault, password);
+      const result = await unlockVault(password);
+      if (result !== 'ok') return reply.status(500).send({ error: result });
+      return reply.status(201).send({ ok: true });
+    },
+  );
+
+  app.get('/api/vault/path', async (_req, reply) => {
+    if (isLocked()) return reply.status(401).send({ error: 'vault-locked' });
+    return { path: getVaultPath() };
+  });
+
+  app.get('/api/vault/test-connection', async (_req, reply) => {
+    if (isLocked()) return reply.status(401).send({ error: 'vault-locked' });
+    const { serverUrl, apiKey } = getVault().settings;
+    if (!serverUrl || !apiKey) {
+      return reply.status(400).send({ error: 'Server URL and API key are not configured' });
+    }
+    const t0 = Date.now();
+    try {
+      const res = await fetch(serverUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({ query: '{ __typename }' }),
+        signal: AbortSignal.timeout(10_000),
+      });
+      const latencyMs = Date.now() - t0;
+      if (!res.ok) {
+        const text = await res.text().catch(() => res.statusText);
+        return { ok: false, error: `HTTP ${res.status}: ${text}`, latencyMs };
+      }
+      return { ok: true, latencyMs };
+    } catch (err) {
+      const latencyMs = Date.now() - t0;
+      return { ok: false, error: err instanceof Error ? err.message : String(err), latencyMs };
+    }
+  });
+
+  await registerSourcesRoutes(app);
+  await registerSettingsRoutes(app);
+  await registerAccountsRoutes(app);
+}

package/src/server/vault-store.ts

@@ -0,0 +1,42 @@
+import { access } from 'node:fs/promises';
+import { getVaultPath, loadVaultFile, saveVaultFile, type Vault } from './vault.js';
+
+let _vault: Vault | null = null;
+let _password: string | null = null;
+
+export async function hasVaultFile(): Promise<boolean> {
+  return access(getVaultPath())
+    .then(() => true)
+    .catch(() => false);
+}
+
+export async function unlockVault(
+  password: string,
+): Promise<'ok' | 'wrong-password' | 'not-found'> {
+  if (!(await hasVaultFile())) return 'not-found';
+  const vault = await loadVaultFile(getVaultPath(), password);
+  if (vault === null) return 'wrong-password';
+  _vault = vault;
+  _password = password;
+  return 'ok';
+}
+
+export function getVault(): Vault {
+  if (_vault === null) throw new Error('Vault is locked');
+  return _vault;
+}
+
+export async function updateVault(fn: (v: Vault) => Vault): Promise<void> {
+  if (_vault === null || _password === null) throw new Error('Vault is locked');
+  _vault = fn(_vault);
+  await saveVaultFile(getVaultPath(), _vault, _password);
+}
+
+export function isLocked(): boolean {
+  return _vault === null;
+}
+
+export function lockVault(): void {
+  _vault = null;
+  _password = null;
+}

package/src/server/vault.ts

@@ -0,0 +1,216 @@
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from 'node:crypto';
+import { readFile, writeFile } from 'node:fs/promises';
+import { z, ZodError } from 'zod';
+
+export function getVaultPath(): string {
+  return process.env['VAULT_PATH'] ?? '.vault';
+}
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LEN = 32;
+const SALT_LEN = 32;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+
+// Scrypt cost parameters stored in the blob header so decryption is independent
+// of whatever the current code constant says (enables future param upgrades).
+const SCRYPT_N = 65_536;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+// Node default maxmem is 32 MB; N=65536 r=8 requires ~64 MB. Compute with 2× headroom.
+const SCRYPT_MAXMEM = 128 * SCRYPT_N * SCRYPT_R * 2;
+// Blob header: N as uint32BE (4 bytes) + r as uint8 (1 byte) + p as uint8 (1 byte)
+const HEADER_LEN = 6;
+
+export const PoalimAccountSchema = z.object({
+  id: z.string(),
+  nickname: z.string().optional(),
+  userCode: z.string(),
+  password: z.string(),
+  options: z
+    .object({
+      isBusinessAccount: z.boolean().optional(),
+      acceptedAccountNumbers: z.array(z.string()).optional(),
+      acceptedBranchNumbers: z.array(z.string()).optional(),
+      ignoredAccountNumbers: z.array(z.string()).optional(),
+      ignoredBranchNumbers: z.array(z.string()).optional(),
+    })
+    .optional(),
+});
+
+export const DiscountAccountSchema = z.object({
+  id: z.string(),
+  ID: z.string(),
+  password: z.string(),
+  code: z.string().optional(),
+  nickname: z.string().optional(),
+});
+
+export const IsracardAmexAccountSchema = z.object({
+  id: z.string(),
+  nickname: z.string().optional(),
+  ownerId: z.string(),
+  password: z.string(),
+  last6Digits: z.string(),
+  options: z
+    .object({
+      acceptedCardNumbers: z.array(z.string()).optional(),
+      ignoredCardNumbers: z.array(z.string()).optional(),
+      cardNumberMapping: z.record(z.string(), z.string()).optional(),
+    })
+    .optional(),
+});
+
+export const CalAccountSchema = z.object({
+  id: z.string(),
+  nickname: z.string().optional(),
+  username: z.string(),
+  password: z.string(),
+  last4Digits: z.string(),
+  options: z
+    .object({
+      acceptedCardNumbers: z.array(z.string()).optional(),
+      ignoredCardNumbers: z.array(z.string()).optional(),
+    })
+    .optional(),
+});
+
+export const MaxAccountSchema = z.object({
+  id: z.string(),
+  nickname: z.string().optional(),
+  username: z.string(),
+  password: z.string(),
+  options: z
+    .object({
+      acceptedCardNumbers: z.array(z.string()).optional(),
+      ignoredCardNumbers: z.array(z.string()).optional(),
+    })
+    .optional(),
+});
+
+export const SettingsSchema = z.object({
+  showBrowser: z.boolean().default(false),
+  fetchBankOfIsraelRates: z.boolean().default(true),
+  concurrentScraping: z.boolean().default(false),
+  defaultDateRangeMonths: z.number().int().positive().default(3),
+  historyFilePath: z.string().default('./history.json'),
+  saveHistory: z.boolean().default(true),
+  serverUrl: z.string().optional(),
+  apiKey: z.string().optional(),
+});
+
+export type Settings = z.infer<typeof SettingsSchema>;
+
+export const AccountRecordSchema = z.object({
+  id: z.string(),
+  sourceId: z.string(),
+  sourceType: z.enum(['poalim', 'discount', 'isracard', 'amex', 'cal', 'max']),
+  accountNumber: z.string(),
+  branchNumber: z.string().optional(),
+  status: z.enum(['accepted', 'ignored', 'pending']).default('pending'),
+});
+
+export type AccountRecord = z.infer<typeof AccountRecordSchema>;
+
+export const VaultSchema = z.object({
+  poalimAccounts: z.array(PoalimAccountSchema).default([]),
+  discountAccounts: z.array(DiscountAccountSchema).default([]),
+  isracardAccounts: z.array(IsracardAmexAccountSchema).default([]),
+  amexAccounts: z.array(IsracardAmexAccountSchema).default([]),
+  calAccounts: z.array(CalAccountSchema).default([]),
+  maxAccounts: z.array(MaxAccountSchema).default([]),
+  accountRecords: z.array(AccountRecordSchema).default([]),
+  settings: SettingsSchema.default({
+    showBrowser: false,
+    fetchBankOfIsraelRates: true,
+    concurrentScraping: false,
+    defaultDateRangeMonths: 3,
+    historyFilePath: './history.json',
+    saveHistory: true,
+  }),
+});
+
+export type Vault = z.infer<typeof VaultSchema>;
+
+function deriveKey(
+  password: string,
+  salt: Buffer,
+  options: { N: number; r: number; p: number; maxmem: number },
+): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, KEY_LEN, options, (err, key) => {
+      if (err) reject(err);
+      else resolve(key);
+    });
+  });
+}
+
+export async function encryptVault(vault: Vault, password: string): Promise<string> {
+  const salt = randomBytes(SALT_LEN);
+  const iv = randomBytes(IV_LEN);
+  const key = await deriveKey(password, salt, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: SCRYPT_MAXMEM,
+  });
+
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(vault), 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  const header = Buffer.alloc(HEADER_LEN);
+  header.writeUInt32BE(SCRYPT_N, 0);
+  header.writeUInt8(SCRYPT_R, 4);
+  header.writeUInt8(SCRYPT_P, 5);
+
+  // Layout: [N(4)] [r(1)] [p(1)] [salt(32)] [iv(12)] [authTag(16)] [ciphertext]
+  return Buffer.concat([header, salt, iv, authTag, encrypted]).toString('base64');
+}
+
+export async function decryptVault(blob: string, password: string): Promise<Vault | null> {
+  try {
+    const buf = Buffer.from(blob, 'base64');
+    const N = buf.readUInt32BE(0);
+    const r = buf.readUInt8(4);
+    const p = buf.readUInt8(5);
+
+    const salt = buf.subarray(HEADER_LEN, HEADER_LEN + SALT_LEN);
+    const iv = buf.subarray(HEADER_LEN + SALT_LEN, HEADER_LEN + SALT_LEN + IV_LEN);
+    const authTag = buf.subarray(
+      HEADER_LEN + SALT_LEN + IV_LEN,
+      HEADER_LEN + SALT_LEN + IV_LEN + TAG_LEN,
+    );
+    const body = buf.subarray(HEADER_LEN + SALT_LEN + IV_LEN + TAG_LEN);
+
+    const key = await deriveKey(password, salt, { N, r, p, maxmem: 128 * N * r * 2 });
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+
+    const plaintext = Buffer.concat([decipher.update(body), decipher.final()]).toString('utf8');
+    return VaultSchema.parse(JSON.parse(plaintext));
+  } catch (err) {
+    if (err instanceof ZodError) {
+      console.error('[vault] schema validation failed after decryption:', err.issues);
+    }
+    return null;
+  }
+}
+
+export function defaultVault(): Vault {
+  return VaultSchema.parse({ settings: {} });
+}
+
+export async function loadVaultFile(filePath: string, password: string): Promise<Vault | null> {
+  const blob = await readFile(filePath, 'utf8');
+  return decryptVault(blob.trim(), password);
+}
+
+export async function saveVaultFile(
+  filePath: string,
+  vault: Vault,
+  password: string,
+): Promise<void> {
+  const data = await encryptVault(vault, password);
+  await writeFile(filePath, data, 'utf8');
+}