@adaptic/backend-legacy 0.0.996 → 0.0.998

package/server.cjs

@@ -59,8 +59,11 @@ const body_parser_1 = __importDefault(require("body-parser"));
 const ws_1 = require("ws");
 const ws_2 = require("graphql-ws/lib/use/ws");
 const auth_1 = require("./middleware/auth.cjs");
+const rate_limiter_1 = require("./middleware/rate-limiter.cjs");
 const audit_logger_1 = require("./middleware/audit-logger.cjs");
 const tenancy_scoping_1 = require("./middleware/tenancy-scoping.cjs");
+const cortex_auth_checker_1 = require("./auth/cortex-auth-checker.cjs");
+const authorization_map_1 = require("./auth/authorization-map.cjs");
 const http_status_mapper_1 = require("./plugins/http-status-mapper.cjs");
 const graphql_validation_plugin_1 = require("./middleware/graphql-validation-plugin.cjs");
 const query_complexity_1 = require("./middleware/query-complexity.cjs");
@@ -100,7 +103,15 @@ function principalToUser(principal) {
             };
     }
 }
+/**
+ * Default number of proxy hops trusted for X-Forwarded-For resolution when
+ * `TRUST_PROXY` is unset. One hop matches a single fronting LB/ingress proxy;
+ * operators must set `TRUST_PROXY` to the exact hop count of their deployment
+ * (audit B01-backend-legacy-02 / -12).
+ */
+const DEFAULT_TRUST_PROXY_HOPS = 1;
 const startServer = async () => {
+    var _a;
     // Boot-time invariant: in production, `GOOGLE_OAUTH_CLIENT_IDS` must be set.
     // Without it, no Google ID token can be safely verified — and the verifier
     // would surface a per-request `misconfigured` error indefinitely. Refuse to
@@ -110,6 +121,21 @@ const startServer = async () => {
     // is on (defaults on in production/staging). Registers default Node.js metrics
     // and starts the uptime gauge ticker. See: src/config/metrics.ts.
     (0, metrics_1.initMetrics)();
+    // CORTEX-P0-001 phase 2 (audit B01-backend-legacy-03): decorate generated
+    // CRUD resolvers with @Authorized() — full coverage on the 5 investor-relations
+    // models, delete mutations elsewhere — so the authChecker below actually
+    // executes. Must run BEFORE buildSchema (decorators land in TypeGraphQL's
+    // metadata storage). The checker stays SHADOW-FIRST: would-denies are logged
+    // + counted but ALLOWED until CORTEX_AUTHCHECKER_ENFORCE is flipped on.
+    // The boot log satisfies audit B01-backend-legacy-07: a zero decorated-action
+    // count means the checker is unreachable and its metrics are meaningless.
+    const authzSummary = (0, authorization_map_1.applyCortexAuthorizationMap)();
+    logger_1.logger.info('[cortex-authz] applied @Authorized coverage (authChecker in shadow unless CORTEX_AUTHCHECKER_ENFORCE)', {
+        fullCoverageModels: authzSummary.fullCoverageModels,
+        deleteCoverageModels: authzSummary.deleteCoverageModels,
+        decoratedActions: authzSummary.decoratedActions,
+        skippedActions: authzSummary.skippedActions.length,
+    });
     const schema = await (0, type_graphql_1.buildSchema)({
         resolvers: [...typegraphql_prisma_1.resolvers, custom_1.OptionsGreeksHistoryCustomResolver],
         validate: false,
@@ -118,12 +144,42 @@ const startServer = async () => {
         // and unauthenticated callers are bypassed in every mode. Gated by
         // `TENANCY_SCOPING_MODE` (default `shadow`).
         globalMiddlewares: [(0, tenancy_scoping_1.createTenancyScopingMiddleware)()],
+        // Resolver-level authorization (CORTEX-P0-001). Invoked for the
+        // `@Authorized()`-decorated fields applied by applyCortexAuthorizationMap
+        // above. SHADOW-FIRST: while `CORTEX_AUTHCHECKER_ENFORCE` is OFF (default),
+        // it observes + counts would-deny operations but always allows —
+        // byte-identical live behaviour until enforcement is flipped on.
+        authChecker: cortex_auth_checker_1.cortexAuthChecker,
     });
     const app = (0, express_1.default)();
     const httpServer = (0, http_1.createServer)(app);
+    // Trust the load-balancer proxy chain so `req.ip` resolves the CLIENT address
+    // from X-Forwarded-For instead of the proxy hop (audit B01-backend-legacy-02).
+    // Without this, every external caller shares one rate-limit bucket per tier,
+    // invalidating the shadow signal and making any future enforce flip an outage
+    // switch for the whole /graphql surface. `TRUST_PROXY` accepts a hop count
+    // (recommended: the EXACT number of proxy hops, so a spoofed X-Forwarded-For
+    // cannot mint arbitrary identifiers — audit B01-backend-legacy-12) or an
+    // Express trust-proxy string (CIDR / preset). Defaults to 1 hop.
+    const rawTrustProxy = ((_a = process.env.TRUST_PROXY) !== null && _a !== void 0 ? _a : '').trim();
+    const trustProxy = rawTrustProxy === ''
+        ? DEFAULT_TRUST_PROXY_HOPS
+        : /^\d+$/.test(rawTrustProxy)
+            ? parseInt(rawTrustProxy, 10)
+            : rawTrustProxy;
+    app.set('trust proxy', trustProxy);
     // HTTP request metrics — must be mounted early to capture every request.
     // The middleware is a no-op when metrics are disabled.
     app.use(metrics_1.metricsMiddleware);
+    // Rate limiting (CORTEX-P0-001). SHADOW-FIRST: while `CORTEX_RATE_LIMIT_ENFORCE`
+    // is OFF (default), the limiters observe + count requests that WOULD be blocked
+    // but never touch the response, so live behaviour is byte-identical. The
+    // GraphQL limiter is mounted INSIDE the /graphql chain after cors() (see below)
+    // so an enforce-mode 429 carries CORS headers and browser clients can read the
+    // Retry-After instead of seeing an opaque CORS failure
+    // (audit B01-backend-legacy-11). Mounted before `/api` auth so limiting
+    // precedes the (more expensive) auth work.
+    app.use('/api', rate_limiter_1.authRateLimiter);
     app.use('/api', (req, res, next) => (0, auth_1.authMiddleware)(req, res, next));
     // APQ cache: in-memory LRU, gated by `APQ_ENABLED` (default on). The
     // Apollo Server option only accepts a value when a cache is provided;
@@ -242,7 +298,11 @@ const startServer = async () => {
         allowedHeaders: ['Content-Type', 'Authorization', 'X-Request-ID'],
         maxAge: 86400, // 24h preflight cache
     };
-    app.use('/graphql', (0, cors_1.default)(corsOptions), body_parser_1.default.json(), (0, express4_1.expressMiddleware)(server, {
+    app.use('/graphql', (0, cors_1.default)(corsOptions), 
+    // After cors() so enforce-mode 429s carry CORS headers; before body parsing
+    // so limiting stays cheap. OPTIONS preflights are skipped inside the
+    // limiter (audit B01-backend-legacy-11).
+    rate_limiter_1.graphqlRateLimiter, body_parser_1.default.json(), (0, express4_1.expressMiddleware)(server, {
         context: async ({ req }) => {
             // Ensure we're using the global prisma instance and never disconnecting it between requests
             if (!global.prisma) {