@anomira/node-sdk 0.2.2 → 0.2.3

package/dist/index.js

@@ -620,7 +620,7 @@ function detectHoneypotType(path) {
 function generateHoneypotResponse(type, canaryToken, callbackBase, orgId) {
   switch (type) {
     case "env_file":
-      return makeEnvFile(canaryToken, callbackBase, orgId);
+      return makeEnvFile(canaryToken);
     case "aws_credentials":
       return makeAwsCredentials(canaryToken);
     case "git_config":
@@ -641,14 +641,16 @@ function generateHoneypotResponse(type, canaryToken, callbackBase, orgId) {
       return makeGeneric(canaryToken);
   }
 }
-function makeEnvFile(canaryToken, callbackBase, orgId) {
+function makeEnvFile(canaryToken, _callbackBase, _orgId) {
   const jwtSecret = genHex(32);
   const dbPassword = genAlphanumeric(20);
   const redisPassword = genAlphanumeric(16);
   const apiKey = genHex(32);
-  const webhookUrl = `${callbackBase}/v1/canary/${orgId}/${canaryToken}`;
   const dnsDb = `db.${canaryToken}.srv.anomira.io`;
   const dnsCache = `cache.${canaryToken}.srv.anomira.io`;
+  const dnsMonitoring = `hooks.monitoring.${canaryToken}.srv.anomira.io`;
+  const dnsAlerts = `hooks.alerts.${canaryToken}.srv.anomira.io`;
+  const dnsDeploy = `deploy.internal.${canaryToken}.srv.anomira.io`;
   const fakeJwt = generateCanaryJwt(canaryToken, jwtSecret);
   const body = `# Production Environment Configuration
 # Last updated: ${new Date(Date.now() - 7 * 864e5).toISOString().split("T")[0]}
@@ -679,9 +681,9 @@ AWS_REGION=eu-west-1
 AWS_S3_BUCKET=app-production-${genHex(4)}
 
 # \u2500\u2500 Monitoring / Webhooks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-MONITORING_WEBHOOK=${webhookUrl}
-ALERT_WEBHOOK=${webhookUrl}
-DEPLOY_HOOK=${callbackBase}/v1/canary/${orgId}/${canaryToken}
+MONITORING_WEBHOOK=https://${dnsMonitoring}/v1/events/ingest
+ALERT_WEBHOOK=https://${dnsAlerts}/services/${genHex(7).toUpperCase()}/notify
+DEPLOY_HOOK=https://${dnsDeploy}/hooks/deploy/${genHex(6)}
 
 # \u2500\u2500 External APIs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 INTERNAL_API_KEY=${apiKey}
@@ -1093,7 +1095,8 @@ function makeGeneric(canaryToken) {
 }
 function generateCanaryJwt(canaryToken, secret) {
   const now = Math.floor(Date.now() / 1e3);
-  const header = { alg: "HS256", typ: "JWT", kid: `canary-${canaryToken.slice(0, 12)}` };
+  const kid = `${canaryToken.slice(0, 8)}-${canaryToken.slice(8, 12)}-4${canaryToken.slice(13, 16)}-${canaryToken.slice(16, 20)}-${canaryToken.slice(20, 32)}`;
+  const header = { alg: "HS256", typ: "JWT", kid };
   const payload = {
     sub: "svc_internal_7482",
     name: "service-account",
@@ -1103,7 +1106,8 @@ function generateCanaryJwt(canaryToken, secret) {
     // issued 48h ago (realistic stale credential)
     exp: now - 86400,
     // expired 24h ago
-    jti: `canary-${canaryToken}`
+    jti: canaryToken
+    // raw hex — no "canary-" prefix to leak purpose
   };
   const h = Buffer.from(JSON.stringify(header)).toString("base64url");
   const p = Buffer.from(JSON.stringify(payload)).toString("base64url");
@@ -1765,6 +1769,12 @@ function defaultGetUserId(req) {
         );
         const jwtId = pickId(payload);
         if (jwtId) return jwtId;
+        for (const val of Object.values(payload)) {
+          if (val && typeof val === "object" && !Array.isArray(val)) {
+            const nested = pickId(val);
+            if (nested) return nested;
+          }
+        }
       }
     } catch {
     }
@@ -1787,15 +1797,21 @@ function normalizeIp(raw) {
 function defaultGetIp(req) {
   const r = req;
   const fwd = r["headers"];
-  const xff = fwd?.["x-forwarded-for"];
-  if (xff) {
-    const first = Array.isArray(xff) ? xff[0] : xff.split(",")[0];
-    if (first) return normalizeIp(first.trim());
+  function firstHdr(name) {
+    const v = fwd?.[name];
+    if (!v) return void 0;
+    const s = (Array.isArray(v) ? v[0] : v.split(",")[0])?.trim();
+    return s || void 0;
   }
-  const xri = fwd?.["x-real-ip"];
-  if (typeof xri === "string") return normalizeIp(xri.trim());
-  const socket = r["socket"];
-  return normalizeIp(socket?.remoteAddress ?? "0.0.0.0");
+  const ip = firstHdr("cf-connecting-ip") ?? // Cloudflare
+  firstHdr("true-client-ip") ?? // Cloudflare Enterprise / Akamai
+  firstHdr("x-forwarded-for") ?? // Nginx, AWS ALB, GCP LB, most proxies
+  firstHdr("x-real-ip") ?? // Nginx (single-IP alternative to XFF)
+  firstHdr("fastly-client-ip") ?? // Fastly CDN
+  firstHdr("x-client-ip") ?? // Generic reverse proxies
+  firstHdr("x-cluster-client-ip") ?? // Cluster / k8s ingress
+  r["socket"]?.remoteAddress ?? "0.0.0.0";
+  return normalizeIp(ip);
 }
 function sendFakeResponse(res, fakeResponse) {
   const allHeaders = {
@@ -1818,10 +1834,29 @@ function sendFakeResponse(res, fakeResponse) {
     res["end"](fakeResponse.body);
   }
 }
+function isLoopbackIp(ip) {
+  return ip === "127.0.0.1" || ip === "0.0.0.0" || ip === "::1";
+}
 function createExpressMiddleware(client) {
+  let ipCheckCount = 0;
+  let ipLoopCount = 0;
+  let ipWarnFired = false;
+  let userIdCheckCount = 0;
+  let userIdMissCount = 0;
+  let userIdWarnFired = false;
   return async function sentinelMiddleware(req, res, next) {
     const startMs = Date.now();
     const ip = client.config.getIp(req);
+    if (!ipWarnFired && ipCheckCount < 20) {
+      ipCheckCount++;
+      if (isLoopbackIp(ip)) ipLoopCount++;
+      if (ipCheckCount === 20 && ipLoopCount >= 16) {
+        ipWarnFired = true;
+        console.warn(
+          "[Anomira] WARNING: client IP not captured on 80%+ of requests.\n  Your app is likely behind a reverse proxy (Nginx, Cloudflare, AWS ALB)\n  that is not forwarding client IP headers. Alerts will have no IP attribution.\n\n  Nginx fix:   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n               proxy_set_header X-Real-IP         $remote_addr;\n  Express fix: app.set('trust proxy', 1);\n  Fastify fix: Fastify({ trustProxy: true })\n  Docs:        https://docs.anomira.io/sdk/ip-capture"
+        );
+      }
+    }
     if (client.isBlocked(ip)) {
       const method_ = req["method"]?.toUpperCase() ?? "GET";
       const url_ = req["originalUrl"] ?? req["url"] ?? "/";
@@ -1878,12 +1913,12 @@ function createExpressMiddleware(client) {
             const b64p = (parts[1] ?? "").replace(/-/g, "+").replace(/_/g, "/");
             const pay = JSON.parse(Buffer.from(b64p + "==", "base64").toString());
             const jti = pay["jti"] ?? "";
-            const kid = hdr["kid"] ?? "";
-            if (jti.startsWith("canary-") && client["canaryTokenCache"].has(jti.slice(7)) || kid.startsWith("canary-") && client["canaryTokenCache"].has(kid.slice(7))) {
+            const cache = client["canaryTokenCache"];
+            if (jti && cache.has(jti)) {
               client.track("http.canary.triggered", {
                 ip,
                 userId,
-                meta: { endpoint: url, method, token: jti.slice(7, 23), source: "canary_jwt" }
+                meta: { endpoint: url, method, token: jti.slice(0, 16), source: "canary_jwt" }
               });
             }
           }
@@ -1971,13 +2006,24 @@ function createExpressMiddleware(client) {
       }
     }
     const onFinish = () => {
+      const lateUserId = client.config.getUserId(req);
+      if (!userIdWarnFired && userIdCheckCount < 20) {
+        userIdCheckCount++;
+        if (!lateUserId) userIdMissCount++;
+        if (userIdCheckCount === 20 && userIdMissCount >= 18) {
+          userIdWarnFired = true;
+          console.warn(
+            "[Anomira] WARNING: userId not captured on 90%+ of requests.\n  EWS Evidence Package, geo-velocity, and account takeover detection\n  silently stop working without it. The SDK tried 5 auto-detection tiers\n  (Passport / express-jwt, req.auth, direct req.userId, session, JWT Bearer)\n  \u2014 none matched your auth setup.\n\n  Fix: pass a getUserId resolver that matches your auth middleware:\n  new Anomira({ ..., getUserId: (req) => req.user?.id })"
+          );
+        }
+      }
       const status = res["statusCode"] ?? 0;
       const latencyMs = Date.now() - startMs;
       const getHeader = res["getHeader"];
       const bytes = typeof getHeader === "function" ? parseInt(getHeader.call(res, "content-length") ?? "0", 10) || 0 : 0;
       client.track(EventName.REQUEST, {
         ip,
-        userId,
+        userId: lateUserId,
         meta: {
           method,
           endpoint: url,
@@ -1988,14 +2034,12 @@ function createExpressMiddleware(client) {
           _fp: fingerprint.score,
           _fpSig: fingerprint.signals.join(","),
           ...fingerprint.knownClient ? { _fpClient: fingerprint.knownClient } : {},
-          // HTTP/2 SETTINGS from client connection preface (when Node.js is TLS endpoint)
           ...h2settings ? {
             _h2Window: h2settings.initialWindowSize,
             _h2HdrTable: h2settings.headerTableSize,
             _h2Score: h2settings.score,
             _h2Signals: h2settings.signals.join(",")
           } : {},
-          // JA3/JA4 from upstream proxy (Nginx with ngx_ssl_fingerprint_module)
           ...upstreamTls.ja3 ? { _ja3: upstreamTls.ja3 } : {},
           ...upstreamTls.ja4 ? { _ja4: upstreamTls.ja4 } : {},
           ...agentInfo.isAgent ? {
@@ -2012,7 +2056,7 @@ function createExpressMiddleware(client) {
       if (agentInfo.isAgent) {
         client.track("http.agent_detected", {
           ip,
-          userId,
+          userId: lateUserId,
           meta: {
             endpoint: url,
             method,
@@ -2028,17 +2072,17 @@ function createExpressMiddleware(client) {
         });
       }
       if (client.config.detect.rateAbuse && status === 429) {
-        client.track(EventName.RATE_LIMIT, { ip, userId, meta: { url, method, statusCode: status } });
+        client.track(EventName.RATE_LIMIT, { ip, userId: lateUserId, meta: { url, method, statusCode: status } });
       }
       if (client.config.detect.bruteForce && status === 401) {
         if (/\/(login|signin|auth|token|session)/i.test(url)) {
-          client.track(EventName.LOGIN_FAILED, { ip, userId, meta: { url, method, statusCode: status } });
+          client.track(EventName.LOGIN_FAILED, { ip, userId: lateUserId, meta: { url, method, statusCode: status } });
         }
       }
       if (client.config.detect.scanDetection && status === 404) {
         const looksLikeScanner = !ua || /curl|wget|python|go-http|nuclei|sqlmap|nikto/i.test(ua);
         if (looksLikeScanner) {
-          client.track(EventName.SCAN_DETECTED, { ip, userId, meta: { url, method, userAgent: ua } });
+          client.track(EventName.SCAN_DETECTED, { ip, userId: lateUserId, meta: { url, method, userAgent: ua } });
         }
       }
       cleanup();
@@ -2051,9 +2095,25 @@ function createExpressMiddleware(client) {
   };
 }
 function createFastifyPlugin(client) {
+  let ipCheckCount = 0;
+  let ipLoopCount = 0;
+  let ipWarnFired = false;
+  let userIdCheckCount = 0;
+  let userIdMissCount = 0;
+  let userIdWarnFired = false;
   return async function sentinelFastifyPlugin(fastify) {
     fastify.addHook("onRequest", (req, reply) => {
       const ip = client.config.getIp(req);
+      if (!ipWarnFired && ipCheckCount < 20) {
+        ipCheckCount++;
+        if (isLoopbackIp(ip)) ipLoopCount++;
+        if (ipCheckCount === 20 && ipLoopCount >= 16) {
+          ipWarnFired = true;
+          console.warn(
+            "[Anomira] WARNING: client IP not captured on 80%+ of requests.\n  Your app is likely behind a reverse proxy (Nginx, Cloudflare, AWS ALB)\n  that is not forwarding client IP headers. Alerts will have no IP attribution.\n\n  Nginx fix:   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n               proxy_set_header X-Real-IP         $remote_addr;\n  Fastify fix: Fastify({ trustProxy: true })\n  Docs:        https://docs.anomira.io/sdk/ip-capture"
+          );
+        }
+      }
       const url_ = req["url"] ?? "/";
       const method_ = req["method"]?.toUpperCase() ?? "GET";
       const hdrs_ = req["headers"];
@@ -2125,6 +2185,16 @@ function createFastifyPlugin(client) {
       const method = req["method"]?.toUpperCase() ?? "GET";
       const userId = client.config.getUserId(req);
       const status = reply["statusCode"] ?? 0;
+      if (!userIdWarnFired && userIdCheckCount < 20) {
+        userIdCheckCount++;
+        if (!userId) userIdMissCount++;
+        if (userIdCheckCount === 20 && userIdMissCount >= 18) {
+          userIdWarnFired = true;
+          console.warn(
+            "[Anomira] WARNING: userId not captured on 90%+ of requests.\n  EWS Evidence Package, geo-velocity, and account takeover detection\n  silently stop working without it. The SDK tried 5 auto-detection tiers\n  (Passport / @fastify/jwt, req.auth, direct req.userId, session, JWT Bearer)\n  \u2014 none matched your auth setup.\n\n  Fix: pass a getUserId resolver that matches your auth middleware:\n  new Anomira({ ..., getUserId: (req) => (req as any).user?.id })"
+          );
+        }
+      }
       const headers = req["headers"];
       const ua = (typeof headers?.["user-agent"] === "string" ? headers["user-agent"] : "") ?? "";
       const latencyMs = reply["elapsedTime"] ?? 0;
@@ -2208,6 +2278,11 @@ function createExpressMiddleware2(client) {
     const ip = client.config.getIp(req);
     const userId = client.config.getUserId(req);
     const { method, originalUrl: url } = req;
+    if (client.isBlocked(ip)) {
+      client.reportBlockedHit(ip, { method, url, userAgent: req.headers["user-agent"] ?? "" });
+      res.status(403).json({ error: "Forbidden" });
+      return;
+    }
     if (client.config.detect.pathTraversal && (url.includes("../") || url.includes("..%2F"))) {
       client.track(EventName.PATH_TRAVERSAL, {
         ip,
@@ -2272,11 +2347,15 @@ function createExpressMiddleware2(client) {
 // src/middleware/fastify.ts
 function createFastifyPlugin2(client) {
   return async function sentinelPlugin(fastify) {
-    fastify.addHook("onRequest", async (req, _reply) => {
+    fastify.addHook("onRequest", async (req, reply) => {
       const ip = client.config.getIp(req);
       const userId = client.config.getUserId(req);
       const url = req.url;
       const method = req.method.toUpperCase();
+      if (client.isBlocked(ip)) {
+        client.reportBlockedHit(ip, { method, url, userAgent: req.headers["user-agent"] ?? "" });
+        return reply.code(403).send({ error: "Forbidden" });
+      }
       if (client.config.detect.pathTraversal && (url.includes("../") || url.includes("..%2F"))) {
         client.track(EventName.PATH_TRAVERSAL, { ip, userId, meta: { url, method } });
       }