@bi-analytics/arness-back 0.0.0-stage → 0.3.0

package/harness/skills/nest-base/templates/security/security-headers.spec.ts

@@ -0,0 +1,27 @@
+// Plantilla del harness → src/common/security/security-headers.spec.ts
+import express from 'express';
+import request from 'supertest';
+import { API_SECURITY_HEADERS, securityHeaders } from './security-headers';
+
+describe('securityHeaders', () => {
+  const app = express();
+  app.use(securityHeaders());
+  app.get('/api/v1/ping', (_req, res) => {
+    res.json({ data: 'pong' });
+  });
+
+  it('sends every security header and hides X-Powered-By', async () => {
+    const res = await request(app).get('/api/v1/ping');
+    expect(res.status).toBe(200);
+    for (const [name, value] of Object.entries(API_SECURITY_HEADERS)) {
+      expect(res.headers[name.toLowerCase()]).toBe(value);
+    }
+    expect(res.headers['x-powered-by']).toBeUndefined();
+  });
+
+  it('also covers responses that are not handled by a route', async () => {
+    const res = await request(app).get('/missing');
+    expect(res.status).toBe(404);
+    expect(res.headers['x-frame-options']).toBe('DENY');
+  });
+});

package/harness/skills/nest-base/templates/security/security-headers.ts

@@ -0,0 +1,21 @@
+// Plantilla del harness → src/common/security/security-headers.ts (AGENTS.md §9, contrato-http.md "Cabeceras de seguridad").
+// Security headers for every response, without helmet. The monitor overwrites the CSP with its own.
+import type { NextFunction, Request, Response } from 'express';
+
+export const API_SECURITY_HEADERS: Readonly<Record<string, string>> = Object.freeze({
+  'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'; base-uri 'none'",
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Referrer-Policy': 'no-referrer',
+  'Strict-Transport-Security': 'max-age=31536000',
+  'Cache-Control': 'no-store',
+});
+
+/** Express middleware: app.use(securityHeaders()) in src/main.ts, before any route. */
+export function securityHeaders(): (req: Request, res: Response, next: NextFunction) => void {
+  return (_req, res, next) => {
+    res.removeHeader('X-Powered-By');
+    res.set(API_SECURITY_HEADERS);
+    next();
+  };
+}

package/harness/skills/nest-base/templates/security/security.module.ts

@@ -0,0 +1,20 @@
+// Plantilla del harness → src/common/security/security.module.ts
+// Global: AuthController and MonitorController inject the same LoginAttemptLimiter.
+import { Global, Module } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import type { AppConfig } from '../../config/configuration';
+import { LoginAttemptLimiter } from './login-attempts';
+
+@Global()
+@Module({
+  providers: [
+    {
+      provide: LoginAttemptLimiter,
+      useFactory: (config: ConfigService<AppConfig, true>): LoginAttemptLimiter =>
+        new LoginAttemptLimiter(config.get('auth.login', { infer: true })),
+      inject: [ConfigService],
+    },
+  ],
+  exports: [LoginAttemptLimiter],
+})
+export class SecurityModule {}

package/harness/skills/nest-base/templates/security/session-lifetime.spec.ts

@@ -0,0 +1,21 @@
+// Plantilla del harness → src/common/security/session-lifetime.spec.ts
+import { AUTH_TIME_CLAIM, isSessionExpired, nowInSeconds, sessionClaims } from './session-lifetime';
+
+describe('session lifetime', () => {
+  const maxAge = 3600;
+
+  it('keeps the session alive until it reaches the max age', () => {
+    const claims = sessionClaims(1000);
+    expect(claims).toEqual({ [AUTH_TIME_CLAIM]: 1000 });
+    expect(isSessionExpired(claims, maxAge, 1000 + maxAge - 1)).toBe(false);
+    expect(isSessionExpired(claims, maxAge, 1000 + maxAge)).toBe(true);
+  });
+
+  it('treats tokens without auth_time as expired', () => {
+    expect(isSessionExpired({}, maxAge, 1000)).toBe(true);
+  });
+
+  it('converts milliseconds to JWT seconds', () => {
+    expect(nowInSeconds(1_700_000_000_999)).toBe(1_700_000_000);
+  });
+});

package/harness/skills/nest-base/templates/security/session-lifetime.ts

@@ -0,0 +1,28 @@
+// Plantilla del harness → src/common/security/session-lifetime.ts (AGENTS.md §8, contrato-http.md "Autenticación").
+// A session starts at /auth/login and lasts at most AUTH_SESSION_MAX_AGE_SECONDS, however many
+// times it is refreshed: a stolen refresh token stops working when the session reaches that age.
+
+/** Claim with the login time (seconds since epoch). The refresh copies it into the new pair. */
+export const AUTH_TIME_CLAIM = 'auth_time';
+
+export interface SessionClaims {
+  [AUTH_TIME_CLAIM]?: number;
+}
+
+/** Current time in seconds, as JWT iat/exp. */
+export const nowInSeconds = (now: number = Date.now()): number => Math.floor(now / 1000);
+
+/** Claims for a new pair: login starts a session; refresh keeps the original auth_time. */
+export function sessionClaims(authTime: number): Required<SessionClaims> {
+  return { [AUTH_TIME_CLAIM]: authTime };
+}
+
+/** True if the refresh must be rejected with 401 SESSION_EXPIRED. Tokens without auth_time count as expired. */
+export function isSessionExpired(
+  claims: SessionClaims,
+  maxAgeSeconds: number,
+  now: number = nowInSeconds(),
+): boolean {
+  const authTime = claims[AUTH_TIME_CLAIM];
+  return typeof authTime !== 'number' || now - authTime >= maxAgeSeconds;
+}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@bi-analytics/arness-back",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.3.0",
+  "description": "Harness de agentes IA (Claude Code, Codex, Gemini CLI, Cursor) para backends NestJS de analítica",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bi-analytics-linktic/harness-back.git"
+  },
+  "type": "module",
+  "homepage": "https://github.com/bi-analytics-linktic/harness-back#readme",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "bin": {
+    "arness": "bin/arness.mjs"
+  },
+  "files": [
+    "bin/",
+    "harness/",
+    "!harness/progress.md",
+    "!harness/.arness.json",
+    "!harness/arness.config.json",
+    "!harness/.arness-backup/",
+    "!harness/decisiones/[0-9]*.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "harness",
+    "agents",
+    "claude-code",
+    "codex",
+    "nestjs"
+  ],
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "eslint": "^9.39.5"
+  },
+  "scripts": {
+    "test": "node --test",
+    "verify": "./harness/init.sh",
+    "pack:check": "pnpm pack --dry-run"
+  }
 }