@ceon-oy/monitor-sdk 1.0.3 → 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +44 -43
- package/dist/index.mjs +44 -43
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -286,12 +286,12 @@ var MonitorClient = class {
|
|
|
286
286
|
/**
|
|
287
287
|
* Fetch with timeout to prevent hanging requests
|
|
288
288
|
*/
|
|
289
|
-
async fetchWithTimeout(url,
|
|
289
|
+
async fetchWithTimeout(url, options2, timeoutMs = this.requestTimeoutMs) {
|
|
290
290
|
const controller = new AbortController();
|
|
291
291
|
const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
|
|
292
292
|
try {
|
|
293
293
|
const response = await fetch(url, {
|
|
294
|
-
...
|
|
294
|
+
...options2,
|
|
295
295
|
signal: controller.signal
|
|
296
296
|
});
|
|
297
297
|
return response;
|
|
@@ -374,13 +374,13 @@ var MonitorClient = class {
|
|
|
374
374
|
try {
|
|
375
375
|
const fsModule = await import("fs");
|
|
376
376
|
const pathModule = await import("path");
|
|
377
|
-
const
|
|
378
|
-
const
|
|
377
|
+
const fs2 = fsModule.default || fsModule;
|
|
378
|
+
const path2 = pathModule.default || pathModule;
|
|
379
379
|
const baseDir = process.cwd();
|
|
380
|
-
const resolvedPath =
|
|
381
|
-
const normalizedPath =
|
|
382
|
-
const normalizedBase =
|
|
383
|
-
if (!
|
|
380
|
+
const resolvedPath = path2.isAbsolute(packagePath) ? packagePath : path2.join(baseDir, packagePath);
|
|
381
|
+
const normalizedPath = path2.normalize(resolvedPath);
|
|
382
|
+
const normalizedBase = path2.normalize(baseDir);
|
|
383
|
+
if (!path2.isAbsolute(packagePath)) {
|
|
384
384
|
if (!normalizedPath.startsWith(normalizedBase)) {
|
|
385
385
|
console.warn("[MonitorClient] Path traversal attempt blocked:", packagePath);
|
|
386
386
|
return [];
|
|
@@ -394,10 +394,10 @@ var MonitorClient = class {
|
|
|
394
394
|
console.warn("[MonitorClient] Path must point to package.json");
|
|
395
395
|
return [];
|
|
396
396
|
}
|
|
397
|
-
if (!
|
|
397
|
+
if (!fs2.existsSync(normalizedPath)) {
|
|
398
398
|
return [];
|
|
399
399
|
}
|
|
400
|
-
const packageJson = JSON.parse(
|
|
400
|
+
const packageJson = JSON.parse(fs2.readFileSync(normalizedPath, "utf-8"));
|
|
401
401
|
const technologies = [];
|
|
402
402
|
const deps = {
|
|
403
403
|
...packageJson.dependencies,
|
|
@@ -431,7 +431,7 @@ var MonitorClient = class {
|
|
|
431
431
|
async sendTechnologies(technologies) {
|
|
432
432
|
await this.sendTechnologiesWithEnvironment(technologies, this.environment);
|
|
433
433
|
}
|
|
434
|
-
async sendTechnologiesWithEnvironment(technologies,
|
|
434
|
+
async sendTechnologiesWithEnvironment(technologies, environment2) {
|
|
435
435
|
const response = await this.fetchWithTimeout(`${this.endpoint}/api/v1/technologies/sync`, {
|
|
436
436
|
method: "POST",
|
|
437
437
|
headers: {
|
|
@@ -439,7 +439,7 @@ var MonitorClient = class {
|
|
|
439
439
|
Authorization: `Bearer ${this.apiKey}`
|
|
440
440
|
},
|
|
441
441
|
body: JSON.stringify({
|
|
442
|
-
environment,
|
|
442
|
+
environment: environment2,
|
|
443
443
|
technologies
|
|
444
444
|
})
|
|
445
445
|
});
|
|
@@ -476,74 +476,74 @@ var MonitorClient = class {
|
|
|
476
476
|
/**
|
|
477
477
|
* Capture a login failure event (convenience method)
|
|
478
478
|
*/
|
|
479
|
-
async captureLoginFailure(
|
|
479
|
+
async captureLoginFailure(options2) {
|
|
480
480
|
return this.captureSecurityEvent({
|
|
481
|
-
eventType: `login_failed_${
|
|
481
|
+
eventType: `login_failed_${options2.authMethod || "other"}`,
|
|
482
482
|
category: "AUTHENTICATION",
|
|
483
483
|
severity: "MEDIUM",
|
|
484
|
-
ip:
|
|
485
|
-
identifier:
|
|
486
|
-
endpoint:
|
|
487
|
-
userAgent:
|
|
488
|
-
metadata: { reason:
|
|
484
|
+
ip: options2.ip,
|
|
485
|
+
identifier: options2.identifier,
|
|
486
|
+
endpoint: options2.endpoint,
|
|
487
|
+
userAgent: options2.userAgent,
|
|
488
|
+
metadata: { reason: options2.reason, authMethod: options2.authMethod }
|
|
489
489
|
});
|
|
490
490
|
}
|
|
491
491
|
/**
|
|
492
492
|
* Capture a successful login event
|
|
493
493
|
*/
|
|
494
|
-
async captureLoginSuccess(
|
|
494
|
+
async captureLoginSuccess(options2) {
|
|
495
495
|
await this.captureSecurityEvent({
|
|
496
|
-
eventType: `login_success_${
|
|
496
|
+
eventType: `login_success_${options2.authMethod || "other"}`,
|
|
497
497
|
category: "AUTHENTICATION",
|
|
498
498
|
severity: "LOW",
|
|
499
|
-
ip:
|
|
500
|
-
identifier:
|
|
501
|
-
endpoint:
|
|
502
|
-
userAgent:
|
|
503
|
-
metadata: { authMethod:
|
|
499
|
+
ip: options2.ip,
|
|
500
|
+
identifier: options2.identifier,
|
|
501
|
+
endpoint: options2.endpoint,
|
|
502
|
+
userAgent: options2.userAgent,
|
|
503
|
+
metadata: { authMethod: options2.authMethod }
|
|
504
504
|
});
|
|
505
505
|
}
|
|
506
506
|
/**
|
|
507
507
|
* Capture a rate limit event
|
|
508
508
|
*/
|
|
509
|
-
async captureRateLimit(
|
|
509
|
+
async captureRateLimit(options2) {
|
|
510
510
|
await this.captureSecurityEvent({
|
|
511
511
|
eventType: "rate_limit_exceeded",
|
|
512
512
|
category: "RATE_LIMIT",
|
|
513
513
|
severity: "MEDIUM",
|
|
514
|
-
ip:
|
|
515
|
-
identifier:
|
|
516
|
-
endpoint:
|
|
517
|
-
userAgent:
|
|
518
|
-
metadata: { limit:
|
|
514
|
+
ip: options2.ip,
|
|
515
|
+
identifier: options2.identifier,
|
|
516
|
+
endpoint: options2.endpoint,
|
|
517
|
+
userAgent: options2.userAgent,
|
|
518
|
+
metadata: { limit: options2.limit, window: options2.window }
|
|
519
519
|
});
|
|
520
520
|
}
|
|
521
521
|
/**
|
|
522
522
|
* Capture an authorization failure (user tried to access unauthorized resource)
|
|
523
523
|
*/
|
|
524
|
-
async captureAuthorizationFailure(
|
|
524
|
+
async captureAuthorizationFailure(options2) {
|
|
525
525
|
await this.captureSecurityEvent({
|
|
526
526
|
eventType: "authorization_denied",
|
|
527
527
|
category: "AUTHORIZATION",
|
|
528
528
|
severity: "MEDIUM",
|
|
529
|
-
ip:
|
|
530
|
-
identifier:
|
|
531
|
-
endpoint:
|
|
532
|
-
userAgent:
|
|
533
|
-
metadata: { resource:
|
|
529
|
+
ip: options2.ip,
|
|
530
|
+
identifier: options2.identifier,
|
|
531
|
+
endpoint: options2.endpoint,
|
|
532
|
+
userAgent: options2.userAgent,
|
|
533
|
+
metadata: { resource: options2.resource, action: options2.action }
|
|
534
534
|
});
|
|
535
535
|
}
|
|
536
536
|
/**
|
|
537
537
|
* Check if an IP or identifier has triggered brute force detection
|
|
538
538
|
*/
|
|
539
|
-
async checkBruteForce(
|
|
539
|
+
async checkBruteForce(options2) {
|
|
540
540
|
const response = await this.fetchWithTimeout(`${this.endpoint}/api/v1/security/detect/brute-force`, {
|
|
541
541
|
method: "POST",
|
|
542
542
|
headers: {
|
|
543
543
|
"Content-Type": "application/json",
|
|
544
544
|
Authorization: `Bearer ${this.apiKey}`
|
|
545
545
|
},
|
|
546
|
-
body: JSON.stringify(
|
|
546
|
+
body: JSON.stringify(options2)
|
|
547
547
|
});
|
|
548
548
|
if (!response.ok) {
|
|
549
549
|
const errorText = await response.text().catch(() => "");
|
|
@@ -569,9 +569,10 @@ var MonitorClient = class {
|
|
|
569
569
|
let path;
|
|
570
570
|
let fs;
|
|
571
571
|
try {
|
|
572
|
-
|
|
573
|
-
|
|
574
|
-
|
|
572
|
+
const _require = typeof globalThis.__webpack_require__ === "function" ? eval("require") : require;
|
|
573
|
+
execSync = _require("child_process").execSync;
|
|
574
|
+
path = _require("path");
|
|
575
|
+
fs = _require("fs");
|
|
575
576
|
} catch {
|
|
576
577
|
console.warn("[MonitorClient] auditDependencies requires Node.js (not available in bundled/browser environments)");
|
|
577
578
|
return null;
|
package/dist/index.mjs
CHANGED
|
@@ -257,12 +257,12 @@ var MonitorClient = class {
|
|
|
257
257
|
/**
|
|
258
258
|
* Fetch with timeout to prevent hanging requests
|
|
259
259
|
*/
|
|
260
|
-
async fetchWithTimeout(url,
|
|
260
|
+
async fetchWithTimeout(url, options2, timeoutMs = this.requestTimeoutMs) {
|
|
261
261
|
const controller = new AbortController();
|
|
262
262
|
const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
|
|
263
263
|
try {
|
|
264
264
|
const response = await fetch(url, {
|
|
265
|
-
...
|
|
265
|
+
...options2,
|
|
266
266
|
signal: controller.signal
|
|
267
267
|
});
|
|
268
268
|
return response;
|
|
@@ -345,13 +345,13 @@ var MonitorClient = class {
|
|
|
345
345
|
try {
|
|
346
346
|
const fsModule = await import("fs");
|
|
347
347
|
const pathModule = await import("path");
|
|
348
|
-
const
|
|
349
|
-
const
|
|
348
|
+
const fs2 = fsModule.default || fsModule;
|
|
349
|
+
const path2 = pathModule.default || pathModule;
|
|
350
350
|
const baseDir = process.cwd();
|
|
351
|
-
const resolvedPath =
|
|
352
|
-
const normalizedPath =
|
|
353
|
-
const normalizedBase =
|
|
354
|
-
if (!
|
|
351
|
+
const resolvedPath = path2.isAbsolute(packagePath) ? packagePath : path2.join(baseDir, packagePath);
|
|
352
|
+
const normalizedPath = path2.normalize(resolvedPath);
|
|
353
|
+
const normalizedBase = path2.normalize(baseDir);
|
|
354
|
+
if (!path2.isAbsolute(packagePath)) {
|
|
355
355
|
if (!normalizedPath.startsWith(normalizedBase)) {
|
|
356
356
|
console.warn("[MonitorClient] Path traversal attempt blocked:", packagePath);
|
|
357
357
|
return [];
|
|
@@ -365,10 +365,10 @@ var MonitorClient = class {
|
|
|
365
365
|
console.warn("[MonitorClient] Path must point to package.json");
|
|
366
366
|
return [];
|
|
367
367
|
}
|
|
368
|
-
if (!
|
|
368
|
+
if (!fs2.existsSync(normalizedPath)) {
|
|
369
369
|
return [];
|
|
370
370
|
}
|
|
371
|
-
const packageJson = JSON.parse(
|
|
371
|
+
const packageJson = JSON.parse(fs2.readFileSync(normalizedPath, "utf-8"));
|
|
372
372
|
const technologies = [];
|
|
373
373
|
const deps = {
|
|
374
374
|
...packageJson.dependencies,
|
|
@@ -402,7 +402,7 @@ var MonitorClient = class {
|
|
|
402
402
|
async sendTechnologies(technologies) {
|
|
403
403
|
await this.sendTechnologiesWithEnvironment(technologies, this.environment);
|
|
404
404
|
}
|
|
405
|
-
async sendTechnologiesWithEnvironment(technologies,
|
|
405
|
+
async sendTechnologiesWithEnvironment(technologies, environment2) {
|
|
406
406
|
const response = await this.fetchWithTimeout(`${this.endpoint}/api/v1/technologies/sync`, {
|
|
407
407
|
method: "POST",
|
|
408
408
|
headers: {
|
|
@@ -410,7 +410,7 @@ var MonitorClient = class {
|
|
|
410
410
|
Authorization: `Bearer ${this.apiKey}`
|
|
411
411
|
},
|
|
412
412
|
body: JSON.stringify({
|
|
413
|
-
environment,
|
|
413
|
+
environment: environment2,
|
|
414
414
|
technologies
|
|
415
415
|
})
|
|
416
416
|
});
|
|
@@ -447,74 +447,74 @@ var MonitorClient = class {
|
|
|
447
447
|
/**
|
|
448
448
|
* Capture a login failure event (convenience method)
|
|
449
449
|
*/
|
|
450
|
-
async captureLoginFailure(
|
|
450
|
+
async captureLoginFailure(options2) {
|
|
451
451
|
return this.captureSecurityEvent({
|
|
452
|
-
eventType: `login_failed_${
|
|
452
|
+
eventType: `login_failed_${options2.authMethod || "other"}`,
|
|
453
453
|
category: "AUTHENTICATION",
|
|
454
454
|
severity: "MEDIUM",
|
|
455
|
-
ip:
|
|
456
|
-
identifier:
|
|
457
|
-
endpoint:
|
|
458
|
-
userAgent:
|
|
459
|
-
metadata: { reason:
|
|
455
|
+
ip: options2.ip,
|
|
456
|
+
identifier: options2.identifier,
|
|
457
|
+
endpoint: options2.endpoint,
|
|
458
|
+
userAgent: options2.userAgent,
|
|
459
|
+
metadata: { reason: options2.reason, authMethod: options2.authMethod }
|
|
460
460
|
});
|
|
461
461
|
}
|
|
462
462
|
/**
|
|
463
463
|
* Capture a successful login event
|
|
464
464
|
*/
|
|
465
|
-
async captureLoginSuccess(
|
|
465
|
+
async captureLoginSuccess(options2) {
|
|
466
466
|
await this.captureSecurityEvent({
|
|
467
|
-
eventType: `login_success_${
|
|
467
|
+
eventType: `login_success_${options2.authMethod || "other"}`,
|
|
468
468
|
category: "AUTHENTICATION",
|
|
469
469
|
severity: "LOW",
|
|
470
|
-
ip:
|
|
471
|
-
identifier:
|
|
472
|
-
endpoint:
|
|
473
|
-
userAgent:
|
|
474
|
-
metadata: { authMethod:
|
|
470
|
+
ip: options2.ip,
|
|
471
|
+
identifier: options2.identifier,
|
|
472
|
+
endpoint: options2.endpoint,
|
|
473
|
+
userAgent: options2.userAgent,
|
|
474
|
+
metadata: { authMethod: options2.authMethod }
|
|
475
475
|
});
|
|
476
476
|
}
|
|
477
477
|
/**
|
|
478
478
|
* Capture a rate limit event
|
|
479
479
|
*/
|
|
480
|
-
async captureRateLimit(
|
|
480
|
+
async captureRateLimit(options2) {
|
|
481
481
|
await this.captureSecurityEvent({
|
|
482
482
|
eventType: "rate_limit_exceeded",
|
|
483
483
|
category: "RATE_LIMIT",
|
|
484
484
|
severity: "MEDIUM",
|
|
485
|
-
ip:
|
|
486
|
-
identifier:
|
|
487
|
-
endpoint:
|
|
488
|
-
userAgent:
|
|
489
|
-
metadata: { limit:
|
|
485
|
+
ip: options2.ip,
|
|
486
|
+
identifier: options2.identifier,
|
|
487
|
+
endpoint: options2.endpoint,
|
|
488
|
+
userAgent: options2.userAgent,
|
|
489
|
+
metadata: { limit: options2.limit, window: options2.window }
|
|
490
490
|
});
|
|
491
491
|
}
|
|
492
492
|
/**
|
|
493
493
|
* Capture an authorization failure (user tried to access unauthorized resource)
|
|
494
494
|
*/
|
|
495
|
-
async captureAuthorizationFailure(
|
|
495
|
+
async captureAuthorizationFailure(options2) {
|
|
496
496
|
await this.captureSecurityEvent({
|
|
497
497
|
eventType: "authorization_denied",
|
|
498
498
|
category: "AUTHORIZATION",
|
|
499
499
|
severity: "MEDIUM",
|
|
500
|
-
ip:
|
|
501
|
-
identifier:
|
|
502
|
-
endpoint:
|
|
503
|
-
userAgent:
|
|
504
|
-
metadata: { resource:
|
|
500
|
+
ip: options2.ip,
|
|
501
|
+
identifier: options2.identifier,
|
|
502
|
+
endpoint: options2.endpoint,
|
|
503
|
+
userAgent: options2.userAgent,
|
|
504
|
+
metadata: { resource: options2.resource, action: options2.action }
|
|
505
505
|
});
|
|
506
506
|
}
|
|
507
507
|
/**
|
|
508
508
|
* Check if an IP or identifier has triggered brute force detection
|
|
509
509
|
*/
|
|
510
|
-
async checkBruteForce(
|
|
510
|
+
async checkBruteForce(options2) {
|
|
511
511
|
const response = await this.fetchWithTimeout(`${this.endpoint}/api/v1/security/detect/brute-force`, {
|
|
512
512
|
method: "POST",
|
|
513
513
|
headers: {
|
|
514
514
|
"Content-Type": "application/json",
|
|
515
515
|
Authorization: `Bearer ${this.apiKey}`
|
|
516
516
|
},
|
|
517
|
-
body: JSON.stringify(
|
|
517
|
+
body: JSON.stringify(options2)
|
|
518
518
|
});
|
|
519
519
|
if (!response.ok) {
|
|
520
520
|
const errorText = await response.text().catch(() => "");
|
|
@@ -540,9 +540,10 @@ var MonitorClient = class {
|
|
|
540
540
|
let path;
|
|
541
541
|
let fs;
|
|
542
542
|
try {
|
|
543
|
-
|
|
544
|
-
|
|
545
|
-
|
|
543
|
+
const _require = typeof globalThis.__webpack_require__ === "function" ? eval("require") : __require;
|
|
544
|
+
execSync = _require("child_process").execSync;
|
|
545
|
+
path = _require("path");
|
|
546
|
+
fs = _require("fs");
|
|
546
547
|
} catch {
|
|
547
548
|
console.warn("[MonitorClient] auditDependencies requires Node.js (not available in bundled/browser environments)");
|
|
548
549
|
return null;
|
package/package.json
CHANGED