@de-otio/trellis 0.4.0

package/dist/lib/abuse-metrics.js

@@ -0,0 +1,322 @@
+"use strict";
+/**
+ * Abuse Metrics Monitor
+ *
+ * Fetches WAF, rate-limiting, and auth abuse metrics from CloudWatch
+ * for the admin abuse dashboard.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateAbuseMetrics = evaluateAbuseMetrics;
+const client_cloudwatch_1 = require("@aws-sdk/client-cloudwatch");
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const logger_1 = require("./logger");
+function sumValues(result) {
+    if (!result?.Values?.length)
+        return 0;
+    return result.Values.reduce((a, b) => a + b, 0);
+}
+function buildTrend(result) {
+    if (!result?.Timestamps?.length || !result?.Values?.length)
+        return [];
+    return result.Timestamps.map((ts, i) => ({
+        timestamp: ts.toISOString(),
+        value: result.Values[i],
+    })).sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+}
+const TIME_RANGES = {
+    "1h": 60 * 60 * 1000,
+    "6h": 6 * 60 * 60 * 1000,
+    "24h": 24 * 60 * 60 * 1000,
+    "7d": 7 * 24 * 60 * 60 * 1000,
+};
+async function getWafMetrics(client, stage, startTime, endTime, period) {
+    const webAclName = `trellis-${stage}-alb-waf`;
+    const queries = [
+        // Rate limit
+        {
+            Id: "rl_allowed",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "AllowedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "RateLimit" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+        {
+            Id: "rl_blocked",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "BlockedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "RateLimit" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+        // Common rules
+        {
+            Id: "cr_allowed",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "AllowedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "AWSManagedRulesCommonRuleSet" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+        {
+            Id: "cr_blocked",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "BlockedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "AWSManagedRulesCommonRuleSet" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+        // Bot control (may not exist)
+        {
+            Id: "bc_allowed",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "AllowedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "BotControl" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+        {
+            Id: "bc_blocked",
+            MetricStat: {
+                Metric: {
+                    Namespace: "AWS/WAFV2",
+                    MetricName: "BlockedRequests",
+                    Dimensions: [
+                        { Name: "WebACL", Value: webAclName },
+                        { Name: "Region", Value: "us-east-1" },
+                        { Name: "Rule", Value: "BotControl" },
+                    ],
+                },
+                Period: period,
+                Stat: "Sum",
+            },
+        },
+    ];
+    const response = await client.send(new client_cloudwatch_1.GetMetricDataCommand({
+        StartTime: startTime,
+        EndTime: endTime,
+        MetricDataQueries: queries,
+    }));
+    const byId = new Map();
+    for (const result of response.MetricDataResults || []) {
+        if (result.Id)
+            byId.set(result.Id, result);
+    }
+    const bcAllowed = sumValues(byId.get("bc_allowed"));
+    const bcBlocked = sumValues(byId.get("bc_blocked"));
+    const hasBotControl = bcAllowed > 0 || bcBlocked > 0;
+    return {
+        rateLimit: {
+            allowed: sumValues(byId.get("rl_allowed")),
+            blocked: sumValues(byId.get("rl_blocked")),
+            trend: buildTrend(byId.get("rl_blocked")),
+        },
+        commonRules: {
+            allowed: sumValues(byId.get("cr_allowed")),
+            blocked: sumValues(byId.get("cr_blocked")),
+            trend: buildTrend(byId.get("cr_blocked")),
+        },
+        botControl: hasBotControl
+            ? {
+                allowed: bcAllowed,
+                blocked: bcBlocked,
+                trend: buildTrend(byId.get("bc_blocked")),
+            }
+            : null,
+    };
+}
+async function getAuthAbuseFromLogs(logsClient, stage, startTime, endTime, logger) {
+    const defaults = {
+        rateLimitExceeded: 0,
+        magicLinkRequests: 0,
+        failedVerifications: 0,
+    };
+    try {
+        const logGroupName = `/trellis/${stage}/api`;
+        const queryString = `
+      fields @timestamp, @message
+      | filter @message like /RATE_LIMIT_EXCEEDED/ or @message like /magic-rate:/ or @message like /VERIFY_FAILED/
+      | stats
+        count_distinct(@message) as total,
+        sum(strcontains(@message, "RATE_LIMIT_EXCEEDED")) as rateLimited,
+        sum(strcontains(@message, "magic-rate:")) as magicLinks,
+        sum(strcontains(@message, "VERIFY_FAILED")) as failedVerify
+    `;
+        const startQuery = await logsClient.send(new client_cloudwatch_logs_1.StartQueryCommand({
+            logGroupName,
+            startTime: Math.floor(startTime.getTime() / 1000),
+            endTime: Math.floor(endTime.getTime() / 1000),
+            queryString,
+        }));
+        if (!startQuery.queryId)
+            return defaults;
+        // Poll for results with a max of 5 attempts
+        for (let attempt = 0; attempt < 5; attempt++) {
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            const results = await logsClient.send(new client_cloudwatch_logs_1.GetQueryResultsCommand({ queryId: startQuery.queryId }));
+            if (results.status === "Complete") {
+                if (results.results?.length) {
+                    const row = results.results[0];
+                    const getValue = (field) => {
+                        const f = row.find((r) => r.field === field);
+                        return f?.value ? parseInt(f.value, 10) || 0 : 0;
+                    };
+                    return {
+                        rateLimitExceeded: getValue("rateLimited"),
+                        magicLinkRequests: getValue("magicLinks"),
+                        failedVerifications: getValue("failedVerify"),
+                    };
+                }
+                return defaults;
+            }
+            if (results.status === "Failed" || results.status === "Cancelled") {
+                return defaults;
+            }
+        }
+    }
+    catch (error) {
+        logger.warn("[AbuseMetrics] Failed to query auth abuse logs", {
+            error: error?.message,
+        });
+    }
+    return defaults;
+}
+async function evaluateAbuseMetrics(env, timeRange = "24h") {
+    const logger = logger_1.Logger.getInstance(env);
+    const stage = env.STAGE || "dev";
+    const region = env.AWS_REGION || "us-east-1";
+    const rangeMs = TIME_RANGES[timeRange] || TIME_RANGES["24h"];
+    const endTime = new Date();
+    const startTime = new Date(endTime.getTime() - rangeMs);
+    // Period: 5 min for 1h/6h, 1 hour for 24h, 6 hours for 7d
+    const period = rangeMs <= 6 * 60 * 60 * 1000
+        ? 300
+        : rangeMs <= 24 * 60 * 60 * 1000
+            ? 3600
+            : 21600;
+    const cwClient = new client_cloudwatch_1.CloudWatchClient({ region });
+    const logsClient = new client_cloudwatch_logs_1.CloudWatchLogsClient({ region });
+    const [wafMetrics, authAbuse] = await Promise.all([
+        getWafMetrics(cwClient, stage, startTime, endTime, period).catch((error) => {
+            logger.warn("[AbuseMetrics] Failed to fetch WAF metrics", {
+                error: error?.message,
+            });
+            return {
+                rateLimit: { allowed: 0, blocked: 0, trend: [] },
+                commonRules: { allowed: 0, blocked: 0, trend: [] },
+                botControl: null,
+            };
+        }),
+        getAuthAbuseFromLogs(logsClient, stage, startTime, endTime, logger),
+    ]);
+    // Build WAF rules array
+    const wafRules = [
+        {
+            name: "IP Rate Limit",
+            allowed: wafMetrics.rateLimit.allowed,
+            blocked: wafMetrics.rateLimit.blocked,
+            trend: wafMetrics.rateLimit.trend,
+        },
+        {
+            name: "Common Rule Set",
+            allowed: wafMetrics.commonRules.allowed,
+            blocked: wafMetrics.commonRules.blocked,
+            trend: wafMetrics.commonRules.trend,
+        },
+    ];
+    if (wafMetrics.botControl) {
+        wafRules.push({
+            name: "Bot Control",
+            allowed: wafMetrics.botControl.allowed,
+            blocked: wafMetrics.botControl.blocked,
+            trend: wafMetrics.botControl.trend,
+        });
+    }
+    // Summary
+    const totalBlocked = wafRules.reduce((s, r) => s + r.blocked, 0);
+    const totalAllowed = wafRules.reduce((s, r) => s + r.allowed, 0);
+    const totalRequests = totalAllowed + totalBlocked;
+    const blockRate = totalRequests > 0
+        ? Math.round((totalBlocked / totalRequests) * 10000) / 100
+        : 0;
+    // Overall status
+    let overallStatus = "low";
+    if (blockRate > 20 || authAbuse.rateLimitExceeded > 50) {
+        overallStatus = "critical";
+    }
+    else if (blockRate > 10 || authAbuse.rateLimitExceeded > 20) {
+        overallStatus = "high";
+    }
+    else if (blockRate > 5 || authAbuse.rateLimitExceeded > 5) {
+        overallStatus = "moderate";
+    }
+    // Recommendations
+    const recommendations = [];
+    if (!wafMetrics.botControl) {
+        recommendations.push("Bot Control is not enabled. Enable WAF Bot Control (Targeted) in prod for browser fingerprinting-based bot detection.");
+    }
+    if (wafMetrics.rateLimit.blocked > 0) {
+        recommendations.push(`${wafMetrics.rateLimit.blocked} requests blocked by IP rate limit. Review if the threshold is appropriate for shared-NAT scenarios.`);
+    }
+    if (authAbuse.rateLimitExceeded > 10) {
+        recommendations.push(`${authAbuse.rateLimitExceeded} magic link rate limits hit. Consider enabling reCAPTCHA enforcement in the Cognito challenge Lambda.`);
+    }
+    if (recommendations.length === 0) {
+        recommendations.push("No abuse concerns detected in this time period.");
+    }
+    return {
+        timeRange,
+        overallStatus,
+        summary: {
+            totalAllowed,
+            totalBlocked,
+            blockRate,
+        },
+        wafRules,
+        authAbuse,
+        topBlockedIps: [], // Requires WAF logging to S3/Kinesis — placeholder for future
+        recommendations,
+        timestamp: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=abuse-metrics.js.map

package/dist/lib/abuse-metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abuse-metrics.js","sourceRoot":"","sources":["../../src/lib/abuse-metrics.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA0SH,oDA8HC;AAtaD,kEAIoC;AACpC,4EAIyC;AACzC,qCAAkD;AAyClD,SAAS,SAAS,CAAC,MAAoC;IACrD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAAoC;IACtD,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,SAAS,EAAE,EAAE,CAAC,WAAW,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,CAAC;KACzB,CAAC,CAAC,CAAC,IAAI,CACN,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACpB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAC9B,CAAC;AAEF,KAAK,UAAU,aAAa,CAC1B,MAAwB,EACxB,KAAa,EACb,SAAe,EACf,OAAa,EACb,MAAc;IAEd,MAAM,UAAU,GAAG,WAAW,KAAK,UAAU,CAAC;IAE9C,MAAM,OAAO,GAAG;QACd,aAAa;QACb;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE;qBACrC;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;QACD;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE;qBACrC;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;QACD,eAAe;QACf;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE;qBACxD;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;QACD;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,8BAA8B,EAAE;qBACxD;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;QACD,8BAA8B;QAC9B;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;qBACtC;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;QACD;YACE,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,SAAS,EAAE,WAAW;oBACtB,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;wBACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE;wBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;qBACtC;iBACF;gBACD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;aACZ;SACF;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,wCAAoB,CAAC;QACvB,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE,OAAO;KAC3B,CAAC,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC;IAErD,OAAO;QACL,SAAS,EAAE;YACT,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;SAC1C;QACD,WAAW,EAAE;YACX,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;SAC1C;QACD,UAAU,EAAE,aAAa;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;aAC1C;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,UAAgC,EAChC,KAAa,EACb,SAAe,EACf,OAAa,EACb,MAAc;IAEd,MAAM,QAAQ,GAAqB;QACjC,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,mBAAmB,EAAE,CAAC;KACvB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,KAAK,MAAM,CAAC;QAE7C,MAAM,WAAW,GAAG;;;;;;;;KAQnB,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CACtC,IAAI,0CAAiB,CAAC;YACpB,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC7C,WAAW;SACZ,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QAEzC,4CAA4C;QAC5C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CACnC,IAAI,+CAAsB,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAC5D,CAAC;YAEF,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;wBACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;wBAC7C,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,CAAC,CAAC;oBACF,OAAO;wBACL,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC;wBAC1C,iBAAiB,EAAE,QAAQ,CAAC,YAAY,CAAC;wBACzC,mBAAmB,EAAE,QAAQ,CAAC,cAAc,CAAC;qBAC9C,CAAC;gBACJ,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClE,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAC5D,KAAK,EAAE,KAAK,EAAE,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,GAIC,EACD,YAAoB,KAAK;IAEzB,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAgB,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAE7C,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAExD,0DAA0D;IAC1D,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC3B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YAC9B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,KAAK,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,oCAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAExD,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAC9D,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBACxD,KAAK,EAAE,KAAK,EAAE,OAAO;aACtB,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;gBAClD,UAAU,EAAE,IAAI;aACH,CAAC;QAClB,CAAC,CACF;QACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC;KACpE,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,QAAQ,GAAuB;QACnC;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;YACrC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;YACrC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK;SAClC;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO;YACvC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO;YACvC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK;SACpC;KACF,CAAC;IAEF,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO;YACtC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO;YACtC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,KAAK;SACnC,CAAC,CAAC;IACL,CAAC;IAED,UAAU;IACV,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,YAAY,GAAG,YAAY,CAAC;IAClD,MAAM,SAAS,GACb,aAAa,GAAG,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,aAAa,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG;QAC1D,CAAC,CAAC,CAAC,CAAC;IAER,iBAAiB;IACjB,IAAI,aAAa,GAAwC,KAAK,CAAC;IAC/D,IAAI,SAAS,GAAG,EAAE,IAAI,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,CAAC;QACvD,aAAa,GAAG,UAAU,CAAC;IAC7B,CAAC;SAAM,IAAI,SAAS,GAAG,EAAE,IAAI,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,CAAC;QAC9D,aAAa,GAAG,MAAM,CAAC;IACzB,CAAC;SAAM,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,UAAU,CAAC;IAC7B,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,eAAe,CAAC,IAAI,CAClB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAClB,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,sGAAsG,CACtI,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,iBAAiB,GAAG,EAAE,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAClB,GAAG,SAAS,CAAC,iBAAiB,uGAAuG,CACtI,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,SAAS;QACT,aAAa;QACb,OAAO,EAAE;YACP,YAAY;YACZ,YAAY;YACZ,SAAS;SACV;QACD,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,EAAE,EAAE,8DAA8D;QACjF,eAAe;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/lib/activitypub/activity-processor.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Activity Processor
+ *
+ * Processes incoming ActivityPub activities.
+ * In Phase 1, this provides a basic structure that will be extended in later phases.
+ */
+import type { PrismaClient, User } from "@prisma/client";
+import type { ActivityStreamsActivity } from "./activity-service";
+export interface ActivityProcessorEnv {
+    LOG_LEVEL?: string;
+}
+export declare class ActivityProcessor {
+    /**
+     * Process incoming activity
+     */
+    static processActivity(prisma: PrismaClient, activity: ActivityStreamsActivity, user: User, env: ActivityProcessorEnv): Promise<void>;
+    /**
+     * Process Create activity (post or DM)
+     * Phase 3: Handles DMs (activities with bto but no to field)
+     */
+    private static processCreate;
+    /**
+     * Process direct message
+     * Phase 3: Store DM in database when received in inbox
+     */
+    private static processDirectMessage;
+    /**
+     * Process Follow activity
+     * Phase 2: Handles friend requests and regular follows
+     */
+    private static processFollow;
+    /**
+     * Process friend request (Follow activity targeting current user)
+     */
+    private static processFriendRequest;
+    /**
+     * Process regular follow (user following another user or entity)
+     */
+    private static processRegularFollow;
+    /**
+     * Process group Follow activity (group membership request)
+     * Phase 3: Handles users joining groups via Follow activity
+     */
+    private static processGroupFollow;
+    /**
+     * Process Like activity
+     * Phase 2: Handles sentiment reactions via Like activities
+     */
+    private static processLike;
+    /**
+     * Extract sentiment from ActivityStreamsActivity
+     * Supports both JSON-LD extension format and plain property format
+     */
+    private static extractSentimentFromActivity;
+    /**
+     * Validate sentiment type
+     */
+    private static isValidSentiment;
+    /**
+     * Process Announce activity (repost)
+     * Phase 1: Basic structure - will be implemented in Phase 2
+     */
+    private static processAnnounce;
+    /**
+     * Process Accept activity
+     * Phase 2: Handles friend request acceptance
+     */
+    private static processAccept;
+    /**
+     * Process Reject activity
+     * Phase 1: Basic structure - will be implemented in Phase 2
+     */
+    private static processReject;
+    /**
+     * Process Undo activity
+     * Phase 1: Basic structure - will be implemented in Phase 2
+     */
+    private static processUndo;
+    /**
+     * Process Undo(Follow) — remote user unfollowed a local user or entity
+     */
+    private static processUndoFollow;
+    /**
+     * Send an Accept activity back to confirm a follow.
+     * Required by the ActivityPub spec.
+     */
+    private static sendAcceptActivity;
+}
+//# sourceMappingURL=activity-processor.d.ts.map

package/dist/lib/activitypub/activity-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-processor.d.ts","sourceRoot":"","sources":["../../../src/lib/activitypub/activity-processor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGlE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B;;OAEG;WACU,eAAe,CAC1B,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,uBAAuB,EACjC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,IAAI,CAAC;IAuChB;;;OAGG;mBACkB,aAAa;IAiClC;;;OAGG;mBACkB,oBAAoB;IA6GzC;;;OAGG;mBACkB,aAAa;IAkElC;;OAEG;mBACkB,oBAAoB;IA4CzC;;OAEG;mBACkB,oBAAoB;IA4FzC;;;OAGG;mBACkB,kBAAkB;IAsEvC;;;OAGG;mBACkB,WAAW;IAuGhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAsB3C;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAiB/B;;;OAGG;mBACkB,eAAe;IAgBpC;;;OAGG;mBACkB,aAAa;IAwFlC;;;OAGG;mBACkB,aAAa;IAgBlC;;;OAGG;mBACkB,WAAW;IAgChC;;OAEG;mBACkB,iBAAiB;IA2DtC;;;OAGG;mBACkB,kBAAkB;CA+BxC"}