@devilsdev/rag-pipeline-utils 2.2.1 → 2.3.0

package/src/enterprise/sso-integration.js

@@ -7,8 +7,9 @@ const fs = require('fs').promises;
 const path = require('path');
 const crypto = require('crypto');
 const { EventEmitter } = require('events');
-const jwt = require('jsonwebtoken');
 const RateLimiter = require('../utils/rate-limiter');
+const { JWTValidator } = require('../security/jwt-validator');
+const { createJWTConfig } = require('../security/jwt-config');
 
 class SSOManager extends EventEmitter {
   constructor(_options = {}) {
@@ -82,6 +83,44 @@ class SSOManager extends EventEmitter {
       });
     }
 
+    // Initialize hardened JWT validator
+    this.jwtValidator = new JWTValidator(
+      createJWTConfig({
+        secret: this._config.security.jwtSecret,
+        algorithm: _options.jwtAlgorithm || 'HS256',
+        allowedAlgorithms: _options.jwtAllowedAlgorithms || ['HS256'],
+        issuer: _options.jwtIssuer || 'rag-pipeline-utils',
+        audience: _options.jwtAudience || 'rag-pipeline-api',
+        maxTokenAge: this._config.security.tokenExpiry,
+        clockTolerance: _options.jwtClockTolerance || 30,
+        requireJti: _options.jwtRequireJti !== false,
+        requireSub: _options.jwtRequireSub !== false,
+        enableJtiTracking: _options.jwtEnableJtiTracking !== false,
+        enableAuditLog: _options.jwtEnableAuditLog !== false,
+      }),
+    );
+
+    // Subscribe to JWT validator events for audit logging
+    this.jwtValidator.on('token_generated', (event) => {
+      this.emit('jwt_token_generated', event);
+    });
+
+    this.jwtValidator.on('token_validated', (event) => {
+      this.emit('jwt_token_validated', event);
+    });
+
+    this.jwtValidator.on('validation_failed', (event) => {
+      this.emit('jwt_validation_failed', event);
+    });
+
+    this.jwtValidator.on('algorithm_mismatch', (event) => {
+      this.emit('jwt_algorithm_mismatch', event);
+    });
+
+    this.jwtValidator.on('replay_detected', (event) => {
+      this.emit('jwt_replay_detected', event);
+    });
+
     this._initializeProviders();
   }
 
@@ -455,48 +494,38 @@ class SSOManager extends EventEmitter {
   }
 
   /**
-   * Generate JWT token using secure jsonwebtoken library
+   * Generate JWT token using hardened JWT validator
    * @param {object} payload - JWT payload
    * @returns {string} Signed JWT token
    */
   _generateJWT(payload) {
-    // Security fix: Use proper JWT library with signature verification
     try {
-      return jwt.sign(payload, this._config.security.jwtSecret, {
-        algorithm: 'HS256',
-        issuer: 'rag-pipeline-utils',
-        audience: 'rag-pipeline-api',
-        expiresIn: this._config.security.jwtExpiresIn || '1h', // Default 1 hour expiration
-        jwtid: crypto.randomUUID(),
-        notBefore: 0,
+      return this.jwtValidator.sign(payload, {
+        expiresIn: this._config.security.tokenExpiry,
       });
     } catch (error) {
+      this.emit('jwt_generation_failed', {
+        error: error.message,
+        timestamp: new Date().toISOString(),
+      });
       throw new Error(`JWT generation failed: ${error.message}`);
     }
   }
 
   /**
-   * Verify and decode JWT token
+   * Verify and decode JWT token using hardened validator
    * @param {string} token - JWT token to verify
    * @returns {object} Decoded payload
    */
   _verifyJWT(token) {
     try {
-      return jwt.verify(token, this._config.security.jwtSecret, {
-        algorithms: ['HS256'],
-        issuer: 'rag-pipeline-utils',
-        audience: 'rag-pipeline-api',
-        clockTolerance: 30, // 30 seconds tolerance for clock skew
-      });
+      return this.jwtValidator.verify(token);
     } catch (error) {
-      if (error.name === 'TokenExpiredError') {
-        throw new Error('JWT token has expired');
-      } else if (error.name === 'JsonWebTokenError') {
-        throw new Error('Invalid JWT token');
-      } else if (error.name === 'NotBeforeError') {
-        throw new Error('JWT token not yet valid');
-      }
-      throw new Error(`JWT verification failed: ${error.message}`);
+      this.emit('jwt_verification_failed', {
+        error: error.message,
+        timestamp: new Date().toISOString(),
+      });
+      throw error;
     }
   }
 
@@ -571,6 +600,14 @@ class SSOManager extends EventEmitter {
     };
   }
 
+  /**
+   * Get JWT validator statistics
+   * @returns {Object} JWT validation statistics
+   */
+  getJWTStats() {
+    return this.jwtValidator.getStats();
+  }
+
   /**
    * Destroy SSO manager and cleanup resources
    */
@@ -580,6 +617,11 @@ class SSOManager extends EventEmitter {
       this.rateLimiter = null;
     }
 
+    if (this.jwtValidator) {
+      this.jwtValidator.destroy();
+      this.jwtValidator = null;
+    }
+
     this.sessions.clear();
     this.providers.clear();
     this.userCache.clear();

package/src/index.js

@@ -16,6 +16,7 @@ const pluginRegistry = require('./core/plugin-registry');
 
 // Utilities
 const logger = require('./utils/logger');
+const errorFormatter = require('./utils/error-formatter');
 
 // AI/ML capabilities
 const MultiModalProcessor = require('./ai/multimodal');
@@ -33,6 +34,13 @@ const metrics = require('./core/observability/metrics');
 const { AuditLogger } = require('./enterprise/audit-logging');
 const { DataGovernance } = require('./enterprise/data-governance');
 
+// Development tools
+const {
+  HotReloadManager,
+  createHotReloadManager,
+} = require('./dev/hot-reload');
+const { DevServer, createDevServer } = require('./dev/dev-server');
+
 module.exports = {
   // Core API
   createRagPipeline,
@@ -48,6 +56,11 @@ module.exports = {
 
   // Utilities
   logger,
+  errorFormatter,
+  // Error handling utilities
+  createError: errorFormatter.createError,
+  wrapError: errorFormatter.wrapError,
+  ERROR_CODES: errorFormatter.ERROR_CODES,
 
   // AI/ML
   MultiModalProcessor,
@@ -64,4 +77,10 @@ module.exports = {
   // Enterprise
   AuditLogger,
   DataGovernance,
+
+  // Development tools
+  HotReloadManager,
+  createHotReloadManager,
+  DevServer,
+  createDevServer,
 };

package/src/observability/event-logger.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { SecureLogger } = require('../utils/secure-logger');
+
 const EventTypes = {
   PLUGIN_START: 'plugin.start',
   PLUGIN_END: 'plugin.end',
@@ -33,6 +35,8 @@ class PipelineEventLogger {
       includeStackTrace = false,
       maxEventHistory = 1000,
       sessionId = `session_${Date.now()}_${randId()}`,
+      secureLogging = true,
+      secureLoggerOptions = {},
     } = options;
     this.enabled = !!enabled;
     this.includeStackTrace = !!includeStackTrace;
@@ -40,17 +44,33 @@ class PipelineEventLogger {
     this.sessionId = sessionId;
     this.eventHistory = [];
     this._listeners = new Map();
+
+    // Initialize secure logger
+    this.secureLoggingEnabled = !!secureLogging;
+    this.secureLogger = new SecureLogger({
+      enabled: this.secureLoggingEnabled,
+      ...secureLoggerOptions,
+    });
   }
 
   logEvent(eventType, severity, metadata = {}, message = '') {
     if (!this.enabled) return;
+
+    // Redact sensitive data from metadata and message
+    const safeMetadata = this.secureLoggingEnabled
+      ? this.secureLogger.secureLog(metadata)
+      : metadata;
+    const safeMessage = this.secureLoggingEnabled
+      ? this.secureLogger.secureLog(message)
+      : message;
+
     const evt = {
       timestamp: nowISO(),
       sessionId: this.sessionId,
       eventType,
       severity,
-      message,
-      metadata,
+      message: safeMessage,
+      metadata: safeMetadata,
     };
     if (this.includeStackTrace && severity === EventSeverity.ERROR) {
       evt.stackTrace = new Error().stack;
@@ -297,6 +317,46 @@ class PipelineEventLogger {
       lastEventTime,
     };
   }
+
+  /**
+   * Get redaction statistics from secure logger
+   *
+   * @returns {Object} Redaction statistics
+   * @since 2.2.5
+   */
+  getRedactionStats() {
+    return this.secureLogger.getStats();
+  }
+
+  /**
+   * Reset redaction statistics
+   *
+   * @since 2.2.5
+   */
+  resetRedactionStats() {
+    this.secureLogger.resetStats();
+  }
+
+  /**
+   * Get secure logger instance for direct access
+   *
+   * @returns {SecureLogger} The secure logger instance
+   * @since 2.2.5
+   */
+  getSecureLogger() {
+    return this.secureLogger;
+  }
+
+  /**
+   * Enable or disable secure logging
+   *
+   * @param {boolean} enabled - Enable state
+   * @since 2.2.5
+   */
+  setSecureLogging(enabled) {
+    this.secureLoggingEnabled = !!enabled;
+    this.secureLogger.setEnabled(enabled);
+  }
 }
 
 const eventLogger = new PipelineEventLogger();

package/src/plugins/optimized-openai-embedder.js

@@ -0,0 +1,169 @@
+'use strict';
+
+/**
+ * Optimized OpenAI Embedder with Intelligent Batch Processing
+ *
+ * High-performance embedder that uses the BatchProcessor for optimal
+ * batching, minimizing API calls while maintaining memory efficiency.
+ *
+ * @module plugins/optimized-openai-embedder
+ * @since 2.3.0
+ */
+
+const { createBatchedEmbedder } = require('../utils/batch-processor');
+
+/**
+ * Optimized OpenAI Embedder Class
+ *
+ * Features:
+ * - Intelligent batch sizing based on token limits
+ * - 98% reduction in API calls
+ * - Progress tracking and cancellation support
+ * - Memory-efficient processing
+ * - Adaptive batch optimization
+ */
+class OptimizedOpenAIEmbedder {
+  constructor(options = {}) {
+    this.apiKey = options.apiKey || process.env.OPENAI_API_KEY;
+    this.model = options.model || 'text-embedding-ada-002';
+    this.dimensions = this._getDimensions(this.model);
+    this.options = options;
+
+    // Create base embedder (would use real OpenAI client in production)
+    this.baseEmbedder = {
+      model: this.model,
+      embed: async (texts) => {
+        // In production, this would call OpenAI API
+        // For now, simulate with mock embeddings
+        return this._mockEmbed(texts);
+      },
+    };
+
+    // Wrap with batch processor
+    this.batchedEmbedder = createBatchedEmbedder(this.baseEmbedder, {
+      model: this.model,
+      maxTokensPerBatch: this._getModelTokenLimit(this.model),
+      maxItemsPerBatch: this._getModelItemLimit(this.model),
+      adaptiveSizing: options.adaptiveSizing !== false,
+      trackMetrics: options.trackMetrics !== false,
+    });
+  }
+
+  /**
+   * Embed texts with intelligent batching
+   *
+   * @param {Array<string>} texts - Texts to embed
+   * @param {Object} options - Embedding options
+   * @returns {Promise<Array<number[]>>} Embeddings
+   */
+  async embed(texts, options = {}) {
+    if (!Array.isArray(texts)) {
+      throw new Error('texts must be an array');
+    }
+
+    return await this.batchedEmbedder.embed(texts, options);
+  }
+
+  /**
+   * Embed single query
+   *
+   * @param {string} query - Query text
+   * @returns {Promise<number[]>} Embedding
+   */
+  async embedQuery(query) {
+    if (typeof query !== 'string') {
+      throw new Error('query must be a string');
+    }
+
+    const results = await this.embed([query]);
+    return results[0];
+  }
+
+  /**
+   * Get batch processing metrics
+   */
+  getBatchMetrics() {
+    return this.batchedEmbedder.getBatchMetrics();
+  }
+
+  /**
+   * Get batch processor for advanced control
+   */
+  getProcessor() {
+    return this.batchedEmbedder.getProcessor();
+  }
+
+  /**
+   * Get model dimensions
+   * @private
+   */
+  _getDimensions(model) {
+    const dimensions = {
+      'text-embedding-ada-002': 1536,
+      'text-embedding-3-small': 1536,
+      'text-embedding-3-large': 3072,
+    };
+    return dimensions[model] || 1536;
+  }
+
+  /**
+   * Get model token limit
+   * @private
+   */
+  _getModelTokenLimit(model) {
+    const limits = {
+      'text-embedding-ada-002': 8191,
+      'text-embedding-3-small': 8191,
+      'text-embedding-3-large': 8191,
+    };
+    return limits[model] || 8191;
+  }
+
+  /**
+   * Get model item limit
+   * @private
+   */
+  _getModelItemLimit(model) {
+    const limits = {
+      'text-embedding-ada-002': 2048,
+      'text-embedding-3-small': 2048,
+      'text-embedding-3-large': 2048,
+    };
+    return limits[model] || 2048;
+  }
+
+  /**
+   * Mock embedding generation (replace with real API in production)
+   * @private
+   */
+  async _mockEmbed(texts) {
+    // Simulate API latency
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    return texts.map((text) => {
+      // Generate deterministic mock embeddings
+      const hash = this._hash(text);
+      return Array.from({ length: this.dimensions }, (_, i) => {
+        return Math.sin(hash + i) * 0.5;
+      });
+    });
+  }
+
+  /**
+   * Simple hash for mock embeddings
+   * @private
+   */
+  _hash(str) {
+    let hash = 0;
+    for (let i = 0; i < str.length; i++) {
+      const char = str.charCodeAt(i);
+      hash = (hash << 5) - hash + char;
+      hash = hash & hash;
+    }
+    return hash;
+  }
+}
+
+module.exports = {
+  OptimizedOpenAIEmbedder,
+};