@devilsdev/rag-pipeline-utils 2.4.5 → 2.5.0

package/src/cli/input-sanitization-middleware.js

@@ -1,356 +0,0 @@
-"use strict";
-
-/**
- * CLI Input Sanitization Middleware
- *
- * Provides automatic input sanitization for CLI commands to prevent:
- * - Command injection attacks
- * - Path traversal attacks
- * - XSS in output
- * - Invalid data types
- *
- * @module cli/input-sanitization-middleware
- * @since 2.3.0
- */
-
-const {
-  InputSanitizer,
-  SanitizationRules,
-  sanitizePath,
-  sanitizeCommand,
-  validateEmail,
-  validateUrl,
-} = require("../utils/input-sanitizer");
-
-/**
- * CLI-specific sanitization rules mapping
- */
-const CLI_SANITIZATION_RULES = {
-  // File and path arguments
-  file: SanitizationRules.PATH,
-  path: SanitizationRules.PATH,
-  output: SanitizationRules.PATH,
-  input: SanitizationRules.PATH,
-  config: SanitizationRules.PATH,
-  report: SanitizationRules.PATH,
-
-  // URL arguments
-  url: SanitizationRules.URL,
-
-  // Email arguments
-  email: SanitizationRules.EMAIL,
-
-  // String arguments (prompts, queries, templates)
-  prompt: SanitizationRules.XSS,
-  query: SanitizationRules.XSS,
-  template: SanitizationRules.ALPHANUMERIC,
-
-  // Configuration keys
-  key: SanitizationRules.ALPHANUMERIC,
-  name: SanitizationRules.SLUG,
-
-  // Numeric arguments
-  timeout: SanitizationRules.INTEGER,
-  concurrency: SanitizationRules.INTEGER,
-  batchSize: SanitizationRules.INTEGER,
-  maxMemory: SanitizationRules.INTEGER,
-
-  // Categories and sections
-  category: SanitizationRules.SLUG,
-  section: SanitizationRules.SLUG,
-  format: SanitizationRules.SLUG,
-};
-
-/**
- * CLI Input Sanitization Middleware
- */
-class CLISanitizationMiddleware {
-  constructor(options = {}) {
-    this.sanitizer = new InputSanitizer({
-      enableCache: options.enableCache !== false,
-      cacheSize: options.cacheSize || 500,
-      cacheTTL: options.cacheTTL || 300000, // 5 minutes
-      throwOnInvalid: options.throwOnInvalid || false,
-      stripInvalid: options.stripInvalid !== false,
-      trackStats: options.trackStats !== false,
-    });
-
-    this.customRules = options.customRules || {};
-    this.enabled = options.enabled !== false;
-    this.verbose = options.verbose || false;
-  }
-
-  /**
-   * Sanitize command arguments
-   *
-   * @param {Object} args - Command arguments object
-   * @returns {Object} Sanitized arguments
-   *
-   * @example
-   * const sanitized = middleware.sanitizeArgs({
-   *   file: '../../../etc/passwd',
-   *   query: '<script>alert("xss")</script>',
-   *   timeout: '1000'
-   * });
-   */
-  sanitizeArgs(args) {
-    if (!this.enabled) {
-      return args;
-    }
-
-    if (!args || typeof args !== "object") {
-      return args;
-    }
-
-    const sanitized = {};
-
-    for (const [key, value] of Object.entries(args)) {
-      // Skip undefined/null values
-      if (value === undefined || value === null) {
-        sanitized[key] = value;
-        continue;
-      }
-
-      // Determine sanitization rule for this argument
-      const rule = this._getRuleForArgument(key, value);
-
-      // Sanitize the value
-      try {
-        sanitized[key] = this.sanitizer.sanitize(value, rule);
-
-        // Log if value was modified (in verbose mode)
-        if (this.verbose && sanitized[key] !== value) {
-          console.warn(
-            `[INPUT_SANITIZER] Sanitized argument '${key}': ${value} => ${sanitized[key]}`,
-          );
-        }
-      } catch (error) {
-        console.error(
-          `[INPUT_SANITIZER] Error sanitizing argument '${key}':`,
-          error.message,
-        );
-        sanitized[key] = value; // Fall back to original value
-      }
-    }
-
-    return sanitized;
-  }
-
-  /**
-   * Sanitize command options
-   *
-   * @param {Object} options - Command options object
-   * @returns {Object} Sanitized options
-   */
-  sanitizeOptions(options) {
-    return this.sanitizeArgs(options);
-  }
-
-  /**
-   * Sanitize command output before displaying
-   *
-   * @param {string} output - Command output string
-   * @returns {string} Sanitized output
-   */
-  sanitizeOutput(output) {
-    if (!this.enabled) {
-      return output;
-    }
-
-    if (typeof output !== "string") {
-      return output;
-    }
-
-    // HTML escape for terminal output (prevents potential terminal injection)
-    return this.sanitizer.sanitize(output, SanitizationRules.HTML);
-  }
-
-  /**
-   * Wrap command action with sanitization
-   *
-   * @param {Function} action - Original command action
-   * @returns {Function} Wrapped action with sanitization
-   *
-   * @example
-   * const wrappedAction = middleware.wrapAction(async (options) => {
-   *   // Original action
-   * });
-   */
-  wrapAction(action) {
-    return async (...args) => {
-      // Last argument is typically options object
-      const lastArg = args[args.length - 1];
-
-      if (lastArg && typeof lastArg === "object") {
-        // Sanitize options
-        args[args.length - 1] = this.sanitizeOptions(lastArg);
-      }
-
-      // Sanitize positional arguments
-      for (let i = 0; i < args.length - 1; i++) {
-        if (typeof args[i] === "string") {
-          args[i] = this.sanitizer.sanitize(args[i], SanitizationRules.HTML);
-        }
-      }
-
-      // Execute original action
-      return await action(...args);
-    };
-  }
-
-  /**
-   * Get sanitization rule for argument based on name and type
-   * @private
-   */
-  _getRuleForArgument(argName, value) {
-    // Check custom rules first
-    if (this.customRules[argName]) {
-      return this.customRules[argName];
-    }
-
-    // Check predefined CLI rules
-    if (CLI_SANITIZATION_RULES[argName]) {
-      return CLI_SANITIZATION_RULES[argName];
-    }
-
-    // Infer rule from argument name patterns
-    if (
-      argName.includes("path") ||
-      argName.includes("file") ||
-      argName.includes("dir")
-    ) {
-      return SanitizationRules.PATH;
-    }
-
-    if (argName.includes("url") || argName.includes("uri")) {
-      return SanitizationRules.URL;
-    }
-
-    if (argName.includes("email")) {
-      return SanitizationRules.EMAIL;
-    }
-
-    if (argName.includes("id") || argName.includes("uuid")) {
-      return SanitizationRules.UUID;
-    }
-
-    // Infer from value type
-    if (typeof value === "number" || /^\d+$/.test(value)) {
-      return SanitizationRules.INTEGER;
-    }
-
-    if (typeof value === "boolean") {
-      return SanitizationRules.BOOLEAN;
-    }
-
-    // Default to XSS sanitization for strings
-    return SanitizationRules.XSS;
-  }
-
-  /**
-   * Get sanitization statistics
-   *
-   * @returns {Object} Statistics object
-   */
-  getStats() {
-    return this.sanitizer.getStats();
-  }
-
-  /**
-   * Reset statistics
-   */
-  resetStats() {
-    this.sanitizer.resetStats();
-  }
-
-  /**
-   * Destroy middleware and cleanup resources
-   */
-  destroy() {
-    this.sanitizer.destroy();
-  }
-}
-
-/**
- * Create global CLI sanitization middleware instance
- */
-const cliSanitizer = new CLISanitizationMiddleware({
-  enabled: process.env.CLI_SANITIZATION !== "false",
-  verbose: process.env.CLI_SANITIZATION_VERBOSE === "true",
-});
-
-/**
- * Quick sanitization helpers for CLI
- */
-function sanitizeCliPath(pathStr) {
-  return sanitizePath(pathStr);
-}
-
-function sanitizeCliCommand(cmdStr) {
-  return sanitizeCommand(cmdStr);
-}
-
-function sanitizeCliQuery(queryStr) {
-  return cliSanitizer.sanitizer.sanitize(queryStr, SanitizationRules.XSS);
-}
-
-function sanitizeCliEmail(emailStr) {
-  return validateEmail(emailStr);
-}
-
-function sanitizeCliUrl(urlStr) {
-  return validateUrl(urlStr);
-}
-
-/**
- * Sanitize file path for CLI operations
- *
- * @param {string} filePath - File path to sanitize
- * @returns {string} Sanitized file path
- */
-function sanitizeFilePath(filePath) {
-  if (!filePath || typeof filePath !== "string") {
-    return filePath;
-  }
-
-  // Remove path traversal attempts
-  let sanitized = filePath;
-
-  // Remove leading traversal
-  sanitized = sanitized.replace(/^(\.\.\/|\.\.\\)+/, "");
-
-  // Remove embedded traversal
-  sanitized = sanitized.replace(/\/(\.\.\/|\.\.\\)/g, "/");
-  sanitized = sanitized.replace(/\\(\.\.\/|\.\.\\)/g, "\\");
-
-  // Normalize path separators
-  sanitized = sanitized.replace(/\\/g, "/");
-
-  // Remove multiple consecutive slashes
-  sanitized = sanitized.replace(/\/+/g, "/");
-
-  return sanitized;
-}
-
-/**
- * Sanitize all CLI options at once
- *
- * @param {Object} options - CLI options object
- * @returns {Object} Sanitized options
- */
-function sanitizeAllCliOptions(options) {
-  return cliSanitizer.sanitizeOptions(options);
-}
-
-module.exports = {
-  CLISanitizationMiddleware,
-  cliSanitizer,
-  sanitizeCliPath,
-  sanitizeCliCommand,
-  sanitizeCliQuery,
-  sanitizeCliEmail,
-  sanitizeCliUrl,
-  sanitizeFilePath,
-  sanitizeAllCliOptions,
-  CLI_SANITIZATION_RULES,
-};

package/src/cli/interactive-wizard.js

@@ -1,373 +0,0 @@
-/**
- * Interactive CLI Wizard for RAG Pipeline Setup
- * Provides guided setup for plugin selection, DAG building, and configuration
- *
- * This module is a thin orchestrator that delegates to focused step modules
- * in src/cli/wizard/. Each step receives the wizard's config state and
- * inquirer instance.
- */
-
-const inquirer = require("inquirer");
-const path = require("path");
-const {
-  DEFAULT_REGISTRY_URLS,
-} = require("../core/plugin-marketplace/plugin-registry-format.js");
-
-// Step modules
-const { setupProject } = require("./wizard/project-setup.js");
-const { selectPlugins } = require("./wizard/plugin-selection.js");
-const {
-  configureSettings,
-  configurePipeline,
-} = require("./wizard/configuration.js");
-const { configurePerformance } = require("./wizard/performance.js");
-const { configureObservability } = require("./wizard/observability.js");
-const {
-  previewAndSave,
-  showConfigSummary,
-  runConfigurationTest,
-} = require("./wizard/preview-save.js");
-
-/**
- * Interactive wizard for RAG pipeline setup
- */
-class InteractiveWizard {
-  constructor(_options = {}) {
-    this._options = {
-      registryUrl: _options.registryUrl || DEFAULT_REGISTRY_URLS[0],
-      outputPath: _options.outputPath || ".ragrc.json",
-      ..._options,
-    };
-    this.registry = null;
-    this._config = {
-      plugins: {
-        loader: {},
-        embedder: {},
-        retriever: {},
-        llm: {},
-      },
-      registry: {
-        urls: [this._options.registryUrl],
-      },
-    };
-
-    // Initialize steps for testing interface
-    this.steps = [
-      "project-setup",
-      "plugin-selection",
-      "configuration",
-      "pipeline-setup",
-      "performance-tuning",
-      "observability",
-      "preview-save",
-    ];
-    this.currentStep = 0;
-  }
-
-  /**
-   * Run the complete interactive wizard
-   * @returns {Promise<object>} Generated configuration
-   */
-  async run() {
-    console.log("🧙‍♂️ Welcome to the RAG Pipeline Interactive Setup Wizard!\n");
-    // eslint-disable-line no-console
-    console.log(
-      "This wizard will help you configure your RAG pipeline with the right plugins and settings.\n",
-    );
-    // eslint-disable-line no-console
-
-    try {
-      // Step 1: Project setup
-      await this.setupProject();
-
-      // Step 2: Plugin selection
-      await this.selectPlugins();
-
-      // Step 3: Configuration
-      await this.configureSettings();
-
-      // Step 4: Pipeline stages
-      await this.configurePipeline();
-
-      // Step 5: Performance settings
-      await this.configurePerformance();
-
-      // Step 6: Observability settings
-      await this.configureObservability();
-
-      // Step 7: Preview and save
-      await this.previewAndSave();
-
-      console.log("\n🎉 RAG Pipeline setup complete!");
-      // eslint-disable-line no-console
-      console.log(`Configuration saved to: ${this._options.outputPath}`);
-      // eslint-disable-line no-console
-
-      return this._config;
-    } catch (error) {
-      console.error("\n❌ Setup wizard failed:", error.message);
-      // eslint-disable-line no-console
-      throw error;
-    }
-  }
-
-  /**
-   * Setup project metadata - delegates to project-setup module
-   */
-  async setupProject() {
-    this._config = await setupProject(this._config, inquirer);
-  }
-
-  /**
-   * Select plugins for each type - delegates to plugin-selection module
-   */
-  async selectPlugins() {
-    const context = {
-      registry: this.registry,
-      getAvailablePlugins: (type) => this.getAvailablePlugins(type),
-      getPluginInfo: (type, name) => this.getPluginInfo(type, name),
-      loadRegistry: () => this.loadRegistry(),
-    };
-    this._config = await selectPlugins(this._config, inquirer, context);
-    // Sync registry back from context (loadRegistry may have updated it)
-    this.registry = context.registry;
-  }
-
-  /**
-   * Configure general settings - delegates to configuration module
-   */
-  async configureSettings() {
-    this._config = await configureSettings(this._config, inquirer);
-  }
-
-  /**
-   * Configure pipeline stages - delegates to configuration module
-   */
-  async configurePipeline() {
-    this._config = await configurePipeline(this._config, inquirer);
-  }
-
-  /**
-   * Configure performance settings - delegates to performance module
-   */
-  async configurePerformance() {
-    this._config = await configurePerformance(this._config, inquirer);
-  }
-
-  /**
-   * Configure observability settings - delegates to observability module
-   */
-  async configureObservability() {
-    this._config = await configureObservability(this._config, inquirer);
-  }
-
-  /**
-   * Preview configuration and save - delegates to preview-save module
-   */
-  async previewAndSave() {
-    this._config = await previewAndSave(this._config, inquirer, this._options);
-  }
-
-  /**
-   * Show configuration summary - delegates to preview-save module
-   */
-  showConfigSummary() {
-    showConfigSummary(this._config);
-  }
-
-  /**
-   * Run configuration test - delegates to preview-save module
-   */
-  async runConfigurationTest() {
-    await runConfigurationTest(this._config);
-  }
-
-  /**
-   * Configure plugin-specific settings
-   * @param {object} plugin - Plugin information
-   * @returns {Promise<object>} Plugin configuration
-   */
-  async configurePluginSettings(plugin) {
-    const {
-      configurePluginSettings: configPluginSettings,
-    } = require("./wizard/plugin-selection.js");
-    return configPluginSettings(plugin, inquirer);
-  }
-
-  /**
-   * Load plugin registry
-   * @returns {Promise<object>} Registry data
-   */
-  async loadRegistry() {
-    // In a real implementation, this would fetch from the registry URL
-    // For now, return mock data
-    return {
-      plugins: {
-        "file-loader": {
-          metadata: {
-            name: "file-loader",
-            _type: "loader",
-            description: "Load files from filesystem",
-          },
-          versions: { "1.0.0": {}, "1.1.0": {} },
-          latest: "1.1.0",
-        },
-        "openai-embedder": {
-          metadata: {
-            name: "openai-embedder",
-            _type: "embedder",
-            description: "OpenAI embeddings",
-          },
-          versions: { "2.0.0": {}, "2.1.0": {} },
-          latest: "2.1.0",
-        },
-      },
-    };
-  }
-
-  /**
-   * Get available plugins for type
-   * @param {string} _type - Plugin type
-   * @returns {Array<object>} Available plugins
-   */
-  getAvailablePlugins(_type) {
-    if (!this.registry) {
-      return this.getBuiltinPlugins(_type);
-    }
-
-    return Object.values(this.registry.plugins)
-      .filter((plugin) => plugin.metadata._type === _type)
-      .map((plugin) => ({
-        name: plugin.metadata.name,
-        description: plugin.metadata.description,
-        version: plugin.latest,
-      }));
-  }
-
-  /**
-   * Get built-in plugin options
-   * @param {string} _type - Plugin type
-   * @returns {Array<object>} Built-in plugins
-   */
-  getBuiltinPlugins(_type) {
-    const builtins = {
-      loader: [
-        { name: "file-loader", description: "Load files from filesystem" },
-        { name: "url-loader", description: "Load content from URLs" },
-      ],
-      embedder: [
-        { name: "openai-embedder", description: "OpenAI embeddings" },
-        { name: "local-embedder", description: "Local embedding model" },
-      ],
-      retriever: [
-        { name: "vector-retriever", description: "Vector similarity search" },
-        { name: "keyword-retriever", description: "Keyword-based search" },
-      ],
-      llm: [
-        { name: "openai-llm", description: "OpenAI language models" },
-        { name: "local-llm", description: "Local language model" },
-      ],
-      reranker: [
-        {
-          name: "similarity-reranker",
-          description: "Similarity-based reranking",
-        },
-      ],
-    };
-
-    return builtins[_type] || [];
-  }
-
-  /**
-   * Get plugin information
-   * @param {string} _type - Plugin type
-   * @param {string} name - Plugin name
-   * @returns {object|null} Plugin information
-   */
-  getPluginInfo(_type, name) {
-    if (!this.registry) {
-      return null;
-    }
-
-    return this.registry.plugins[name] || null;
-  }
-
-  /**
-   * Load wizard configuration
-   * @returns {object} Current configuration
-   */
-  loadConfig() {
-    return { ...this._config };
-  }
-
-  /**
-   * Navigate to next step
-   * @returns {string} Next step name
-   */
-  nextStep() {
-    if (this.currentStep < this.steps.length - 1) {
-      this.currentStep++;
-    }
-    return this.steps[this.currentStep];
-  }
-
-  /**
-   * Navigate to previous step
-   * @returns {string} Previous step name
-   */
-  previousStep() {
-    if (this.currentStep > 0) {
-      this.currentStep--;
-    }
-    return this.steps[this.currentStep];
-  }
-
-  /**
-   * Complete the wizard
-   * @returns {Promise<object>} Completion result
-   */
-  async complete() {
-    return {
-      success: true,
-      config: this._config,
-      message: "Wizard completed successfully",
-    };
-  }
-
-  /**
-   * Validate user input
-   * @param {string} input - Input to validate
-   * @returns {boolean} Whether input is valid
-   */
-  validateInput(input) {
-    return typeof input === "string" && input.trim().length > 0;
-  }
-
-  /**
-   * Process user selection
-   * @param {string} selection - User selection
-   * @returns {object} Processing result
-   */
-  processSelection(selection) {
-    return {
-      selection,
-      processed: true,
-      timestamp: Date.now(),
-    };
-  }
-}
-
-/**
- * Main wizard function for CLI usage
- * @param {object} options - Wizard options
- * @returns {Promise<object>} Generated configuration
- */
-async function runInteractiveWizard(options = {}) {
-  const wizard = new InteractiveWizard(options);
-  return await wizard.run();
-}
-
-module.exports = {
-  InteractiveWizard,
-  runInteractiveWizard,
-};