@digitaldefiance/node-express-suite 3.7.5 → 3.8.0

package/src/middleware-utils.ts

@@ -1,138 +0,0 @@
-/**
- * @fileoverview Middleware initialization utilities.
- * Configures Express middleware including Helmet, CORS, and body parsers.
- * @module middleware-utils
- */
-
-import {
-  SuiteCoreStringKey,
-  TranslatableSuiteError,
-} from '@digitaldefiance/suite-core-lib';
-import cors from 'cors';
-import { randomBytes } from 'crypto';
-import {
-  Application,
-  json,
-  NextFunction,
-  Request,
-  Response,
-  urlencoded,
-} from 'express';
-import helmet, { HelmetOptions } from 'helmet';
-import { IncomingMessage, ServerResponse } from 'http';
-import { ISimpleCSPDef, isSimpleCSPDef } from './interfaces/csp-definition';
-
-/**
- * Creates a CORS options delegate function.
- * @param {string[]} corsWhitelist - Array of allowed origins
- * @returns {Function} CORS options delegate
- */
-export const corsOptionsDelegate = (corsWhitelist: string[]) => {
-  return (
-    req: cors.CorsRequest,
-    callback: (
-      error: Error | null,
-      options: cors.CorsOptions | undefined,
-    ) => void,
-  ) => {
-    let corsOptions: cors.CorsOptions;
-    const origin = req.headers.origin;
-    if (
-      origin &&
-      corsWhitelist.find((w: string | RegExp) => {
-        if (w instanceof RegExp) {
-          return w.test(origin);
-        } else {
-          return w === origin;
-        }
-      })
-    ) {
-      corsOptions = { origin: true };
-    } else {
-      corsOptions = { origin: false };
-    }
-    callback(null, corsOptions);
-  };
-};
-
-/**
- * Type guard to check if object is HelmetOptions.
- * @param {unknown} obj - Object to check
- * @returns {boolean} True if object is HelmetOptions
- */
-export const isHelmetOptions = (obj: unknown): obj is HelmetOptions => {
-  // A very basic check; in real scenarios, you might want to be more thorough
-  return !!(
-    obj &&
-    typeof obj === 'object' &&
-    ('contentSecurityPolicy' in obj ||
-      'crossOriginEmbedderPolicy' in obj ||
-      'crossOriginOpenerPolicy' in obj ||
-      'crossOriginResourcePolicy' in obj ||
-      'originAgentCluster' in obj ||
-      'referrerPolicy' in obj)
-  );
-};
-
-/**
- * Initializes Express middleware stack.
- * Configures Helmet for security headers, CORS, and body parsers.
- * @param {Application} app - Express application instance
- * @param {string[]} corsWhitelist - Array of allowed CORS origins
- * @param {ISimpleCSPDef | HelmetOptions} csp - CSP configuration or Helmet options
- * @throws {TranslatableSuiteError} If invalid CSP configuration provided
- */
-export const initMiddleware = (
-  app: Application,
-  corsWhitelist: string[],
-  csp: ISimpleCSPDef | HelmetOptions,
-): void => {
-  // Helmet helps you secure your Express apps by setting various HTTP headers
-  // CSP nonce
-  app.use((req: Request, res: Response, next: NextFunction) => {
-    res.locals['cspNonce'] = randomBytes(32).toString('hex');
-    next();
-  });
-  if (isSimpleCSPDef(csp)) {
-    app.use(
-      helmet({
-        contentSecurityPolicy: {
-          directives: {
-            defaultSrc: ["'self'", ...csp.defaultSrc],
-            imgSrc: ["'self'", 'data:', 'blob:', ...csp.imgSrc],
-            connectSrc: ["'self'", ...csp.connectSrc],
-            scriptSrc: [
-              "'self'",
-              //"'unsafe-inline'",
-              "'strict-dynamic'",
-              (req: IncomingMessage, res: ServerResponse) => {
-                const response = res as Response;
-                return `'nonce-${response.locals['cspNonce']}'`;
-              },
-              ...csp.scriptSrc,
-            ],
-            styleSrc: [
-              "'self'",
-              // "'unsafe-inline'",
-              ...csp.styleSrc,
-            ],
-            fontSrc: ["'self'", ...csp.fontSrc],
-            frameSrc: ["'self'", ...csp.frameSrc],
-          },
-        },
-      }),
-    );
-  } else if (isHelmetOptions(csp)) {
-    app.use(helmet(csp));
-  } else {
-    throw new TranslatableSuiteError(
-      SuiteCoreStringKey.Error_InvalidCspOrHelmetOptionsProvided,
-    );
-  }
-  // Enable CORS
-  app.use(cors(corsOptionsDelegate(corsWhitelist)));
-  // Parse incoming requests with JSON payloads
-  app.use(json());
-  // Parse incoming requests with urlencoded payloads
-  app.use(urlencoded({ extended: true }));
-};

package/src/middlewares/authenticate-crypto.ts

@@ -1,237 +0,0 @@
-/**
- * @fileoverview Cryptographic authentication middleware for operations requiring private keys.
- * Validates mnemonic or password to unlock user's private key for sensitive operations.
- * @module middlewares/authenticate-crypto
- */
-
-import { SecureString } from '@digitaldefiance/ecies-lib';
-import { ClientSession } from '@digitaldefiance/mongoose-types';
-import {
-  Member as BackendMember,
-  PlatformID,
-} from '@digitaldefiance/node-ecies-lib';
-import {
-  AccountStatus,
-  getSuiteCoreTranslation,
-  InvalidCredentialsError,
-  SuiteCoreStringKey,
-} from '@digitaldefiance/suite-core-lib';
-import { NextFunction, Request, Response } from 'express';
-import { ServiceKeys } from '../container';
-import { IUserDocument } from '../documents/user';
-import { BaseModelName } from '../enumerations';
-import { InvalidPasswordError } from '../errors';
-import { IApplication } from '../interfaces/application';
-import { withTransaction } from '../utils';
-
-/**
- * Express middleware for cryptographic authentication.
- * Requires mnemonic or password in request body to unlock user's private key.
- * Attaches authenticated BackendMember with private key to req.eciesUser.
- * Used for operations requiring cryptographic signing or decryption.
- * @template TID - Platform ID type (defaults to Buffer)
- * @template TAccountStatus - Account status type (defaults to AccountStatus)
- * @param {IApplication<TID>} application - Application instance
- * @param {Request} req - Express request object
- * @param {Response} res - Express response object
- * @param {NextFunction} next - Express next function
- * @param {TAccountStatus} [activeStatusValue] - Expected active account status
- * @returns {Promise<Response | void>} Response or void if successful
- * @throws {InvalidCredentialsError} When credentials are invalid
- * @throws {InvalidPasswordError} When password is incorrect
- */
-export async function authenticateCrypto<
-  TID extends PlatformID = Buffer,
-  TAccountStatus extends string = AccountStatus,
->(
-  application: IApplication<TID>,
-  req: Request,
-  res: Response,
-  next: NextFunction,
-  activeStatusValue: TAccountStatus = AccountStatus.Active as TAccountStatus,
-): Promise<Response | void> {
-  if (!req.user) {
-    return res.status(401).send(
-      // amazonq-ignore-next-line false positive, hardcoded string
-      getSuiteCoreTranslation(SuiteCoreStringKey.Validation_InvalidToken),
-    );
-  }
-
-  // Try validatedBody first (if validation has run), then fall back to raw body
-  // Note: This middleware runs BEFORE validation, so validatedBody may not exist yet
-  const validatedBody = (req as Request & { validatedBody?: unknown })
-    .validatedBody as Record<string, unknown> | undefined;
-  const rawBody = req.body as Record<string, unknown> | undefined;
-  const sourceBody = validatedBody ?? rawBody;
-
-  if (!sourceBody) {
-    return res.status(400).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-      ),
-    });
-  }
-
-  const mnemonic =
-    typeof sourceBody['mnemonic'] === 'string'
-      ? (sourceBody['mnemonic'] as string)
-      : undefined;
-  const password =
-    // amazonq-ignore-next-line false positive
-    typeof sourceBody['password'] === 'string'
-      ? (sourceBody['password'] as string)
-      : undefined;
-  if (!mnemonic && !password) {
-    return res.status(400).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-      ),
-    });
-  }
-  const UserModel = application.getModel<IUserDocument<string, TID>>(
-    BaseModelName.User,
-  );
-  const userService = application.services.get(ServiceKeys.USER) as {
-    loginWithMnemonic: (
-      email: string,
-      mnemonic: SecureString,
-      session?: ClientSession,
-    ) => Promise<any>;
-    loginWithPassword: (
-      email: string,
-      password: string,
-      session?: ClientSession,
-    ) => Promise<any>;
-  };
-
-  try {
-    return await withTransaction<Response | void>(
-      application.db.connection,
-      application.environment.mongo.useTransactions,
-      undefined,
-      async (sess: ClientSession | undefined) => {
-        const userDoc = await UserModel.findById(req.user!.id)
-          .session(sess ?? null)
-          .exec();
-
-        if (!userDoc || userDoc.accountStatus !== activeStatusValue) {
-          return res.status(403).send(
-            // amazonq-ignore-next-line false positive, hardcoded string
-            getSuiteCoreTranslation(SuiteCoreStringKey.Validation_UserNotFound),
-          );
-        }
-
-        // Ensure we're only authenticating the currently logged-in user
-        if (userDoc._id.toString() !== req.user!.id) {
-          return res.status(403).send(
-            // amazonq-ignore-next-line false positive, hardcoded string
-            getSuiteCoreTranslation(
-              SuiteCoreStringKey.Validation_InvalidCredentials,
-            ),
-          );
-        }
-
-        let loginResult: {
-          userDoc: IUserDocument;
-          userMember: BackendMember;
-          adminMember: BackendMember;
-        };
-
-        if (mnemonic) {
-          // Authenticate with mnemonic
-          const userMnemonic = new SecureString(mnemonic);
-          try {
-            loginResult = await userService.loginWithMnemonic(
-              userDoc.email,
-              userMnemonic,
-              sess,
-            );
-          } finally {
-            userMnemonic.dispose();
-          }
-        } else if (password) {
-          // Authenticate with password
-          loginResult = await userService.loginWithPassword(
-            userDoc.email,
-            password,
-            sess,
-          );
-        } else {
-          // Should not happen due to earlier guard; keeps TypeScript happy
-          return res.status(400).send({
-            // amazonq-ignore-next-line false positive, hardcoded string
-            message: getSuiteCoreTranslation(
-              SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired,
-            ),
-          });
-        }
-
-        // Double-check authenticated user matches logged-in user
-        if (loginResult.userDoc._id.toString() !== req.user!.id) {
-          return res.status(403).send(
-            // amazonq-ignore-next-line false positive, hardcoded string
-            getSuiteCoreTranslation(
-              SuiteCoreStringKey.Validation_InvalidCredentials,
-            ),
-          );
-        }
-
-        // Attach the fully authenticated member (with private key) to the request
-        req.eciesUser = loginResult.userMember;
-        // Do not attach the admin user to the request; it's a process-wide singleton
-        // and must not be disposed as part of request cleanup.
-
-        next();
-        return;
-      },
-      {
-        timeoutMs: application.environment.mongo.transactionTimeout,
-      },
-    );
-  } catch (err) {
-    if (
-      err instanceof InvalidCredentialsError ||
-      err instanceof InvalidPasswordError
-    ) {
-      // amazonq-ignore-next-line false positive
-      console.error(
-        'Crypto authentication failed:',
-        `userId=${String(req.user?.id || 'unknown').replace(
-          /[\r\n]/g,
-          '',
-        )} hasPassword=${!!password} hasMnemonic=${!!mnemonic}`,
-      );
-      return res.status(401).send({
-        // amazonq-ignore-next-line false positive, hardcoded string
-        message: getSuiteCoreTranslation(
-          SuiteCoreStringKey.Validation_InvalidCredentials,
-        ),
-      });
-    }
-    const sanitizedErr =
-      err instanceof Error
-        ? err.message.replace(/[\r\n]/g, ' ')
-        : String(err).replace(/[\r\n]/g, ' ');
-    console.error(
-      `${getSuiteCoreTranslation(
-        SuiteCoreStringKey.Error_UnexpectedErrorInAuthenticateCrypto,
-      )}:`,
-      sanitizedErr,
-    );
-    if (err instanceof Error && err.stack) {
-      console.error(
-        `${getSuiteCoreTranslation(SuiteCoreStringKey.Common_StackTrace)}:`,
-        err.stack,
-      );
-    }
-    return res.status(500).send({
-      // amazonq-ignore-next-line false positive, hardcoded string
-      message: getSuiteCoreTranslation(
-        SuiteCoreStringKey.Common_UnexpectedError,
-      ),
-      error: err,
-    });
-  }
-}

package/src/middlewares/authenticate-token.ts

@@ -1,165 +0,0 @@
-/**
- * @fileoverview JWT token authentication middleware.
- * Validates bearer tokens, loads user data, and sets up request context.
- * @module middlewares/authenticate-token
- */
-
-import type { Timezone as TimezoneType } from '@digitaldefiance/i18n-lib';
-import { GlobalActiveContext } from '@digitaldefiance/i18n-lib';
-import { ClientSession } from '@digitaldefiance/mongoose-types';
-import {
-  AccountStatus,
-  getSuiteCoreTranslation,
-  ITokenRole,
-  ITokenUser,
-  SuiteCoreStringKey,
-} from '@digitaldefiance/suite-core-lib';
-import { NextFunction, Request, Response } from 'express';
-import { IncomingHttpHeaders } from 'http';
-import { IUserDocument } from '../documents/user';
-import { BaseModelName } from '../enumerations/base-model-name';
-import { TokenExpiredError } from '../errors/token-expired';
-import { IApplication } from '../interfaces/application';
-import { JwtService } from '../services/jwt';
-import { RequestUserService } from '../services/request-user';
-import { RoleService } from '../services/role';
-import { withTransaction } from '../utils';
-import type { PlatformID } from '@digitaldefiance/node-ecies-lib';
-
-// Type for Timezone constructor
-type TimezoneConstructor = new (tz: string) => TimezoneType;
-
-// Helper to create Timezone from the same module instance as GlobalActiveContext
-function createTimezone(tz: string): TimezoneType {
-  const context = GlobalActiveContext.getInstance();
-  const TimezoneConstructor = context.adminTimezone
-    .constructor as TimezoneConstructor;
-  return new TimezoneConstructor(tz);
-}
-
-/**
- * Extracts bearer token from HTTP request headers.
- * @param {IncomingHttpHeaders} headers - HTTP request headers
- * @returns {string | null} Bearer token if found, null otherwise
- */
-export function findAuthToken(headers: IncomingHttpHeaders): string | null {
-  const authHeader = headers['Authorization'] || headers['authorization'];
-  if (authHeader && typeof authHeader === 'string') {
-    const parts = authHeader.split(' ');
-    if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') {
-      return parts[1];
-    }
-  }
-  return null;
-}
-
-/**
- * Express middleware for JWT token authentication.
- * Validates token, loads user from database, checks account status,
- * and populates req.user with authenticated user data.
- * @template TID - Platform ID type (defaults to Buffer)
- * @template D - Date type (defaults to Date)
- * @template TTokenRole - Token role interface type
- * @template TTokenUser - Token user interface type
- * @template TApplication - Application interface type
- * @param {TApplication} application - Application instance
- * @param {Request} req - Express request object
- * @param {Response} res - Express response object
- * @param {NextFunction} next - Express next function
- * @returns {Promise<Response>} Response object
- * @throws {TokenExpiredError} When token has expired
- */
-export async function authenticateToken<
-  TID extends PlatformID = Buffer,
-  D extends Date = Date,
-  TTokenRole extends ITokenRole<TID, D> = ITokenRole<TID, D>,
-  TTokenUser extends ITokenUser = ITokenUser,
-  TApplication extends IApplication<TID> = IApplication<TID>,
->(
-  application: TApplication,
-  req: Request,
-  res: Response,
-  next: NextFunction,
-): Promise<Response> {
-  const UserModel = application.getModel<IUserDocument<string, TID>>(
-    BaseModelName.User,
-  );
-  const token = findAuthToken(req.headers);
-  if (token == null) {
-    return res
-      .status(401)
-      .send(
-        getSuiteCoreTranslation(SuiteCoreStringKey.Validation_InvalidToken),
-      );
-  }
-
-  try {
-    return await withTransaction<Response>(
-      application.db.connection,
-      application.environment.mongo.useTransactions,
-      undefined,
-      async (sess: ClientSession | undefined) => {
-        const jwtService = new JwtService<
-          TID,
-          D,
-          TTokenRole,
-          TTokenUser,
-          TApplication
-        >(application);
-        const user: TTokenUser | null = await jwtService.verifyToken(token);
-        if (user === null) {
-          return res.status(403).send(
-            // amazonq-ignore-next-line false positive, hardcoded string
-            getSuiteCoreTranslation(SuiteCoreStringKey.Validation_UserNotFound),
-          );
-        }
-        const userDoc = await UserModel.findById(user.userId)
-          .select('-password')
-          .session(sess ?? null)
-          .exec();
-        if (!userDoc || userDoc.accountStatus !== AccountStatus.Active) {
-          return res.status(403).send(
-            // amazonq-ignore-next-line false positive, hardcoded string
-            getSuiteCoreTranslation(SuiteCoreStringKey.Validation_UserNotFound),
-          );
-        }
-        const roleService = new RoleService<TID, D, TTokenRole>(application);
-        const roles = await roleService.getUserRoles(userDoc._id as TID, sess);
-        const tokenRoles = roleService.rolesToTokenRoles(roles);
-        req.user = RequestUserService.makeRequestUserDTO(userDoc, tokenRoles);
-        const context = GlobalActiveContext.getInstance();
-        context.userLanguage = userDoc.siteLanguage ?? context.userLanguage;
-        context.setLanguageContextSpace('user');
-        context.userTimezone = createTimezone(userDoc.timezone);
-        next();
-        return res;
-      },
-      {
-        timeoutMs: application.environment.mongo.transactionTimeout,
-      },
-    );
-  } catch (err) {
-    if (err instanceof TokenExpiredError) {
-      return res.status(401).send({
-        message: getSuiteCoreTranslation(
-          SuiteCoreStringKey.Validation_TokenExpired,
-        ),
-        error: err,
-      });
-    } else if (err instanceof Error && err.name === 'JsonWebTokenError') {
-      return res.status(400).send({
-        message: getSuiteCoreTranslation(
-          SuiteCoreStringKey.Validation_InvalidToken,
-        ),
-        error: err,
-      });
-    } else {
-      return res.status(500).send({
-        message: getSuiteCoreTranslation(
-          SuiteCoreStringKey.Common_UnexpectedError,
-        ),
-        error: err,
-      });
-    }
-  }
-}

package/src/middlewares/cleanup-crypto.ts

@@ -1,47 +0,0 @@
-/**
- * @fileoverview Cleanup middleware for disposing cryptographic resources.
- * Ensures private keys and sensitive material are properly disposed after request completion.
- * @module middlewares/cleanup-crypto
- */
-
-import { NextFunction, Request, Response } from 'express';
-
-/**
- * Express middleware to cleanup cryptographic resources after request completion.
- * Wraps response.end() to dispose of req.eciesUser before sending response.
- * Should be registered early in middleware chain to ensure cleanup on all responses.
- * @param {Request} req - Express request object
- * @param {Response} res - Express response object
- * @param {NextFunction} next - Express next function
- */
-export function cleanupCrypto(
-  req: Request,
-  res: Response,
-  next: NextFunction,
-): void {
-  // Store original end function
-  const originalEnd = res.end;
-
-  // Override end function to cleanup before response
-  const wrappedEnd = function (this: Response, ...args: unknown[]) {
-    // Cleanup eciesUser if it exists
-    if (req.eciesUser) {
-      try {
-        // Dispose of sensitive cryptographic material
-        req.eciesUser.dispose();
-        req.eciesUser = undefined;
-      } catch (error) {
-        console.error('Error cleaning up crypto resources:', error);
-      }
-    }
-    // Do not dispose system user here; it may be a process-wide singleton
-
-    // Call original end function
-    // Type assertion needed because we're wrapping the end function
-    return originalEnd.apply(this, args as Parameters<typeof originalEnd>);
-  } as typeof res.end;
-
-  res.end = wrappedEnd;
-
-  next();
-}