@etcsec-com/etc-collector 1.4.0

package/src/api/controllers/providers.controller.ts

@@ -0,0 +1,165 @@
+import { Request, Response, NextFunction } from 'express';
+import type { Logger } from 'winston';
+import { logger } from '../../utils/logger';
+import { LDAPConfig, AzureConfig } from '../../types/config.types';
+import { GraphProvider } from '../../providers/azure/graph.provider';
+
+/**
+ * Provider info without sensitive data
+ */
+interface ProviderInfo {
+  name: string;
+  enabled: boolean;
+  status: 'configured' | 'not_configured' | 'partial';
+  details?: Record<string, unknown>;
+}
+
+/**
+ * ProvidersController
+ *
+ * Handles provider information endpoints.
+ *
+ * Endpoints:
+ * - GET /api/v1/providers/info - Get all configured providers info
+ */
+export class ProvidersController {
+  private logger: Logger;
+
+  constructor(
+    private ldapConfig: LDAPConfig,
+    private azureConfig: AzureConfig,
+    private graphProvider?: GraphProvider
+  ) {
+    this.logger = logger;
+  }
+
+  /**
+   * GET /api/v1/providers/info
+   * Get information about all configured providers
+   *
+   * This endpoint requires PROVIDERS_INFO_ENABLED=true.
+   * Returns non-sensitive configuration details for each provider.
+   *
+   * Response:
+   * - 200: Providers information
+   * - 500: Server error
+   */
+  async getProvidersInfo(_req: Request, res: Response, next: NextFunction): Promise<void> {
+    try {
+      const providers: ProviderInfo[] = [];
+
+      // LDAP/Active Directory provider
+      const ldapProvider = this.getLDAPProviderInfo();
+      providers.push(ldapProvider);
+
+      // Azure/Entra ID provider - use config tenantName or fetch from API
+      let tenantInfo: { displayName: string; verifiedDomains: string[] } | null = null;
+      if (this.azureConfig.tenantName) {
+        // Use configured tenant name
+        tenantInfo = { displayName: this.azureConfig.tenantName, verifiedDomains: [] };
+      } else if (this.graphProvider && this.azureConfig.enabled) {
+        // Try to fetch from API
+        try {
+          const org = await this.graphProvider.getOrganization();
+          tenantInfo = { displayName: org.displayName, verifiedDomains: org.verifiedDomains };
+        } catch (err) {
+          this.logger.debug('Could not fetch Azure organization info', { error: err });
+        }
+      }
+      const azureProvider = this.getAzureProviderInfo(tenantInfo);
+      providers.push(azureProvider);
+
+      this.logger.debug('Providers info requested', {
+        providerCount: providers.length,
+        providers: providers.map((p) => ({ name: p.name, enabled: p.enabled })),
+      });
+
+      res.json({
+        success: true,
+        providers,
+        summary: {
+          total: providers.length,
+          enabled: providers.filter((p) => p.enabled).length,
+          configured: providers.filter((p) => p.status === 'configured').length,
+        },
+      });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  /**
+   * Get LDAP provider info (non-sensitive)
+   */
+  private getLDAPProviderInfo(): ProviderInfo {
+    const hasUrl = !!this.ldapConfig.url;
+    const hasBindDN = !!this.ldapConfig.bindDN;
+    const hasBaseDN = !!this.ldapConfig.baseDN;
+    const hasPassword = !!this.ldapConfig.bindPassword;
+
+    const isConfigured = hasUrl && hasBindDN && hasBaseDN && hasPassword;
+    const isPartial = (hasUrl || hasBindDN || hasBaseDN) && !isConfigured;
+
+    // Extract domain from URL without exposing IP
+    let serverInfo = 'not configured';
+    if (hasUrl) {
+      try {
+        const url = new URL(this.ldapConfig.url);
+        serverInfo = `${url.protocol}//${url.hostname}:${url.port || (url.protocol === 'ldaps:' ? '636' : '389')}`;
+      } catch {
+        serverInfo = 'invalid URL';
+      }
+    }
+
+    return {
+      name: 'active-directory',
+      enabled: isConfigured,
+      status: isConfigured ? 'configured' : isPartial ? 'partial' : 'not_configured',
+      details: {
+        server: serverInfo,
+        baseDN: this.ldapConfig.baseDN || 'not configured',
+        tlsVerify: this.ldapConfig.tlsVerify,
+        timeout: this.ldapConfig.timeout,
+        hasCACert: !!this.ldapConfig.caCertPath,
+      },
+    };
+  }
+
+  /**
+   * Get Azure provider info (non-sensitive)
+   */
+  private getAzureProviderInfo(
+    tenantInfo: { displayName: string; verifiedDomains: string[] } | null
+  ): ProviderInfo {
+    const isEnabled = this.azureConfig.enabled;
+    const hasTenantId = !!this.azureConfig.tenantId;
+    const hasClientId = !!this.azureConfig.clientId;
+    const hasClientSecret = !!this.azureConfig.clientSecret;
+
+    const isConfigured = isEnabled && hasTenantId && hasClientId && hasClientSecret;
+    const isPartial = isEnabled && !isConfigured;
+
+    return {
+      name: 'azure-entra-id',
+      enabled: isEnabled,
+      status: isConfigured ? 'configured' : isPartial ? 'partial' : 'not_configured',
+      details: {
+        tenantName: tenantInfo?.displayName || 'not available',
+        tenantId: this.azureConfig.tenantId || 'not configured',
+        verifiedDomains: tenantInfo?.verifiedDomains || [],
+        clientId: hasClientId ? this.maskString(this.azureConfig.clientId!) : 'not configured',
+        hasClientSecret: hasClientSecret,
+      },
+    };
+  }
+
+  /**
+   * Mask a string for display (show first and last 4 chars)
+   */
+  private maskString(str: string): string {
+    if (str.length <= 8) {
+      return '****';
+    }
+    return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
+  }
+}

package/src/api/dto/AuditRequest.dto.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO for audit request parameters
+ */
+export interface AuditRequestDto {
+  includeDetails?: boolean;
+  includeComputers?: boolean;
+  includeConfig?: boolean;
+}

package/src/api/dto/AuditResponse.dto.ts

@@ -0,0 +1,19 @@
+/**
+ * DTO for audit response structure
+ */
+export interface AuditResponseDto {
+  success: boolean;
+  provider: 'active-directory' | 'azure';
+  auditId: string;
+  timestamp: string;
+  summary: {
+    totalFindings: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    riskScore: number;
+  };
+  findings?: unknown[]; // Will be properly typed in later stories
+  metadata?: Record<string, unknown>;
+}

package/src/api/dto/TokenRequest.dto.ts

@@ -0,0 +1,8 @@
+/**
+ * DTO for token generation request
+ */
+export interface TokenRequestDto {
+  expiresIn?: string;
+  maxUses?: number;
+  metadata?: Record<string, string>;
+}

package/src/api/dto/TokenResponse.dto.ts

@@ -0,0 +1,14 @@
+/**
+ * DTO for token information response
+ */
+export interface TokenResponseDto {
+  jti: string;
+  token?: string;
+  createdAt: string;
+  expiresAt: string;
+  maxUses: number;
+  usedCount: number;
+  revoked: boolean;
+  revokedAt?: string;
+  revokedReason?: string;
+}

package/src/api/middlewares/authenticate.ts

@@ -0,0 +1,203 @@
+import { Request, Response, NextFunction } from 'express';
+import { TokenService } from '../../services/auth/token.service';
+import { logger } from '../../utils/logger';
+import {
+  TokenExpiredError,
+  TokenRevokedError,
+  UsageLimitExceededError,
+  TokenNotFoundError,
+  InvalidSignatureError,
+  InvalidTokenError,
+} from '../../services/auth/errors';
+
+/**
+ * Authentication Middleware
+ *
+ * Validates JWT tokens from Authorization header and enforces usage quotas.
+ *
+ * Features:
+ * - Extracts token from Authorization: Bearer <token> header
+ * - Validates JWT signature and constraints
+ * - Increments usage count on successful authentication
+ * - Attaches token info to request object
+ * - Returns appropriate error responses (401/403)
+ *
+ * Task 3: Authentication Middleware (Story 1.4)
+ */
+
+/**
+ * Extended Request interface with token information
+ */
+export interface AuthenticatedRequest extends Request {
+  token?: {
+    jti: string;
+    iat: number;
+    exp: number;
+    maxUses: number;
+  };
+}
+
+/**
+ * Create authentication middleware with token service
+ *
+ * Usage:
+ * ```typescript
+ * router.post('/protected', authenticate(tokenService), controller.method);
+ * ```
+ *
+ * @param tokenService TokenService instance for validation
+ * @returns Express middleware function
+ */
+export const authenticate = (tokenService: TokenService) => {
+  return async (req: AuthenticatedRequest, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      // 1. Extract token from Authorization header (Bearer <token>)
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        logger.warn('Authentication failed: missing or invalid Authorization header', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'AUTHENTICATION_FAILED',
+            message: 'Missing or invalid Authorization header',
+          },
+        });
+        return;
+      }
+
+      const token = authHeader.substring(7); // Remove 'Bearer '
+
+      // 2. Validate token
+      const payload = await tokenService.validate(token);
+
+      // 3. Increment usage count
+      await tokenService.incrementUsage(payload.jti);
+
+      // 4. Attach token info to request
+      req.token = {
+        jti: payload.jti,
+        iat: payload.iat,
+        exp: payload.exp,
+        maxUses: payload.maxUses,
+      };
+
+      // 5. Log successful authentication
+      logger.debug('Request authenticated', {
+        jti: payload.jti,
+        path: req.path,
+        method: req.method,
+      });
+
+      next();
+    } catch (error) {
+      // Handle authentication errors with specific error codes
+
+      if (error instanceof TokenExpiredError) {
+        logger.warn('Authentication failed: token expired', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'TOKEN_EXPIRED',
+            message: 'Token has expired',
+          },
+        });
+        return;
+      }
+
+      if (error instanceof TokenRevokedError) {
+        logger.warn('Authentication failed: token revoked', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'TOKEN_REVOKED',
+            message: 'Token has been revoked',
+          },
+        });
+        return;
+      }
+
+      if (error instanceof UsageLimitExceededError) {
+        logger.warn('Authentication failed: usage limit exceeded', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(403).json({
+          success: false,
+          error: {
+            code: 'USAGE_LIMIT_EXCEEDED',
+            message: 'Token usage limit exceeded',
+          },
+        });
+        return;
+      }
+
+      if (error instanceof TokenNotFoundError) {
+        logger.warn('Authentication failed: token not found', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'AUTHENTICATION_FAILED',
+            message: 'Invalid token',
+          },
+        });
+        return;
+      }
+
+      if (error instanceof InvalidSignatureError) {
+        logger.warn('Authentication failed: invalid signature', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'AUTHENTICATION_FAILED',
+            message: 'Invalid token signature',
+          },
+        });
+        return;
+      }
+
+      if (error instanceof InvalidTokenError) {
+        logger.warn('Authentication failed: invalid token', {
+          path: req.path,
+          method: req.method,
+        });
+        res.status(401).json({
+          success: false,
+          error: {
+            code: 'AUTHENTICATION_FAILED',
+            message: 'Invalid token',
+          },
+        });
+        return;
+      }
+
+      // Generic error for unexpected cases
+      logger.error('Authentication failed: unexpected error', {
+        path: req.path,
+        method: req.method,
+        error: error instanceof Error ? error.message : 'Unknown error',
+      });
+      res.status(401).json({
+        success: false,
+        error: {
+          code: 'AUTHENTICATION_FAILED',
+          message: 'Authentication failed',
+        },
+      });
+    }
+  };
+};

package/src/api/middlewares/errorHandler.ts

@@ -0,0 +1,54 @@
+import { Request, Response, NextFunction } from 'express';
+import { BaseError } from '../../types/error.types';
+import { logError } from '../../utils/logger';
+
+/**
+ * Centralized error handling middleware
+ * Catches all errors and formats consistent error responses
+ */
+export const errorHandler = (
+  error: Error,
+  _req: Request,
+  res: Response,
+  _next: NextFunction
+): void => {
+  // Log the error
+  logError('Error caught by error handler', error, {
+    path: _req.path,
+    method: _req.method,
+  });
+
+  // Determine if this is an operational error
+  const isOperational = error instanceof BaseError && error.isOperational;
+  const statusCode = error instanceof BaseError ? error.statusCode : 500;
+
+  // Determine error code
+  const errorCode =
+    error.name !== 'Error' ? error.name.replace(/([A-Z])/g, '_$1').toUpperCase() : 'INTERNAL_SERVER_ERROR';
+
+  // Build error response
+  const errorResponse: {
+    success: false;
+    error: {
+      code: string;
+      message: string;
+      details?: unknown;
+    };
+  } = {
+    success: false,
+    error: {
+      code: errorCode,
+      message: error.message || 'An unexpected error occurred',
+    },
+  };
+
+  // In development, include stack trace and additional details
+  if (process.env['NODE_ENV'] === 'development') {
+    errorResponse.error.details = {
+      stack: error.stack,
+      isOperational,
+    };
+  }
+
+  res.status(statusCode).json(errorResponse);
+};

package/src/api/middlewares/rateLimit.ts

@@ -0,0 +1,35 @@
+import rateLimit from 'express-rate-limit';
+
+/**
+ * Rate limiting configuration
+ */
+
+// General API rate limit: 100 requests per minute
+export const apiLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 100,
+  message: {
+    success: false,
+    error: {
+      code: 'RATE_LIMIT_EXCEEDED',
+      message: 'Too many requests, please try again later',
+    },
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+// Audit endpoint rate limit: 10 audits per 5 minutes
+export const auditLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000, // 5 minutes
+  max: 10,
+  message: {
+    success: false,
+    error: {
+      code: 'AUDIT_RATE_LIMIT_EXCEEDED',
+      message: 'Too many audit requests, please try again later',
+    },
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+});

package/src/api/middlewares/validate.ts

@@ -0,0 +1,32 @@
+import { Request, Response, NextFunction } from 'express';
+import { z, ZodError } from 'zod';
+
+/**
+ * Zod validation middleware
+ * Validates request body against a Zod schema
+ */
+export const validate = (schema: z.ZodSchema) => {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    try {
+      // Validate and parse the request body
+      req.body = schema.parse(req.body);
+      next();
+    } catch (error) {
+      if (error instanceof ZodError) {
+        res.status(400).json({
+          success: false,
+          error: {
+            code: 'VALIDATION_ERROR',
+            message: 'Request validation failed',
+            details: error.issues.map((err) => ({
+              field: err.path.join('.'),
+              message: err.message,
+            })),
+          },
+        });
+        return;
+      }
+      next(error);
+    }
+  };
+};

package/src/api/routes/audit.routes.ts

@@ -0,0 +1,77 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { AuditController } from '../controllers/audit.controller';
+import { JobsController } from '../controllers/jobs.controller';
+import { validate } from '../middlewares/validate';
+import { authenticate } from '../middlewares/authenticate';
+import { auditLimiter } from '../middlewares/rateLimit';
+import { auditRequestSchema } from '../validators/audit.schemas';
+import { TokenService } from '../../services/auth/token.service';
+
+/**
+ * Audit routes
+ * POST /api/v1/audit/ad - Run AD audit (sync or async with ?async=true)
+ * GET /api/v1/audit/ad/status - Check LDAP connection
+ * POST /api/v1/audit/azure - Run Azure audit
+ * GET /api/v1/audit/azure/status - Check Graph connection
+ * GET /api/v1/audit/jobs - List all jobs
+ * GET /api/v1/audit/jobs/:jobId - Get job status/progress
+ * DELETE /api/v1/audit/jobs/:jobId - Delete/cancel a job
+ */
+export const createAuditRoutes = (controller: AuditController, tokenService: TokenService): Router => {
+  const router = Router();
+  const authMiddleware = authenticate(tokenService);
+  const jobsController = new JobsController();
+
+  // AD endpoints
+  router.post(
+    '/ad',
+    authMiddleware,
+    auditLimiter,
+    validate(auditRequestSchema),
+    (req: Request, res: Response, next: NextFunction) => controller.runADAudit(req, res, next)
+  );
+
+  router.get(
+    '/ad/status',
+    authMiddleware,
+    (req: Request, res: Response, next: NextFunction) => controller.getADStatus(req, res, next)
+  );
+
+  // Azure endpoints
+  router.post(
+    '/azure',
+    authMiddleware,
+    auditLimiter,
+    validate(auditRequestSchema),
+    (req: Request, res: Response, next: NextFunction) => controller.runAzureAudit(req, res, next)
+  );
+
+  router.get(
+    '/azure/status',
+    authMiddleware,
+    (req: Request, res: Response, next: NextFunction) => controller.getAzureStatus(req, res, next)
+  );
+
+  // Jobs endpoints (for async audit polling)
+  router.get(
+    '/jobs',
+    authMiddleware,
+    (req: Request, res: Response, next: NextFunction) => jobsController.listJobs(req, res, next)
+  );
+
+  router.get(
+    '/jobs/:jobId',
+    authMiddleware,
+    (req: Request<{ jobId: string }>, res: Response, next: NextFunction) =>
+      jobsController.getJobStatus(req, res, next)
+  );
+
+  router.delete(
+    '/jobs/:jobId',
+    authMiddleware,
+    (req: Request<{ jobId: string }>, res: Response, next: NextFunction) =>
+      jobsController.deleteJob(req, res, next)
+  );
+
+  return router;
+};