@etcsec-com/etc-collector 1.4.0

package/src/api/routes/auth.routes.ts

@@ -0,0 +1,71 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { AuthController } from '../controllers/auth.controller';
+import { validate } from '../middlewares/validate';
+import { authenticate } from '../middlewares/authenticate';
+import {
+  GenerateTokenSchema,
+  ValidateTokenSchema,
+  RevokeTokenSchema,
+} from '../validators/auth.schemas';
+import { TokenService } from '../../services/auth/token.service';
+import { InfoEndpointsConfig } from '../../types/config.types';
+
+/**
+ * Authentication routes
+ * POST /api/v1/auth/token - Generate JWT token
+ * POST /api/v1/auth/validate - Validate token
+ * POST /api/v1/auth/revoke - Revoke token
+ * GET /api/v1/auth/tokens - List all tokens
+ * GET /api/v1/auth/tokens/:jti - Get token info by jti
+ * GET /api/v1/auth/token/info - Get current token info (if TOKEN_INFO_ENABLED)
+ */
+export const createAuthRoutes = (
+  controller: AuthController,
+  tokenService: TokenService,
+  infoEndpointsConfig: InfoEndpointsConfig
+): Router => {
+  const router = Router();
+  const authMiddleware = authenticate(tokenService);
+
+  router.post(
+    '/token',
+    validate(GenerateTokenSchema),
+    (req, res, next) => controller.generateToken(req, res, next)
+  );
+
+  router.post(
+    '/validate',
+    validate(ValidateTokenSchema),
+    (req, res, next) => controller.validateToken(req, res, next)
+  );
+
+  router.post(
+    '/revoke',
+    authMiddleware,
+    validate(RevokeTokenSchema),
+    (req: Request, res: Response, next: NextFunction) => controller.revokeToken(req, res, next)
+  );
+
+  router.get(
+    '/tokens',
+    authMiddleware,
+    (req: Request, res: Response, next: NextFunction) => controller.listTokens(req, res, next)
+  );
+
+  // Get token info by jti (always available)
+  router.get(
+    '/tokens/:jti',
+    authMiddleware,
+    (req: Request, res: Response, next: NextFunction) => controller.getTokenInfo(req, res, next)
+  );
+
+  // Current token info endpoint (conditional - only if TOKEN_INFO_ENABLED)
+  if (infoEndpointsConfig.tokenInfoEnabled) {
+    router.get(
+      '/token/info',
+      (req: Request, res: Response, next: NextFunction) => controller.getCurrentTokenInfo(req, res, next)
+    );
+  }
+
+  return router;
+};

package/src/api/routes/export.routes.ts

@@ -0,0 +1,34 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { ExportController } from '../controllers/export.controller';
+import { validate } from '../middlewares/validate';
+import { authenticate } from '../middlewares/authenticate';
+import { exportRequestSchema } from '../validators/audit.schemas';
+import { TokenService } from '../../services/auth/token.service';
+
+/**
+ * Export routes
+ * POST /api/v1/export/ad - Export AD audit results
+ * POST /api/v1/export/azure - Export Azure audit results
+ */
+export const createExportRoutes = (controller: ExportController, tokenService: TokenService): Router => {
+  const router = Router();
+  const authMiddleware = authenticate(tokenService);
+
+  // AD export
+  router.post(
+    '/ad',
+    authMiddleware,
+    validate(exportRequestSchema),
+    (req: Request, res: Response, next: NextFunction) => controller.exportADAudit(req, res, next)
+  );
+
+  // Azure export
+  router.post(
+    '/azure',
+    authMiddleware,
+    validate(exportRequestSchema),
+    (req: Request, res: Response, next: NextFunction) => controller.exportAzureAudit(req, res, next)
+  );
+
+  return router;
+};

package/src/api/routes/health.routes.ts

@@ -0,0 +1,14 @@
+import { Router } from 'express';
+import { HealthController } from '../controllers/health.controller';
+
+/**
+ * Health check routes
+ * GET /health - Health check endpoint
+ */
+export const createHealthRoutes = (controller: HealthController): Router => {
+  const router = Router();
+
+  router.get('/health', (req, res) => controller.checkHealth(req, res));
+
+  return router;
+};

package/src/api/routes/index.ts

@@ -0,0 +1,40 @@
+import { Router } from 'express';
+import { createHealthRoutes } from './health.routes';
+import { createAuthRoutes } from './auth.routes';
+import { createAuditRoutes } from './audit.routes';
+import { createExportRoutes } from './export.routes';
+import { createProvidersRoutes } from './providers.routes';
+import { HealthController } from '../controllers/health.controller';
+import { AuthController } from '../controllers/auth.controller';
+import { AuditController } from '../controllers/audit.controller';
+import { ExportController } from '../controllers/export.controller';
+import { ProvidersController } from '../controllers/providers.controller';
+import { TokenService } from '../../services/auth/token.service';
+import { InfoEndpointsConfig } from '../../types/config.types';
+
+/**
+ * Main route aggregator
+ * Mounts all API routes
+ */
+export const createRoutes = (
+  healthController: HealthController,
+  authController: AuthController,
+  auditController: AuditController,
+  exportController: ExportController,
+  providersController: ProvidersController,
+  tokenService: TokenService,
+  infoEndpointsConfig: InfoEndpointsConfig
+): Router => {
+  const router = Router();
+
+  // Mount health check at root
+  router.use('/', createHealthRoutes(healthController));
+
+  // Mount API v1 routes
+  router.use('/api/v1/auth', createAuthRoutes(authController, tokenService, infoEndpointsConfig));
+  router.use('/api/v1/audit', createAuditRoutes(auditController, tokenService));
+  router.use('/api/v1/export', createExportRoutes(exportController, tokenService));
+  router.use('/api/v1/providers', createProvidersRoutes(providersController, infoEndpointsConfig));
+
+  return router;
+};

package/src/api/routes/providers.routes.ts

@@ -0,0 +1,24 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { ProvidersController } from '../controllers/providers.controller';
+import { InfoEndpointsConfig } from '../../types/config.types';
+
+/**
+ * Providers routes
+ * GET /api/v1/providers/info - Get all providers info (if PROVIDERS_INFO_ENABLED)
+ */
+export const createProvidersRoutes = (
+  controller: ProvidersController,
+  infoEndpointsConfig: InfoEndpointsConfig
+): Router => {
+  const router = Router();
+
+  // Providers info endpoint (conditional - only if PROVIDERS_INFO_ENABLED)
+  if (infoEndpointsConfig.providersInfoEnabled) {
+    router.get(
+      '/info',
+      (req: Request, res: Response, next: NextFunction) => controller.getProvidersInfo(req, res, next)
+    );
+  }
+
+  return router;
+};

package/src/api/validators/audit.schemas.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+
+/**
+ * Zod schemas for audit endpoints
+ */
+
+export const auditRequestSchema = z.object({
+  includeDetails: z.boolean().optional().default(false),
+  maxUsers: z.number().int().positive().optional(),
+  maxGroups: z.number().int().positive().optional(),
+  maxComputers: z.number().int().positive().optional(),
+  maxApps: z.number().int().positive().optional(),
+});
+
+export const exportRequestSchema = z.object({
+  auditResult: z.object({
+    score: z.object({
+      score: z.number(),
+      rating: z.string(),
+      weightedPoints: z.number(),
+      totalUsers: z.number(),
+      findings: z.object({
+        critical: z.number(),
+        high: z.number(),
+        medium: z.number(),
+        low: z.number(),
+        total: z.number(),
+      }),
+      categories: z.record(z.string(), z.number()),
+    }),
+    findings: z.array(
+      z.object({
+        type: z.string(),
+        severity: z.enum(['critical', 'high', 'medium', 'low']),
+        category: z.string(),
+        title: z.string(),
+        description: z.string(),
+        count: z.number(),
+        affectedEntities: z.array(z.string()).optional(),
+      })
+    ),
+    stats: z.object({
+      totalUsers: z.number().optional(),
+      totalGroups: z.number().optional(),
+      totalComputers: z.number().optional(),
+      totalApps: z.number().optional(),
+      totalPolicies: z.number().optional(),
+      totalFindings: z.number(),
+      executionTimeMs: z.number(),
+    }),
+    timestamp: z.coerce.date(),
+  }),
+  format: z.enum(['json', 'csv']),
+  domain: z.string().optional(),
+  tenantId: z.string().optional(),
+  includeDetails: z.boolean().optional(),
+  includeAffectedEntities: z.boolean().optional(),
+  delimiter: z.string().length(1).optional(),
+});

package/src/api/validators/auth.schemas.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+
+/**
+ * Zod Validation Schemas for Authentication Endpoints
+ *
+ * Provides type-safe request validation for JWT token management.
+ *
+ * Task 5: Create Zod Validation Schemas (Story 1.4)
+ */
+
+/**
+ * Generate Token Request Schema
+ *
+ * Validates token generation requests:
+ * - expiresIn: Duration string (e.g., '1h', '7d', '30d')
+ * - maxUses: Usage quota (0 = unlimited, >0 = limited uses)
+ * - metadata: Optional arbitrary metadata
+ */
+export const GenerateTokenSchema = z.object({
+  expiresIn: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'Invalid duration format. Expected: <number><unit> (e.g., 1h, 7d)')
+    .optional()
+    .default('1h'),
+  maxUses: z.number().int().min(0, 'maxUses must be >= 0').optional().default(0),
+  metadata: z.record(z.string(), z.any()).optional(),
+});
+
+/**
+ * Validate Token Request Schema
+ *
+ * Validates token validation requests:
+ * - token: JWT token string (non-empty)
+ */
+export const ValidateTokenSchema = z.object({
+  token: z.string().min(1, 'Token is required'),
+});
+
+/**
+ * Revoke Token Request Schema
+ *
+ * Validates token revocation requests:
+ * - jti: JWT ID (UUID v4 format)
+ * - reason: Optional revocation reason
+ */
+export const RevokeTokenSchema = z.object({
+  jti: z.string().uuid('Invalid JWT ID format'),
+  reason: z.string().optional(),
+});
+
+/**
+ * Type Inference from Zod Schemas
+ *
+ * These types are automatically inferred from the schemas above,
+ * ensuring type safety across the application.
+ */
+export type GenerateTokenRequest = z.infer<typeof GenerateTokenSchema>;
+export type ValidateTokenRequest = z.infer<typeof ValidateTokenSchema>;
+export type RevokeTokenRequest = z.infer<typeof RevokeTokenSchema>;

package/src/app.ts

@@ -0,0 +1,87 @@
+import express, { Express } from 'express';
+import helmet from 'helmet';
+import cors from 'cors';
+import swaggerUi from 'swagger-ui-express';
+import yaml from 'js-yaml';
+import fs from 'fs';
+import path from 'path';
+import { DIContainer } from './container';
+import { createRoutes } from './api/routes';
+import { apiLimiter } from './api/middlewares/rateLimit';
+import { errorHandler } from './api/middlewares/errorHandler';
+
+/**
+ * Express Application Setup
+ * Configures middleware and mounts routes
+ */
+export function createApp(): Express {
+  const app = express();
+
+  // Security middleware (skip helmet for swagger)
+  app.use((req, res, next) => {
+    if (req.path.startsWith('/swagger')) {
+      return next();
+    }
+    helmet()(req, res, next);
+  });
+  app.use(cors());
+
+  // Body parsing
+  app.use(express.json());
+  app.use(express.urlencoded({ extended: true }));
+
+  // Rate limiting
+  app.use('/api/', apiLimiter);
+
+  // Swagger UI - load OpenAPI spec (MUST be before other routes)
+  try {
+    const openapiPath = path.join(__dirname, '../docs/api/openapi.yaml');
+    const openapiSpec = yaml.load(fs.readFileSync(openapiPath, 'utf8')) as object;
+    app.use('/swagger', swaggerUi.serve, swaggerUi.setup(openapiSpec, {
+      customCss: '.swagger-ui .topbar { display: none }',
+      customSiteTitle: 'ETC Collector API',
+    }));
+  } catch (err) {
+    console.error('Failed to load Swagger:', err);
+  }
+
+  // Get controllers and services from DI container
+  const container = DIContainer.getInstance();
+  const healthController = container.getHealthController();
+  const authController = container.getAuthController();
+  const auditController = container.getAuditController();
+  const exportController = container.getExportController();
+  const providersController = container.getProvidersController();
+  const tokenService = container.getTokenService();
+  const infoEndpointsConfig = container.getInfoEndpointsConfig();
+
+  // Mount routes
+  app.use(
+    '/',
+    createRoutes(
+      healthController,
+      authController,
+      auditController,
+      exportController,
+      providersController,
+      tokenService,
+      infoEndpointsConfig
+    )
+  );
+
+  // 404 handler
+  app.use((_req, res) => {
+    res.status(404).json({
+      success: false,
+      error: {
+        code: 'NOT_FOUND',
+        message: 'The requested resource was not found',
+      },
+    });
+  });
+
+  // Error handler (must be last)
+  app.use(errorHandler);
+
+  return app;
+}

package/src/config/config.schema.ts

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+
+/**
+ * Configuration Schema (Zod validation)
+ * Validates all environment variables at startup
+ */
+
+const ConfigSchema = z.object({
+  server: z.object({
+    port: z.coerce.number().int().positive().default(8443),
+    nodeEnv: z.enum(['development', 'production', 'test']).default('production'),
+  }),
+
+  // Info endpoints configuration (disabled by default for security)
+  infoEndpoints: z.object({
+    tokenInfoEnabled: z
+      .union([z.boolean(), z.string()])
+      .transform((val) => {
+        if (typeof val === 'boolean') return val;
+        return val === 'true' || val === '1';
+      })
+      .default(false),
+    providersInfoEnabled: z
+      .union([z.boolean(), z.string()])
+      .transform((val) => {
+        if (typeof val === 'boolean') return val;
+        return val === 'true' || val === '1';
+      })
+      .default(false),
+  }),
+
+  jwt: z.object({
+    privateKeyPath: z.string().default('./keys/private.pem'),
+    publicKeyPath: z.string().default('./keys/public.pem'),
+    tokenExpiry: z.string().default('1h'),
+    tokenMaxUses: z.coerce.number().int().min(0).default(10),
+  }),
+
+  ldap: z.object({
+    url: z.string().url('LDAP_URL must be a valid URL'),
+    bindDN: z.string().min(1, 'LDAP_BIND_DN is required'),
+    bindPassword: z.string().min(1, 'LDAP_BIND_PASSWORD is required'),
+    baseDN: z.string().min(1, 'LDAP_BASE_DN is required'),
+    tlsVerify: z.coerce.boolean().default(true),
+    caCertPath: z.string().optional(),
+    timeout: z.coerce.number().int().positive().default(30000),
+    skipHostnameVerification: z.coerce.boolean().default(false),
+    tlsServername: z.string().optional(),
+  }),
+
+  azure: z
+    .object({
+      enabled: z
+        .union([z.boolean(), z.string()])
+        .transform((val) => {
+          if (typeof val === 'boolean') return val;
+          return val === 'true' || val === '1';
+        })
+        .default(false),
+      tenantId: z.string().optional(),
+      tenantName: z.string().optional(),
+      clientId: z.string().optional(),
+      clientSecret: z.string().optional(),
+    })
+    .refine(
+      (data) => {
+        // If enabled, all fields are required
+        if (data.enabled) {
+          return data.tenantId && data.clientId && data.clientSecret;
+        }
+        return true;
+      },
+      {
+        message: 'AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET are required when AZURE_ENABLED=true',
+      }
+    ),
+
+  smb: z.object({
+    enabled: z
+      .union([z.boolean(), z.string()])
+      .transform((val) => {
+        if (typeof val === 'boolean') return val;
+        return val === 'true' || val === '1';
+      })
+      .default(false),
+    username: z.string().optional(),
+    password: z.string().optional(),
+    timeout: z.coerce.number().int().positive().default(10000),
+  }).default({
+    enabled: false,
+    timeout: 10000,
+  }),
+
+  logging: z.object({
+    level: z.enum(['error', 'warn', 'info', 'debug']).default('info'),
+    format: z.enum(['json', 'simple']).default('json'),
+  }),
+
+  database: z.object({
+    path: z.string().default('./data/etc-collector.db'),
+    enableWAL: z.coerce.boolean().default(true),
+    busyTimeout: z.coerce.number().int().positive().default(5000),
+  }),
+});
+
+export type Config = z.infer<typeof ConfigSchema>;
+
+export { ConfigSchema };

package/src/config/index.ts

@@ -0,0 +1,82 @@
+import dotenv from 'dotenv';
+import { ConfigSchema, Config } from './config.schema';
+
+/**
+ * Configuration Loader
+ * Loads and validates environment variables with Zod
+ */
+
+// Load .env file in development
+if (process.env['NODE_ENV'] === 'development') {
+  dotenv.config();
+}
+
+/**
+ * Load and validate configuration
+ * Throws error if validation fails
+ */
+export function loadConfig(): Config {
+  const rawConfig = {
+    server: {
+      port: process.env['PORT'],
+      nodeEnv: process.env['NODE_ENV'],
+    },
+    infoEndpoints: {
+      tokenInfoEnabled: process.env['TOKEN_INFO_ENABLED'],
+      providersInfoEnabled: process.env['PROVIDERS_INFO_ENABLED'],
+    },
+    jwt: {
+      privateKeyPath: process.env['JWT_PRIVATE_KEY_PATH'],
+      publicKeyPath: process.env['JWT_PUBLIC_KEY_PATH'],
+      tokenExpiry: process.env['TOKEN_EXPIRY'],
+      tokenMaxUses: process.env['TOKEN_MAX_USES'],
+    },
+    ldap: {
+      url: process.env['LDAP_URL'],
+      bindDN: process.env['LDAP_BIND_DN'],
+      bindPassword: process.env['LDAP_BIND_PASSWORD'],
+      baseDN: process.env['LDAP_BASE_DN'],
+      tlsVerify: process.env['LDAP_TLS_VERIFY'],
+      caCertPath: process.env['LDAP_CA_CERT_PATH'],
+      timeout: process.env['LDAP_TIMEOUT'],
+      skipHostnameVerification: process.env['LDAP_SKIP_HOSTNAME_VERIFICATION'],
+      tlsServername: process.env['LDAP_TLS_SERVERNAME'],
+    },
+    azure: {
+      enabled: process.env['AZURE_ENABLED'],
+      tenantId: process.env['AZURE_TENANT_ID'],
+      tenantName: process.env['AZURE_TENANT_NAME'],
+      clientId: process.env['AZURE_CLIENT_ID'],
+      clientSecret: process.env['AZURE_CLIENT_SECRET'],
+    },
+    logging: {
+      level: process.env['LOG_LEVEL'],
+      format: process.env['LOG_FORMAT'],
+    },
+    database: {
+      path: process.env['DB_PATH'] || process.env['DATABASE_PATH'],
+      enableWAL: process.env['DB_ENABLE_WAL'],
+      busyTimeout: process.env['DB_BUSY_TIMEOUT'],
+    },
+  };
+
+  try {
+    const config = ConfigSchema.parse(rawConfig);
+    return config;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw new Error(`Configuration validation failed: ${error.message}`);
+    }
+    throw error;
+  }
+}
+
+// Export singleton config instance
+let configInstance: Config | null = null;
+
+export function getConfig(): Config {
+  if (!configInstance) {
+    configInstance = loadConfig();
+  }
+  return configInstance;
+}