@etcsec-com/etc-collector 1.4.0

package/src/container.ts

@@ -0,0 +1,221 @@
+import Database from 'better-sqlite3';
+import { getConfig } from './config';
+import { DatabaseManager } from './data/database';
+import { TokenRepository } from './data/repositories/token.repository';
+import { CryptoService } from './services/auth/crypto.service';
+import { TokenService } from './services/auth/token.service';
+import { HealthController } from './api/controllers/health.controller';
+import { AuthController } from './api/controllers/auth.controller';
+import { AuditController } from './api/controllers/audit.controller';
+import { ExportController } from './api/controllers/export.controller';
+import { ProvidersController } from './api/controllers/providers.controller';
+import { LDAPProvider } from './providers/ldap/ldap.provider';
+import { GraphProvider } from './providers/azure/graph.provider';
+import type { Logger } from 'winston';
+import { logger } from './utils/logger';
+import { InfoEndpointsConfig } from './types/config.types';
+
+/**
+ * Dependency Injection Container
+ *
+ * Manages all application dependencies with singleton pattern.
+ * Handles proper initialization order:
+ * 1. Config
+ * 2. Database + Repositories
+ * 3. CryptoService (loads RSA keys)
+ * 4. TokenService
+ * 5. LDAP Provider
+ * 6. Azure Graph Provider
+ * 7. Controllers
+ *
+ * Updated: Story 1.4 (JWT), Story 1.5 (LDAP), Story 1.6 (Azure)
+ */
+export class DIContainer {
+  private static instance: DIContainer | null = null;
+  private logger: Logger;
+
+  // Database
+  private db!: Database.Database;
+  private dbManager!: DatabaseManager;
+
+  // Repositories
+  private tokenRepository!: TokenRepository;
+
+  // Services
+  private cryptoService!: CryptoService;
+  private tokenService!: TokenService;
+
+  // Providers
+  private ldapProvider!: LDAPProvider;
+  private graphProvider!: GraphProvider;
+
+  // Controllers
+  private healthController!: HealthController;
+  private authController!: AuthController;
+  private auditController!: AuditController;
+  private exportController!: ExportController;
+  private providersController!: ProvidersController;
+
+  // Config
+  private infoEndpointsConfig!: InfoEndpointsConfig;
+
+  private constructor() {
+    this.logger = logger;
+  }
+
+  /**
+   * Get singleton instance
+   *
+   * @throws Error if instance not initialized (call initialize() first)
+   */
+  static getInstance(): DIContainer {
+    if (!DIContainer.instance) {
+      throw new Error('DIContainer not initialized. Call DIContainer.initialize() first.');
+    }
+    return DIContainer.instance;
+  }
+
+  /**
+   * Initialize DI container with async dependencies
+   *
+   * This method must be called before using the container.
+   * It loads configuration, initializes database, loads RSA keys, and creates all services.
+   *
+   * @returns Promise<DIContainer> Initialized container instance
+   */
+  static async initialize(): Promise<DIContainer> {
+    if (DIContainer.instance) {
+      return DIContainer.instance;
+    }
+
+    const container = new DIContainer();
+    await container.init();
+    DIContainer.instance = container;
+    return container;
+  }
+
+  /**
+   * Reset singleton instance (for testing)
+   */
+  static reset(): void {
+    DIContainer.instance = null;
+  }
+
+  /**
+   * Internal initialization logic
+   */
+  private async init(): Promise<void> {
+    this.logger.info('Initializing DI container');
+
+    // 1. Load configuration
+    const config = getConfig();
+    this.logger.debug('Configuration loaded', {
+      port: config.server.port,
+      env: config.server.nodeEnv,
+      dbPath: config.database.path,
+    });
+
+    // 2. Initialize database and repositories
+    this.dbManager = DatabaseManager.getInstance();
+    this.db = this.dbManager.connect(config.database.path);
+    this.tokenRepository = new TokenRepository(this.db);
+    this.logger.debug('Database and repositories initialized');
+
+    // 3. Initialize crypto service and load RSA keys
+    this.cryptoService = new CryptoService(
+      config.jwt.privateKeyPath,
+      config.jwt.publicKeyPath
+    );
+    await this.cryptoService.loadOrGenerateKeys();
+    this.logger.debug('Crypto service initialized and keys loaded');
+
+    // 4. Initialize token service
+    this.tokenService = new TokenService(this.tokenRepository, this.cryptoService);
+    this.logger.debug('Token service initialized');
+
+    // 5. Initialize LDAP provider
+    this.ldapProvider = new LDAPProvider(config.ldap);
+    this.logger.debug('LDAP provider initialized', {
+      url: config.ldap.url,
+      baseDN: config.ldap.baseDN,
+    });
+
+    // 6. Initialize Azure Graph provider (only if enabled)
+    if (config.azure.enabled && config.azure.tenantId && config.azure.clientId && config.azure.clientSecret) {
+      this.graphProvider = new GraphProvider({
+        tenantId: config.azure.tenantId,
+        clientId: config.azure.clientId,
+        clientSecret: config.azure.clientSecret,
+      });
+      this.logger.debug('Azure Graph provider initialized', {
+        tenantId: config.azure.tenantId,
+        clientId: config.azure.clientId,
+      });
+    } else {
+      this.logger.info('Azure provider disabled (AZURE_ENABLED=false or missing credentials)');
+    }
+
+    // 7. Initialize controllers
+    this.healthController = new HealthController();
+    this.authController = new AuthController(this.tokenService, config.jwt);
+    this.auditController = new AuditController();
+    this.exportController = new ExportController();
+    this.providersController = new ProvidersController(config.ldap, config.azure, this.graphProvider);
+    this.logger.debug('Controllers initialized');
+
+    // 8. Store config for routes
+    this.infoEndpointsConfig = config.infoEndpoints;
+
+    this.logger.info('DI container initialization complete');
+  }
+
+  // === Getters ===
+
+  getDatabase(): Database.Database {
+    return this.db;
+  }
+
+  getTokenRepository(): TokenRepository {
+    return this.tokenRepository;
+  }
+
+  getCryptoService(): CryptoService {
+    return this.cryptoService;
+  }
+
+  getTokenService(): TokenService {
+    return this.tokenService;
+  }
+
+  getLDAPProvider(): LDAPProvider {
+    return this.ldapProvider;
+  }
+
+  getGraphProvider(): GraphProvider {
+    return this.graphProvider;
+  }
+
+  getHealthController(): HealthController {
+    return this.healthController;
+  }
+
+  getAuthController(): AuthController {
+    return this.authController;
+  }
+
+  getAuditController(): AuditController {
+    return this.auditController;
+  }
+
+  getExportController(): ExportController {
+    return this.exportController;
+  }
+
+  getProvidersController(): ProvidersController {
+    return this.providersController;
+  }
+
+  getInfoEndpointsConfig(): InfoEndpointsConfig {
+    return this.infoEndpointsConfig;
+  }
+}

package/src/data/database.ts

@@ -0,0 +1,78 @@
+import Database from 'better-sqlite3';
+import { mkdirSync, existsSync } from 'fs';
+import { dirname } from 'path';
+import { logInfo, logError } from '../utils/logger';
+
+/**
+ * SQLite Database Connection Manager
+ * Singleton pattern for database access
+ */
+export class DatabaseManager {
+  private static instance: DatabaseManager;
+  private db: Database.Database | null = null;
+  private dbPath: string | null = null;
+
+  private constructor() {}
+
+  static getInstance(): DatabaseManager {
+    if (!DatabaseManager.instance) {
+      DatabaseManager.instance = new DatabaseManager();
+    }
+    return DatabaseManager.instance;
+  }
+
+  connect(dbPath: string): Database.Database {
+    if (this.db) {
+      return this.db;
+    }
+
+    try {
+      // Create parent directory if not exists
+      const dir = dirname(dbPath);
+      if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+        logInfo('Created database directory', { path: dir });
+      }
+
+      // Connect to database
+      this.db = new Database(dbPath);
+      this.dbPath = dbPath;
+
+      // Configure pragmas for performance and safety
+      this.db.pragma('journal_mode = WAL'); // Write-Ahead Logging
+      this.db.pragma('synchronous = NORMAL'); // Balance safety/performance
+      this.db.pragma('foreign_keys = ON'); // Enable foreign key constraints
+      this.db.pragma('busy_timeout = 5000'); // 5 second timeout on locks
+
+      logInfo('Database connected successfully', {
+        path: dbPath,
+        journalMode: this.db.pragma('journal_mode', { simple: true }),
+      });
+
+      return this.db;
+    } catch (error) {
+      logError('Failed to connect to database', error as Error, { path: dbPath });
+      throw error;
+    }
+  }
+
+  getDatabase(): Database.Database {
+    if (!this.db) {
+      throw new Error('Database not connected. Call connect() first.');
+    }
+    return this.db;
+  }
+
+  close(): void {
+    if (this.db) {
+      logInfo('Closing database connection', { path: this.dbPath });
+      this.db.close();
+      this.db = null;
+      this.dbPath = null;
+    }
+  }
+
+  isConnected(): boolean {
+    return this.db !== null;
+  }
+}

package/src/data/jobs/token-cleanup.job.ts

@@ -0,0 +1,166 @@
+import { TokenRepository } from '../repositories/token.repository';
+import { logInfo, logError } from '../../utils/logger';
+
+/**
+ * Token Cleanup Job
+ * Removes expired and old revoked tokens according to retention policy
+ *
+ * Retention Policy:
+ * - Expired tokens (expires_at < now): Deleted immediately if not revoked
+ * - Expired + Revoked tokens (expires_at < now AND revoked_at < now - 90 days): Deleted after 90 days
+ * - Active tokens: Never deleted
+ *
+ * This job should be scheduled to run periodically (e.g., daily at 3 AM)
+ */
+export class TokenCleanupJob {
+  constructor(private tokenRepo: TokenRepository) {}
+
+  /**
+   * Execute the cleanup job
+   * @returns Number of tokens deleted
+   */
+  run(): number {
+    logInfo('Starting token cleanup job');
+
+    try {
+      const before = this.tokenRepo.count();
+
+      // Delete expired tokens (90-day retention for revoked)
+      const deletedCount = this.deleteExpiredTokens();
+
+      const after = this.tokenRepo.count();
+
+      logInfo('Token cleanup job completed', {
+        tokensBefore: before,
+        tokensAfter: after,
+        deletedCount,
+      });
+
+      return deletedCount;
+    } catch (error) {
+      logError('Token cleanup job failed', error as Error);
+      throw error;
+    }
+  }
+
+  /**
+   * Delete expired tokens with 90-day retention for revoked tokens
+   * @private
+   * @returns Number of tokens deleted
+   */
+  private deleteExpiredTokens(): number {
+    // Query deletes:
+    // 1. Non-revoked expired tokens (cleanup immediately)
+    // 2. Revoked tokens that expired AND were revoked > 90 days ago (retain for audit)
+    const stmt = this.tokenRepo['db'].prepare(`
+      DELETE FROM tokens
+      WHERE datetime(expires_at) <= datetime('now')
+        AND (
+          revoked_at IS NULL
+          OR datetime(revoked_at) <= datetime('now', '-90 days')
+        )
+    `);
+
+    const result = stmt.run();
+    const deletedCount = result.changes;
+
+    if (deletedCount > 0) {
+      logInfo('Deleted expired tokens', { count: deletedCount });
+    } else {
+      logInfo('No expired tokens to delete');
+    }
+
+    return deletedCount;
+  }
+
+  /**
+   * Get cleanup statistics without deleting anything
+   * Useful for monitoring and alerting
+   * @returns Cleanup statistics
+   */
+  getStatistics(): CleanupStatistics {
+    const db = this.tokenRepo['db'];
+
+    // Count expired non-revoked tokens (immediate deletion candidates)
+    const expiredNonRevoked = db
+      .prepare(`
+        SELECT COUNT(*) as count FROM tokens
+        WHERE datetime(expires_at) <= datetime('now')
+          AND revoked_at IS NULL
+      `)
+      .get() as { count: number };
+
+    // Count old revoked expired tokens (deletion candidates after 90 days)
+    const oldRevokedExpired = db
+      .prepare(`
+        SELECT COUNT(*) as count FROM tokens
+        WHERE datetime(expires_at) <= datetime('now')
+          AND revoked_at IS NOT NULL
+          AND datetime(revoked_at) <= datetime('now', '-90 days')
+      `)
+      .get() as { count: number };
+
+    // Count recent revoked expired tokens (retained for audit, < 90 days)
+    const recentRevokedExpired = db
+      .prepare(`
+        SELECT COUNT(*) as count FROM tokens
+        WHERE datetime(expires_at) <= datetime('now')
+          AND revoked_at IS NOT NULL
+          AND datetime(revoked_at) > datetime('now', '-90 days')
+      `)
+      .get() as { count: number };
+
+    const totalDeletionCandidates = expiredNonRevoked.count + oldRevokedExpired.count;
+
+    const stats: CleanupStatistics = {
+      totalTokens: this.tokenRepo.count(),
+      activeTokens: this.tokenRepo.countActive(),
+      expiredNonRevoked: expiredNonRevoked.count,
+      oldRevokedExpired: oldRevokedExpired.count,
+      recentRevokedExpired: recentRevokedExpired.count,
+      totalDeletionCandidates,
+    };
+
+    logInfo('Token cleanup statistics', stats as unknown as Record<string, unknown>);
+
+    return stats;
+  }
+
+  /**
+   * Run cleanup job and return statistics
+   * Combines cleanup and reporting in one operation
+   * @returns Cleanup result with statistics
+   */
+  runWithStatistics(): CleanupResult {
+    const statsBefore = this.getStatistics();
+    const deletedCount = this.run();
+    const statsAfter = this.getStatistics();
+
+    return {
+      deletedCount,
+      statsBefore,
+      statsAfter,
+    };
+  }
+}
+
+/**
+ * Token cleanup statistics
+ */
+export interface CleanupStatistics {
+  totalTokens: number;
+  activeTokens: number;
+  expiredNonRevoked: number; // Immediate deletion candidates
+  oldRevokedExpired: number; // Deletion candidates after 90 days
+  recentRevokedExpired: number; // Retained for audit (< 90 days)
+  totalDeletionCandidates: number; // Sum of immediate + old revoked
+}
+
+/**
+ * Cleanup job result
+ */
+export interface CleanupResult {
+  deletedCount: number;
+  statsBefore: CleanupStatistics;
+  statsAfter: CleanupStatistics;
+}

package/src/data/migrations/001_initial_schema.sql

@@ -0,0 +1,47 @@
+-- Initial Schema Migration
+-- Creates tokens table for JWT token management with constraints and views
+
+-- Tokens table
+CREATE TABLE IF NOT EXISTS tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    jti TEXT UNIQUE NOT NULL,
+    public_key TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    expires_at TEXT NOT NULL,
+    max_uses INTEGER NOT NULL DEFAULT 0,
+    used_count INTEGER NOT NULL DEFAULT 0,
+    revoked_at TEXT,
+    revoked_by TEXT,
+    revoked_reason TEXT,
+    metadata TEXT,
+    CONSTRAINT check_usage CHECK (used_count <= max_uses OR max_uses = 0),
+    CONSTRAINT check_dates CHECK (datetime(expires_at) > datetime(created_at))
+);
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS idx_tokens_jti ON tokens(jti);
+CREATE INDEX IF NOT EXISTS idx_tokens_expires_at ON tokens(expires_at);
+CREATE INDEX IF NOT EXISTS idx_tokens_revoked_at ON tokens(revoked_at);
+CREATE INDEX IF NOT EXISTS idx_tokens_created_at ON tokens(created_at);
+
+-- Partial index for active tokens (optimization)
+CREATE INDEX IF NOT EXISTS idx_tokens_expired
+ON tokens(expires_at)
+WHERE revoked_at IS NULL;
+
+-- View for active tokens
+CREATE VIEW IF NOT EXISTS v_active_tokens AS
+SELECT
+  id,
+  jti,
+  created_at,
+  expires_at,
+  max_uses,
+  used_count,
+  CASE
+    WHEN max_uses = 0 THEN -1
+    ELSE (max_uses - used_count)
+  END AS remaining_uses
+FROM tokens
+WHERE revoked_at IS NULL
+  AND datetime(expires_at) > datetime('now');

package/src/data/migrations/migration.runner.ts

@@ -0,0 +1,125 @@
+import { readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+import Database from 'better-sqlite3';
+import { logInfo, logError } from '../../utils/logger';
+
+/**
+ * Migration Runner
+ * Executes SQL migration files sequentially with version tracking
+ */
+export class MigrationRunner {
+  constructor(private db: Database.Database) {}
+
+  async run(): Promise<void> {
+    try {
+      logInfo('Starting database migrations');
+
+      // Create migrations tracking table
+      this.createMigrationsTable();
+
+      // Get current version
+      const currentVersion = this.getCurrentVersion();
+      logInfo('Current migration version', { version: currentVersion });
+
+      // Find all migration files
+      const migrations = this.findMigrationFiles();
+
+      // Apply pending migrations
+      let appliedCount = 0;
+      for (const migration of migrations) {
+        if (migration.version > currentVersion) {
+          this.applyMigration(migration);
+          appliedCount++;
+        }
+      }
+
+      if (appliedCount === 0) {
+        logInfo('No pending migrations');
+      } else {
+        logInfo('Migrations completed', { appliedCount });
+      }
+    } catch (error) {
+      logError('Migration failed', error as Error);
+      throw error;
+    }
+  }
+
+  private createMigrationsTable(): void {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS migrations (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        version INTEGER UNIQUE NOT NULL,
+        name TEXT NOT NULL,
+        applied_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+    `);
+  }
+
+  private getCurrentVersion(): number {
+    const result = this.db
+      .prepare('SELECT COALESCE(MAX(version), 0) as version FROM migrations')
+      .get() as { version: number };
+    return result.version;
+  }
+
+  private findMigrationFiles(): Array<{ version: number; name: string; path: string }> {
+    const migrationsDir = __dirname;
+    const files = readdirSync(migrationsDir).filter((f) => f.endsWith('.sql'));
+
+    return files
+      .map((file) => ({
+        version: this.getMigrationVersion(file),
+        name: file,
+        path: join(migrationsDir, file),
+      }))
+      .sort((a, b) => a.version - b.version);
+  }
+
+  private getMigrationVersion(filename: string): number {
+    const match = filename.match(/^(\d+)_/);
+    if (!match || !match[1]) {
+      throw new Error(`Invalid migration filename: ${filename}`);
+    }
+    return parseInt(match[1], 10);
+  }
+
+  private applyMigration(migration: { version: number; name: string; path: string }): void {
+    logInfo('Applying migration', { name: migration.name, version: migration.version });
+
+    // Wrap in transaction for atomicity
+    const apply = this.db.transaction(() => {
+      try {
+        // Read and execute SQL
+        const sql = readFileSync(migration.path, 'utf-8');
+        this.db.exec(sql);
+
+        // Record migration
+        this.db
+          .prepare('INSERT INTO migrations (version, name) VALUES (?, ?)')
+          .run(migration.version, migration.name);
+
+        logInfo('Migration applied successfully', { name: migration.name });
+      } catch (error) {
+        logError('Migration failed', error as Error, { name: migration.name });
+        throw error;
+      }
+    });
+
+    apply();
+  }
+
+  /**
+   * Static helper for running migrations from config
+   */
+  static async runMigrations(dbPath: string): Promise<void> {
+    const Database = (await import('better-sqlite3')).default;
+    const db = new Database(dbPath);
+
+    try {
+      const runner = new MigrationRunner(db);
+      await runner.run();
+    } finally {
+      db.close();
+    }
+  }
+}

package/src/data/models/Token.model.ts

@@ -0,0 +1,35 @@
+/**
+ * Token Model
+ * Represents a JWT token in the database
+ */
+export interface Token {
+  id: number;
+  jti: string;
+  public_key: string;
+  created_at: string;
+  expires_at: string;
+  max_uses: number;
+  used_count: number;
+  revoked_at: string | null;
+  revoked_by: string | null;
+  revoked_reason: string | null;
+  metadata: string | null;
+}
+
+export interface TokenCreateInput {
+  jti: string;
+  public_key: string;
+  expires_at: string;
+  max_uses?: number;
+  metadata?: string;
+}
+
+export interface ActiveToken {
+  id: number;
+  jti: string;
+  created_at: string;
+  expires_at: string;
+  max_uses: number;
+  used_count: number;
+  remaining_uses: number;
+}