@futdevpro/nts-dynamo 1.15.144 → 1.15.150

package/src/_collections/global-settings.const.ts

@@ -1,126 +1,126 @@
-
-
-import { DyNTS_RouteSecurity } from '../_enums/route-security.enum';
-import { DyNTS_Global_Settings } from '../_models/interfaces/global-settings.interface';
-import { DyNTS_SocketSecurity } from '../_modules/socket/_enums/socket-security.enum';
-import { DyNTS_getEnvironment_settings } from './get-environment-settings.util';
-
-/**
- * Default configuration used across the NodeTS framework.
- * These values can be overridden when bootstrapping the server.
- */
-export const DyNTS_global_settings: DyNTS_Global_Settings = {
-  baseUrl: '/api',
-  systemVersion: 'unknown-version',
-  defaultRouteSecurity: DyNTS_RouteSecurity.open,
-  defaultSocketSecurity: DyNTS_SocketSecurity.open,
-  
-  defaultPageSize: 10,
-  archiveListAfter: 100,
-  env_settings: DyNTS_getEnvironment_settings(),
-  
-  autoResolveEndpointCirculationErrors: true,
-  compactErrorResponse: true,
-
-  log_settings: {
-    highDetailedLogs: false,
-    
-    setup: false,
-  
-    request: true,
-    requestsContent: false,
-    responseContent: false,
-    requestStackLocation: false,
-  
-    socket_allEvents: true,
-    socket_mainEvents: true,
-    socket_eventContent: false,
-  
-    api_events: true,
-    api_requestContents: false,
-    api_requestSettings: false,
-    api_responseContents: false,
-    api_errors: true,
-  
-    detailedErrors: false,
-
-    server_debug: false,
-
-    logs_endpoint: {
-      enabled: false,
-      maxEntries: 2000,
-    },
-  },
-
-  autoResearchIssues: true,
-
-  // Auth-service kötelező alapból (régi viselkedés). Public / no-auth szervereknél
-  // `auth_settings.optional = true` → getAuthService() undefined-ot ad dobás helyett,
-  // és a startup 'Authentication Service missing!' warn is elmarad.
-  auth_settings: {
-    optional: false,
-  },
-
-  bot_settings: null,
-
-  openAi_settings: null,
-
-  dias_settings: null,
-
-  assistant_settings: null,
-
-  docChunking: {
-    maxChunkSize: 1000,
-    maxChunkCount: 1000,
-  },
-
-  // BFR-MASTERPROMPTER-011 / SEC-R2-8 — security response-headerek default-ON (safe-by-default
-  // készlet: x-powered-by removal + SAMEORIGIN + nosniff + strict-origin-when-cross-origin;
-  // HSTS AUTO csak prod-on; CSP opt-in). Per-app tweak az overrideDynamoNTSGlobalSettings()-ben.
-  securityHeaders: {
-    enabled: true,
-    removePoweredBy: true,
-  },
-
-  // FR-193 — bedrock OOM korai-figyelmeztető heap-watchdog. Default-on: minden nts-szerver
-  // megkapja a heap-nyomás-figyelést a base App startup-ban (lásd DyNTS_MemoryGuard). Csak
-  // MEGFIGYELÉS + tartós rögzítés a near-OOM küszöböknél — nem változtat a viselkedésen.
-  memoryGuard: {
-    enabled: true,
-    pollIntervalMs: 10000,
-    heapWarningThreshold: 85,
-    heapCriticalThreshold: 95,
-    recoveryMargin: 10,
-    maxHistoryCount: 100,
-    // GC-thrash precursor (a %-küszöb által gyakran KÉSŐN/sosem fogott OOM) + crash-entry + opcionális graceful-exit.
-    gcWarningFraction: 0.40,
-    gcCriticalFraction: 0.60,
-    installCrashHandlers: true,
-    exitOnSustainedCritical: false,
-    sustainedCriticalPolls: 3,
-    exitCode: 137,
-    bootGraceMs: 60000,
-    // Auto-load-shed 503 (BFR-OVERSEER-009 maradék) — opt-in; esszenciális útvonalak kivételével.
-    loadShedEnabled: false,
-    loadShedExemptPathParts: ['/health', '/readiness', '/status', '/diag'],
-  },
-  // Event-loop-lag diag (BFR-OVERSEER-007) — olcsó natív mérés, default ON (opt-out lehetséges).
-  eventLoopDiag: {
-    enabled: true,
-    pollIntervalMs: 5000,
-    maxHistoryCount: 120,
-  },
-
-  // FR-258 / SR-4 — proactive collection-growth monitor (companion to memoryGuard). Periodically
-  // samples each collection's document count (scan-free estimatedDocumentCount) and warns into the
-  // Errors-sink BEFORE an unbounded collection can be loaded into heap and OOM. Observation only —
-  // never deletes (retention SR-1/SR-2 does the deleting). Slow cadence (5 min) — growth is slow.
-  collectionGrowthMonitor: {
-    enabled: true,
-    pollIntervalMs: 300000,
-    sizeThresholdDocCount: 250000,
-    growthRateThresholdPct: 50,
-    reAlertCooldownMs: 3600000,
-  },
-};
-
+
+
+import { DyNTS_RouteSecurity } from '../_enums/route-security.enum';
+import { DyNTS_Global_Settings } from '../_models/interfaces/global-settings.interface';
+import { DyNTS_SocketSecurity } from '../_modules/socket/_enums/socket-security.enum';
+import { DyNTS_getEnvironment_settings } from './get-environment-settings.util';
+
+/**
+ * Default configuration used across the NodeTS framework.
+ * These values can be overridden when bootstrapping the server.
+ */
+export const DyNTS_global_settings: DyNTS_Global_Settings = {
+  baseUrl: '/api',
+  systemVersion: 'unknown-version',
+  defaultRouteSecurity: DyNTS_RouteSecurity.open,
+  defaultSocketSecurity: DyNTS_SocketSecurity.open,
+  
+  defaultPageSize: 10,
+  archiveListAfter: 100,
+  env_settings: DyNTS_getEnvironment_settings(),
+  
+  autoResolveEndpointCirculationErrors: true,
+  compactErrorResponse: true,
+
+  log_settings: {
+    highDetailedLogs: false,
+    
+    setup: false,
+  
+    request: true,
+    requestsContent: false,
+    responseContent: false,
+    requestStackLocation: false,
+  
+    socket_allEvents: true,
+    socket_mainEvents: true,
+    socket_eventContent: false,
+  
+    api_events: true,
+    api_requestContents: false,
+    api_requestSettings: false,
+    api_responseContents: false,
+    api_errors: true,
+  
+    detailedErrors: false,
+
+    server_debug: false,
+
+    logs_endpoint: {
+      enabled: false,
+      maxEntries: 2000,
+    },
+  },
+
+  autoResearchIssues: true,
+
+  // Auth-service kötelező alapból (régi viselkedés). Public / no-auth szervereknél
+  // `auth_settings.optional = true` → getAuthService() undefined-ot ad dobás helyett,
+  // és a startup 'Authentication Service missing!' warn is elmarad.
+  auth_settings: {
+    optional: false,
+  },
+
+  bot_settings: null,
+
+  openAi_settings: null,
+
+  dias_settings: null,
+
+  assistant_settings: null,
+
+  docChunking: {
+    maxChunkSize: 1000,
+    maxChunkCount: 1000,
+  },
+
+  // BFR-MASTERPROMPTER-011 / SEC-R2-8 — security response-headerek default-ON (safe-by-default
+  // készlet: x-powered-by removal + SAMEORIGIN + nosniff + strict-origin-when-cross-origin;
+  // HSTS AUTO csak prod-on; CSP opt-in). Per-app tweak az overrideDynamoNTSGlobalSettings()-ben.
+  securityHeaders: {
+    enabled: true,
+    removePoweredBy: true,
+  },
+
+  // FR-193 — bedrock OOM korai-figyelmeztető heap-watchdog. Default-on: minden nts-szerver
+  // megkapja a heap-nyomás-figyelést a base App startup-ban (lásd DyNTS_MemoryGuard). Csak
+  // MEGFIGYELÉS + tartós rögzítés a near-OOM küszöböknél — nem változtat a viselkedésen.
+  memoryGuard: {
+    enabled: true,
+    pollIntervalMs: 10000,
+    heapWarningThreshold: 85,
+    heapCriticalThreshold: 95,
+    recoveryMargin: 10,
+    maxHistoryCount: 100,
+    // GC-thrash precursor (a %-küszöb által gyakran KÉSŐN/sosem fogott OOM) + crash-entry + opcionális graceful-exit.
+    gcWarningFraction: 0.40,
+    gcCriticalFraction: 0.60,
+    installCrashHandlers: true,
+    exitOnSustainedCritical: false,
+    sustainedCriticalPolls: 3,
+    exitCode: 137,
+    bootGraceMs: 60000,
+    // Auto-load-shed 503 (BFR-OVERSEER-009 maradék) — opt-in; esszenciális útvonalak kivételével.
+    loadShedEnabled: false,
+    loadShedExemptPathParts: ['/health', '/readiness', '/status', '/diag'],
+  },
+  // Event-loop-lag diag (BFR-OVERSEER-007) — olcsó natív mérés, default ON (opt-out lehetséges).
+  eventLoopDiag: {
+    enabled: true,
+    pollIntervalMs: 5000,
+    maxHistoryCount: 120,
+  },
+
+  // FR-258 / SR-4 — proactive collection-growth monitor (companion to memoryGuard). Periodically
+  // samples each collection's document count (scan-free estimatedDocumentCount) and warns into the
+  // Errors-sink BEFORE an unbounded collection can be loaded into heap and OOM. Observation only —
+  // never deletes (retention SR-1/SR-2 does the deleting). Slow cadence (5 min) — growth is slow.
+  collectionGrowthMonitor: {
+    enabled: true,
+    pollIntervalMs: 300000,
+    sizeThresholdDocCount: 250000,
+    growthRateThresholdPct: 50,
+    reAlertCooldownMs: 3600000,
+  },
+};
+

package/src/_collections/npm-token-check.util.spec.ts

@@ -0,0 +1,218 @@
+import {
+  classifyNpmTokenProbe,
+  extractTokenFromNpmrc,
+  classifyNpmTokenShape,
+  describeNpmTokenState,
+  DyNTS_NpmTokenShape,
+  DyNTS_NpmTokenState,
+} from './npm-token-check.util';
+
+/**
+ * FR-320 spec — npm-token allapot-osztalyozo.
+ *
+ * MIERT SZAMIT (2026-08-20..22, valos incidens): a flotta npm-tokenje lejart, majd egy 2FA-bypass
+ * jog NELKULI pot-token kerult be. A kovetkezmeny NAPOKIG tartott, es MINDENHOL `E404`-kent
+ * jelentkezett — privat csomagnal ugyanis az npm a jogosulatlan kerest 404-gyel utasitja el, NEM
+ * 401-gyel. Igy a "nincs ilyen csomag", a "lejart kulcs" es a "rossz jogu kulcs"
+ * MEGKULONBOZTETHETETLEN volt.
+ *
+ * A kulcs-diszkriminator a `/-/whoami`: az NEM csomag-fuggo, ezert nem esik bele a privat-404
+ * elrejtesbe.
+ */
+describe('| FR-320 — npm-token allapot-osztalyozo', () => {
+
+  describe('| alak-ellenorzes (halozat NELKUL)', () => {
+    it('| ures / hianyzo ertek -> missing', () => {
+      expect(classifyNpmTokenShape(undefined)).toBe(DyNTS_NpmTokenShape.missing);
+      expect(classifyNpmTokenShape(null)).toBe(DyNTS_NpmTokenShape.missing);
+      expect(classifyNpmTokenShape('')).toBe(DyNTS_NpmTokenShape.missing);
+      expect(classifyNpmTokenShape('   ')).toBe(DyNTS_NpmTokenShape.missing);
+    });
+
+    /** A leggyakoribb operatori hiba: a TELJES .npmrc-sor kerul a token helyere. */
+    it('| a bemasolt .npmrc-sor -> malformed', () => {
+      expect(classifyNpmTokenShape('//registry.npmjs.org/:_authToken=npm_abcdefghijklmnopqrstuvwxyz'))
+        .toBe(DyNTS_NpmTokenShape.malformed);
+    });
+
+    it('| bennragadt idezojel / whitespace -> malformed', () => {
+      expect(classifyNpmTokenShape('"npm_abcdefghijklmnopqrstuvwxyz"')).toBe(DyNTS_NpmTokenShape.malformed);
+      expect(classifyNpmTokenShape('npm_abcdefghij klmnopqrstuvwxyz')).toBe(DyNTS_NpmTokenShape.malformed);
+    });
+
+    it('| nyilvanvaloan tul rovid ertek -> malformed', () => {
+      expect(classifyNpmTokenShape('changeme')).toBe(DyNTS_NpmTokenShape.malformed);
+    });
+
+    /**
+     * A regi, prefix NELKULI (UUID-alaku) tokenek MEG ervenyesek lehetnek. Inkabb engedjunk at egy
+     * kesobb 401-et kapo tokent, mint hogy egy jot elutasitsunk helyi heurisztikaval.
+     */
+    it('| npm_ prefixu ES prefix nelkuli hosszu ertek is plausible', () => {
+      expect(classifyNpmTokenShape('npm_0123456789abcdefghijklmnopqrstuvwxyz')).toBe(DyNTS_NpmTokenShape.plausible);
+      expect(classifyNpmTokenShape('01234567-89ab-cdef-0123-456789abcdef')).toBe(DyNTS_NpmTokenShape.plausible);
+    });
+  });
+
+  describe('| halozati osztalyozas', () => {
+    it('| 401 -> invalid (lejart / visszavont / rossz)', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 401 })).toBe(DyNTS_NpmTokenState.invalid);
+    });
+
+    /**
+     * A LENYEGI allitas: elo token (whoami 200) + scope-olt csomag 404 -> NEM "nincs ilyen csomag",
+     * hanem JOGOSULTSAG-hiany. Pontosan ez volt megkulonboztethetetlen az incidensben.
+     */
+    it('| elo token + csomag-404 -> no-scope-access (NEM invalid, NEM hianyzo csomag)', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 200, scopedPackageStatus: 404 }))
+        .toBe(DyNTS_NpmTokenState.noScopeAccess);
+      expect(classifyNpmTokenProbe({ whoamiStatus: 200, scopedPackageStatus: 403 }))
+        .toBe(DyNTS_NpmTokenState.noScopeAccess);
+    });
+
+    it('| elo token + csomag-200 -> ok', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 200, scopedPackageStatus: 200 }))
+        .toBe(DyNTS_NpmTokenState.ok);
+    });
+
+    it('| csomag-proba nelkul, elo tokennel -> ok', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 200 })).toBe(DyNTS_NpmTokenState.ok);
+    });
+
+    /** A 2FA-bypass hianya read-only probaval NEM latszik — csak egy mar elbukott publishbol. */
+    it('| elo token + EOTP publish-hiba -> missing-publish-right (a 2FA-bypass hianya)', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 200, publishErrorCode: 'EOTP' }))
+        .toBe(DyNTS_NpmTokenState.missingPublishRight);
+    });
+
+    /**
+     * NEGATIV allitas, ami a legfontosabb: ha a proba EL SEM JUTOTT a registryig, akkor NEM
+     * mondhatjuk, hogy a token rossz. A meres hianya nem bizonyitek.
+     */
+    it('| elerhetetlen registry -> unknown, NEM invalid', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: null })).toBe(DyNTS_NpmTokenState.unknown);
+      expect(classifyNpmTokenProbe({ whoamiStatus: null })).not.toBe(DyNTS_NpmTokenState.invalid);
+    });
+
+    it('| 5xx / rate-limit -> unknown (nem allitunk semmit a tokenrol)', () => {
+      expect(classifyNpmTokenProbe({ whoamiStatus: 500 })).toBe(DyNTS_NpmTokenState.unknown);
+      expect(classifyNpmTokenProbe({ whoamiStatus: 429 })).toBe(DyNTS_NpmTokenState.unknown);
+    });
+  });
+
+  describe('| magyarazat', () => {
+    it('| MINDEN allapothoz ad kovetkezo-lepest', () => {
+      for (const state of Object.values(DyNTS_NpmTokenState)) {
+        const text: string = describeNpmTokenState(state);
+        expect(text.length).toBeGreaterThan(20);
+      }
+    });
+
+    /** Az `invalid` magyarazatnak KI KELL MONDANIA a 404-es elrejtest — ez vitte felre a diagnozist. */
+    it('| az invalid magyarazata figyelmeztet, hogy a hivoknal 404-kent latszik', () => {
+      expect(describeNpmTokenState(DyNTS_NpmTokenState.invalid)).toContain('404');
+    });
+
+    it('| a missing-publish-right magyarazata megnevezi a 2FA-bypass-t', () => {
+      expect(describeNpmTokenState(DyNTS_NpmTokenState.missingPublishRight)).toContain('2FA-bypass');
+    });
+  });
+});
+
+
+/**
+ * FR-320b spec — a token FAJLBOL is feloldhato.
+ *
+ * MIERT (a sajat elso valtozatom hibaja): a util eloszor CSAK a `process.env.NPM_TOKEN`-t nezte, es
+ * ezert a workstationomon `missing`-et adott — HOLOTT az npm ott mukodott, mert a token a
+ * `~/.npmrc`-ben all. Ez HAMIS NEGATIV, es epp a legfontosabb helyeken (runner-kontener, hosztok)
+ * sult volna el, ahol a token szinten FAJLBAN van.
+ *
+ * A `.npmrc`-t csak OLVASSUK — letrehozni tilos (flotta-szintu hard rule).
+ */
+describe('| FR-320b — token kinyerese .npmrc-bol', () => {
+
+  it('| a valodi .npmrc-alakbol kinyeri az erteket', () => {
+    const content: string = '//registry.npmjs.org/:_authToken=npm_0123456789abcdefghijklmnop';
+    expect(extractTokenFromNpmrc(content)).toBe('npm_0123456789abcdefghijklmnop');
+  });
+
+  it('| tobbsoros fajlbol a MEGFELELO registry sorat valasztja', () => {
+    const content: string = [
+      '# megjegyzes',
+      '//npm.pkg.github.com/:_authToken=github_masik_token_ertek',
+      '//registry.npmjs.org/:_authToken=npm_ez_a_helyes_ertek_1234',
+      'engine-strict=true',
+    ].join('\n');
+    expect(extractTokenFromNpmrc(content)).toBe('npm_ez_a_helyes_ertek_1234');
+  });
+
+  it('| a bennragadt idezojeleket levagja', () => {
+    expect(extractTokenFromNpmrc('//registry.npmjs.org/:_authToken="npm_idezojelben_1234567890"'))
+      .toBe('npm_idezojelben_1234567890');
+  });
+
+  /** NEGATIV: ne talaljunk ki tokent ott, ahol nincs. */
+  it('| token nelkuli / megjegyzett tartalomra null', () => {
+    expect(extractTokenFromNpmrc('engine-strict=true')).toBeNull();
+    expect(extractTokenFromNpmrc('# //registry.npmjs.org/:_authToken=npm_megjegyzesben')).toBeNull();
+    expect(extractTokenFromNpmrc('')).toBeNull();
+  });
+
+  it('| MAS registry sorat NEM veszi el', () => {
+    expect(extractTokenFromNpmrc('//npm.pkg.github.com/:_authToken=github_token_ertek_123456')).toBeNull();
+  });
+});
+
+
+/**
+ * FR-320c spec — ELO token mellett a publish-oldali hiba MINDIG jogosultsag-hiany.
+ *
+ * MERVE (2026-08-22, valos publish-kimenet):
+ *   `npm error 404 Not Found - PUT https://registry.npmjs.org/@futdevpro%2fnts-dynamo`
+ * — MIKOZBEN ugyanaz a token OLVASNI tudta a csomagot (a runner registry-auth probaja OK volt).
+ *
+ * Az npm a PUT-ra is 404-gyel valaszol, ha nincs IRASI jog (letezes-elrejtes). Enelkul a
+ * megkulonboztetes nelkul ez "nincs ilyen csomag"-nak latszik — es epp ez vitte felre a diagnozist.
+ */
+describe('| FR-320c — publish-oldali hibak elo token mellett', () => {
+
+  it('| EOTP -> missing-publish-right (2FA-bypass)', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 200, publishErrorCode: 'EOTP' }))
+      .toBe(DyNTS_NpmTokenState.missingPublishRight);
+  });
+
+  it('| E403 -> missing-publish-right', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 200, publishErrorCode: 'E403' }))
+      .toBe(DyNTS_NpmTokenState.missingPublishRight);
+  });
+
+  /** A LENYEGI uj eset: PUT-ra kapott 404 elo tokennel = nincs irasi jog, NEM hianyzo csomag. */
+  it('| E404 elo tokennel -> missing-publish-right, NEM hianyzo csomag', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 200, publishErrorCode: 'E404' }))
+      .toBe(DyNTS_NpmTokenState.missingPublishRight);
+  });
+
+  it('| kisbetus hibakodot is felismer', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 200, publishErrorCode: 'e404' }))
+      .toBe(DyNTS_NpmTokenState.missingPublishRight);
+  });
+
+  /** NEGATIV: publish-hiba NELKUL, olvasassal egyutt tovabbra is `ok`. */
+  it('| publish-hiba nelkul tovabbra is ok', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 200, scopedPackageStatus: 200 }))
+      .toBe(DyNTS_NpmTokenState.ok);
+  });
+
+  /** NEGATIV: HALOTT token mellett a publish-hiba NEM minositheto jog-hianynak. */
+  it('| 401-es tokennel a publish-hiba NEM missing-publish-right, hanem invalid', () => {
+    expect(classifyNpmTokenProbe({ whoamiStatus: 401, publishErrorCode: 'E404' }))
+      .toBe(DyNTS_NpmTokenState.invalid);
+  });
+
+  it('| a magyarazat KIMONDJA, hogy a PUT-404 nem hianyzo csomag', () => {
+    const text: string = describeNpmTokenState(DyNTS_NpmTokenState.missingPublishRight);
+    expect(text).toContain('404');
+    expect(text).toContain('NEM hianyzo csomagot');
+  });
+});