@govish/shared-services 1.0.0

package/dist/middleware/authenticateDevice.js

@@ -0,0 +1,310 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthenticateDeviceOrOfficer = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const apiKeyService_1 = require("../services/apiKeyService");
+const auditService_1 = require("../services/auditService");
+const deviceService_1 = require("../services/deviceService");
+const officerService_1 = require("../services/officerService");
+const logMode_1 = require("../utils/logMode");
+/**
+ * Middleware to authenticate either a device, an officer, or a microservice (via API key)
+ * Checks JWT token and validates against Device or Officer table
+ * Also checks for API keys for microservice authentication
+ *
+ * Supports multiple authentication methods:
+ * - X-API-Key: <api_key> (for microservice authentication)
+ * - Device-Token: <device_jwt_token> (for device authentication)
+ * - Authorization: Bearer <user_jwt_token> (for officer/user authentication)
+ *
+ * Priority: API Key > Device Token > Authorization Token
+ */
+const createAuthenticateDeviceOrOfficer = (deps) => {
+    const apiKeyService = new apiKeyService_1.ApiKeyService(deps);
+    const logger = deps.logger;
+    const enableDebugLogs = deps.enableDebugLogs || false;
+    // Debug log helper for middleware
+    const debugLog = (message, data) => {
+        if (enableDebugLogs) {
+            if (data) {
+                console.log(`[AUDIT MIDDLEWARE] ${message}`, data);
+            }
+            else {
+                console.log(`[AUDIT MIDDLEWARE] ${message}`);
+            }
+        }
+    };
+    const debugError = (message, data) => {
+        if (enableDebugLogs) {
+            if (data) {
+                console.error(`[AUDIT MIDDLEWARE] ${message}`, data);
+            }
+            else {
+                console.error(`[AUDIT MIDDLEWARE] ${message}`);
+            }
+        }
+    };
+    // Use internal services instead of external functions
+    const deviceService = new deviceService_1.DeviceService(deps);
+    const officerService = new officerService_1.OfficerService(deps);
+    const jwtConfig = deps.jwtConfig || {
+        secret: process.env.JWT_SECRET || 'your-super-secret-key-change-this-in-production',
+        expiresIn: 24 * 60 * 60,
+        issuer: deps.serverName || 'citizen-app',
+        audience: deps.serverName || 'citizen-users',
+    };
+    // Initialize audit service (it will handle Kafka unavailability gracefully)
+    // Always initialize so we can log to console/logger even if Kafka is not available
+    const auditService = new auditService_1.AuditService(deps);
+    return (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
+        try {
+            // First, check for API key (for microservice authentication)
+            const apiKeyHeader = req.headers['x-api-key'];
+            if (apiKeyHeader) {
+                const apiKey = yield apiKeyService.validateApiKey(apiKeyHeader);
+                if (apiKey) {
+                    // Attach API key info to request
+                    req.apiKey = apiKey;
+                    req.microservice = apiKey.microservice;
+                    req.authType = 'api_key';
+                    // Log audit event
+                    if (auditService) {
+                        auditService.logAuditEvent(req, {
+                        // Event type will be determined automatically
+                        }).catch((err) => {
+                            logger.error('Failed to log audit event', { error: err.message });
+                        });
+                    }
+                    return next();
+                }
+                else {
+                    return res.status(401).json({
+                        message: 'Invalid, expired, or inactive API key'
+                    });
+                }
+            }
+            // Check for device-token header (case-insensitive)
+            // Express normalizes headers to lowercase, but check multiple variations
+            // Also check rawHeaders in case Express hasn't normalized it
+            let deviceTokenHeader;
+            // Check normalized headers first
+            deviceTokenHeader =
+                req.headers['device-token'] ||
+                    req.headers['device_token']; // Also check underscore variant
+            // If not found, check rawHeaders
+            if (!deviceTokenHeader && req.rawHeaders) {
+                const index = req.rawHeaders.findIndex((h) => h.toLowerCase() === 'device-token' || h.toLowerCase() === 'device_token');
+                if (index >= 0 && index < req.rawHeaders.length - 1) {
+                    deviceTokenHeader = req.rawHeaders[index + 1];
+                }
+            }
+            const authHeader = req.headers.authorization;
+            let deviceAuthenticated = false;
+            let officerAuthenticated = false;
+            // Authenticate device if Device-Token header is present
+            if (deviceTokenHeader) {
+                try {
+                    const decoded = jsonwebtoken_1.default.verify(deviceTokenHeader, jwtConfig.secret, {
+                        issuer: jwtConfig.issuer,
+                        audience: jwtConfig.audience,
+                    });
+                    // Get device from service (uses Redis cache with auth service fallback)
+                    const device = yield deviceService.getDeviceById(decoded.sub);
+                    if (!device) {
+                        // Log audit event for device not found
+                        if (auditService) {
+                            req.authType = 'device';
+                            auditService.logAuditEvent(req, {
+                                event_type: undefined, // Will be determined automatically
+                                response_status: 401,
+                                error_message: 'Device not found',
+                                error_code: 'DEVICE_NOT_FOUND',
+                            }).catch((err) => {
+                                logger.debug('Failed to log audit event', { error: err.message });
+                            });
+                        }
+                        return res.status(401).json({ message: 'Device not found' });
+                    }
+                    if (!device.is_active) {
+                        // Log audit event for inactive device
+                        if (auditService) {
+                            req.authType = 'device';
+                            req.device = device;
+                            auditService.logAuditEvent(req, {
+                                event_type: undefined, // Will be determined automatically
+                                response_status: 403,
+                                error_message: 'Device is not active',
+                                error_code: 'DEVICE_INACTIVE',
+                            }).catch((err) => {
+                                logger.debug('Failed to log audit event', { error: err.message });
+                            });
+                        }
+                        return res.status(403).json({ message: 'Device is not active' });
+                    }
+                    // Attach device to request
+                    req.device = device;
+                    deviceAuthenticated = true;
+                }
+                catch (error) {
+                    // Log audit event for invalid device token
+                    if (auditService) {
+                        req.authType = 'device';
+                        auditService.logAuditEvent(req, {
+                            event_type: undefined, // Will be determined automatically
+                            response_status: 401,
+                            error_message: error instanceof Error ? error.message : 'Invalid or expired device token',
+                            error_code: 'INVALID_DEVICE_TOKEN',
+                        }).catch((err) => {
+                            logger.debug('Failed to log audit event', { error: err.message });
+                        });
+                    }
+                    return res.status(401).json({ message: 'Invalid or expired device token' });
+                }
+            }
+            // Authenticate officer if Authorization header is present
+            if (authHeader && authHeader.startsWith('Bearer ')) {
+                const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+                try {
+                    const decoded = jsonwebtoken_1.default.verify(token, jwtConfig.secret, {
+                        issuer: jwtConfig.issuer,
+                        audience: jwtConfig.audience,
+                    });
+                    // Skip if this is a device token (should use Device-Token header instead)
+                    if (decoded.type === 'device') {
+                        if (!deviceAuthenticated) {
+                            return res.status(401).json({ message: 'Device tokens should use Device-Token header' });
+                        }
+                        // If device already authenticated via Device-Token, continue
+                    }
+                    else {
+                        // Authenticate as officer
+                        const officerId = decoded.id || decoded.sub;
+                        if (!officerId) {
+                            return res.status(401).json({ message: 'Invalid token payload' });
+                        }
+                        // Get officer from service (uses Redis cache with auth service fallback)
+                        const officer = yield officerService.getOfficerById(officerId);
+                        if (!officer) {
+                            // Log audit event for officer not found
+                            if (auditService) {
+                                req.authType = 'officer';
+                                auditService.logAuditEvent(req, {
+                                    event_type: undefined, // Will be determined automatically
+                                    response_status: 401,
+                                    error_message: 'Officer not found',
+                                    error_code: 'OFFICER_NOT_FOUND',
+                                }).catch((err) => {
+                                    logger.debug('Failed to log audit event', { error: err.message });
+                                });
+                            }
+                            return res.status(401).json({ message: 'Officer not found' });
+                        }
+                        // Attach officer to request
+                        req.officer = officer;
+                        req.user = officer;
+                        officerAuthenticated = true;
+                    }
+                }
+                catch (error) {
+                    // Log audit event for invalid authorization token
+                    if (auditService) {
+                        req.authType = 'officer';
+                        auditService.logAuditEvent(req, {
+                            event_type: undefined, // Will be determined automatically
+                            response_status: 401,
+                            error_message: error instanceof Error ? error.message : 'Invalid or expired authorization token',
+                            error_code: 'INVALID_AUTH_TOKEN',
+                        }).catch((err) => {
+                            logger.debug('Failed to log audit event', { error: err.message });
+                        });
+                    }
+                    return res.status(401).json({ message: 'Invalid or expired authorization token' });
+                }
+            }
+            // At least one authentication method must succeed
+            if (!deviceAuthenticated && !officerAuthenticated) {
+                // Log audit event for missing authentication
+                if (auditService) {
+                    auditService.logAuditEvent(req, {
+                        event_type: undefined, // Will be determined automatically
+                        response_status: 401,
+                        error_message: 'No valid token provided. Provide either Device-Token or Authorization header',
+                        error_code: 'NO_AUTH_TOKEN',
+                    }).catch((err) => {
+                        logger.debug('Failed to log audit event', { error: err.message });
+                    });
+                }
+                return res.status(401).json({ message: 'No valid token provided. Provide either Device-Token or Authorization header' });
+            }
+            // Set auth type
+            if (deviceAuthenticated && officerAuthenticated) {
+                req.authType = 'both';
+            }
+            else if (deviceAuthenticated) {
+                req.authType = 'device';
+                req.user = null;
+            }
+            else {
+                req.authType = 'officer';
+                req.device = null;
+            }
+            (0, logMode_1.devLog)('Authentication successful', {
+                authType: req.authType,
+                device: req.device,
+                officer: req.officer,
+                apiKey: req.apiKey,
+                microservice: req.microservice,
+            });
+            // Log audit event for endpoint access (non-blocking)
+            if (auditService) {
+                (0, logMode_1.devLog)('Calling audit service for endpoint access', {
+                    path: req.path,
+                    originalUrl: req.originalUrl,
+                    baseUrl: req.baseUrl,
+                    method: req.method,
+                    authType: req.authType,
+                });
+                auditService.logAuditEvent(req, {
+                    event_type: undefined, // Will be determined automatically
+                    // Custom keys can be added here
+                }).catch((err) => {
+                    logger.error('Failed to log audit event', {
+                        error: err.message,
+                        stack: err.stack,
+                        path: req.path,
+                        originalUrl: req.originalUrl,
+                    });
+                    (0, logMode_1.devError)('Audit logging failed', err);
+                });
+            }
+            else {
+                debugError('Audit service not available', {
+                    hasKafkaProducer: !!deps.kafkaProducer,
+                    hasIsProducerConnected: !!deps.isProducerConnected,
+                });
+                (0, logMode_1.devLog)('Audit service not available', {
+                    hasKafkaProducer: !!deps.kafkaProducer,
+                    hasIsProducerConnected: !!deps.isProducerConnected,
+                });
+            }
+            return next();
+        }
+        catch (error) {
+            (0, logMode_1.devError)('Authentication error:', error);
+            return res.status(500).json({ message: 'Authentication error' });
+        }
+    });
+};
+exports.createAuthenticateDeviceOrOfficer = createAuthenticateDeviceOrOfficer;

package/dist/services/apiKeyService.d.ts

@@ -0,0 +1,53 @@
+import { SharedServicesDependencies } from '../types/dependencies';
+export interface ApiKeyData {
+    id: number;
+    key: string;
+    microservice: string;
+    description?: string;
+    is_active: boolean;
+    last_used_at?: Date;
+    expires_at?: Date;
+    created_at: Date;
+    updated_at: Date;
+    created_by?: number;
+}
+export declare class ApiKeyService {
+    private logger;
+    private safeRedisGet?;
+    private safeRedisSet?;
+    constructor(deps: SharedServicesDependencies);
+    /**
+     * Generate a new API key
+     */
+    generateApiKey(): string;
+    /**
+     * Create a new API key for a microservice
+     * Creates via auth service API
+     */
+    createApiKey(microservice: string, description?: string, expiresInDays?: number, createdBy?: number): Promise<ApiKeyData>;
+    /**
+     * Validate an API key
+     * Uses Redis cache with auth service fallback (similar to officer service pattern)
+     */
+    validateApiKey(apiKey: string): Promise<ApiKeyData | null>;
+    /**
+     * Get all API keys from auth service
+     */
+    getAllApiKeys(microservice?: string): Promise<ApiKeyData[]>;
+    /**
+     * Get API key by ID from auth service
+     */
+    getApiKeyById(id: number): Promise<ApiKeyData | null>;
+    /**
+     * Revoke/deactivate an API key via auth service
+     */
+    revokeApiKey(id: number): Promise<ApiKeyData>;
+    /**
+     * Reactivate an API key via auth service
+     */
+    reactivateApiKey(id: number): Promise<ApiKeyData>;
+    /**
+     * Delete an API key via auth service
+     */
+    deleteApiKey(id: number): Promise<void>;
+}

package/dist/services/apiKeyService.js

@@ -0,0 +1,293 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyService = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+class ApiKeyService {
+    constructor(deps) {
+        this.logger = deps.logger;
+        this.safeRedisGet = deps.safeRedisGet;
+        this.safeRedisSet = deps.safeRedisSet;
+    }
+    /**
+     * Generate a new API key
+     */
+    generateApiKey() {
+        // Generate a secure random API key
+        const randomBytes = crypto_1.default.randomBytes(32);
+        const apiKey = `ak_${randomBytes.toString('base64url')}`;
+        return apiKey;
+    }
+    /**
+     * Create a new API key for a microservice
+     * Creates via auth service API
+     */
+    createApiKey(microservice, description, expiresInDays, createdBy) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                // Create API key via auth service
+                const response = yield fetch(`http://${authHost}/api/v1/api-key`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        microservice,
+                        description,
+                        expiresInDays,
+                        createdBy
+                    })
+                });
+                if (!response.ok) {
+                    const errorData = yield response.json().catch(() => ({}));
+                    throw new Error(errorData.message || `Failed to create API key: ${response.status}`);
+                }
+                const apiKey = yield response.json();
+                const keyData = apiKey.data || apiKey;
+                this.logger.info('API key created successfully', {
+                    apiKeyId: keyData.id,
+                    microservice
+                });
+                return keyData;
+            }
+            catch (error) {
+                this.logger.error('Error creating API key', {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    microservice
+                });
+                throw error;
+            }
+        });
+    }
+    /**
+     * Validate an API key
+     * Uses Redis cache with auth service fallback (similar to officer service pattern)
+     */
+    validateApiKey(apiKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // Try to get from Redis cache first
+                const cacheKey = `api_key:${apiKey}`;
+                const cachedData = this.safeRedisGet ? yield this.safeRedisGet(cacheKey) : null;
+                let key = null;
+                if (cachedData) {
+                    try {
+                        key = JSON.parse(cachedData);
+                        this.logger.debug('API key found in cache', { apiKeyId: key.id });
+                    }
+                    catch (parseError) {
+                        this.logger.warn('Failed to parse cached API key', {
+                            error: parseError instanceof Error ? parseError.message : 'Unknown error'
+                        });
+                    }
+                }
+                // If not in cache, fetch from auth service
+                if (!key) {
+                    let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                    if (!authHost.includes(':')) {
+                        authHost = `${authHost}:3000`;
+                    }
+                    const response = yield fetch(`http://${authHost}/api/v1/api-key/validate`, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ apiKey })
+                    });
+                    if (!response.ok) {
+                        if (response.status === 404 || response.status === 401) {
+                            return null;
+                        }
+                        this.logger.warn('Failed to validate API key from auth service', {
+                            status: response.status
+                        });
+                        return null;
+                    }
+                    const result = yield response.json();
+                    key = result.data || result;
+                    // Cache the result if found (15 minutes TTL for API keys)
+                    if (key && this.safeRedisSet) {
+                        yield this.safeRedisSet(cacheKey, JSON.stringify(key));
+                        this.logger.debug('API key cached', { apiKeyId: key.id });
+                    }
+                }
+                if (!key) {
+                    return null;
+                }
+                // Check if key is active
+                if (!key.is_active) {
+                    this.logger.warn('Inactive API key used', { apiKeyId: key.id });
+                    return null;
+                }
+                // Check if key has expired
+                if (key.expires_at && new Date(key.expires_at) < new Date()) {
+                    this.logger.warn('Expired API key used', { apiKeyId: key.id });
+                    return null;
+                }
+                return key;
+            }
+            catch (error) {
+                this.logger.error('Error validating API key', {
+                    error: error instanceof Error ? error.message : 'Unknown error'
+                });
+                return null;
+            }
+        });
+    }
+    /**
+     * Get all API keys from auth service
+     */
+    getAllApiKeys(microservice) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                const url = microservice
+                    ? `http://${authHost}/api/v1/api-key?microservice=${microservice}`
+                    : `http://${authHost}/api/v1/api-key`;
+                const response = yield fetch(url);
+                if (!response.ok) {
+                    throw new Error(`Failed to fetch API keys: ${response.status}`);
+                }
+                const result = yield response.json();
+                return result.data || result;
+            }
+            catch (error) {
+                this.logger.error('Error fetching API keys', {
+                    error: error instanceof Error ? error.message : 'Unknown error'
+                });
+                throw error;
+            }
+        });
+    }
+    /**
+     * Get API key by ID from auth service
+     */
+    getApiKeyById(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                const response = yield fetch(`http://${authHost}/api/v1/api-key/${id}`);
+                if (!response.ok) {
+                    if (response.status === 404) {
+                        return null;
+                    }
+                    throw new Error(`Failed to fetch API key: ${response.status}`);
+                }
+                const result = yield response.json();
+                return result.data || result;
+            }
+            catch (error) {
+                this.logger.error('Error fetching API key by ID', {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    id
+                });
+                throw error;
+            }
+        });
+    }
+    /**
+     * Revoke/deactivate an API key via auth service
+     */
+    revokeApiKey(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                const response = yield fetch(`http://${authHost}/api/v1/api-key/${id}/revoke`, {
+                    method: 'PUT'
+                });
+                if (!response.ok) {
+                    throw new Error(`Failed to revoke API key: ${response.status}`);
+                }
+                const result = yield response.json();
+                const apiKey = result.data || result;
+                this.logger.info('API key revoked', { apiKeyId: id });
+                return apiKey;
+            }
+            catch (error) {
+                this.logger.error('Error revoking API key', {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    id
+                });
+                throw error;
+            }
+        });
+    }
+    /**
+     * Reactivate an API key via auth service
+     */
+    reactivateApiKey(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                const response = yield fetch(`http://${authHost}/api/v1/api-key/${id}/reactivate`, {
+                    method: 'PUT'
+                });
+                if (!response.ok) {
+                    throw new Error(`Failed to reactivate API key: ${response.status}`);
+                }
+                const result = yield response.json();
+                const apiKey = result.data || result;
+                this.logger.info('API key reactivated', { apiKeyId: id });
+                return apiKey;
+            }
+            catch (error) {
+                this.logger.error('Error reactivating API key', {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    id
+                });
+                throw error;
+            }
+        });
+    }
+    /**
+     * Delete an API key via auth service
+     */
+    deleteApiKey(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let authHost = process.env.AUTH_HOST || 'localhost:3000';
+                if (!authHost.includes(':')) {
+                    authHost = `${authHost}:3000`;
+                }
+                const response = yield fetch(`http://${authHost}/api/v1/api-key/${id}`, {
+                    method: 'DELETE'
+                });
+                if (!response.ok) {
+                    throw new Error(`Failed to delete API key: ${response.status}`);
+                }
+                this.logger.info('API key deleted', { apiKeyId: id });
+            }
+            catch (error) {
+                this.logger.error('Error deleting API key', {
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    id
+                });
+                throw error;
+            }
+        });
+    }
+}
+exports.ApiKeyService = ApiKeyService;