@govish/shared-services 1.3.0 → 1.5.1

package/dist/services/auditService.js

@@ -39,6 +39,16 @@ var AuditEventType;
     AuditEventType["ENDPOINT_ACCESSED"] = "endpoint_accessed";
     AuditEventType["UNAUTHORIZED_ACCESS"] = "unauthorized_access";
     AuditEventType["FORBIDDEN_ACCESS"] = "forbidden_access";
+    // IPRS events
+    AuditEventType["IPRS_PERSON_SEARCHED"] = "iprs_person_searched";
+    AuditEventType["IPRS_PERSON_FETCHED_FROM_VPS"] = "iprs_person_fetched_from_vps";
+    AuditEventType["IPRS_PERSON_STORED"] = "iprs_person_stored";
+    AuditEventType["IPRS_PERSON_UPDATED"] = "iprs_person_updated";
+    // Vehicle events
+    AuditEventType["VEHICLE_SEARCHED"] = "vehicle_searched";
+    AuditEventType["VEHICLE_FETCHED_FROM_IPRS"] = "vehicle_fetched_from_iprs";
+    AuditEventType["VEHICLE_STORED"] = "vehicle_stored";
+    AuditEventType["VEHICLE_UPDATED"] = "vehicle_updated";
 })(AuditEventType || (exports.AuditEventType = AuditEventType = {}));
 class AuditService {
     constructor(deps) {
@@ -294,6 +304,7 @@ class AuditService {
                 const officer = req.officer; // Use officer directly, as it has all the properties
                 const device = req.device;
                 const apiKey = req.apiKey;
+                console.log('🔑 [Audit] API Key:', apiKey);
                 const authenticatedMicroservice = req.microservice;
                 // Get microservice name from environment or default
                 const microserviceName = this.serverName || 'Package Name';
@@ -303,9 +314,11 @@ class AuditService {
                     eventType = AuditService.determineEventType(req);
                 }
                 // Build audit payload - start with base fields
+                // Note: API key fields will be set later if API key is detected
+                // microservice should always be the receiving service (from SERVER_NAME), not the source microservice
                 const auditPayload = {
                     timestamp: new Date().toISOString(),
-                    microservice: authenticatedMicroservice || microserviceName,
+                    microservice: microserviceName, // Always use receiving service name from SERVER_NAME
                     event_type: eventType,
                     endpoint: req.originalUrl || req.url,
                     method: req.method,
@@ -313,6 +326,12 @@ class AuditService {
                     query_params: Object.keys(req.query).length > 0 ? req.query : undefined,
                     ip_address,
                     user_agent,
+                    api_key_id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    api_key_name: apiKey === null || apiKey === void 0 ? void 0 : apiKey.description,
+                    api_key_description: apiKey === null || apiKey === void 0 ? void 0 : apiKey.description,
+                    api_key_preview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : undefined,
+                    source_microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    authenticated_microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
                 };
                 // Add officer information if authenticated
                 if (officer) {
@@ -336,25 +355,92 @@ class AuditService {
                     auditPayload.device_device_id = device.device_id;
                 }
                 // Set user type and add API Key / Microservice information
-                if (authType === 'api_key' || authType === 'microservice') {
-                    auditPayload.user_type = 'microservice';
-                    auditPayload.authenticated_microservice = authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice);
-                    auditPayload.api_key_id = apiKey === null || apiKey === void 0 ? void 0 : apiKey.id;
-                    // Set microservice name in the main microservice field
-                    if (authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice)) {
-                        auditPayload.microservice = authenticatedMicroservice || apiKey.microservice;
+                // IMPORTANT: Always check for API key presence regardless of authType, as API key might be present
+                // even when authType is set to 'officer' or 'both' due to priority logic
+                const hasApiKey = !!(apiKey || authenticatedMicroservice);
+                const sourceMicroservice = (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice) || authenticatedMicroservice;
+                // Always include API key information if present
+                if (hasApiKey) {
+                    // Include API key object fields only if apiKey object exists
+                    if (apiKey) {
+                        auditPayload.api_key_id = apiKey.id;
+                        auditPayload.api_key_name = apiKey.description || undefined; // API key name (from description field)
+                        auditPayload.api_key_description = apiKey.description || undefined; // Keep description for backward compatibility
+                        auditPayload.api_key_preview = apiKey.key ? apiKey.key.substring(0, 15) + '...' : undefined;
+                    }
+                    // ALWAYS include microservice information if authenticatedMicroservice is detected
+                    // This works even if apiKey object is not attached
+                    // Note: microservice field should always be the receiving service (from SERVER_NAME)
+                    // source_microservice and authenticated_microservice are the API key's microservice
+                    if (sourceMicroservice) {
+                        auditPayload.source_microservice = sourceMicroservice;
+                        auditPayload.authenticated_microservice = sourceMicroservice;
+                        // Do NOT overwrite microservice - it should always be the receiving service
+                    }
+                    else if (authenticatedMicroservice) {
+                        // Fallback: use authenticatedMicroservice directly if sourceMicroservice is not set
+                        auditPayload.source_microservice = authenticatedMicroservice;
+                        auditPayload.authenticated_microservice = authenticatedMicroservice;
+                        // Do NOT overwrite microservice - it should always be the receiving service
                     }
-                    // For microservice authentication, we don't have a user_id
+                    // Log API key presence with full details
+                    this.debugLog('API Key Detected', {
+                        apiKeyId: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.id) || 'N/A',
+                        apiKeyName: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.description) || sourceMicroservice || authenticatedMicroservice || 'N/A',
+                        apiKeyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                        sourceMicroservice: sourceMicroservice || authenticatedMicroservice,
+                        hasApiKeyObject: !!apiKey,
+                        endpoint: auditPayload.endpoint
+                    });
+                }
+                // Now set user_type based on authType and what's actually present
+                if (authType === 'api_key_and_officer') {
+                    // API Key + Officer authentication (may also have device)
+                    auditPayload.user_type = 'api_key_and_officer';
+                    // Include officer information (officer is already set above)
+                    if (officer) {
+                        auditPayload.user_id = officer.id;
+                        auditPayload.officer_id = officer.id;
+                        auditPayload.officer_name = officer.name || undefined;
+                        auditPayload.officer_service_number = officer.service_number || undefined;
+                        auditPayload.officer_email = officer.email || undefined;
+                    }
+                    // Explicitly preserve device information if present (device info was added earlier, but ensure it's preserved)
+                    if (device) {
+                        const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                        if (!isNaN(deviceId)) {
+                            auditPayload.device_id = deviceId;
+                        }
+                        auditPayload.device_device_id = device.device_id;
+                    }
+                }
+                else if (authType === 'api_key' || authType === 'microservice') {
+                    auditPayload.user_type = 'microservice';
+                    // For microservice authentication, we don't have a user_id unless device is present
+                    // (device info is already set above if present)
                 }
                 else if (authType === 'both') {
-                    auditPayload.user_type = 'both';
+                    // Device + Officer - but check if API key is also present
+                    if (hasApiKey) {
+                        // All three: API Key + Device + Officer
+                        auditPayload.user_type = 'api_key_and_officer'; // Upgrade to api_key_and_officer since API key is present
+                    }
+                    else {
+                        auditPayload.user_type = 'both';
+                    }
                     // When both are authenticated, prioritize officer as user_id
                     if (officer) {
                         auditPayload.user_id = officer.id;
                     }
                 }
                 else if (authType === 'device') {
-                    auditPayload.user_type = 'device';
+                    // Device only - but check if API key is also present
+                    if (hasApiKey) {
+                        auditPayload.user_type = 'api_key'; // Upgrade to api_key since API key is present
+                    }
+                    else {
+                        auditPayload.user_type = 'device';
+                    }
                     // Use device id as user_id when only device is authenticated
                     if (device) {
                         const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
@@ -364,12 +450,85 @@ class AuditService {
                     }
                 }
                 else if (authType === 'officer') {
-                    auditPayload.user_type = 'officer';
+                    // Officer only - but check if API key is also present
+                    if (hasApiKey) {
+                        auditPayload.user_type = 'api_key_and_officer'; // Upgrade to api_key_and_officer since API key is present
+                        this.debugLog('Upgraded user_type from "officer" to "api_key_and_officer" because API key detected', {
+                            sourceMicroservice: sourceMicroservice,
+                            apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                            hasApiKeyObject: !!apiKey
+                        });
+                        // Explicitly preserve device information if present when upgrading from officer to api_key_and_officer
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                    else {
+                        auditPayload.user_type = 'officer';
+                    }
                     // Use officer id as user_id when only officer is authenticated
                     if (officer) {
                         auditPayload.user_id = officer.id;
                     }
                 }
+                // Log when API key is present but wasn't reflected in authType
+                if (hasApiKey && authType !== 'api_key' && authType !== 'api_key_and_officer' && authType !== 'microservice') {
+                    this.debugLog('API Key detected but authType was different', {
+                        authType,
+                        apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                        sourceMicroservice: sourceMicroservice,
+                        finalUserType: auditPayload.user_type,
+                        hasApiKeyObject: !!apiKey,
+                        authenticatedMicroservice: authenticatedMicroservice
+                    });
+                }
+                // Final check: Ensure user_type matches what we actually have
+                if (hasApiKey && officer && auditPayload.user_type !== 'api_key_and_officer') {
+                    this.debugLog('Force upgrading user_type to api_key_and_officer (final check)', {
+                        currentUserType: auditPayload.user_type,
+                        hasApiKey: hasApiKey,
+                        hasOfficer: !!officer,
+                        sourceMicroservice: sourceMicroservice
+                    });
+                    auditPayload.user_type = 'api_key_and_officer';
+                    // Explicitly preserve device information when force upgrading to api_key_and_officer
+                    if (device) {
+                        const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                        if (!isNaN(deviceId)) {
+                            auditPayload.device_id = deviceId;
+                        }
+                        auditPayload.device_device_id = device.device_id;
+                    }
+                }
+                // Final validation: Ensure API key information is included if payload.microservice was provided
+                // This is a safety check in case payload parameter contained microservice info that wasn't processed
+                // Note: auditPayload.microservice should always be microserviceName (receiving service) at this point
+                if (payload.microservice && payload.microservice !== microserviceName && !auditPayload.source_microservice) {
+                    // Payload contained a microservice different from receiving service, use it as source
+                    auditPayload.source_microservice = payload.microservice;
+                    auditPayload.authenticated_microservice = payload.microservice;
+                    // Upgrade user_type if officer is present
+                    if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('Final safety check: Upgraded user_type to api_key_and_officer', {
+                            microservice: auditPayload.microservice,
+                            receivingMicroservice: microserviceName,
+                            officerId: auditPayload.officer_id
+                        });
+                        // Explicitly preserve device information when upgrading from officer to api_key_and_officer in final validation
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                }
                 // Extract arrest-specific information from request body or response
                 this.addArrestInformation(req, auditPayload, payload);
                 // Merge custom keys from payload
@@ -382,6 +541,69 @@ class AuditService {
                         auditPayload[key] = payload[key];
                     }
                 });
+                // CRITICAL: Final check AFTER payload merge to ensure API key detection is not overridden
+                // If microservice indicates API key usage but user_type doesn't reflect it, fix it
+                // Check if API key was used by checking if authenticatedMicroservice or apiKey exists
+                // This works regardless of SERVER_NAME configuration
+                const finalHasApiKey = !!(apiKey || authenticatedMicroservice || auditPayload.source_microservice);
+                const finalSourceMicroservice = sourceMicroservice || auditPayload.source_microservice || auditPayload.microservice;
+                // CRITICAL: Preserve device information after payload merge (in case payload merge cleared it)
+                // Device information should always be preserved if device was authenticated
+                if (device) {
+                    const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                    if (!isNaN(deviceId)) {
+                        auditPayload.device_id = deviceId;
+                    }
+                    auditPayload.device_device_id = device.device_id;
+                }
+                if (finalHasApiKey && (authenticatedMicroservice || apiKey)) {
+                    // ALWAYS set microservice fields when API key is detected
+                    // Don't check if they already exist - ensure they're set (in case payload merge cleared them)
+                    // Note: microservice field should always be the receiving service (from SERVER_NAME)
+                    auditPayload.source_microservice = finalSourceMicroservice;
+                    auditPayload.authenticated_microservice = finalSourceMicroservice;
+                    // Do NOT overwrite microservice - it should always be the receiving service
+                    // Include API key object fields if available
+                    if (apiKey) {
+                        // Always set these if apiKey exists, even if already set (in case payload merge cleared them)
+                        auditPayload.api_key_id = apiKey.id;
+                        auditPayload.api_key_name = apiKey.description || undefined;
+                        auditPayload.api_key_description = apiKey.description || undefined;
+                        auditPayload.api_key_preview = apiKey.key ? apiKey.key.substring(0, 15) + '...' : undefined;
+                    }
+                    // ALWAYS upgrade user_type when API key is detected and officer is present
+                    if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type to api_key_and_officer after payload merge', {
+                            microservice: auditPayload.microservice,
+                            receivingMicroservice: microserviceName,
+                            officerId: auditPayload.officer_id,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                        // Explicitly preserve device information when upgrading from officer to api_key_and_officer after payload merge
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                    else if (auditPayload.user_type === 'both' && finalHasApiKey) {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type from "both" to "api_key_and_officer" after payload merge', {
+                            microservice: auditPayload.microservice,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                    }
+                    else if (!auditPayload.officer_id && auditPayload.user_type === 'device' && finalHasApiKey) {
+                        auditPayload.user_type = 'api_key';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type from "device" to "api_key" after payload merge', {
+                            microservice: auditPayload.microservice,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                    }
+                }
                 // Build user info string for logging
                 const userInfo = auditPayload.officer_name
                     ? `${auditPayload.officer_name} (Officer ID: ${auditPayload.officer_id})`
@@ -460,6 +682,31 @@ class AuditService {
                         return;
                     }
                     this.debugLog('All checks passed - proceeding to send');
+                    // Final safety check: If microservice indicates API key but fields are missing, add them
+                    // This catches any edge cases where fields might have been cleared
+                    if (auditPayload.microservice &&
+                        auditPayload.microservice !== microserviceName &&
+                        (!auditPayload.source_microservice || !auditPayload.authenticated_microservice)) {
+                        auditPayload.source_microservice = auditPayload.microservice;
+                        auditPayload.authenticated_microservice = auditPayload.microservice;
+                        // Upgrade user_type if needed
+                        if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                            auditPayload.user_type = 'api_key_and_officer';
+                            this.debugLog('🔧 [PRE-SEND] Final safety check: Upgraded user_type to api_key_and_officer', {
+                                microservice: auditPayload.microservice,
+                                receivingMicroservice: microserviceName,
+                                officerId: auditPayload.officer_id
+                            });
+                            // Explicitly preserve device information when upgrading from officer to api_key_and_officer in pre-send check
+                            if (device) {
+                                const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                                if (!isNaN(deviceId)) {
+                                    auditPayload.device_id = deviceId;
+                                }
+                                auditPayload.device_device_id = device.device_id;
+                            }
+                        }
+                    }
                     const topic = this.auditTopic || 'audit-log';
                     const kafkaMessage = {
                         key: `${auditPayload.method}-${auditPayload.endpoint}-${Date.now()}`,
@@ -654,6 +901,36 @@ class AuditService {
                 return AuditEventType.ARRESTS_LISTED;
             }
         }
+        // IPRS events
+        if (fullPath.includes('/iprs') || path.includes('/iprs')) {
+            if (method === 'POST' && (fullPath.includes('/search') || path.includes('/search'))) {
+                return AuditEventType.IPRS_PERSON_SEARCHED;
+            }
+            else if (method === 'GET' && (fullPath.includes('/fetch') || path.includes('/fetch'))) {
+                return AuditEventType.IPRS_PERSON_FETCHED_FROM_VPS;
+            }
+            else if (method === 'POST' && (fullPath.includes('/store') || path.includes('/store'))) {
+                return AuditEventType.IPRS_PERSON_STORED;
+            }
+            else if (method === 'PUT') {
+                return AuditEventType.IPRS_PERSON_UPDATED;
+            }
+        }
+        // Vehicle events
+        if (fullPath.includes('/vehicle') || path.includes('/vehicles')) {
+            if (method === 'GET' && (fullPath.includes('/search') || path.includes('/search'))) {
+                return AuditEventType.VEHICLE_SEARCHED;
+            }
+            else if (method === 'GET' && (fullPath.includes('/fetch') || path.includes('/fetch'))) {
+                return AuditEventType.VEHICLE_FETCHED_FROM_IPRS;
+            }
+            else if (method === 'POST' && (fullPath.includes('/store') || path.includes('/store'))) {
+                return AuditEventType.VEHICLE_STORED;
+            }
+            else if (method === 'PUT') {
+                return AuditEventType.VEHICLE_UPDATED;
+            }
+        }
         // Default to endpoint accessed
         return AuditEventType.ENDPOINT_ACCESSED;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@govish/shared-services",
-  "version": "1.3.0",
-  "description": "Govish shared services package - officer, device, station, penal code, station-duty block, and rank leave days cache services; API key service; audit logging; authentication middleware",
+  "version": "1.5.1",
+  "description": "Govish shared services package - officer, device, station, penal code, station-duty block, and rank leave days cache services; API key service; audit logging; authentication middleware with support for API key + officer combined authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -23,6 +23,11 @@
     "audit",
     "authentication",
     "middleware",
+    "api-key",
+    "jwt",
+    "device-authentication",
+    "officer-authentication",
+    "microservice-authentication",
     "typescript"
   ],
   "author": "",