@intranefr/superbackend 1.4.3

package/src/routes/workflows.routes.js

@@ -0,0 +1,110 @@
+const express = require('express');
+const router = express.Router();
+const Workflow = require('../models/Workflow');
+const WorkflowExecution = require('../models/WorkflowExecution');
+const workflowService = require('../services/workflow.service');
+
+// List workflows
+router.get('/', async (req, res) => {
+  const query = req.currentOrganization ? { organizationId: req.currentOrganization.id } : {};
+  const workflows = await Workflow.find(query).sort('-createdAt');
+  res.json(workflows);
+});
+
+// Get single workflow
+router.get('/:id', async (req, res) => {
+  const workflow = await Workflow.findById(req.params.id);
+  if (!workflow) return res.status(404).json({ error: 'Workflow not found' });
+  res.json(workflow);
+});
+
+// Create workflow
+router.post('/', async (req, res) => {
+  const workflow = await Workflow.create({
+    ...req.body,
+    organizationId: req.currentOrganization?.id
+  });
+  res.status(201).json(workflow);
+});
+
+// Update workflow
+router.put('/:id', async (req, res) => {
+  const workflow = await Workflow.findByIdAndUpdate(req.params.id, req.body, { new: true });
+  if (!workflow) return res.status(404).json({ error: 'Workflow not found' });
+  res.json(workflow);
+});
+
+// Delete workflow
+router.delete('/:id', async (req, res) => {
+  await Workflow.findByIdAndDelete(req.params.id);
+  await WorkflowExecution.deleteMany({ workflowId: req.params.id });
+  res.json({ success: true });
+});
+
+// Get executions
+router.get('/:id/runs', async (req, res) => {
+  const executions = await WorkflowExecution.find({ workflowId: req.params.id }).sort('-executedAt').limit(50);
+  res.json(executions);
+});
+
+// Test execution
+router.post('/:id/test', async (req, res) => {
+  try {
+    const initialContext = {
+      body: req.body.body || {},
+      query: req.body.query || {},
+      headers: req.body.headers || {},
+      method: req.body.method || 'POST'
+    };
+    const service = await workflowService.execute(req.params.id, initialContext);
+    res.json({
+      status: service.status,
+      log: service.executionLog,
+      context: service.context
+    });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// Isolated node test
+router.post('/:id/nodes/:nodeId/test', async (req, res) => {
+  try {
+    const { WorkflowService } = require('../services/workflow.service');
+    const Workflow = require('../models/Workflow');
+    
+    const workflow = await Workflow.findById(req.params.id);
+    if (!workflow) return res.status(404).json({ error: 'Workflow not found' });
+
+    // Use dirty node data from request body if provided, otherwise fallback to DB
+    const node = req.body.node || workflow.nodes.find(n => n.id === req.params.nodeId);
+    if (!node) return res.status(404).json({ error: 'Node not found' });
+
+    const service = new WorkflowService(req.params.id);
+    // Standard runNode logic but with the provided node object
+    service.context = {
+      ...req.body.context,
+      entrypoint: req.body.context?.entrypoint || workflow.testDataset || {},
+      payload: req.body.context?.payload || workflow.testDataset || {},
+      nodes: req.body.context?.nodes || {},
+      lastNode: req.body.context?.lastNode || workflow.testDataset || {},
+      env: process.env
+    };
+    
+    const result = await service.executeNode(node);
+    
+    // Persist result in the node's testResult field in DB
+    const nodeIndex = workflow.nodes.findIndex(n => n.id === req.params.nodeId);
+    if (nodeIndex !== -1) {
+      workflow.nodes[nodeIndex].testResult = result;
+      workflow.markModified('nodes');
+      await workflow.save();
+    }
+
+    res.json({ result, context: service.context });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+module.exports = router;

package/src/services/assets.service.js

@@ -0,0 +1,110 @@
+const Asset = require('../models/Asset');
+const objectStorage = require('./objectStorage.service');
+
+async function getAssetById(id, { status = 'uploaded' } = {}) {
+  const asset = await Asset.findById(id);
+  if (!asset) {
+    const err = new Error('Asset not found');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  if (status && asset.status !== status) {
+    const err = new Error('Asset not found');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  return asset.toObject();
+}
+
+async function getAssetByKey(key, { status = 'uploaded' } = {}) {
+  const asset = await Asset.findOne({ key: String(key || '').trim() });
+  if (!asset) {
+    const err = new Error('Asset not found');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  if (status && asset.status !== status) {
+    const err = new Error('Asset not found');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  return asset.toObject();
+}
+
+async function listAssets({
+  namespace,
+  tag,
+  visibility,
+  status = 'uploaded',
+  page = 1,
+  limit = 50,
+} = {}) {
+  const normalizedLimit = Math.min(100, Math.max(1, Number(limit) || 50));
+  const normalizedPage = Math.max(1, Number(page) || 1);
+  const skip = (normalizedPage - 1) * normalizedLimit;
+
+  const filter = {};
+  if (status) filter.status = status;
+  if (namespace) filter.namespace = String(namespace);
+  if (visibility) filter.visibility = String(visibility);
+  if (tag) filter.tags = String(tag).trim().toLowerCase();
+
+  const [assets, total] = await Promise.all([
+    Asset.find(filter).sort({ createdAt: -1 }).skip(skip).limit(normalizedLimit).lean(),
+    Asset.countDocuments(filter),
+  ]);
+
+  return {
+    assets,
+    pagination: {
+      page: normalizedPage,
+      limit: normalizedLimit,
+      total,
+      pages: Math.ceil(total / normalizedLimit),
+    },
+  };
+}
+
+async function getAssetBytesById(id, { status = 'uploaded' } = {}) {
+  const asset = await getAssetById(id, { status });
+  const result = await objectStorage.getObject({ key: asset.key });
+  if (!result || !result.body) {
+    const err = new Error('File not found in storage');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  return {
+    asset,
+    contentType: result.contentType || asset.contentType,
+    body: result.body,
+  };
+}
+
+async function getAssetBytesByKey(key, { status = 'uploaded' } = {}) {
+  const asset = await getAssetByKey(key, { status });
+  const result = await objectStorage.getObject({ key: asset.key });
+  if (!result || !result.body) {
+    const err = new Error('File not found in storage');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  return {
+    asset,
+    contentType: result.contentType || asset.contentType,
+    body: result.body,
+  };
+}
+
+module.exports = {
+  getAssetById,
+  getAssetByKey,
+  listAssets,
+  getAssetBytesById,
+  getAssetBytesByKey,
+};

package/src/services/audit.service.js

@@ -0,0 +1,62 @@
+const AuditEvent = require('../models/AuditEvent');
+const webhookService = require('./webhook.service');
+
+async function createAuditEvent({
+  actorType,
+  actorId,
+  action,
+  entityType,
+  entityId,
+  before,
+  after,
+  meta,
+}) {
+  try {
+    await AuditEvent.create({
+      actorType,
+      actorId,
+      action,
+      entityType,
+      entityId,
+      before,
+      after,
+      meta,
+    });
+
+    // Trigger Webhooks for critical events or all audit events
+    // Assuming organizationId is available in meta or can be inferred
+    const organizationId = meta?.organizationId || meta?.orgId;
+    if (organizationId) {
+      webhookService.emit('audit.event', {
+        action,
+        entityType,
+        entityId,
+        actorType,
+        actorId,
+        timestamp: new Date().toISOString()
+      }, organizationId);
+    }
+  } catch (error) {
+    console.error('Error creating audit event:', error);
+  }
+}
+
+function getBasicAuthActor(req) {
+  const authHeader = req.headers.authorization;
+  if (!authHeader || !authHeader.startsWith('Basic ')) {
+    return { actorType: 'admin', actorId: null };
+  }
+
+  try {
+    const credentials = Buffer.from(authHeader.substring(6), 'base64').toString('utf-8');
+    const [username] = credentials.split(':');
+    return { actorType: 'admin', actorId: username || null };
+  } catch (e) {
+    return { actorType: 'admin', actorId: null };
+  }
+}
+
+module.exports = {
+  createAuditEvent,
+  getBasicAuthActor,
+};

package/src/services/auditLogger.js

@@ -0,0 +1,165 @@
+const AuditEvent = require('../models/AuditEvent');
+
+const SENSITIVE_KEYS = [
+  'password',
+  'token',
+  'secret',
+  'authorization',
+  'cookie',
+  'apikey',
+  'api_key',
+  'accesstoken',
+  'refreshtoken',
+  'passwordhash',
+];
+
+async function getConfig() {
+  return {
+    auditTrackingEnabled: process.env.AUDIT_TRACKING_ENABLED !== 'false',
+    auditLogFailedAttempts: process.env.AUDIT_LOG_FAILED_ATTEMPTS !== 'false',
+    auditRetentionDays: parseInt(process.env.AUDIT_RETENTION_DAYS, 10) || 90,
+  };
+}
+
+function scrubValue(key, value) {
+  const lowerKey = String(key).toLowerCase();
+  for (const sensitive of SENSITIVE_KEYS) {
+    if (lowerKey.includes(sensitive)) {
+      return '[REDACTED]';
+    }
+  }
+  return value;
+}
+
+function scrubObject(obj, depth = 0) {
+  if (depth > 5 || !obj || typeof obj !== 'object') return obj;
+  if (Array.isArray(obj)) {
+    return obj.slice(0, 10).map((item) => scrubObject(item, depth + 1));
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (typeof value === 'object' && value !== null) {
+      result[key] = scrubObject(value, depth + 1);
+    } else {
+      result[key] = scrubValue(key, value);
+    }
+  }
+  return result;
+}
+
+function extractContext(req) {
+  if (!req) return {};
+  return {
+    ip: req.ip || req.headers?.['x-forwarded-for']?.split(',')[0]?.trim() || req.connection?.remoteAddress,
+    userAgent: req.headers?.['user-agent']?.slice(0, 500),
+    requestId: req.headers?.['x-request-id'] || req.requestId,
+    path: req.path || req.url,
+    method: req.method,
+  };
+}
+
+function extractActor(req) {
+  if (!req) {
+    return { actorType: 'system', actorId: null };
+  }
+
+  if (req.user) {
+    return {
+      actorType: 'user',
+      actorId: String(req.user._id || req.user.id),
+    };
+  }
+
+  const authHeader = req.headers?.authorization || '';
+  if (authHeader.startsWith('Basic ')) {
+    try {
+      const credentials = Buffer.from(authHeader.substring(6), 'base64').toString('utf-8');
+      const [username] = credentials.split(':');
+      return { actorType: 'admin', actorId: username || null };
+    } catch (e) {
+      return { actorType: 'admin', actorId: null };
+    }
+  }
+
+  return { actorType: 'system', actorId: null };
+}
+
+async function logAudit(event) {
+  try {
+    const config = await getConfig();
+    if (!config.auditTrackingEnabled) {
+      return null;
+    }
+
+    if (event.outcome === 'failure' && !config.auditLogFailedAttempts) {
+      return null;
+    }
+
+    const actor = event.actor || extractActor(event.req);
+    const context = event.context || extractContext(event.req);
+
+    const auditEvent = await AuditEvent.create({
+      actorType: actor.actorType || 'system',
+      actorId: actor.actorId || null,
+      action: event.action,
+      entityType: event.entityType || event.targetType || 'unknown',
+      entityId: event.entityId || event.targetId || null,
+      before: event.before || null,
+      after: event.after || null,
+      meta: scrubObject({
+        ...(event.meta || {}),
+        outcome: event.outcome || 'success',
+        context,
+        details: scrubObject(event.details || {}),
+      }),
+      outcome: event.outcome || 'success',
+      context,
+      targetType: event.targetType || event.entityType,
+      targetId: event.targetId || event.entityId,
+    });
+
+    return auditEvent;
+  } catch (err) {
+    try {
+      console.log('[AuditLogger] Failed to log audit:', err.message);
+    } catch (e) {
+      // ignore
+    }
+    return null;
+  }
+}
+
+function logAuditSync(event) {
+  setImmediate(() => {
+    logAudit(event).catch(() => {});
+  });
+}
+
+function auditMiddleware(action, options = {}) {
+  return (req, res, next) => {
+    const originalEnd = res.end;
+    res.end = function (...args) {
+      const outcome = res.statusCode >= 400 ? 'failure' : 'success';
+      logAuditSync({
+        req,
+        action,
+        outcome,
+        entityType: options.entityType || options.targetType,
+        entityId: options.getEntityId ? options.getEntityId(req) : (req.params?.id || req.params?.key),
+        details: options.getDetails ? options.getDetails(req, res) : undefined,
+      });
+      return originalEnd.apply(this, args);
+    };
+    next();
+  };
+}
+
+module.exports = {
+  logAudit,
+  logAuditSync,
+  auditMiddleware,
+  getConfig,
+  extractActor,
+  extractContext,
+  scrubObject,
+};