@intranefr/superbackend 1.6.7 → 1.7.8

package/src/services/github.service.js

@@ -0,0 +1,255 @@
+const axios = require('axios');
+const crypto = require('crypto');
+const globalSettingsService = require('./globalSettings.service');
+
+class GitHubService {
+  constructor() {
+    this.clientId = null;
+    this.clientSecret = null;
+    this.callbackUrl = null;
+    this.baseURL = 'https://github.com';
+    this.apiBaseURL = 'https://api.github.com';
+    
+    // OAuth scopes requested
+    this.scopes = ['read:user', 'user:email'];
+  }
+
+  /**
+   * Get GitHub OAuth credentials from global settings or environment variables
+   * Global settings take precedence over env vars
+   */
+  async getCredentials() {
+    // Try global settings first (they override env vars)
+    const clientId = await globalSettingsService.getSettingValue('github.oauth.clientId');
+    const clientSecret = await globalSettingsService.getSettingValue('github.oauth.clientSecret');
+    const callbackUrl = await globalSettingsService.getSettingValue('github.oauth.callbackUrl');
+
+    return {
+      clientId: clientId || process.env.GITHUB_CLIENT_ID,
+      clientSecret: clientSecret || process.env.GITHUB_CLIENT_SECRET,
+      callbackUrl: callbackUrl || process.env.GITHUB_CALLBACK_URL || 'http://localhost:3000/api/auth/github/callback'
+    };
+  }
+
+  /**
+   * Generate OAuth authorization URL
+   * @param {string} state - CSRF protection state parameter
+   * @returns {string} GitHub OAuth URL
+   */
+  async getAuthURL(state) {
+    const credentials = await this.getCredentials();
+    
+    if (!credentials.clientId) {
+      throw new Error('GITHUB_CLIENT_ID not configured');
+    }
+
+    const params = new URLSearchParams({
+      client_id: credentials.clientId,
+      redirect_uri: credentials.callbackUrl,
+      scope: this.scopes.join(' '),
+      state: state
+    });
+
+    return `${this.baseURL}/login/oauth/authorize?${params.toString()}`;
+  }
+
+  /**
+   * Exchange authorization code for access token
+   * @param {string} code - Authorization code from GitHub callback
+   * @param {string} state - State parameter to verify
+   * @returns {Promise<object>} Token response
+   */
+  async getAccessToken(code, state) {
+    const credentials = await this.getCredentials();
+    
+    if (!credentials.clientId || !credentials.clientSecret) {
+      throw new Error('GitHub OAuth credentials not configured');
+    }
+
+    try {
+      const response = await axios.post(
+        `${this.baseURL}/login/oauth/access_token`,
+        {
+          client_id: credentials.clientId,
+          client_secret: credentials.clientSecret,
+          code: code,
+          redirect_uri: credentials.callbackUrl,
+          state: state
+        },
+        {
+          headers: {
+            'Accept': 'application/json',
+            'Content-Type': 'application/json'
+          }
+        }
+      );
+
+      if (response.data.error) {
+        throw new Error(response.data.error_description || response.data.error);
+      }
+
+      return {
+        accessToken: response.data.access_token,
+        refreshToken: response.data.refresh_token,
+        scope: response.data.scope,
+        tokenType: response.data.token_type
+      };
+    } catch (error) {
+      if (error.response) {
+        throw new Error(`GitHub token exchange failed: ${error.response.data.error_description || error.response.statusText}`);
+      }
+      throw new Error(`GitHub token exchange failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Get user profile from GitHub API
+   * @param {string} accessToken - GitHub access token
+   * @returns {Promise<object>} GitHub user profile
+   */
+  async getUserProfile(accessToken) {
+    try {
+      const response = await axios.get(`${this.apiBaseURL}/user`, {
+        headers: {
+          'Authorization': `token ${accessToken}`,
+          'Accept': 'application/vnd.github.v3+json'
+        }
+      });
+
+      return {
+        id: String(response.data.id),
+        login: response.data.login,
+        name: response.data.name || response.data.login,
+        email: response.data.email,
+        avatarUrl: response.data.avatar_url,
+        htmlUrl: response.data.html_url,
+        company: response.data.company,
+        location: response.data.location,
+        bio: response.data.bio
+      };
+    } catch (error) {
+      if (error.response) {
+        throw new Error(`GitHub API error: ${error.response.data.message || error.response.statusText}`);
+      }
+      throw new Error(`Failed to fetch GitHub profile: ${error.message}`);
+    }
+  }
+
+  /**
+   * Get user emails from GitHub API
+   * @param {string} accessToken - GitHub access token
+   * @returns {Promise<Array>} List of user emails
+   */
+  async getUserEmails(accessToken) {
+    try {
+      const response = await axios.get(`${this.apiBaseURL}/user/emails`, {
+        headers: {
+          'Authorization': `token ${accessToken}`,
+          'Accept': 'application/vnd.github.v3+json'
+        }
+      });
+
+      // Return primary verified email or first verified email
+      const emails = response.data || [];
+      const primaryEmail = emails.find(e => e.primary && e.verified);
+      const verifiedEmail = emails.find(e => e.verified);
+      
+      return {
+        primary: primaryEmail?.email || verifiedEmail?.email || emails[0]?.email,
+        all: emails
+      };
+    } catch (error) {
+      if (error.response) {
+        throw new Error(`GitHub API error: ${error.response.data.message || error.response.statusText}`);
+      }
+      throw new Error(`Failed to fetch GitHub emails: ${error.message}`);
+    }
+  }
+
+  /**
+   * Refresh access token (if refresh token is available)
+   * @param {string} refreshToken - GitHub refresh token
+   * @returns {Promise<object>} New token response
+   */
+  async refreshAccessToken(refreshToken) {
+    const credentials = await this.getCredentials();
+    
+    if (!credentials.clientId || !credentials.clientSecret) {
+      throw new Error('GitHub OAuth credentials not configured');
+    }
+
+    try {
+      const response = await axios.post(
+        `${this.baseURL}/login/oauth/access_token`,
+        {
+          client_id: credentials.clientId,
+          client_secret: credentials.clientSecret,
+          grant_type: 'refresh_token',
+          refresh_token: refreshToken
+        },
+        {
+          headers: {
+            'Accept': 'application/json',
+            'Content-Type': 'application/json'
+          }
+        }
+      );
+
+      if (response.data.error) {
+        throw new Error(response.data.error_description || response.data.error);
+      }
+
+      return {
+        accessToken: response.data.access_token,
+        refreshToken: response.data.refresh_token || refreshToken,
+        scope: response.data.scope,
+        tokenType: response.data.token_type
+      };
+    } catch (error) {
+      if (error.response) {
+        throw new Error(`GitHub token refresh failed: ${error.response.data.error_description || error.response.statusText}`);
+      }
+      throw new Error(`GitHub token refresh failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Generate a cryptographically secure state parameter
+   * @returns {string} State parameter for CSRF protection
+   */
+  generateState() {
+    return crypto.randomBytes(32).toString('hex');
+  }
+
+  /**
+   * Verify state parameter matches
+   * @param {string} provided - State from callback
+   * @param {string} expected - Expected state
+   * @returns {boolean} True if valid
+   */
+  verifyState(provided, expected) {
+    if (!provided || !expected) return false;
+    return crypto.timingSafeEqual(
+      Buffer.from(provided),
+      Buffer.from(expected)
+    );
+  }
+
+  /**
+   * Get full user info including email
+   * @param {string} accessToken - GitHub access token
+   * @returns {Promise<object>} Complete user profile
+   */
+  async getFullUserInfo(accessToken) {
+    const profile = await this.getUserProfile(accessToken);
+    const emails = await this.getUserEmails(accessToken);
+    
+    return {
+      ...profile,
+      email: profile.email || emails.primary,
+      emailVerified: !!emails.primary
+    };
+  }
+}
+
+module.exports = new GitHubService();

package/src/services/rateLimiter.service.js

@@ -128,6 +128,31 @@ function registerLimiter(limiterId, { label, integration, inferredMountPath } =
   return next;
 }
 
+function getLimiterDefaultConfig(limiterId) {
+  // Default configuration for specific limiters
+  const defaults = {
+    // Waiting list endpoints - strict rate limiting to prevent spam
+    waitingListSubscribeLimiter: {
+      enabled: true,
+      mode: 'enforce',
+      algorithm: 'fixedWindow',
+      limit: { max: 1, windowMs: 60000 }, // 1 request per minute
+      identity: { type: 'ip' },
+      metrics: { enabled: true, bucketMs: 60000, retentionDays: 14 }
+    },
+    waitingListStatsLimiter: {
+      enabled: true,
+      mode: 'reportOnly', // Start with monitoring
+      algorithm: 'fixedWindow',
+      limit: { max: 60, windowMs: 60000 }, // 60 requests per minute
+      identity: { type: 'ip' },
+      metrics: { enabled: true, bucketMs: 60000, retentionDays: 14 }
+    }
+  };
+
+  return defaults[limiterId] || null;
+}
+
 async function ensureLimiterOverrideExists(limiterId) {
   const id = normalizeLimiterId(limiterId);
 
@@ -156,10 +181,13 @@ async function ensureLimiterOverrideExists(limiterId) {
       return;
     }
 
+    // Get default config for this limiter, or use minimal enabled: false
+    const defaultConfig = getLimiterDefaultConfig(id) || { enabled: false };
+
     const updated = {
       version: Number(data?.version || 1) || 1,
       defaults: data?.defaults || {},
-      limiters: { ...(data?.limiters || {}), [id]: { enabled: false } },
+      limiters: { ...(data?.limiters || {}), [id]: defaultConfig },
     };
 
     doc.jsonRaw = JSON.stringify(updated, null, 2);

package/src/services/waitingListJson.service.js

@@ -290,9 +290,9 @@ async function getWaitingListStats(options = {}) {
  * Get paginated waiting list entries for admin
  */
 async function getWaitingListEntriesAdmin(filters = {}) {
-  const { status, type, email, limit = 50, offset = 0 } = filters;
+  const { status, type, email, limit = 50, offset = 0, bypassCache = false } = filters;
   
-  const { entries } = await getWaitingListEntries();
+  const { entries } = await getWaitingListEntries({ bypassCache });
   
   // Apply filters
   let filteredEntries = entries;
@@ -333,6 +333,32 @@ async function getWaitingListEntriesAdmin(filters = {}) {
   };
 }
 
+/**
+ * Get available types with counts
+ */
+async function getAvailableTypes() {
+  const { entries } = await getWaitingListEntries();
+  
+  // Count entries by type
+  const typeCounts = entries.reduce((acc, entry) => {
+    const type = String(entry.type || 'unknown').trim();
+    if (type) {
+      acc[type] = (acc[type] || 0) + 1;
+    }
+    return acc;
+  }, {});
+  
+  // Convert to sorted array
+  const types = Object.entries(typeCounts)
+    .map(([type, count]) => ({ type, count }))
+    .sort((a, b) => b.count - a.count);
+  
+  return {
+    types,
+    total: entries.length
+  };
+}
+
 /**
  * Clear all waiting list related caches
  */
@@ -352,6 +378,8 @@ function getWaitingListCacheInfo() {
 
 /**
  * Initialize waiting list data structure if it doesn't exist
+ * Note: cacheTtlSeconds MUST be 0 for persistence use cases (waiting list, rate limiters)
+ * to ensure real-time data consistency. Caching would cause stale reads.
  */
 async function initializeWaitingListData() {
   try {
@@ -368,7 +396,7 @@ async function initializeWaitingListData() {
           lastUpdated: new Date().toISOString()
         }),
         publicEnabled: false,
-        cacheTtlSeconds: 300
+        cacheTtlSeconds: 0 // No caching - required for real-time persistence
       });
     } else {
       throw error;
@@ -384,6 +412,7 @@ module.exports = {
   removeWaitingListEntry,
   getWaitingListStats,
   getWaitingListEntriesAdmin,
+  getAvailableTypes,
   
   // Cache management
   clearWaitingListCache,