@llm-dev-ops/agentics-cli 1.4.26 → 1.4.27

package/dist/bundled-agents/analytics-hub-agents/dist/auth/audit.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * Audit Logging System
+ * Comprehensive audit trail for compliance (SOC 2, GDPR, HIPAA)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditLogger = exports.AuditLogger = exports.AuditSeverity = exports.AuditAction = void 0;
+exports.auditLog = auditLog;
+var AuditAction;
+(function (AuditAction) {
+    // Authentication
+    AuditAction["USER_LOGIN"] = "user.login";
+    AuditAction["USER_LOGOUT"] = "user.logout";
+    AuditAction["USER_LOGIN_FAILED"] = "user.login.failed";
+    AuditAction["USER_MFA_ENABLED"] = "user.mfa.enabled";
+    AuditAction["USER_MFA_DISABLED"] = "user.mfa.disabled";
+    // Authorization
+    AuditAction["ACCESS_GRANTED"] = "access.granted";
+    AuditAction["ACCESS_DENIED"] = "access.denied";
+    // User management
+    AuditAction["USER_CREATED"] = "user.created";
+    AuditAction["USER_UPDATED"] = "user.updated";
+    AuditAction["USER_DELETED"] = "user.deleted";
+    AuditAction["USER_PASSWORD_CHANGED"] = "user.password.changed";
+    AuditAction["USER_ROLE_CHANGED"] = "user.role.changed";
+    // Data access
+    AuditAction["DATA_READ"] = "data.read";
+    AuditAction["DATA_CREATED"] = "data.created";
+    AuditAction["DATA_UPDATED"] = "data.updated";
+    AuditAction["DATA_DELETED"] = "data.deleted";
+    AuditAction["DATA_EXPORTED"] = "data.exported";
+    // API keys
+    AuditAction["API_KEY_CREATED"] = "api_key.created";
+    AuditAction["API_KEY_REVOKED"] = "api_key.revoked";
+    AuditAction["API_KEY_ROTATED"] = "api_key.rotated";
+    // System
+    AuditAction["CONFIG_CHANGED"] = "config.changed";
+    AuditAction["BACKUP_CREATED"] = "backup.created";
+    AuditAction["BACKUP_RESTORED"] = "backup.restored";
+    // GDPR
+    AuditAction["GDPR_DATA_EXPORT_REQUESTED"] = "gdpr.data_export.requested";
+    AuditAction["GDPR_DATA_EXPORTED"] = "gdpr.data_exported";
+    AuditAction["GDPR_DATA_DELETION_REQUESTED"] = "gdpr.data_deletion.requested";
+    AuditAction["GDPR_DATA_DELETED"] = "gdpr.data_deleted";
+    // Security
+    AuditAction["SECURITY_ANOMALY_DETECTED"] = "security.anomaly.detected";
+    AuditAction["RATE_LIMIT_EXCEEDED"] = "security.rate_limit.exceeded";
+    AuditAction["SUSPICIOUS_ACTIVITY"] = "security.suspicious_activity";
+})(AuditAction || (exports.AuditAction = AuditAction = {}));
+var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["INFO"] = "info";
+    AuditSeverity["WARNING"] = "warning";
+    AuditSeverity["CRITICAL"] = "critical";
+})(AuditSeverity || (exports.AuditSeverity = AuditSeverity = {}));
+class AuditLogger {
+    /**
+     * Log audit event
+     */
+    async log(event) {
+        const auditLog = {
+            id: this.generateId(),
+            timestamp: new Date(),
+            ...event,
+        };
+        // In production, this would:
+        // 1. Write to database (TimescaleDB for time-series audit logs)
+        // 2. Write to secure audit log file
+        // 3. Send to SIEM system
+        // 4. Optionally send to compliance monitoring service
+        await this.persistAuditLog(auditLog);
+        await this.sendToSIEM(auditLog);
+        // Log critical events immediately
+        if (event.severity === AuditSeverity.CRITICAL) {
+            await this.alertSecurityTeam(auditLog);
+        }
+    }
+    /**
+     * Log from Fastify request
+     */
+    async logFromRequest(request, action, options) {
+        const authRequest = request;
+        await this.log({
+            action,
+            severity: options.severity || AuditSeverity.INFO,
+            userId: authRequest.user?.userId,
+            userEmail: authRequest.user?.email,
+            organizationId: authRequest.user?.organizationId,
+            resourceType: options.resourceType,
+            resourceId: options.resourceId,
+            ipAddress: this.getClientIP(request),
+            userAgent: request.headers['user-agent'],
+            sessionId: authRequest.user?.sessionId,
+            details: options.details,
+            result: options.result,
+            errorMessage: options.errorMessage,
+        });
+    }
+    /**
+     * Query audit logs (for compliance reports)
+     */
+    async queryLogs(_filters) {
+        // In production: Query TimescaleDB
+        // SELECT * FROM audit_logs WHERE ...
+        return { logs: [], total: 0 };
+    }
+    /**
+     * Generate compliance report
+     */
+    async generateComplianceReport(_startDate, _endDate, _reportType) {
+        // In production: Aggregate audit logs for compliance reporting
+        return {
+            totalEvents: 0,
+            criticalEvents: 0,
+            accessDenials: 0,
+            dataExports: 0,
+            dataDeletions: 0,
+            securityAnomalies: 0,
+        };
+    }
+    /**
+     * Get client IP address
+     */
+    getClientIP(request) {
+        return (request.headers['x-forwarded-for']?.split(',')[0]?.trim() ||
+            request.headers['x-real-ip'] ||
+            request.ip ||
+            'unknown');
+    }
+    /**
+     * Generate unique audit log ID
+     */
+    generateId() {
+        return `audit_${Date.now()}_${Math.random().toString(36).substring(7)}`;
+    }
+    /**
+     * Persist audit log to database
+     */
+    async persistAuditLog(_log) {
+        // In production:
+        // await db.query(`
+        //   INSERT INTO audit_logs (id, timestamp, action, severity, user_id, ...)
+        //   VALUES ($1, $2, $3, $4, $5, ...)
+        // `, [...values]);
+        // console.log('Audit log:', JSON.stringify(log));
+    }
+    /**
+     * Send to SIEM system
+     */
+    async sendToSIEM(_log) {
+        // In production: Send to Splunk, ELK, or other SIEM
+    }
+    /**
+     * Alert security team for critical events
+     */
+    async alertSecurityTeam(_log) {
+        // In production: Send to PagerDuty, Slack, email
+        // console.warn('CRITICAL AUDIT EVENT:', log);
+    }
+}
+exports.AuditLogger = AuditLogger;
+exports.auditLogger = new AuditLogger();
+/**
+ * Audit middleware decorator
+ */
+function auditLog(action, options) {
+    return (_target, _propertyKey, descriptor) => {
+        const originalMethod = descriptor.value;
+        descriptor.value = async function (...args) {
+            const request = args[0];
+            let result = 'success';
+            let errorMessage;
+            let resourceId;
+            try {
+                const response = await originalMethod.apply(this, args);
+                // Try to extract resource ID from response
+                if (response?.data?.id) {
+                    resourceId = response.data.id;
+                }
+                return response;
+            }
+            catch (error) {
+                result = 'failure';
+                errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                throw error;
+            }
+            finally {
+                // Log the audit event
+                await exports.auditLogger.logFromRequest(request, action, {
+                    severity: options?.severity || AuditSeverity.INFO,
+                    resourceType: options?.resourceType,
+                    resourceId,
+                    result,
+                    errorMessage,
+                });
+            }
+        };
+        return descriptor;
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/auth/audit.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA0OH,4BAwCC;AA7QD,IAAY,WA8CX;AA9CD,WAAY,WAAW;IACrB,iBAAiB;IACjB,wCAAyB,CAAA;IACzB,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,oDAAqC,CAAA;IACrC,sDAAuC,CAAA;IAEvC,gBAAgB;IAChB,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAE/B,kBAAkB;IAClB,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,8DAA+C,CAAA;IAC/C,sDAAuC,CAAA;IAEvC,cAAc;IACd,sCAAuB,CAAA;IACvB,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAE/B,WAAW;IACX,kDAAmC,CAAA;IACnC,kDAAmC,CAAA;IACnC,kDAAmC,CAAA;IAEnC,SAAS;IACT,gDAAiC,CAAA;IACjC,gDAAiC,CAAA;IACjC,kDAAmC,CAAA;IAEnC,OAAO;IACP,wEAAyD,CAAA;IACzD,wDAAyC,CAAA;IACzC,4EAA6D,CAAA;IAC7D,sDAAuC,CAAA;IAEvC,WAAW;IACX,sEAAuD,CAAA;IACvD,mEAAoD,CAAA;IACpD,mEAAoD,CAAA;AACtD,CAAC,EA9CW,WAAW,2BAAX,WAAW,QA8CtB;AAED,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,8BAAa,CAAA;IACb,oCAAmB,CAAA;IACnB,sCAAqB,CAAA;AACvB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAoBD,MAAa,WAAW;IACtB;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAyC;QACjD,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,GAAG,KAAK;SACT,CAAC;QAEF,6BAA6B;QAC7B,gEAAgE;QAChE,oCAAoC;QACpC,yBAAyB;QACzB,sDAAsD;QAEtD,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEhC,kCAAkC;QAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAuB,EACvB,MAAmB,EACnB,OAOC;QAED,MAAM,WAAW,GAAG,OAA+B,CAAC;QAEpD,MAAM,IAAI,CAAC,GAAG,CAAC;YACb,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI;YAChD,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM;YAChC,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK;YAClC,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,cAAc;YAChD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;YACxC,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,SAAS;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,QASf;QACC,mCAAmC;QACnC,qCAAqC;QACrC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,UAAgB,EAChB,QAAc,EACd,WAAsC;QAStC,+DAA+D;QAC/D,OAAO;YACL,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,CAAC;YAChB,iBAAiB,EAAE,CAAC;SACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAuB;QACzC,OAAO,CACJ,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YACpE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAY;YACxC,OAAO,CAAC,EAAE;YACV,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,OAAO,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,IAAc;QAC1C,iBAAiB;QACjB,mBAAmB;QACnB,2EAA2E;QAC3E,qCAAqC;QACrC,mBAAmB;QAEnB,kDAAkD;IACpD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,IAAc;QACrC,oDAAoD;IACtD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAc;QAC5C,iDAAiD;QACjD,8CAA8C;IAChD,CAAC;CACF;AAtJD,kCAsJC;AAEY,QAAA,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAE7C;;GAEG;AACH,SAAgB,QAAQ,CAAC,MAAmB,EAAE,OAG7C;IACC,OAAO,CAAC,OAAY,EAAE,YAAoB,EAAE,UAA8B,EAAE,EAAE;QAC5E,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;QAExC,UAAU,CAAC,KAAK,GAAG,KAAK,WAAW,GAAG,IAAW;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;YAC1C,IAAI,MAAM,GAA0B,SAAS,CAAC;YAC9C,IAAI,YAAgC,CAAC;YACrC,IAAI,UAA8B,CAAC;YAEnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAExD,2CAA2C;gBAC3C,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACvB,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,CAAC;gBAED,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,SAAS,CAAC;gBACnB,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACxE,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,sBAAsB;gBACtB,MAAM,mBAAW,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE;oBAChD,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,aAAa,CAAC,IAAI;oBACjD,YAAY,EAAE,OAAO,EAAE,YAAY;oBACnC,UAAU;oBACV,MAAM;oBACN,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.d.ts

@@ -0,0 +1,55 @@
+/**
+ * JWT Token Management
+ * Handles JWT generation, validation, and refresh token management
+ */
+export interface JWTPayload {
+    userId: string;
+    email: string;
+    roles: string[];
+    permissions: string[];
+    organizationId?: string;
+    sessionId: string;
+    mfaVerified: boolean;
+}
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+export declare class JWTManager {
+    private accessTokenSecret;
+    private refreshTokenSecret;
+    private accessTokenExpiry;
+    private refreshTokenExpiry;
+    constructor();
+    private generateSecret;
+    /**
+     * Generate access and refresh token pair
+     */
+    generateTokenPair(payload: JWTPayload): Promise<TokenPair>;
+    /**
+     * Verify access token
+     */
+    verifyAccessToken(token: string): Promise<JWTPayload>;
+    /**
+     * Verify refresh token
+     */
+    verifyRefreshToken(token: string): Promise<{
+        userId: string;
+        sessionId: string;
+    }>;
+    /**
+     * Decode token without verification (for debugging)
+     */
+    decodeToken(token: string): any;
+    /**
+     * Parse expiry string to seconds
+     */
+    private parseExpiry;
+    /**
+     * Generate session ID
+     */
+    generateSessionId(): Promise<string>;
+}
+export declare const jwtManager: JWTManager;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,kBAAkB,CAAS;;IASnC,OAAO,CAAC,cAAc;IAItB;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAmChE;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB3D;;OAEG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBvF;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG;IAI/B;;OAEG;IACH,OAAO,CAAC,WAAW;IAkBnB;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI3C;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * JWT Token Management
+ * Handles JWT generation, validation, and refresh token management
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtManager = exports.JWTManager = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+const util_1 = require("util");
+const randomBytesAsync = (0, util_1.promisify)(crypto_1.randomBytes);
+class JWTManager {
+    accessTokenSecret;
+    refreshTokenSecret;
+    accessTokenExpiry;
+    refreshTokenExpiry;
+    constructor() {
+        this.accessTokenSecret = process.env.JWT_ACCESS_SECRET || this.generateSecret();
+        this.refreshTokenSecret = process.env.JWT_REFRESH_SECRET || this.generateSecret();
+        this.accessTokenExpiry = process.env.JWT_ACCESS_EXPIRY || '15m';
+        this.refreshTokenExpiry = process.env.JWT_REFRESH_EXPIRY || '7d';
+    }
+    generateSecret() {
+        return (0, crypto_1.randomBytes)(64).toString('hex');
+    }
+    /**
+     * Generate access and refresh token pair
+     */
+    async generateTokenPair(payload) {
+        const accessToken = jsonwebtoken_1.default.sign({
+            ...payload,
+            type: 'access',
+        }, this.accessTokenSecret, {
+            expiresIn: this.accessTokenExpiry,
+            issuer: 'llm-analytics-hub',
+            audience: 'llm-analytics-api',
+        });
+        const refreshToken = jsonwebtoken_1.default.sign({
+            userId: payload.userId,
+            sessionId: payload.sessionId,
+            type: 'refresh',
+        }, this.refreshTokenSecret, {
+            expiresIn: this.refreshTokenExpiry,
+            issuer: 'llm-analytics-hub',
+            audience: 'llm-analytics-api',
+        });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.parseExpiry(this.accessTokenExpiry),
+        };
+    }
+    /**
+     * Verify access token
+     */
+    async verifyAccessToken(token) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, this.accessTokenSecret, {
+                issuer: 'llm-analytics-hub',
+                audience: 'llm-analytics-api',
+            });
+            if (decoded.type !== 'access') {
+                throw new Error('Invalid token type');
+            }
+            return decoded;
+        }
+        catch (error) {
+            if (error instanceof jsonwebtoken_1.default.TokenExpiredError) {
+                throw new Error('Token expired');
+            }
+            if (error instanceof jsonwebtoken_1.default.JsonWebTokenError) {
+                throw new Error('Invalid token');
+            }
+            throw error;
+        }
+    }
+    /**
+     * Verify refresh token
+     */
+    async verifyRefreshToken(token) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, this.refreshTokenSecret, {
+                issuer: 'llm-analytics-hub',
+                audience: 'llm-analytics-api',
+            });
+            if (decoded.type !== 'refresh') {
+                throw new Error('Invalid token type');
+            }
+            return { userId: decoded.userId, sessionId: decoded.sessionId };
+        }
+        catch (error) {
+            if (error instanceof jsonwebtoken_1.default.TokenExpiredError) {
+                throw new Error('Refresh token expired');
+            }
+            if (error instanceof jsonwebtoken_1.default.JsonWebTokenError) {
+                throw new Error('Invalid refresh token');
+            }
+            throw error;
+        }
+    }
+    /**
+     * Decode token without verification (for debugging)
+     */
+    decodeToken(token) {
+        return jsonwebtoken_1.default.decode(token);
+    }
+    /**
+     * Parse expiry string to seconds
+     */
+    parseExpiry(expiry) {
+        const unit = expiry.slice(-1);
+        const value = parseInt(expiry.slice(0, -1));
+        switch (unit) {
+            case 's':
+                return value;
+            case 'm':
+                return value * 60;
+            case 'h':
+                return value * 3600;
+            case 'd':
+                return value * 86400;
+            default:
+                return 900; // 15 minutes default
+        }
+    }
+    /**
+     * Generate session ID
+     */
+    async generateSessionId() {
+        const buffer = await randomBytesAsync(32);
+        return buffer.toString('hex');
+    }
+}
+exports.JWTManager = JWTManager;
+exports.jwtManager = new JWTManager();
+//# sourceMappingURL=jwt.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAEH,gEAA+B;AAC/B,mCAAqC;AACrC,+BAAiC;AAEjC,MAAM,gBAAgB,GAAG,IAAA,gBAAS,EAAC,oBAAW,CAAC,CAAC;AAkBhD,MAAa,UAAU;IACb,iBAAiB,CAAS;IAC1B,kBAAkB,CAAS;IAC3B,iBAAiB,CAAS;IAC1B,kBAAkB,CAAS;IAEnC;QACE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAChF,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAClF,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAChE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC;IACnE,CAAC;IAEO,cAAc;QACpB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAmB;QACzC,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAC1B;YACE,GAAG,OAAO;YACV,IAAI,EAAE,QAAQ;SACf,EACD,IAAI,CAAC,iBAAiB,EACtB;YACE,SAAS,EAAE,IAAI,CAAC,iBAA2B;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,mBAAmB;SACX,CACrB,CAAC;QAEF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC3B;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,SAAS;SAChB,EACD,IAAI,CAAC,kBAAkB,EACvB;YACE,SAAS,EAAE,IAAI,CAAC,kBAA4B;YAC5C,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,mBAAmB;SACX,CACrB,CAAC;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACpD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE;gBACxD,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,mBAAmB;aAC9B,CAAkC,CAAC;YAEpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBACzD,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,mBAAmB;aAC9B,CAAwD,CAAC;YAE1D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,KAAK,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,MAAc;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,KAAK,CAAC;YACvB;gBACE,OAAO,GAAG,CAAC,CAAC,qBAAqB;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACF;AA9ID,gCA8IC;AAEY,QAAA,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Multi-Factor Authentication (MFA)
+ * TOTP-based two-factor authentication
+ */
+export interface MFASetup {
+    secret: string;
+    qrCodeUrl: string;
+    backupCodes: string[];
+}
+export declare class MFAManager {
+    /**
+     * Generate MFA secret and QR code
+     */
+    setupMFA(_userId: string, email: string): Promise<MFASetup>;
+    /**
+     * Verify TOTP token
+     */
+    verifyToken(secret: string, token: string): boolean;
+    /**
+     * Generate backup codes
+     */
+    private generateBackupCodes;
+    /**
+     * Generate random alphanumeric code
+     */
+    private generateRandomCode;
+    /**
+     * Verify backup code
+     */
+    verifyBackupCode(_userId: string, code: string, usedCodes: string[]): Promise<boolean>;
+    /**
+     * Generate current TOTP token (for testing)
+     */
+    generateToken(secret: string): string;
+}
+export declare const mfaManager: MFAManager;
+//# sourceMappingURL=mfa.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../../src/auth/mfa.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBAAa,UAAU;IACrB;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqBjE;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IASnD;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC;IAWnB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAMtC;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Multi-Factor Authentication (MFA)
+ * TOTP-based two-factor authentication
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mfaManager = exports.MFAManager = void 0;
+const speakeasy = __importStar(require("speakeasy"));
+const QRCode = __importStar(require("qrcode"));
+class MFAManager {
+    /**
+     * Generate MFA secret and QR code
+     */
+    async setupMFA(_userId, email) {
+        // Generate secret
+        const secret = speakeasy.generateSecret({
+            name: `LLM Analytics Hub (${email})`,
+            issuer: 'LLM Analytics Hub',
+            length: 32,
+        });
+        // Generate QR code
+        const qrCodeUrl = await QRCode.toDataURL(secret.otpauth_url);
+        // Generate backup codes
+        const backupCodes = this.generateBackupCodes();
+        return {
+            secret: secret.base32,
+            qrCodeUrl,
+            backupCodes,
+        };
+    }
+    /**
+     * Verify TOTP token
+     */
+    verifyToken(secret, token) {
+        return speakeasy.totp.verify({
+            secret,
+            encoding: 'base32',
+            token,
+            window: 2, // Allow 2 time steps before/after for clock skew
+        });
+    }
+    /**
+     * Generate backup codes
+     */
+    generateBackupCodes(count = 10) {
+        const codes = [];
+        for (let i = 0; i < count; i++) {
+            // Generate 8-character alphanumeric code
+            const code = this.generateRandomCode(8);
+            codes.push(code);
+        }
+        return codes;
+    }
+    /**
+     * Generate random alphanumeric code
+     */
+    generateRandomCode(length) {
+        const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // Removed confusing chars
+        let code = '';
+        for (let i = 0; i < length; i++) {
+            code += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+        // Format as XXXX-XXXX for readability
+        return code.match(/.{1,4}/g)?.join('-') || code;
+    }
+    /**
+     * Verify backup code
+     */
+    async verifyBackupCode(_userId, code, usedCodes) {
+        // Check if code was already used
+        if (usedCodes.includes(code)) {
+            return false;
+        }
+        // Backup codes would be stored in database
+        // This is a placeholder for the verification logic
+        return true;
+    }
+    /**
+     * Generate current TOTP token (for testing)
+     */
+    generateToken(secret) {
+        return speakeasy.totp({
+            secret,
+            encoding: 'base32',
+        });
+    }
+}
+exports.MFAManager = MFAManager;
+exports.mfaManager = new MFAManager();
+//# sourceMappingURL=mfa.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../../src/auth/mfa.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qDAAuC;AACvC,+CAAiC;AAQjC,MAAa,UAAU;IACrB;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,KAAa;QAC3C,kBAAkB;QAClB,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC;YACtC,IAAI,EAAE,sBAAsB,KAAK,GAAG;YACpC,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;QAE9D,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE/C,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;YACT,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc,EAAE,KAAa;QACvC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM;YACN,QAAQ,EAAE,QAAQ;YAClB,KAAK;YACL,MAAM,EAAE,CAAC,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,QAAgB,EAAE;QAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,yCAAyC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,MAAc;QACvC,MAAM,KAAK,GAAG,kCAAkC,CAAC,CAAC,0BAA0B;QAC5E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,sCAAsC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,IAAY,EACZ,SAAmB;QAEnB,iCAAiC;QACjC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2CAA2C;QAC3C,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,OAAO,SAAS,CAAC,IAAI,CAAC;YACpB,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AA1FD,gCA0FC;AAEY,QAAA,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Authentication Middleware
+ * Handles JWT validation, API key authentication, and request decoration
+ */
+import { FastifyRequest, FastifyReply } from 'fastify';
+export interface AuthOptions {
+    required?: boolean;
+    allowApiKey?: boolean;
+    requireMFA?: boolean;
+}
+/**
+ * Authentication middleware
+ */
+export declare function authenticate(request: FastifyRequest, reply: FastifyReply, options?: AuthOptions): Promise<void>;
+/**
+ * Require authentication (throws error if not authenticated)
+ */
+export declare function requireAuth(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Optional authentication (doesn't throw if not authenticated)
+ */
+export declare function optionalAuth(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Require MFA
+ */
+export declare function requireMFA(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * CSRF Token Validation Middleware
+ */
+export declare function validateCSRF(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Rate limiting by user
+ */
+export declare function createUserRateLimiter(max: number, timeWindow: number): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,WAAgB,iBAqE1B;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBAGpB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,iBA6BpB;AAcD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,IAGrD,SAAS,cAAc,EAAE,OAAO,YAAY,mBA0C3D"}