@llm-dev-ops/agentics-cli 1.4.26 → 1.4.29

package/dist/bundled-agents/policy-engine-agents/src/db/models/api-key-repository.ts

@@ -0,0 +1,342 @@
+/**
+ * API Key Repository
+ * Database operations for API key management with bcrypt hashing
+ */
+import bcrypt from 'bcrypt';
+import { randomBytes } from 'crypto';
+import { db } from '../client';
+import logger from '@utils/logger';
+import { DatabaseError } from '@utils/errors';
+
+export interface APIKey {
+  id: string;
+  name: string;
+  key_hash: string;
+  key_prefix: string;
+  permissions: string[];
+  rate_limit: number;
+  expires_at: Date | null;
+  last_used_at: Date | null;
+  created_at: Date;
+  created_by: string | null;
+  revoked: boolean;
+}
+
+export interface CreateAPIKeyParams {
+  name: string;
+  permissions: string[];
+  rateLimit?: number;
+  expiresAt?: Date;
+  createdBy?: string;
+}
+
+export interface GeneratedAPIKey {
+  apiKey: APIKey;
+  rawKey: string; // Only returned on creation, never stored
+}
+
+const BCRYPT_ROUNDS = 12;
+const API_KEY_LENGTH = 32; // 256 bits
+const API_KEY_PREFIX = 'llmpe_'; // LLM Policy Engine prefix
+
+/**
+ * API Key Repository
+ */
+export class APIKeyRepository {
+  /**
+   * Generate a secure API key
+   * Format: llmpe_<random_bytes_hex>
+   */
+  private generateSecureKey(): string {
+    const randomBytesHex = randomBytes(API_KEY_LENGTH).toString('hex');
+    return `${API_KEY_PREFIX}${randomBytesHex}`;
+  }
+
+  /**
+   * Extract key prefix for identification (first 12 chars)
+   */
+  private extractKeyPrefix(key: string): string {
+    return key.substring(0, 12);
+  }
+
+  /**
+   * Hash API key using bcrypt
+   */
+  async hashApiKey(key: string): Promise<string> {
+    try {
+      return await bcrypt.hash(key, BCRYPT_ROUNDS);
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to hash API key: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Validate API key against stored hash
+   */
+  private async compareKey(key: string, hash: string): Promise<boolean> {
+    try {
+      return await bcrypt.compare(key, hash);
+    } catch (error) {
+      logger.error({ error }, 'Failed to compare API key');
+      return false;
+    }
+  }
+
+  /**
+   * Create a new API key
+   */
+  async createApiKey(params: CreateAPIKeyParams): Promise<GeneratedAPIKey> {
+    const rawKey = this.generateSecureKey();
+    const keyHash = await this.hashApiKey(rawKey);
+    const keyPrefix = this.extractKeyPrefix(rawKey);
+
+    try {
+      const result = await db.query<APIKey>(
+        `INSERT INTO api_keys (
+          name, key_hash, key_prefix, permissions, rate_limit, expires_at, created_by
+        ) VALUES ($1, $2, $3, $4, $5, $6, $7)
+        RETURNING *`,
+        [
+          params.name,
+          keyHash,
+          keyPrefix,
+          params.permissions,
+          params.rateLimit || 100,
+          params.expiresAt || null,
+          params.createdBy || null,
+        ],
+      );
+
+      if (result.rows.length === 0) {
+        throw new DatabaseError('Failed to create API key');
+      }
+
+      const apiKey = result.rows[0];
+
+      logger.info(
+        {
+          keyId: apiKey.id,
+          name: apiKey.name,
+          keyPrefix: apiKey.key_prefix,
+          permissions: apiKey.permissions,
+        },
+        'API key created',
+      );
+
+      return {
+        apiKey,
+        rawKey, // Only returned once, never stored
+      };
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to create API key: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Validate API key and return key details if valid
+   * Returns null if key is invalid, expired, or revoked
+   */
+  async validateApiKey(key: string): Promise<APIKey | null> {
+    // Validate key format
+    if (!key || !key.startsWith(API_KEY_PREFIX)) {
+      logger.debug('Invalid API key format');
+      return null;
+    }
+
+    const keyPrefix = this.extractKeyPrefix(key);
+
+    try {
+      // Find API keys with matching prefix
+      const result = await db.query<APIKey>(
+        `SELECT * FROM api_keys
+         WHERE key_prefix = $1
+         AND revoked = false
+         AND (expires_at IS NULL OR expires_at > NOW())`,
+        [keyPrefix],
+      );
+
+      // Check each matching key with bcrypt
+      for (const apiKey of result.rows) {
+        const isValid = await this.compareKey(key, apiKey.key_hash);
+
+        if (isValid) {
+          // Update last_used_at timestamp asynchronously
+          this.updateLastUsed(apiKey.id).catch((err) => {
+            logger.warn({ error: err, keyId: apiKey.id }, 'Failed to update last_used_at');
+          });
+
+          logger.debug(
+            {
+              keyId: apiKey.id,
+              keyPrefix: apiKey.key_prefix,
+              permissions: apiKey.permissions,
+            },
+            'API key validated successfully',
+          );
+
+          return apiKey;
+        }
+      }
+
+      logger.debug({ keyPrefix }, 'API key validation failed');
+      return null;
+    } catch (error) {
+      logger.error({ error, keyPrefix }, 'Error validating API key');
+      return null;
+    }
+  }
+
+  /**
+   * Update last_used_at timestamp for API key
+   */
+  async updateLastUsed(id: string): Promise<void> {
+    try {
+      await db.query(
+        `UPDATE api_keys SET last_used_at = NOW() WHERE id = $1`,
+        [id],
+      );
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to update last_used_at: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Revoke an API key
+   */
+  async revokeApiKey(id: string): Promise<void> {
+    try {
+      const result = await db.query(
+        `UPDATE api_keys SET revoked = true WHERE id = $1 RETURNING *`,
+        [id],
+      );
+
+      if (result.rowCount === 0) {
+        throw new DatabaseError(`API key not found: ${id}`);
+      }
+
+      logger.info({ keyId: id }, 'API key revoked');
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to revoke API key: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Get API key by ID
+   */
+  async getApiKeyById(id: string): Promise<APIKey | null> {
+    try {
+      const result = await db.query<APIKey>(
+        `SELECT * FROM api_keys WHERE id = $1`,
+        [id],
+      );
+
+      return result.rows[0] || null;
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to get API key: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * List all API keys (excluding hashes)
+   */
+  async listApiKeys(filters?: {
+    revoked?: boolean;
+    createdBy?: string;
+  }): Promise<Omit<APIKey, 'key_hash'>[]> {
+    try {
+      let query = `SELECT
+        id, name, key_prefix, permissions, rate_limit,
+        expires_at, last_used_at, created_at, created_by, revoked
+        FROM api_keys WHERE 1=1`;
+      const params: any[] = [];
+      let paramCount = 1;
+
+      if (filters?.revoked !== undefined) {
+        query += ` AND revoked = $${paramCount}`;
+        params.push(filters.revoked);
+        paramCount++;
+      }
+
+      if (filters?.createdBy) {
+        query += ` AND created_by = $${paramCount}`;
+        params.push(filters.createdBy);
+        paramCount++;
+      }
+
+      query += ` ORDER BY created_at DESC`;
+
+      const result = await db.query(query, params);
+      return result.rows;
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to list API keys: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Delete an API key permanently
+   */
+  async deleteApiKey(id: string): Promise<void> {
+    try {
+      const result = await db.query(
+        `DELETE FROM api_keys WHERE id = $1 RETURNING *`,
+        [id],
+      );
+
+      if (result.rowCount === 0) {
+        throw new DatabaseError(`API key not found: ${id}`);
+      }
+
+      logger.info({ keyId: id }, 'API key deleted');
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to delete API key: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Rotate an API key (revoke old, create new)
+   */
+  async rotateApiKey(id: string): Promise<GeneratedAPIKey> {
+    const oldKey = await this.getApiKeyById(id);
+
+    if (!oldKey) {
+      throw new DatabaseError(`API key not found: ${id}`);
+    }
+
+    // Create new key with same properties
+    const newKey = await this.createApiKey({
+      name: `${oldKey.name} (rotated)`,
+      permissions: oldKey.permissions,
+      rateLimit: oldKey.rate_limit,
+      expiresAt: oldKey.expires_at || undefined,
+      createdBy: oldKey.created_by || undefined,
+    });
+
+    // Revoke old key
+    await this.revokeApiKey(id);
+
+    logger.info(
+      { oldKeyId: id, newKeyId: newKey.apiKey.id },
+      'API key rotated',
+    );
+
+    return newKey;
+  }
+}
+
+// Export singleton instance
+export const apiKeyRepository = new APIKeyRepository();
+export default apiKeyRepository;

package/dist/bundled-agents/policy-engine-agents/src/db/models/evaluation-repository.ts

@@ -0,0 +1,278 @@
+/**
+ * Evaluation Repository - Audit log repository for policy evaluations
+ */
+import { db } from '../client';
+import { PolicyEvaluationRequest, PolicyEvaluationResponse, DecisionType } from '../../types/policy';
+import { DatabaseError } from '@utils/errors';
+import logger from '@utils/logger';
+
+export interface EvaluationLog {
+  id: string;
+  requestId: string;
+  policyIds: string[];
+  decision: DecisionType;
+  allowed: boolean;
+  reason?: string;
+  matchedPolicies: string[];
+  matchedRules: string[];
+  context: any;
+  evaluationTimeMs: number;
+  cached: boolean;
+  createdAt: Date;
+  metadata?: any;
+}
+
+export interface EvaluationFilters {
+  requestId?: string;
+  policyIds?: string[];
+  decision?: DecisionType;
+  allowed?: boolean;
+  startDate?: Date;
+  endDate?: Date;
+  limit?: number;
+  offset?: number;
+}
+
+export class EvaluationRepository {
+  /**
+   * Log a policy evaluation
+   */
+  async log(
+    request: PolicyEvaluationRequest,
+    response: PolicyEvaluationResponse,
+  ): Promise<EvaluationLog> {
+    try {
+      const result = await db.query(
+        `INSERT INTO policy_evaluations (
+          request_id, policy_ids, decision, allowed, reason,
+          matched_policies, matched_rules, context, evaluation_time_ms, cached, metadata
+        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+        RETURNING *`,
+        [
+          response.requestId,
+          request.policies || [],
+          response.decision.decision,
+          response.decision.allowed,
+          response.decision.reason,
+          response.decision.matchedPolicies,
+          response.decision.matchedRules,
+          JSON.stringify(request.context),
+          response.decision.evaluationTimeMs,
+          response.cached || false,
+          JSON.stringify(response.decision.metadata || {}),
+        ],
+      );
+
+      logger.debug({ requestId: response.requestId }, 'Evaluation logged to database');
+
+      return this.mapRowToEvaluationLog(result.rows[0]);
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to log evaluation: ${error instanceof Error ? error.message : String(error)}`,
+        { requestId: request.requestId },
+      );
+    }
+  }
+
+  /**
+   * Get evaluation by request ID
+   */
+  async findByRequestId(requestId: string): Promise<EvaluationLog | null> {
+    try {
+      const result = await db.query(
+        'SELECT * FROM policy_evaluations WHERE request_id = $1',
+        [requestId],
+      );
+
+      if (result.rows.length === 0) {
+        return null;
+      }
+
+      return this.mapRowToEvaluationLog(result.rows[0]);
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to find evaluation: ${error instanceof Error ? error.message : String(error)}`,
+        { requestId },
+      );
+    }
+  }
+
+  /**
+   * Find evaluations with filters
+   */
+  async find(filters: EvaluationFilters): Promise<EvaluationLog[]> {
+    try {
+      const conditions: string[] = [];
+      const params: any[] = [];
+      let paramCount = 1;
+
+      if (filters.requestId) {
+        conditions.push(`request_id = $${paramCount++}`);
+        params.push(filters.requestId);
+      }
+
+      if (filters.policyIds && filters.policyIds.length > 0) {
+        conditions.push(`policy_ids && $${paramCount++}`);
+        params.push(filters.policyIds);
+      }
+
+      if (filters.decision) {
+        conditions.push(`decision = $${paramCount++}`);
+        params.push(filters.decision);
+      }
+
+      if (filters.allowed !== undefined) {
+        conditions.push(`allowed = $${paramCount++}`);
+        params.push(filters.allowed);
+      }
+
+      if (filters.startDate) {
+        conditions.push(`created_at >= $${paramCount++}`);
+        params.push(filters.startDate);
+      }
+
+      if (filters.endDate) {
+        conditions.push(`created_at <= $${paramCount++}`);
+        params.push(filters.endDate);
+      }
+
+      const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+      const limit = filters.limit || 100;
+      const offset = filters.offset || 0;
+
+      const query = `
+        SELECT * FROM policy_evaluations
+        ${whereClause}
+        ORDER BY created_at DESC
+        LIMIT $${paramCount++} OFFSET $${paramCount++}
+      `;
+
+      params.push(limit, offset);
+
+      const result = await db.query(query, params);
+
+      return result.rows.map((row) => this.mapRowToEvaluationLog(row));
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to find evaluations: ${error instanceof Error ? error.message : String(error)}`,
+        { filters },
+      );
+    }
+  }
+
+  /**
+   * Get evaluations by policy ID
+   */
+  async findByPolicyId(policyId: string, limit: number = 100): Promise<EvaluationLog[]> {
+    return this.find({ policyIds: [policyId], limit });
+  }
+
+  /**
+   * Get evaluation statistics
+   */
+  async getStats(startDate?: Date, endDate?: Date): Promise<{
+    total: number;
+    allowed: number;
+    denied: number;
+    warned: number;
+    modified: number;
+    avgEvaluationTimeMs: number;
+    cacheHitRate: number;
+  }> {
+    try {
+      const conditions: string[] = [];
+      const params: any[] = [];
+      let paramCount = 1;
+
+      if (startDate) {
+        conditions.push(`created_at >= $${paramCount++}`);
+        params.push(startDate);
+      }
+
+      if (endDate) {
+        conditions.push(`created_at <= $${paramCount++}`);
+        params.push(endDate);
+      }
+
+      const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+
+      const result = await db.query(
+        `SELECT
+          COUNT(*) as total,
+          SUM(CASE WHEN allowed = true THEN 1 ELSE 0 END) as allowed,
+          SUM(CASE WHEN decision = 'deny' THEN 1 ELSE 0 END) as denied,
+          SUM(CASE WHEN decision = 'warn' THEN 1 ELSE 0 END) as warned,
+          SUM(CASE WHEN decision = 'modify' THEN 1 ELSE 0 END) as modified,
+          AVG(evaluation_time_ms) as avg_evaluation_time_ms,
+          SUM(CASE WHEN cached = true THEN 1 ELSE 0 END)::float / NULLIF(COUNT(*), 0) as cache_hit_rate
+        FROM policy_evaluations
+        ${whereClause}`,
+        params,
+      );
+
+      const row = result.rows[0];
+
+      return {
+        total: parseInt(row.total, 10),
+        allowed: parseInt(row.allowed, 10),
+        denied: parseInt(row.denied, 10),
+        warned: parseInt(row.warned, 10),
+        modified: parseInt(row.modified, 10),
+        avgEvaluationTimeMs: parseFloat(row.avg_evaluation_time_ms) || 0,
+        cacheHitRate: parseFloat(row.cache_hit_rate) || 0,
+      };
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to get evaluation stats: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  /**
+   * Delete old evaluations
+   */
+  async deleteOlderThan(days: number): Promise<number> {
+    try {
+      const cutoffDate = new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - days);
+
+      const result = await db.query(
+        'DELETE FROM policy_evaluations WHERE created_at < $1',
+        [cutoffDate],
+      );
+
+      logger.info(
+        { deletedCount: result.rowCount, days },
+        'Old evaluations deleted from database',
+      );
+
+      return result.rowCount || 0;
+    } catch (error) {
+      throw new DatabaseError(
+        `Failed to delete old evaluations: ${error instanceof Error ? error.message : String(error)}`,
+        { days },
+      );
+    }
+  }
+
+  /**
+   * Map database row to EvaluationLog object
+   */
+  private mapRowToEvaluationLog(row: any): EvaluationLog {
+    return {
+      id: row.id,
+      requestId: row.request_id,
+      policyIds: row.policy_ids || [],
+      decision: row.decision as DecisionType,
+      allowed: row.allowed,
+      reason: row.reason,
+      matchedPolicies: row.matched_policies || [],
+      matchedRules: row.matched_rules || [],
+      context: row.context,
+      evaluationTimeMs: row.evaluation_time_ms,
+      cached: row.cached,
+      createdAt: row.created_at,
+      metadata: row.metadata,
+    };
+  }
+}