@llm-dev-ops/agentics-cli 1.4.27 → 1.4.29

package/dist/bundled-agents/analytics-hub-agents/src/auth/middleware.ts

@@ -1,220 +0,0 @@
-/**
- * Authentication Middleware
- * Handles JWT validation, API key authentication, and request decoration
- */
-
-import { FastifyRequest, FastifyReply } from 'fastify';
-import { jwtManager } from './jwt';
-import { rbacManager, Role, Permission, AuthenticatedRequest } from './rbac';
-import { apiKeyManager } from './api-keys';
-
-export interface AuthOptions {
-  required?: boolean;
-  allowApiKey?: boolean;
-  requireMFA?: boolean;
-}
-
-/**
- * Authentication middleware
- */
-export async function authenticate(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  options: AuthOptions = {}
-) {
-  const { required = true, allowApiKey = true, requireMFA = false } = options;
-
-  try {
-    // Try JWT authentication first
-    const authHeader = request.headers.authorization;
-
-    if (authHeader?.startsWith('Bearer ')) {
-      const token = authHeader.substring(7);
-      const payload = await jwtManager.verifyAccessToken(token);
-
-      // Check MFA requirement
-      if (requireMFA && !payload.mfaVerified) {
-        throw new Error('MFA verification required');
-      }
-
-      // Get user permissions
-      const permissions = rbacManager.getUserPermissions(
-        payload.roles as Role[]
-      );
-
-      // Decorate request with user info
-      (request as AuthenticatedRequest).user = {
-        ...payload,
-        roles: payload.roles as Role[],
-        permissions: permissions as Permission[],
-      };
-
-      return;
-    }
-
-    // Try API Key authentication
-    if (allowApiKey) {
-      const apiKey = request.headers['x-api-key'] as string;
-
-      if (apiKey) {
-        const keyData = await apiKeyManager.validateKey(apiKey);
-
-        if (keyData) {
-          // Decorate request with API key user info
-          (request as AuthenticatedRequest).user = {
-            userId: keyData.userId,
-            email: keyData.name,
-            roles: [Role.API_CLIENT],
-            permissions: rbacManager.getRolePermissions(Role.API_CLIENT),
-            organizationId: keyData.organizationId,
-            sessionId: keyData.keyId,
-            mfaVerified: false, // API keys don't require MFA
-          };
-
-          return;
-        }
-      }
-    }
-
-    // No valid authentication found
-    if (required) {
-      throw new Error('Authentication required');
-    }
-  } catch (error) {
-    if (required) {
-      reply.code(401).send({
-        success: false,
-        error: error instanceof Error ? error.message : 'Authentication failed',
-      });
-      return;
-    }
-  }
-}
-
-/**
- * Require authentication (throws error if not authenticated)
- */
-export async function requireAuth(
-  request: FastifyRequest,
-  reply: FastifyReply
-) {
-  await authenticate(request, reply, { required: true });
-}
-
-/**
- * Optional authentication (doesn't throw if not authenticated)
- */
-export async function optionalAuth(
-  request: FastifyRequest,
-  reply: FastifyReply
-) {
-  await authenticate(request, reply, { required: false });
-}
-
-/**
- * Require MFA
- */
-export async function requireMFA(
-  request: FastifyRequest,
-  reply: FastifyReply
-) {
-  await authenticate(request, reply, { required: true, requireMFA: true });
-}
-
-/**
- * CSRF Token Validation Middleware
- */
-export async function validateCSRF(
-  request: FastifyRequest,
-  reply: FastifyReply
-) {
-  // Skip CSRF for GET, HEAD, OPTIONS
-  if (['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
-    return;
-  }
-
-  const csrfToken = request.headers['x-csrf-token'] as string;
-  const sessionToken = request.headers['x-session-token'] as string;
-
-  if (!csrfToken || !sessionToken) {
-    reply.code(403).send({
-      success: false,
-      error: 'CSRF token required',
-    });
-    return;
-  }
-
-  // Validate CSRF token (would check against session in production)
-  // This is a simplified version
-  const isValid = await validateCSRFToken(csrfToken, sessionToken);
-
-  if (!isValid) {
-    reply.code(403).send({
-      success: false,
-      error: 'Invalid CSRF token',
-    });
-    return;
-  }
-}
-
-async function validateCSRFToken(
-  _csrfToken: string,
-  _sessionToken: string
-): Promise<boolean> {
-  // In production, this would:
-  // 1. Look up session in Redis/database
-  // 2. Verify CSRF token matches session
-  // 3. Check token expiry
-  // For now, returning true as placeholder
-  return true;
-}
-
-/**
- * Rate limiting by user
- */
-export function createUserRateLimiter(max: number, timeWindow: number) {
-  const userLimits = new Map<string, { count: number; resetAt: number }>();
-
-  return async (request: FastifyRequest, reply: FastifyReply) => {
-    const user = (request as AuthenticatedRequest).user;
-
-    if (!user) {
-      return; // No user, skip rate limiting
-    }
-
-    const userId = user.userId;
-    const now = Date.now();
-
-    let userLimit = userLimits.get(userId);
-
-    if (!userLimit || userLimit.resetAt < now) {
-      // Create new limit window
-      userLimit = {
-        count: 0,
-        resetAt: now + timeWindow,
-      };
-      userLimits.set(userId, userLimit);
-    }
-
-    userLimit.count++;
-
-    if (userLimit.count > max) {
-      const retryAfter = Math.ceil((userLimit.resetAt - now) / 1000);
-
-      reply.code(429).header('Retry-After', retryAfter.toString()).send({
-        success: false,
-        error: 'Rate limit exceeded',
-        retryAfter,
-      });
-      return;
-    }
-
-    // Add rate limit headers
-    reply.header('X-RateLimit-Limit', max.toString());
-    reply.header('X-RateLimit-Remaining', (max - userLimit.count).toString());
-    reply.header(
-      'X-RateLimit-Reset',
-      Math.ceil(userLimit.resetAt / 1000).toString()
-    );
-  };
-}

package/dist/bundled-agents/analytics-hub-agents/src/auth/oauth.ts

@@ -1,293 +0,0 @@
-/**
- * OAuth 2.0 / OIDC Integration
- * Supports Keycloak, Auth0, Okta, and other OIDC providers
- */
-
-import { Issuer, Client, generators, TokenSet } from 'openid-client';
-import { jwtManager } from './jwt';
-import { Role } from './rbac';
-
-export interface OAuthConfig {
-  issuerUrl: string;
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-  scopes: string[];
-}
-
-export interface OAuthUser {
-  sub: string; // subject (user ID from provider)
-  email: string;
-  email_verified: boolean;
-  name?: string;
-  given_name?: string;
-  family_name?: string;
-  picture?: string;
-  roles?: string[];
-  groups?: string[];
-}
-
-export class OAuthManager {
-  private client: Client | null = null;
-  private issuer: Issuer | null = null;
-  private config: OAuthConfig;
-
-  constructor(config?: OAuthConfig) {
-    this.config = config || {
-      issuerUrl:
-        process.env.OAUTH_ISSUER_URL ||
-        'https://keycloak.llm-analytics.com/realms/llm-analytics',
-      clientId: process.env.OAUTH_CLIENT_ID || 'llm-analytics-hub',
-      clientSecret: process.env.OAUTH_CLIENT_SECRET || '',
-      redirectUri:
-        process.env.OAUTH_REDIRECT_URI ||
-        'https://app.llm-analytics.com/auth/callback',
-      scopes: ['openid', 'profile', 'email', 'roles'],
-    };
-  }
-
-  /**
-   * Initialize OAuth client
-   */
-  async initialize(): Promise<void> {
-    this.issuer = await Issuer.discover(this.config.issuerUrl);
-
-    this.client = new this.issuer.Client({
-      client_id: this.config.clientId,
-      client_secret: this.config.clientSecret,
-      redirect_uris: [this.config.redirectUri],
-      response_types: ['code'],
-    });
-  }
-
-  /**
-   * Get authorization URL
-   */
-  async getAuthorizationUrl(state?: string): Promise<{ url: string; state: string; nonce: string }> {
-    if (!this.client) {
-      await this.initialize();
-    }
-
-    const codeVerifier = generators.codeVerifier();
-    const codeChallenge = generators.codeChallenge(codeVerifier);
-    const nonce = generators.nonce();
-    const stateValue = state || generators.state();
-
-    const authUrl = this.client!.authorizationUrl({
-      scope: this.config.scopes.join(' '),
-      code_challenge: codeChallenge,
-      code_challenge_method: 'S256',
-      state: stateValue,
-      nonce,
-    });
-
-    // Store code verifier for token exchange (would use Redis in production)
-    await this.storeCodeVerifier(stateValue, codeVerifier);
-
-    return {
-      url: authUrl,
-      state: stateValue,
-      nonce,
-    };
-  }
-
-  /**
-   * Handle OAuth callback
-   */
-  async handleCallback(
-    callbackUrl: string,
-    expectedState: string
-  ): Promise<{ user: OAuthUser; tokens: TokenSet }> {
-    if (!this.client) {
-      await this.initialize();
-    }
-
-    // Retrieve code verifier
-    const codeVerifier = await this.getCodeVerifier(expectedState);
-
-    if (!codeVerifier) {
-      throw new Error('Invalid state or expired session');
-    }
-
-    // Exchange authorization code for tokens
-    const params = this.client!.callbackParams(callbackUrl);
-    const tokenSet = await this.client!.callback(
-      this.config.redirectUri,
-      params,
-      {
-        code_verifier: codeVerifier,
-        state: expectedState,
-      }
-    );
-
-    // Get user info from token claims
-    const claims = tokenSet.claims() as OAuthUser;
-
-    // Optionally fetch additional user info
-    const userinfo = await this.client!.userinfo(tokenSet);
-
-    const user: OAuthUser = {
-      sub: claims.sub,
-      email: claims.email || (userinfo.email as string),
-      email_verified: claims.email_verified || false,
-      name: claims.name || (userinfo.name as string),
-      given_name: claims.given_name || (userinfo.given_name as string),
-      family_name: claims.family_name || (userinfo.family_name as string),
-      picture: claims.picture || (userinfo.picture as string),
-      roles: claims.roles || this.extractRoles(claims),
-      groups: claims.groups || (userinfo.groups as string[]),
-    };
-
-    // Clean up code verifier
-    await this.deleteCodeVerifier(expectedState);
-
-    return { user, tokens: tokenSet };
-  }
-
-  /**
-   * Refresh access token
-   */
-  async refreshToken(refreshToken: string): Promise<TokenSet> {
-    if (!this.client) {
-      await this.initialize();
-    }
-
-    return await this.client!.refresh(refreshToken);
-  }
-
-  /**
-   * Revoke token
-   */
-  async revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void> {
-    if (!this.client) {
-      await this.initialize();
-    }
-
-    await this.client!.revoke(token, tokenTypeHint);
-  }
-
-  /**
-   * End session (logout)
-   */
-  async endSession(idToken: string, postLogoutRedirectUri?: string): Promise<string> {
-    if (!this.client) {
-      await this.initialize();
-    }
-
-    return this.client!.endSessionUrl({
-      id_token_hint: idToken,
-      post_logout_redirect_uri:
-        postLogoutRedirectUri || 'https://app.llm-analytics.com',
-    });
-  }
-
-  /**
-   * Map OAuth user to internal user and generate JWT
-   */
-  async createInternalSession(oauthUser: OAuthUser): Promise<{
-    accessToken: string;
-    refreshToken: string;
-    expiresIn: number;
-  }> {
-    // Map OAuth roles to internal roles
-    const internalRoles = this.mapOAuthRolesToInternal(oauthUser.roles || []);
-
-    // Generate session ID
-    const sessionId = await jwtManager.generateSessionId();
-
-    // Generate JWT tokens
-    const tokens = await jwtManager.generateTokenPair({
-      userId: oauthUser.sub,
-      email: oauthUser.email,
-      roles: internalRoles,
-      permissions: [], // Will be populated by RBAC middleware
-      sessionId,
-      mfaVerified: false, // OAuth doesn't guarantee MFA
-    });
-
-    return tokens;
-  }
-
-  /**
-   * Extract roles from OAuth claims
-   */
-  private extractRoles(claims: any): string[] {
-    // Try different claim paths where roles might be stored
-    const rolePaths = [
-      'roles',
-      'realm_access.roles',
-      'resource_access.llm-analytics-hub.roles',
-      'groups',
-    ];
-
-    for (const path of rolePaths) {
-      const value = this.getNestedValue(claims, path);
-      if (Array.isArray(value)) {
-        return value;
-      }
-    }
-
-    return [];
-  }
-
-  /**
-   * Get nested object value by path
-   */
-  private getNestedValue(obj: any, path: string): any {
-    return path.split('.').reduce((current, key) => current?.[key], obj);
-  }
-
-  /**
-   * Map OAuth roles to internal RBAC roles
-   */
-  private mapOAuthRolesToInternal(oauthRoles: string[]): Role[] {
-    const roleMap: Record<string, Role> = {
-      'super-admin': Role.SUPER_ADMIN,
-      'super_admin': Role.SUPER_ADMIN,
-      'admin': Role.ADMIN,
-      'administrator': Role.ADMIN,
-      'analyst': Role.ANALYST,
-      'data-analyst': Role.ANALYST,
-      'developer': Role.DEVELOPER,
-      'dev': Role.DEVELOPER,
-      'viewer': Role.VIEWER,
-      'read-only': Role.VIEWER,
-    };
-
-    const mappedRoles: Role[] = [];
-
-    for (const oauthRole of oauthRoles) {
-      const normalizedRole = oauthRole.toLowerCase();
-      if (roleMap[normalizedRole]) {
-        mappedRoles.push(roleMap[normalizedRole]);
-      }
-    }
-
-    // Default to viewer if no roles matched
-    return mappedRoles.length > 0 ? mappedRoles : [Role.VIEWER];
-  }
-
-  /**
-   * Store code verifier (would use Redis in production)
-   */
-  private async storeCodeVerifier(_state: string, _verifier: string): Promise<void> {
-    // In production: await redis.setex(`oauth:verifier:${state}`, 600, verifier);
-  }
-
-  /**
-   * Get code verifier (would use Redis in production)
-   */
-  private async getCodeVerifier(_state: string): Promise<string | null> {
-    // In production: return await redis.get(`oauth:verifier:${state}`);
-    return null;
-  }
-
-  /**
-   * Delete code verifier (would use Redis in production)
-   */
-  private async deleteCodeVerifier(_state: string): Promise<void> {
-    // In production: await redis.del(`oauth:verifier:${state}`);
-  }
-}
-
-export const oauthManager = new OAuthManager();