@panguard-ai/panguard 0.3.7 → 0.4.1

package/dist/cli/commands/serve-types.js

@@ -0,0 +1,108 @@
+/**
+ * Shared types, helpers and middleware for serve sub-modules.
+ */
+import { authenticateRequest, requireAdmin } from '@panguard-ai/panguard-auth';
+// ── JSON Response ──────────────────────────────────────────────
+export function sendJson(res, status, data) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(data));
+}
+// ── Request Body Reader ────────────────────────────────────────
+/** Read request body with 1MB size limit */
+export function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        const MAX_BODY = 1_048_576; // 1MB
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY) {
+                req.destroy();
+                reject(new Error('Request body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        req.on('error', reject);
+    });
+}
+// ── Timing-safe Comparison ─────────────────────────────────────
+/** Timing-safe string comparison to prevent side-channel attacks */
+export function timingSafeCompare(a, b) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { timingSafeEqual } = require('node:crypto');
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length) {
+        // Compare against self to maintain constant time
+        timingSafeEqual(ab, ab);
+        return false;
+    }
+    return timingSafeEqual(ab, bb);
+}
+// ── Threat Cloud Auth Helpers ──────────────────────────────────
+/**
+ * Require TC_API_KEY auth for write endpoints.
+ * In production: BLOCK if TC_API_KEY not set (refuse unauthenticated writes).
+ * In dev: allow passthrough with warning.
+ */
+export function requireTCWriteAuth(req, res) {
+    const tcApiKey = process.env['TC_API_KEY'];
+    if (!tcApiKey) {
+        if (process.env['NODE_ENV'] === 'production') {
+            sendJson(res, 503, {
+                ok: false,
+                error: 'Threat Cloud write API not configured (TC_API_KEY missing)',
+            });
+            return false;
+        }
+        return true; // dev passthrough
+    }
+    const authHeader = req.headers.authorization ?? '';
+    const token = authHeader.replace('Bearer ', '');
+    if (!timingSafeCompare(token, tcApiKey)) {
+        sendJson(res, 401, { ok: false, error: 'Invalid API key' });
+        return false;
+    }
+    return true;
+}
+/**
+ * Require admin session auth for admin-only GET endpoints.
+ * Verifies the Bearer token is a valid session with admin role.
+ */
+export function requireTCAdminAuth(req, res, db) {
+    const user = authenticateRequest(req, db);
+    if (!user) {
+        sendJson(res, 401, { ok: false, error: 'Authentication required' });
+        return false;
+    }
+    if (!requireAdmin(user)) {
+        sendJson(res, 403, { ok: false, error: 'Admin access required' });
+        return false;
+    }
+    return true;
+}
+/** Validate Content-Type is application/json for POST requests */
+export function requireJsonContentType(req, res) {
+    const ct = req.headers['content-type'] ?? '';
+    if (!ct.includes('application/json')) {
+        sendJson(res, 400, { ok: false, error: 'Content-Type must be application/json' });
+        return false;
+    }
+    return true;
+}
+// ── Rate Limiter ───────────────────────────────────────────────
+/** Per-IP rate limiter for Threat Cloud endpoints (120 req/min) */
+const tcRateLimits = new Map();
+export function checkTCRateLimit(ip) {
+    const now = Date.now();
+    const entry = tcRateLimits.get(ip);
+    if (!entry || now > entry.resetAt) {
+        tcRateLimits.set(ip, { count: 1, resetAt: now + 60_000 });
+        return true;
+    }
+    entry.count++;
+    return entry.count <= 120;
+}
+//# sourceMappingURL=serve-types.js.map

package/dist/cli/commands/serve-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-types.js","sourceRoot":"","sources":["../../../src/cli/commands/serve-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAoB/E,kEAAkE;AAElE,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACzE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,kEAAkE;AAElE,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,MAAM;QAElC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAElE,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,iEAAiE;IACjE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IACnF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QAC5B,iDAAiD;QACjD,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,4DAA4D;aACpE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAU;IACtF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,GAAmB;IAC9E,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAElE,mEAAmE;AACnE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE3E,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC;AAC5B,CAAC"}

package/dist/cli/commands/serve.d.ts

@@ -2,6 +2,12 @@
  * panguard serve - Unified HTTP server gateway
  *
  * Serves auth API, admin API, admin dashboard UI, and health check.
+ * Route handling is delegated to focused sub-modules:
+ *   serve-core.ts  -- middleware, health, static files, rule seeding
+ *   serve-auth.ts  -- auth, waitlist, usage routes
+ *   serve-admin.ts -- admin dashboard + manager proxy routes
+ *   serve-tc.ts    -- Threat Cloud API routes
+ *   serve-types.ts -- shared types and utilities
  */
 import { Command } from 'commander';
 export declare function serveCommand(): Command;

package/dist/cli/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmCpC,wBAAgB,YAAY,IAAI,OAAO,CAiXtC"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,wBAAgB,YAAY,IAAI,OAAO,CA0XtC"}