@superdangerous/app-framework 4.9.0

package/src/middleware/auth.ts

@@ -0,0 +1,329 @@
+/**
+ * Authentication Middleware
+ * Generic authentication utilities for Express applications
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { createLogger } from "../core/index.js";
+
+let logger: any; // Will be initialized when needed
+
+function ensureLogger() {
+  if (!logger) {
+    logger = createLogger("AuthMiddleware");
+  }
+  return logger;
+}
+
+// Extend Express Request type to include user
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    interface Request {
+      user?: {
+        id: string;
+        username: string;
+        roles?: string[];
+      };
+    }
+  }
+}
+
+// Extend express-session types
+declare module "express-session" {
+  interface SessionData {
+    authenticated?: boolean;
+    username?: string;
+    userId?: string;
+    roles?: string[];
+  }
+}
+
+export interface AuthConfig {
+  loginPath?: string;
+  apiPrefix?: string;
+  excludePaths?: string[];
+  onUnauthorized?: (req: Request, res: Response) => void;
+}
+
+/**
+ * Creates authentication middleware with configuration
+ */
+export function createAuthMiddleware(config: AuthConfig = {}) {
+  const {
+    loginPath = "/login",
+    apiPrefix = "/api/",
+    excludePaths = [],
+    onUnauthorized,
+  } = config;
+
+  return function requireAuth(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): void {
+    // Check if path is excluded
+    if (excludePaths.some((path) => req.path.startsWith(path))) {
+      return next();
+    }
+
+    // Check if user is authenticated
+    if (req.session && req.session.authenticated) {
+      // Attach user to request
+      req.user = {
+        id: req.session.userId || "",
+        username: req.session.username || "",
+        roles: req.session.roles || [],
+      };
+      return next();
+    }
+
+    // Handle unauthorized access
+    if (onUnauthorized) {
+      return onUnauthorized(req, res);
+    }
+
+    // Default behavior
+    if (req.path.startsWith(apiPrefix)) {
+      // For API routes, return JSON error
+      res.status(401).json({
+        success: false,
+        error: "Authentication required",
+        message: "Please log in to access this resource",
+      });
+    } else {
+      // For web routes, redirect to login
+      res.redirect(loginPath);
+    }
+  };
+}
+
+/**
+ * Login handler factory
+ */
+export interface LoginCredentials {
+  username: string;
+  password: string;
+}
+
+export interface AuthService {
+  validateCredentials: (credentials: LoginCredentials) => Promise<{
+    valid: boolean;
+    user?: {
+      id: string;
+      username: string;
+      roles?: string[];
+    };
+    error?: string;
+  }>;
+}
+
+export function createLoginHandler(authService: AuthService) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { username, password } = req.body;
+
+      if (!username || !password) {
+        res.status(400).json({
+          success: false,
+          error: "Missing credentials",
+          message: "Username and password are required",
+        });
+        return;
+      }
+
+      const result = await authService.validateCredentials({
+        username,
+        password,
+      });
+
+      if (result.valid && result.user) {
+        // Set session
+        req.session.authenticated = true;
+        req.session.username = result.user.username;
+        req.session.userId = result.user.id;
+        req.session.roles = result.user.roles;
+
+        ensureLogger().info(`User logged in: ${username}`);
+
+        res.json({
+          success: true,
+          user: {
+            username: result.user.username,
+            roles: result.user.roles,
+          },
+        });
+      } else {
+        ensureLogger().warn(`Failed login attempt for user: ${username}`);
+        res.status(401).json({
+          success: false,
+          error: "Invalid credentials",
+          message: result.error || "Invalid username or password",
+        });
+      }
+    } catch (_error: any) {
+      ensureLogger().error("Login error:", _error);
+      res.status(500).json({
+        success: false,
+        error: "Login failed",
+        message: "An error occurred during login",
+      });
+    }
+  };
+}
+
+/**
+ * Logout handler factory
+ */
+export function createLogoutHandler() {
+  return (req: Request, res: Response): void => {
+    const username = req.session?.username;
+
+    req.session.destroy((err: any) => {
+      if (err) {
+        ensureLogger().error("Error destroying session:", err);
+        res.status(500).json({
+          success: false,
+          error: "Logout failed",
+        });
+        return;
+      }
+
+      if (username) {
+        ensureLogger().info(`User logged out: ${username}`);
+      }
+
+      res.json({ success: true });
+    });
+  };
+}
+
+/**
+ * Auth check handler
+ */
+export function createAuthCheckHandler() {
+  return (req: Request, res: Response): void => {
+    if (req.session?.authenticated) {
+      res.json({
+        authenticated: true,
+        user: {
+          username: req.session.username,
+          roles: req.session.roles,
+        },
+      });
+    } else {
+      res.status(401).json({
+        authenticated: false,
+      });
+    }
+  };
+}
+
+/**
+ * Role-based access control middleware
+ */
+export function requireRole(roles: string | string[]) {
+  const requiredRoles = Array.isArray(roles) ? roles : [roles];
+
+  return (req: Request, res: Response, next: NextFunction): void => {
+    if (!req.user) {
+      res.status(401).json({
+        success: false,
+        error: "Authentication required",
+      });
+      return;
+    }
+
+    const userRoles = req.user.roles || [];
+    const hasRole = requiredRoles.some((role) => userRoles.includes(role));
+
+    if (!hasRole) {
+      res.status(403).json({
+        success: false,
+        error: "Insufficient permissions",
+        message: `This action requires one of the following roles: ${requiredRoles.join(", ")}`,
+      });
+      return;
+    }
+
+    next();
+  };
+}
+
+/**
+ * Simple in-memory auth service for development
+ */
+export class SimpleAuthService implements AuthService {
+  private users: Map<
+    string,
+    { password: string; id: string; roles?: string[] }
+  >;
+
+  constructor(
+    users: Array<{
+      username: string;
+      password: string;
+      id?: string;
+      roles?: string[];
+    }> = [],
+  ) {
+    this.users = new Map();
+
+    // Add default admin user if no users provided
+    if (users.length === 0) {
+      users = [
+        {
+          username: "admin",
+          password: "admin",
+          id: "admin-1",
+          roles: ["admin"],
+        },
+      ];
+    }
+
+    users.forEach((user) => {
+      this.users.set(user.username, {
+        password: user.password,
+        id: user.id || `user-${user.username}`,
+        roles: user.roles,
+      });
+    });
+  }
+
+  async validateCredentials(credentials: LoginCredentials) {
+    const user = this.users.get(credentials.username);
+
+    if (!user || user.password !== credentials.password) {
+      return {
+        valid: false,
+        error: "Invalid username or password",
+      };
+    }
+
+    return {
+      valid: true,
+      user: {
+        id: user.id,
+        username: credentials.username,
+        roles: user.roles,
+      },
+    };
+  }
+
+  addUser(username: string, password: string, roles?: string[]) {
+    this.users.set(username, {
+      password,
+      id: `user-${username}`,
+      roles,
+    });
+  }
+}
+
+export default {
+  createAuthMiddleware,
+  createLoginHandler,
+  createLogoutHandler,
+  createAuthCheckHandler,
+  requireRole,
+  SimpleAuthService,
+};

package/src/middleware/cors.ts

@@ -0,0 +1,187 @@
+/**
+ * Dynamic CORS Middleware
+ * Intelligently handles CORS based on environment and configuration
+ */
+
+import cors from "cors";
+import { createLogger } from "../core/logger.js";
+
+const logger = createLogger("CORS");
+
+export interface DynamicCorsOptions {
+  /**
+   * Explicitly allowed origins (optional)
+   */
+  allowedOrigins?: string[];
+
+  /**
+   * Port ranges to automatically allow in development
+   */
+  devPortRanges?: Array<{ start: number; end: number }>;
+
+  /**
+   * Common development ports to always allow
+   */
+  commonDevPorts?: number[];
+
+  /**
+   * Whether to allow credentials
+   */
+  credentials?: boolean;
+
+  /**
+   * Custom origin validator function
+   */
+  customValidator?: (origin: string) => boolean;
+}
+
+/**
+ * Creates dynamic CORS middleware that intelligently handles origins
+ */
+export function createDynamicCors(options: DynamicCorsOptions = {}) {
+  const {
+    allowedOrigins = [],
+    devPortRanges = [
+      { start: 3000, end: 3010 },
+      { start: 5170, end: 5180 },
+      { start: 8080, end: 8090 },
+    ],
+    commonDevPorts = [3000, 3001, 5173, 5174, 5175, 8080, 8081],
+    credentials = true,
+    customValidator,
+  } = options;
+
+  // Build allowed origins list for development
+  const buildDevOrigins = (): string[] => {
+    const origins = new Set<string>();
+
+    // Add explicitly allowed origins
+    allowedOrigins.forEach((origin) => origins.add(origin));
+
+    // Add common development ports
+    commonDevPorts.forEach((port) => {
+      origins.add(`http://localhost:${port}`);
+      origins.add(`http://127.0.0.1:${port}`);
+    });
+
+    // Add port ranges
+    devPortRanges.forEach((range) => {
+      for (let port = range.start; port <= range.end; port++) {
+        origins.add(`http://localhost:${port}`);
+        origins.add(`http://127.0.0.1:${port}`);
+      }
+    });
+
+    return Array.from(origins);
+  };
+
+  // CORS origin function
+  const originFunction = (
+    origin: string | undefined,
+    callback: (err: Error | null, allow?: boolean | string) => void,
+  ) => {
+    // Allow requests with no origin (same-origin, Postman, etc.)
+    if (!origin) {
+      return callback(null, true);
+    }
+
+    // Production mode
+    if (process.env.NODE_ENV === "production") {
+      // Check against explicit allowed origins
+      if (allowedOrigins.length > 0 && allowedOrigins.includes(origin)) {
+        return callback(null, true);
+      }
+
+      // Check custom validator
+      if (customValidator && customValidator(origin)) {
+        return callback(null, true);
+      }
+
+      // Check if origin matches the app's domain
+      const appDomain = process.env.APP_DOMAIN || process.env.PRODUCTION_URL;
+      if (appDomain && origin.includes(appDomain)) {
+        return callback(null, true);
+      }
+
+      // Reject by default in production
+      logger.warn(`CORS rejected origin in production: ${origin}`);
+      return callback(new Error("Not allowed by CORS"));
+    }
+
+    // Development mode - be more permissive
+    const devOrigins = buildDevOrigins();
+
+    // Check if origin matches any development origin
+    if (devOrigins.some((allowed) => origin.startsWith(allowed))) {
+      return callback(null, true);
+    }
+
+    // Check if it's any localhost/127.0.0.1 origin
+    if (origin.includes("localhost") || origin.includes("127.0.0.1")) {
+      logger.debug(`Allowing localhost origin: ${origin}`);
+      return callback(null, true);
+    }
+
+    // Check custom validator
+    if (customValidator && customValidator(origin)) {
+      return callback(null, true);
+    }
+
+    // Log and allow in development (with warning)
+    logger.warn(`CORS: Allowing unrecognized origin in development: ${origin}`);
+    return callback(null, true);
+  };
+
+  // Create and return configured CORS middleware
+  const corsMiddleware = cors({
+    origin: originFunction,
+    credentials,
+    methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
+    allowedHeaders: ["Content-Type", "Authorization", "X-Requested-With"],
+    exposedHeaders: ["X-Total-Count", "X-Page-Count"],
+    maxAge: 86400, // 24 hours
+  });
+
+  // Attach the origin function for testing purposes
+  (corsMiddleware as any)._originFunction = originFunction;
+
+  return corsMiddleware;
+}
+
+/**
+ * Simple CORS middleware for production with specific domains
+ */
+export function createProductionCors(allowedDomains: string[]) {
+  const originFunction = (
+    origin: string | undefined,
+    callback: (err: Error | null, allow?: boolean) => void,
+  ) => {
+    if (!origin || allowedDomains.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(new Error("Not allowed by CORS"));
+    }
+  };
+
+  const corsMiddleware = cors({
+    origin: originFunction,
+    credentials: true,
+  });
+
+  // Attach for testing
+  (corsMiddleware as any)._originFunction = originFunction;
+
+  return corsMiddleware;
+}
+
+/**
+ * Permissive CORS for development
+ */
+export function createDevCors() {
+  return createDynamicCors({
+    allowedOrigins: [],
+    credentials: true,
+  });
+}
+
+export default createDynamicCors;

package/src/middleware/errorHandler.ts

@@ -0,0 +1,103 @@
+/**
+ * Error Handling Middleware
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { createLogger } from "../core/index.js";
+
+const logger = createLogger("ErrorHandler");
+
+// Custom error class
+export class AppError extends Error {
+  public readonly statusCode: number;
+  public readonly isOperational: boolean;
+
+  constructor(
+    message: string,
+    statusCode: number = 500,
+    isOperational: boolean = true,
+  ) {
+    super(message);
+    this.statusCode = statusCode;
+    this.isOperational = isOperational;
+
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+// 404 Not Found handler
+export function notFoundHandler(req: Request, res: Response) {
+  res.status(404).json({
+    success: false,
+    error: "Not Found",
+    message: `Cannot ${req.method} ${req.path}`,
+    path: req.path,
+    method: req.method,
+  });
+}
+
+// Global error handler
+export function errorHandler(
+  err: any,
+  req: Request,
+  res: Response,
+  _next: NextFunction,
+) {
+  // Default to 500 server error
+  let statusCode = err.statusCode || 500;
+  let message = err.message || "Internal Server Error";
+
+  // Log the error
+  if (statusCode >= 500) {
+    logger.error("Server error", {
+      error: err,
+      request: {
+        method: req.method,
+        path: req.path,
+        query: req.query,
+        body: req.body,
+        headers: req.headers,
+      },
+    });
+  } else {
+    logger.warn("Client error", {
+      statusCode,
+      message,
+      path: req.path,
+    });
+  }
+
+  // Handle specific error types
+  if (err.name === "ValidationError") {
+    statusCode = 400;
+    message = "Validation failed";
+  } else if (err.name === "UnauthorizedError") {
+    statusCode = 401;
+    message = "Unauthorized";
+  } else if (err.name === "JsonWebTokenError") {
+    statusCode = 401;
+    message = "Invalid token";
+  } else if (err.name === "TokenExpiredError") {
+    statusCode = 401;
+    message = "Token expired";
+  }
+
+  // Send error response
+  res.status(statusCode).json({
+    success: false,
+    error: message,
+    ...(process.env.NODE_ENV === "development" && {
+      stack: err.stack,
+      details: err,
+    }),
+  });
+}
+
+// Async handler wrapper to catch errors in async routes
+export function asyncHandler(
+  fn: (req: Request, res: Response, next: NextFunction) => any,
+) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    Promise.resolve(fn(req, res, next)).catch(next);
+  };
+}