@zintrust/core 0.1.0

package/src/microservices/RequestTracingMiddleware.js

@@ -0,0 +1,122 @@
+import { Env } from '../config/env';
+import { Logger } from '../config/logger';
+import * as crypto from '../node-singletons/crypto';
+/**
+ * Trace logger for structured logging
+ */
+export const TraceLogger = Object.freeze({
+    /**
+     * Create a new trace logger instance
+     */
+    create(traceId, serviceName) {
+        return {
+            info(message, data) {
+                Logger.info(`[${traceId}] ${serviceName} INFO: ${message}`, data ?? '');
+            },
+            warn(message, data) {
+                Logger.warn(`[${traceId}] ${serviceName} WARN: ${message}`, data ?? '');
+            },
+            error(message, data) {
+                Logger.error(`[${traceId}] ${serviceName} ERROR: ${message}`, data ?? '');
+            },
+            debug(message, data) {
+                if (Env.get('DEBUG') !== undefined && Env.get('DEBUG') !== '') {
+                    Logger.debug(`[${traceId}] ${serviceName} DEBUG: ${message}`, data ?? '');
+                }
+            },
+        };
+    },
+});
+/**
+ * Generate unique trace ID
+ */
+function generateTraceId() {
+    return `${Date.now()}-${crypto.randomBytes(8).toString('hex')}`;
+}
+function shouldSampleRequest(samplingRate) {
+    if (samplingRate >= 1)
+        return true;
+    if (samplingRate <= 0)
+        return false;
+    const scale = 1_000_000;
+    const value = crypto.randomInt(0, scale) / scale;
+    return value <= samplingRate;
+}
+function createTracingMiddleware(serviceName, enabled, samplingRate) {
+    return async (req, res, next) => {
+        if (enabled === false || shouldSampleRequest(samplingRate) === false) {
+            return next();
+        }
+        // Check for existing trace ID (from parent service)
+        const traceIdHeader = req.getHeader('x-trace-id');
+        const traceId = (typeof traceIdHeader === 'string' ? traceIdHeader : '') || generateTraceId();
+        const parentServiceIdHeader = req.getHeader('x-parent-service-id');
+        const parentServiceId = typeof parentServiceIdHeader === 'string' ? parentServiceIdHeader : undefined;
+        const depthHeader = req.getHeader('x-trace-depth');
+        const depth = Number.parseInt((typeof depthHeader === 'string' ? depthHeader : '') || '0');
+        // Store trace context in request
+        const traceContext = {
+            traceId,
+            parentServiceId,
+            depth,
+            startTime: Date.now(),
+            serviceName,
+        };
+        req.context = Object.keys(req.context).length > 0 ? req.context : {};
+        req.context['trace'] = traceContext;
+        req.context['traceLogger'] = TraceLogger.create(traceId, serviceName);
+        // Attach trace headers to response
+        res.setHeader('x-trace-id', traceId);
+        res.setHeader('x-trace-service', serviceName);
+        res.setHeader('x-trace-depth', depth.toString());
+        // Log request start
+        const method = req.getMethod();
+        const path = req.getPath();
+        Logger.info(`[TRACE ${traceId}] ${serviceName} ${method} ${path} (depth: ${depth}) ` +
+            (parentServiceId === undefined ? '' : `(from: ${parentServiceId})`));
+        // Track response timing
+        const startTime = Date.now();
+        const originalJson = res.json.bind(res);
+        res.json = function (data) {
+            const duration = Date.now() - startTime;
+            Logger.info(`[TRACE ${traceId}] ${serviceName} ${method} ${path} ${res.getStatus()} (${duration}ms)`);
+            return originalJson(data);
+        };
+        await next();
+    };
+}
+function createInjectHeaders(serviceName) {
+    return (headers = {}, traceId) => {
+        const depthHeader = headers['x-trace-depth'];
+        const newDepth = Number.parseInt(depthHeader ?? '0') + 1;
+        return {
+            ...headers,
+            'x-trace-id': traceId ?? crypto.randomBytes(8).toString('hex'),
+            'x-parent-service-id': serviceName,
+            'x-trace-depth': newDepth.toString(),
+        };
+    };
+}
+/**
+ * Request Tracing Middleware
+ * Enables request tracking across microservices for debugging and observability
+ */
+export function RequestTracingMiddlewareFactory() {
+    return {
+        /**
+         * Middleware to add request tracing
+         */
+        middleware(serviceName, enabled = true, samplingRate = 1) {
+            return createTracingMiddleware(serviceName, enabled, samplingRate);
+        },
+        /**
+         * Middleware to inject trace headers into outgoing service calls
+         */
+        injectHeaders(serviceName, _targetServiceName) {
+            return createInjectHeaders(serviceName);
+        },
+    };
+}
+export const RequestTracingMiddleware = RequestTracingMiddlewareFactory();
+export const middleware = (serviceName, enabled = true, samplingRate = 1) => RequestTracingMiddleware.middleware(serviceName, enabled, samplingRate);
+export default RequestTracingMiddleware;

package/src/microservices/ServiceAuthMiddleware.d.ts

@@ -0,0 +1,58 @@
+import { IRequest } from '../http/Request';
+import { IResponse } from '../http/Response';
+export type NextFunction = (error?: Error) => void | Promise<void>;
+/**
+ * Service-to-service authentication strategies
+ */
+export type AuthStrategy = 'api-key' | 'jwt' | 'none' | 'custom';
+export interface AuthContext {
+    isServiceCall: boolean;
+    serviceName?: string;
+    strategy: AuthStrategy;
+    authenticated: boolean;
+}
+export interface IApiKeyAuth {
+    verify(token: string): boolean;
+    generate(): string;
+}
+/**
+ * API Key Authentication
+ */
+export declare const ApiKeyAuth: Readonly<{
+    /**
+     * Create a new API key auth instance
+     */
+    create(apiKey?: string): IApiKeyAuth;
+}>;
+export interface IJwtAuth {
+    sign(payload: Record<string, unknown>, expiresIn?: string): string;
+    verify(token: string): Record<string, unknown> | null;
+}
+/**
+ * JWT Authentication
+ */
+export declare const JwtAuth: Readonly<{
+    /**
+     * Create a new JWT auth instance
+     */
+    create(secret?: string): IJwtAuth;
+}>;
+export interface ICustomAuth {
+    verify(token: string): boolean;
+}
+/**
+ * Custom Authentication (developer-defined)
+ */
+export declare const CustomAuth: Readonly<{
+    /**
+     * Create a new custom auth instance
+     */
+    create(validator: (token: string) => boolean): ICustomAuth;
+}>;
+export interface IServiceAuthMiddleware {
+    registerCustomAuth(validator: (token: string) => boolean): void;
+    middleware(strategy: AuthStrategy): (req: IRequest, res: IResponse, next: NextFunction) => void | Promise<void>;
+}
+export declare const ServiceAuthMiddleware: Readonly<IServiceAuthMiddleware>;
+export default ServiceAuthMiddleware;
+//# sourceMappingURL=ServiceAuthMiddleware.d.ts.map

package/src/microservices/ServiceAuthMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceAuthMiddleware.d.ts","sourceRoot":"","sources":["../../../src/microservices/ServiceAuthMiddleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAI3C,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;oBACa,MAAM,GAAG,WAAW;EA6BpC,CAAC;AAEH,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,eAAO,MAAM,OAAO;IAClB;;OAEG;oBACa,MAAM,GAAG,QAAQ;EAyDjC,CAAC;AAEH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB;;OAEG;sBACe,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,WAAW;EAO1D,CAAC;AAEH,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAChE,UAAU,CACR,QAAQ,EAAE,YAAY,GACrB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAwMD,eAAO,MAAM,qBAAqB,kCAA+C,CAAC;AAElF,eAAe,qBAAqB,CAAC"}

package/src/microservices/ServiceAuthMiddleware.js

@@ -0,0 +1,240 @@
+import { Env } from '../config/env';
+import { Logger } from '../config/logger';
+import * as crypto from '../node-singletons/crypto';
+/**
+ * API Key Authentication
+ */
+export const ApiKeyAuth = Object.freeze({
+    /**
+     * Create a new API key auth instance
+     */
+    create(apiKey) {
+        const generateSecureApiKeyDefault = () => {
+            return crypto.randomBytes(32).toString('hex');
+        };
+        const getApiKey = () => {
+            const envKey = Env.get('SERVICE_API_KEY');
+            const secureDefault = generateSecureApiKeyDefault();
+            if (envKey === undefined || envKey === secureDefault) {
+                Logger.warn('⚠️  WARNING: Using generated default API key. Set SERVICE_API_KEY environment variable in production!');
+                return secureDefault;
+            }
+            return envKey;
+        };
+        const key = apiKey ?? getApiKey();
+        return {
+            verify(token) {
+                return token === key;
+            },
+            generate() {
+                return crypto.randomBytes(32).toString('hex');
+            },
+        };
+    },
+});
+/**
+ * JWT Authentication
+ */
+export const JwtAuth = Object.freeze({
+    /**
+     * Create a new JWT auth instance
+     */
+    create(secret) {
+        const generateSecureJwtDefault = () => {
+            return crypto.randomBytes(32).toString('hex');
+        };
+        const getJwtSecret = () => {
+            const envSecret = Env.get('SERVICE_JWT_SECRET');
+            const secureDefault = generateSecureJwtDefault();
+            if (envSecret === undefined || envSecret === secureDefault) {
+                Logger.warn('⚠️  WARNING: Using generated default JWT secret. Set SERVICE_JWT_SECRET environment variable in production!');
+                return secureDefault;
+            }
+            return envSecret;
+        };
+        const jwtSecret = secret ?? getJwtSecret();
+        return {
+            sign(payload, _expiresIn = '1h') {
+                // Simplified JWT (in production, use jsonwebtoken library)
+                const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64');
+                const body = Buffer.from(JSON.stringify({ ...payload, iat: Date.now() })).toString('base64');
+                const signature = crypto
+                    .createHmac('sha256', jwtSecret)
+                    .update(`${header}.${body}`)
+                    .digest('base64');
+                return `${header}.${body}.${signature}`;
+            },
+            verify(token) {
+                try {
+                    const parts = token.split('.');
+                    if (parts.length !== 3)
+                        return null;
+                    const [header, body, signature] = parts;
+                    const expectedSignature = crypto
+                        .createHmac('sha256', jwtSecret)
+                        .update(`${header}.${body}`)
+                        .digest('base64');
+                    if (signature !== expectedSignature) {
+                        return null;
+                    }
+                    return JSON.parse(Buffer.from(body, 'base64').toString());
+                }
+                catch (error) {
+                    Logger.error('JWT verification failed', error);
+                    return null;
+                }
+            },
+        };
+    },
+});
+/**
+ * Custom Authentication (developer-defined)
+ */
+export const CustomAuth = Object.freeze({
+    /**
+     * Create a new custom auth instance
+     */
+    create(validator) {
+        return {
+            verify(token) {
+                return validator(token);
+            },
+        };
+    },
+});
+/**
+ * Create initial authentication context
+ */
+const createAuthContext = (strategy) => {
+    return {
+        isServiceCall: false,
+        strategy,
+        authenticated: strategy === 'none',
+    };
+};
+/**
+ * Attach context to request and proceed to next middleware
+ */
+const attachContextAndNext = (req, context, next) => {
+    req.context ??= {};
+    req.context['serviceAuth'] = context;
+    return next();
+};
+/**
+ * Finalize successful service authentication
+ */
+const finalizeServiceAuth = (req, context, next) => {
+    context.authenticated = true;
+    context.isServiceCall = true;
+    return attachContextAndNext(req, context, next);
+};
+/**
+ * Parse authorization header
+ */
+const parseAuthHeader = (req) => {
+    const authHeader = req.getHeader('authorization');
+    if (authHeader === undefined || typeof authHeader !== 'string') {
+        return null;
+    }
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2) {
+        return null;
+    }
+    const scheme = parts[0];
+    const token = parts[1];
+    if (!scheme || !token) {
+        return null;
+    }
+    return { scheme, token };
+};
+/**
+ * Verify API Key strategy
+ */
+const verifyApiKeyStrategy = (apiKeyAuth, scheme, token) => {
+    if (scheme !== 'Bearer' || apiKeyAuth.verify(token) === false) {
+        return { authenticated: false, status: 403, error: 'Invalid API key' };
+    }
+    return { authenticated: true };
+};
+/**
+ * Verify JWT strategy
+ */
+const verifyJwtStrategy = (jwtAuth, scheme, token, context) => {
+    if (scheme !== 'Bearer') {
+        return {
+            authenticated: false,
+            status: 401,
+            error: 'Invalid authorization scheme',
+        };
+    }
+    const payload = jwtAuth.verify(token);
+    if (payload === null) {
+        return { authenticated: false, status: 403, error: 'Invalid JWT token' };
+    }
+    const serviceName = payload['serviceName'];
+    context.serviceName = typeof serviceName === 'string' ? serviceName : '';
+    return { authenticated: true };
+};
+/**
+ * Verify Custom strategy
+ */
+const verifyCustomStrategy = (customValidator, token) => {
+    if (customValidator === null || customValidator(token) === false) {
+        return { authenticated: false, status: 403, error: 'Authentication failed' };
+    }
+    return { authenticated: true };
+};
+/**
+ * Verify authentication strategy
+ */
+const verifyStrategy = (strategy, auth, context, deps) => {
+    switch (strategy) {
+        case 'api-key':
+            return verifyApiKeyStrategy(deps.apiKeyAuth, auth.scheme, auth.token);
+        case 'jwt':
+            return verifyJwtStrategy(deps.jwtAuth, auth.scheme, auth.token, context);
+        case 'custom':
+            return verifyCustomStrategy(deps.customValidator, auth.token);
+        default:
+            return { authenticated: false, status: 401, error: 'Unsupported strategy' };
+    }
+};
+const createServiceAuthMiddleware = () => {
+    const defaultApiKeyAuth = ApiKeyAuth.create();
+    const defaultJwtAuth = JwtAuth.create();
+    let customValidator = null;
+    return {
+        /**
+         * Register custom auth validator
+         */
+        registerCustomAuth(validator) {
+            customValidator = validator;
+        },
+        /**
+         * Middleware to authenticate service-to-service calls
+         */
+        middleware(strategy) {
+            return async (req, res, next) => {
+                const context = createAuthContext(strategy);
+                if (strategy === 'none') {
+                    return attachContextAndNext(req, context, next);
+                }
+                const auth = parseAuthHeader(req);
+                if (auth === null) {
+                    return res.setStatus(401).json({ error: 'Missing or invalid authorization header' });
+                }
+                const result = verifyStrategy(strategy, auth, context, {
+                    apiKeyAuth: defaultApiKeyAuth,
+                    jwtAuth: defaultJwtAuth,
+                    customValidator,
+                });
+                if (!result.authenticated) {
+                    return res.setStatus(result.status ?? 401).json({ error: result.error });
+                }
+                return finalizeServiceAuth(req, context, next);
+            };
+        },
+    };
+};
+export const ServiceAuthMiddleware = Object.freeze(createServiceAuthMiddleware());
+export default ServiceAuthMiddleware;

package/src/microservices/ServiceBundler.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Service Bundler - Creates optimized, independent microservice packages
+ * Target: Each service < 1MB for serverless deployment
+ */
+export interface BundleConfig {
+    serviceName: string;
+    domain: string;
+    outputDir: string;
+    targetSize?: number;
+    includeTests?: boolean;
+    includeDocs?: boolean;
+}
+export interface BundleResult {
+    serviceName: string;
+    sizeBytes: number;
+    sizeMB: number;
+    files: number;
+    location: string;
+    optimized: boolean;
+}
+export interface IServiceBundler {
+    bundleService(config: BundleConfig): Promise<BundleResult>;
+    bundleAll(domain: string, services: string[], outputDir?: string): Promise<BundleResult[]>;
+    createServiceImage(serviceName: string, domain: string, registry?: string): Promise<string>;
+}
+export interface IServiceBundlerManager {
+    getInstance(): IServiceBundler;
+    bundleService(config: BundleConfig): Promise<BundleResult>;
+    bundleAll(domain: string, services: string[], outputDir?: string): Promise<BundleResult[]>;
+    createServiceImage(serviceName: string, domain: string, registry?: string): Promise<string>;
+    create(): IServiceBundler;
+}
+/**
+ * Service bundler for independent deployment
+ */
+export declare const ServiceBundler: IServiceBundlerManager;
+/**
+ * CLI command to bundle services
+ */
+export declare function bundleServices(domain: string, services: string): Promise<void>;
+export declare const bundleService: (config: BundleConfig) => Promise<BundleResult>;
+export declare const bundleAll: (domain: string, services: string[], outputDir?: string) => Promise<BundleResult[]>;
+export declare const createServiceImage: (serviceName: string, domain: string, registry?: string) => Promise<string>;
+export default ServiceBundler;
+//# sourceMappingURL=ServiceBundler.d.ts.map

package/src/microservices/ServiceBundler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceBundler.d.ts","sourceRoot":"","sources":["../../../src/microservices/ServiceBundler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3F,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7F;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,IAAI,eAAe,CAAC;IAC/B,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3F,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5F,MAAM,IAAI,eAAe,CAAC;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,wBAiEvB,CAAC;AA+RL;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcpF;AAED,eAAO,MAAM,aAAa,GAAU,QAAQ,YAAY,KAAG,OAAO,CAAC,YAAY,CAC3B,CAAC;AACrD,eAAO,MAAM,SAAS,GACpB,QAAQ,MAAM,EACd,UAAU,MAAM,EAAE,EAClB,YAAY,MAAM,KACjB,OAAO,CAAC,YAAY,EAAE,CAAwE,CAAC;AAClG,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,QAAQ,MAAM,EACd,WAAW,MAAM,KAChB,OAAO,CAAC,MAAM,CAC+D,CAAC;AAEjF,eAAe,cAAc,CAAC"}