aip-master-node-sumit 1.0.0

package/index.js

@@ -0,0 +1,109 @@
+const axios = require('axios');
+
+// 🛡️ THE FIX: Allow clients to define the URL, or default to your live production API
+const AIP_MASTER_API = process.env.AIP_MASTER_URL || 'http://localhost:8080/api/v1'; 
+const API_KEY = process.env.AIP_MASTER_API_KEY; 
+
+// Startup Ping Verification (Only runs if they provided an API key)
+if (API_KEY) {
+    axios.post(`${AIP_MASTER_API}/iam/ping`, { module: 'middleware' }, {
+        headers: { 'Authorization': `Bearer ${API_KEY}` }
+    }).catch(() => {});
+}
+
+/**
+ * Universal Security Guard (God-Mode)
+ * @param {Object} options - { requireLogin: boolean }
+ */
+const aipGuard = (options = { requireLogin: true }) => {
+    return async (req, res, next) => {
+        
+        // 🛡️ LAYER 1: INFRASTRUCTURE SHIELD (Anti-DDoS & Header Hacks)
+        const MAX_PAYLOAD_BYTES = 2 * 1024 * 1024; // 2MB Upload Limit
+        
+        // Block advanced Chunked Encoding bypass attacks
+        if (req.headers['transfer-encoding'] && req.headers['transfer-encoding'].includes('chunked')) {
+            return res.status(411).send("AIP Infrastructure Shield: Chunked encoding rejected.");
+        }
+
+        if (req.headers['content-length'] && parseInt(req.headers['content-length']) > MAX_PAYLOAD_BYTES) {
+            return res.status(413).send("AIP Infrastructure Shield: Payload Too Large.");
+        }
+        
+        // Inject Secure Anti-Hacker Headers into the browser
+        res.setHeader('X-Frame-Options', 'DENY');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+        res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
+
+        // 🛡️ LAYER 2: IDENTITY CHECK & RBAC AUTO-DISCOVERY
+        if (options.requireLogin) {
+            const token = req.query.token || (req.cookies && req.cookies.aip_session);
+            if (!token) return res.redirect('/login');
+
+            try {
+                // The Scout: Automatically grabs the route and sends it to AIP Master for RBAC Scanning
+                const currentAction = req.method + " " + (req.baseUrl + req.path);
+                const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
+                    { 
+                        session_token: token, 
+                        action: currentAction 
+                    }, 
+                    { 
+                        headers: { 'Authorization': `Bearer ${API_KEY}` } 
+                    }
+                );
+
+                req.user = authRes.data.user; 
+                res.cookie('aip_session', token, { httpOnly: true, secure: true });
+
+            } catch (error) {
+                if (res.clearCookie) res.clearCookie('aip_session');
+                const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
+                return res.status(403).send(errMsg);
+            }
+        }
+
+        // 🛡️ LAYER 3: WAF THREAT SCAN & SMART IP EXTRACTION
+        try {
+            const payloadData = JSON.stringify({ 
+                body: req.body, 
+                query: req.query 
+            });
+
+            // Smart IP Resolver: Protects clients hosted on Vercel, Heroku, or AWS
+            const forwardedFor = req.headers['x-forwarded-for'];
+            let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
+
+            if (forwardedFor) {
+                // Handle both string and array formats safely
+                clientIp = Array.isArray(forwardedFor) 
+                    ? forwardedFor[0].trim() 
+                    : forwardedFor.split(',')[0].trim();
+            }
+
+            const wafRes = await axios.post(`${AIP_MASTER_API}/verify`, {
+                api_key: API_KEY,
+                ip: clientIp,
+                method: req.method,
+                url: req.originalUrl,
+                payload: payloadData,
+                origin: req.headers.origin || "",
+                user_agent: req.headers['user-agent'] || ""
+            });
+
+            if (wafRes.data.action === "block") {
+                return res.status(403).send(`AIP Firewall Blocked Request: ${wafRes.data.reason}`);
+            }
+
+        } catch (error) {
+            console.error("WAF Engine Unreachable");
+            return res.status(500).send("Security verification failed.");
+        }
+
+        // Passed all 3 Layers perfectly!
+        next(); 
+    };
+};
+
+module.exports = aipGuard;

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "aip-master-node-sumit",
+  "version": "1.0.0",
+  "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "security",
+    "waf",
+    "iam",
+    "hospital-management"
+  ],
+  "author": "Sumit Rajwani",
+  "license": "ISC",
+  "dependencies": {
+    "axios": "^1.13.6"
+  }
+}