aip-master-node-sumit 1.0.2 → 1.0.6

package/index.js

@@ -1,24 +1,32 @@
 const axios = require('axios');
-const AIP_MASTER_API = process.env.AIP_MASTER_URL || 'http://localhost:8080/api/v1'; 
-const API_KEY = process.env.AIP_MASTER_API_KEY; 
 
-// 🛡️ The Heartbeat System.
-// This continuously pings the Go Server every 5 minutes 
-// to keep the dashboard "Live" without needing to restart the Express server!
+// 🛡️ THE FIX: Smart URL Cleaner ensures the base API URL is exactly right
+const getSafeMasterUrl = (url) => {
+    if (!url) return 'http://localhost:8080/api/v1';
+    let clean = url.replace(/\/+$/, '');
+    if (clean.endsWith('/iam')) {
+        clean = clean.substring(0, clean.length - 4);
+    }
+    return clean;
+};
+
+const AIP_MASTER_API = getSafeMasterUrl(process.env.AIP_MASTER_URL); 
+const API_KEY = process.env.AIP_MASTER_API_KEY;
+
 if (API_KEY) {
     const sendHeartbeat = async () => {
         try {
             await axios.post(`${AIP_MASTER_API}/iam/ping`, { module: 'middleware' }, {
                 headers: { 'Authorization': `Bearer ${API_KEY}` },
-                timeout: 5000 // Prevent hanging if master is slow
+                timeout: 5000 
             });
         } catch (err) {
             // Silently fail so the client's app doesn't crash if Master API is updating
         }
     };
 
-    sendHeartbeat(); // Fire immediately on server startup
-    setInterval(sendHeartbeat, 5 * 60 * 1000); // Fire every 5 minutes forever
+    sendHeartbeat(); 
+    setInterval(sendHeartbeat, 5 * 60 * 1000);
 }
 
 const aipGuard = (options = { requireLogin: true }) => {
@@ -26,6 +34,7 @@ const aipGuard = (options = { requireLogin: true }) => {
         
         // LAYER 1: INFRASTRUCTURE SHIELD 
         const MAX_PAYLOAD_BYTES = 2 * 1024 * 1024;
+
         if (req.headers['transfer-encoding'] && req.headers['transfer-encoding'].includes('chunked')) {
             return res.status(411).send("AIP Infrastructure Shield: Chunked encoding rejected.");
         }
@@ -39,8 +48,8 @@ const aipGuard = (options = { requireLogin: true }) => {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
         res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
 
-        // Robust Token Extraction (Checks query, cookies, and Authorization headers)
         let token = req.query.token || (req.cookies && req.cookies.aip_session);
+
         if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
             token = req.headers.authorization.split(' ')[1];
         } else if (!token && req.headers['x-aip-token']) {
@@ -50,22 +59,24 @@ const aipGuard = (options = { requireLogin: true }) => {
         // LAYER 2: IDENTITY CHECK & RBAC
         if (options.requireLogin) {
             if (!token) return res.status(401).send("Unauthorized: Missing AIP Session Token");
+
             try {
                 const currentAction = req.method + " " + (req.baseUrl + req.path);
+
                 const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
                     { session_token: token, action: currentAction }, 
                     { headers: { 'Authorization': `Bearer ${API_KEY}` } }
                 );
+
                 req.user = authRes.data.user; 
 
                 const isProd = process.env.NODE_ENV === 'production';
                 res.cookie('aip_session', token, { httpOnly: true, secure: isProd });
+
             } catch (error) {
                 const status = error.response?.status || 500;
                 const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
-                
-                // 🛡️ CRITICAL FIX: Only clear the session cookie if the token is actually dead (401).
-                // If it is an RBAC block (403), we just deny the action but keep them logged in!
+
                 if (status === 401 && res.clearCookie) {
                     res.clearCookie('aip_session');
                 }
@@ -80,8 +91,10 @@ const aipGuard = (options = { requireLogin: true }) => {
                 body: req.body || {}, 
                 query: req.query || {}
             });
+
             const forwardedFor = req.headers['x-forwarded-for'];
             let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
+
             if (forwardedFor) {
                 clientIp = Array.isArray(forwardedFor) 
                     ? forwardedFor[0].trim() 
@@ -96,9 +109,9 @@ const aipGuard = (options = { requireLogin: true }) => {
                 payload: payloadData,
                 origin: req.headers.origin || "",
                 user_agent: req.headers['user-agent'] || "",
-                session_token: token || "" // Explicitly forwarding the token to the Master WAF
+                session_token: token || "" 
             });
-            
+
             if (wafRes.data.action === "block") {
                 return res.status(403).send(`AIP Firewall Blocked Request: ${wafRes.data.reason}`);
             }
@@ -112,4 +125,60 @@ const aipGuard = (options = { requireLogin: true }) => {
     };
 };
 
+// ==========================================
+// 🛡️ NEW: IaaS Admin Client SDK
+// ==========================================
+class AipAdminClient {
+    constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
+        if (!apiKey) throw new Error("AIP Admin Client requires an API Key");
+        this.apiKey = apiKey;
+        this.baseUrl = getSafeMasterUrl(masterUrl);
+        
+        this.client = axios.create({
+            baseURL: this.baseUrl,
+            headers: { 'Authorization': `Bearer ${this.apiKey}` }
+        });
+    }
+
+    // --- User Management ---
+    async getUsers() {
+        const res = await this.client.get('/sdk/admin/users');
+        return res.data;
+    }
+
+    async createUser({ name, email, password, role_id, send_email = false }) {
+        const res = await this.client.post('/sdk/admin/users', { name, email, password, role_id, send_email });
+        return res.data;
+    }
+
+    async updateUser(userId, { name, role_id }) {
+        const res = await this.client.put(`/sdk/admin/users/${userId}`, { name, role_id });
+        return res.data;
+    }
+
+    async updateRBAC(userId, permissions) {
+        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions });
+        return res.data;
+    }
+
+    async deleteUser(userId) {
+        const res = await this.client.delete(`/sdk/admin/users/${userId}`);
+        return res.data;
+    }
+
+    // --- Role Management ---
+    async getRoles() {
+        const res = await this.client.get('/sdk/admin/roles');
+        return res.data;
+    }
+
+    async createRole({ name, slug, permissions }) {
+        const res = await this.client.post('/sdk/admin/roles', { name, slug, permissions });
+        return res.data;
+    }
+}
+
+// 🛡️ Attach the Admin Client directly to the Guard export for backward compatibility
+aipGuard.AipAdminClient = AipAdminClient;
+
 module.exports = aipGuard;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aip-master-node-sumit",
-  "version": "1.0.2",
+  "version": "1.0.6",
   "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
   "main": "index.js",
   "scripts": {