aip-master-node-sumit 1.0.7 → 1.0.8

package/index.js

@@ -1,6 +1,6 @@
 const axios = require('axios');
 
-// 🛡️ THE FIX: Smart URL Cleaner ensures the base API URL is exactly right
+// 🛡️ Smart URL Cleaner
 const getSafeMasterUrl = (url) => {
     if (!url) return 'http://localhost:8080/api/v1';
     let clean = url.replace(/\/+$/, '');
@@ -10,6 +10,22 @@ const getSafeMasterUrl = (url) => {
     return clean;
 };
 
+// 🛡️ THE FIX: Bulletproof Native Cookie Parser (Handles JWT padding '=')
+const parseRawCookies = (cookieHeader) => {
+    if (!cookieHeader) return {};
+
+    return cookieHeader.split(';').reduce((acc, cookie) => {
+        const index = cookie.indexOf('=');
+        if (index < 0) return acc;
+
+        const key = decodeURIComponent(cookie.substring(0, index).trim());
+        const val = decodeURIComponent(cookie.substring(index + 1).trim());
+
+        acc[key] = val;
+        return acc;
+    }, {});
+};
+
 const AIP_MASTER_API = getSafeMasterUrl(process.env.AIP_MASTER_URL); 
 const API_KEY = process.env.AIP_MASTER_API_KEY;
 
@@ -20,11 +36,8 @@ if (API_KEY) {
                 headers: { 'Authorization': `Bearer ${API_KEY}` },
                 timeout: 5000 
             });
-        } catch (err) {
-            // Silently fail so the client's app doesn't crash if Master API is updating
-        }
+        } catch (err) {}
     };
-
     sendHeartbeat(); 
     setInterval(sendHeartbeat, 5 * 60 * 1000);
 }
@@ -38,11 +51,9 @@ const aipGuard = (options = { requireLogin: true }) => {
         const origin = req.headers.origin || req.headers.Origin;
         
         if (origin) {
-            // If origin is present, dynamically echo it to satisfy strict browser credential policies
             res.setHeader('Access-Control-Allow-Origin', origin);
             res.setHeader('Access-Control-Allow-Credentials', 'true');
         } else {
-            // Fallback for non-browser clients (like Postman or cURL)
             res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
         }
         
@@ -50,7 +61,6 @@ const aipGuard = (options = { requireLogin: true }) => {
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
 
-        // Handle preflight requests gracefully
         if (req.method === 'OPTIONS') {
             res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-AIP-Token, X-Requested-With, Accept');
@@ -65,12 +75,13 @@ const aipGuard = (options = { requireLogin: true }) => {
         if (req.headers['transfer-encoding'] && req.headers['transfer-encoding'].includes('chunked')) {
             return res.status(411).json({ error: "AIP Infrastructure Shield: Chunked encoding rejected." });
         }
-
         if (req.headers['content-length'] && parseInt(req.headers['content-length']) > MAX_PAYLOAD_BYTES) {
             return res.status(413).json({ error: "AIP Infrastructure Shield: Payload Too Large." });
         }
 
-        let token = req.query.token || (req.cookies && req.cookies.aip_session);
+        // 🛡️ THE FIX: Smart Cookie Extraction & Removed Vulnerable Query Tokens
+        const cookies = req.cookies || parseRawCookies(req.headers.cookie);
+        let token = cookies.aip_session;
 
         if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
             token = req.headers.authorization.split(' ')[1];
@@ -86,7 +97,6 @@ const aipGuard = (options = { requireLogin: true }) => {
 
             try {
                 const currentAction = req.method + " " + (req.baseUrl + req.path);
-
                 const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
                     { session_token: token, action: currentAction }, 
                     { headers: { 'Authorization': `Bearer ${API_KEY}` } }
@@ -94,15 +104,28 @@ const aipGuard = (options = { requireLogin: true }) => {
 
                 req.user = authRes.data.user; 
 
+                // 🛡️ THE FIX: Native Node.js Fallback for Set-Cookie (Framework Agnostic)
                 const isProd = process.env.NODE_ENV === 'production';
-                res.cookie('aip_session', token, { httpOnly: true, secure: isProd });
+                if (typeof res.cookie === 'function') {
+                    res.cookie('aip_session', token, { 
+                        httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000
+                    });
+                } else {
+                    const cookieStr = `aip_session=${token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`;
+                    res.setHeader('Set-Cookie', cookieStr);
+                }
 
             } catch (error) {
                 const status = error.response?.status || 500;
                 const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
 
-                if (status === 401 && res.clearCookie) {
-                    res.clearCookie('aip_session');
+                const isProd = process.env.NODE_ENV === 'production';
+                if (status === 401) {
+                    if (typeof res.clearCookie === 'function') {
+                        res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
+                    } else {
+                        res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
+                    }
                 }
                 
                 return res.status(status === 401 ? 401 : 403).json({ error: errMsg });
@@ -113,28 +136,16 @@ const aipGuard = (options = { requireLogin: true }) => {
         // 🛡️ LAYER 3: WAF THREAT SCAN
         // ==========================================
         try {
-            const payloadData = JSON.stringify({ 
-                body: req.body || {}, 
-                query: req.query || {}
-            });
-
+            const payloadData = JSON.stringify({ body: req.body || {}, query: req.query || {} });
             const forwardedFor = req.headers['x-forwarded-for'];
             let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
-
             if (forwardedFor) {
-                clientIp = Array.isArray(forwardedFor) 
-                    ? forwardedFor[0].trim() 
-                    : forwardedFor.split(',')[0].trim();
+                clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
             }
 
             const wafRes = await axios.post(`${AIP_MASTER_API}/verify`, {
-                api_key: API_KEY,
-                ip: clientIp,
-                method: req.method,
-                url: req.originalUrl,
-                payload: payloadData,
-                origin: req.headers.origin || "",
-                user_agent: req.headers['user-agent'] || "",
+                api_key: API_KEY, ip: clientIp, method: req.method, url: req.originalUrl,
+                payload: payloadData, origin: req.headers.origin || "", user_agent: req.headers['user-agent'] || "",
                 session_token: token || "" 
             });
 
@@ -143,68 +154,62 @@ const aipGuard = (options = { requireLogin: true }) => {
             }
 
         } catch (error) {
-            console.error("WAF Engine Unreachable");
             return res.status(500).json({ error: "Security verification failed." });
         }
-
         next(); 
     };
 };
 
-// ==========================================
-// 🛡️ NEW: IaaS Admin Client SDK
-// ==========================================
 class AipAdminClient {
     constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
         if (!apiKey) throw new Error("AIP Admin Client requires an API Key");
         this.apiKey = apiKey;
         this.baseUrl = getSafeMasterUrl(masterUrl);
-        
-        this.client = axios.create({
-            baseURL: this.baseUrl,
-            headers: { 'Authorization': `Bearer ${this.apiKey}` }
-        });
-    }
-
-    // --- User Management ---
-    async getUsers() {
-        const res = await this.client.get('/sdk/admin/users');
-        return res.data;
-    }
-
-    async createUser({ name, email, password, role_id, send_email = false }) {
-        const res = await this.client.post('/sdk/admin/users', { name, email, password, role_id, send_email });
-        return res.data;
-    }
-
-    async updateUser(userId, { name, role_id }) {
-        const res = await this.client.put(`/sdk/admin/users/${userId}`, { name, role_id });
-        return res.data;
-    }
-
-    async updateRBAC(userId, permissions) {
-        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions });
-        return res.data;
+        this.client = axios.create({ baseURL: this.baseUrl, headers: { 'Authorization': `Bearer ${this.apiKey}` } });
     }
+    async getUsers() { const res = await this.client.get('/sdk/admin/users'); return res.data; }
+    async createUser(data) { const res = await this.client.post('/sdk/admin/users', data); return res.data; }
+    async updateUser(userId, data) { const res = await this.client.put(`/sdk/admin/users/${userId}`, data); return res.data; }
+    async updateRBAC(userId, permissions) { const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions }); return res.data; }
+    async deleteUser(userId) { const res = await this.client.delete(`/sdk/admin/users/${userId}`); return res.data; }
+    async getRoles() { const res = await this.client.get('/sdk/admin/roles'); return res.data; }
+    async createRole(data) { const res = await this.client.post('/sdk/admin/roles', data); return res.data; }
+}
 
-    async deleteUser(userId) {
-        const res = await this.client.delete(`/sdk/admin/users/${userId}`);
-        return res.data;
+class AipIAMClient {
+    constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
+        if (!apiKey) throw new Error("AIP IAM Client requires an API Key");
+        this.apiKey = apiKey;
+        this.baseUrl = getSafeMasterUrl(masterUrl);
+        this.client = axios.create({ baseURL: this.baseUrl });
     }
+    async loginUser(req, res, credentials) {
+        let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
+        const forwardedFor = req.headers['x-forwarded-for'];
+        if (forwardedFor) clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
 
-    // --- Role Management ---
-    async getRoles() {
-        const res = await this.client.get('/sdk/admin/roles');
-        return res.data;
+        const authRes = await this.client.post('/iam/auth', { api_key: this.apiKey, ip: clientIp, ...credentials });
+        
+        if (authRes.data.session_token) {
+            const isProd = process.env.NODE_ENV === 'production';
+            if (typeof res.cookie === 'function') {
+                res.cookie('aip_session', authRes.data.session_token, { httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000 });
+            } else {
+                res.setHeader('Set-Cookie', `aip_session=${authRes.data.session_token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`);
+            }
+        }
+        return authRes.data;
     }
-
-    async createRole({ name, slug, permissions }) {
-        const res = await this.client.post('/sdk/admin/roles', { name, slug, permissions });
-        return res.data;
+    logoutUser(res) {
+        const isProd = process.env.NODE_ENV === 'production';
+        if (typeof res.clearCookie === 'function') {
+            res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
+        } else {
+            res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
+        }
     }
 }
 
-// 🛡️ Attach the Admin Client directly to the Guard export for backward compatibility
 aipGuard.AipAdminClient = AipAdminClient;
-
+aipGuard.AipIAMClient = AipIAMClient;
 module.exports = aipGuard;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aip-master-node-sumit",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
   "main": "index.js",
   "scripts": {