aip-master-node-sumit 1.0.7 → 1.0.9

package/index.js

@@ -1,6 +1,6 @@
 const axios = require('axios');
 
-// 🛡️ THE FIX: Smart URL Cleaner ensures the base API URL is exactly right
+// 🛡️ Smart URL Cleaner
 const getSafeMasterUrl = (url) => {
     if (!url) return 'http://localhost:8080/api/v1';
     let clean = url.replace(/\/+$/, '');
@@ -10,6 +10,22 @@ const getSafeMasterUrl = (url) => {
     return clean;
 };
 
+// 🛡️ THE FIX: Bulletproof Native Cookie Parser (Handles JWT padding '=')
+const parseRawCookies = (cookieHeader) => {
+    if (!cookieHeader) return {};
+
+    return cookieHeader.split(';').reduce((acc, cookie) => {
+        const index = cookie.indexOf('=');
+        if (index < 0) return acc;
+
+        const key = decodeURIComponent(cookie.substring(0, index).trim());
+        const val = decodeURIComponent(cookie.substring(index + 1).trim());
+
+        acc[key] = val;
+        return acc;
+    }, {});
+};
+
 const AIP_MASTER_API = getSafeMasterUrl(process.env.AIP_MASTER_URL); 
 const API_KEY = process.env.AIP_MASTER_API_KEY;
 
@@ -24,7 +40,6 @@ if (API_KEY) {
             // Silently fail so the client's app doesn't crash if Master API is updating
         }
     };
-
     sendHeartbeat(); 
     setInterval(sendHeartbeat, 5 * 60 * 1000);
 }
@@ -38,11 +53,9 @@ const aipGuard = (options = { requireLogin: true }) => {
         const origin = req.headers.origin || req.headers.Origin;
         
         if (origin) {
-            // If origin is present, dynamically echo it to satisfy strict browser credential policies
             res.setHeader('Access-Control-Allow-Origin', origin);
             res.setHeader('Access-Control-Allow-Credentials', 'true');
         } else {
-            // Fallback for non-browser clients (like Postman or cURL)
             res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
         }
         
@@ -65,12 +78,13 @@ const aipGuard = (options = { requireLogin: true }) => {
         if (req.headers['transfer-encoding'] && req.headers['transfer-encoding'].includes('chunked')) {
             return res.status(411).json({ error: "AIP Infrastructure Shield: Chunked encoding rejected." });
         }
-
         if (req.headers['content-length'] && parseInt(req.headers['content-length']) > MAX_PAYLOAD_BYTES) {
             return res.status(413).json({ error: "AIP Infrastructure Shield: Payload Too Large." });
         }
 
-        let token = req.query.token || (req.cookies && req.cookies.aip_session);
+        // 🛡️ THE FIX: Smart Cookie Extraction & Removed Vulnerable Query Tokens
+        const cookies = req.cookies || parseRawCookies(req.headers.cookie);
+        let token = cookies.aip_session;
 
         if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
             token = req.headers.authorization.split(' ')[1];
@@ -82,11 +96,13 @@ const aipGuard = (options = { requireLogin: true }) => {
         // 🛡️ LAYER 2: IDENTITY CHECK & RBAC
         // ==========================================
         if (options.requireLogin) {
-            if (!token) return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
+            if (!token) {
+                return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
+            }
 
             try {
                 const currentAction = req.method + " " + (req.baseUrl + req.path);
-
+                
                 const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
                     { session_token: token, action: currentAction }, 
                     { headers: { 'Authorization': `Bearer ${API_KEY}` } }
@@ -94,15 +110,39 @@ const aipGuard = (options = { requireLogin: true }) => {
 
                 req.user = authRes.data.user; 
 
+                // 🛡️ THE FIX: Native Node.js Fallback for Set-Cookie (Framework Agnostic)
                 const isProd = process.env.NODE_ENV === 'production';
-                res.cookie('aip_session', token, { httpOnly: true, secure: isProd });
+                
+                if (typeof res.cookie === 'function') {
+                    // Express.js environment
+                    res.cookie('aip_session', token, { 
+                        httpOnly: true, 
+                        secure: isProd, 
+                        sameSite: isProd ? 'none' : 'lax', 
+                        path: '/', 
+                        maxAge: 12 * 60 * 60 * 1000
+                    });
+                } else {
+                    // Raw Node.js or alternate framework environment
+                    const cookieStr = `aip_session=${token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`;
+                    res.setHeader('Set-Cookie', cookieStr);
+                }
 
             } catch (error) {
                 const status = error.response?.status || 500;
                 const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
+                const isProd = process.env.NODE_ENV === 'production';
 
-                if (status === 401 && res.clearCookie) {
-                    res.clearCookie('aip_session');
+                if (status === 401) {
+                    if (typeof res.clearCookie === 'function') {
+                        res.clearCookie('aip_session', { 
+                            path: '/', 
+                            sameSite: isProd ? 'none' : 'lax', 
+                            secure: isProd 
+                        });
+                    } else {
+                        res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
+                    }
                 }
                 
                 return res.status(status === 401 ? 401 : 403).json({ error: errMsg });
@@ -115,12 +155,12 @@ const aipGuard = (options = { requireLogin: true }) => {
         try {
             const payloadData = JSON.stringify({ 
                 body: req.body || {}, 
-                query: req.query || {}
+                query: req.query || {} 
             });
-
+            
             const forwardedFor = req.headers['x-forwarded-for'];
             let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
-
+            
             if (forwardedFor) {
                 clientIp = Array.isArray(forwardedFor) 
                     ? forwardedFor[0].trim() 
@@ -128,12 +168,12 @@ const aipGuard = (options = { requireLogin: true }) => {
             }
 
             const wafRes = await axios.post(`${AIP_MASTER_API}/verify`, {
-                api_key: API_KEY,
-                ip: clientIp,
-                method: req.method,
+                api_key: API_KEY, 
+                ip: clientIp, 
+                method: req.method, 
                 url: req.originalUrl,
-                payload: payloadData,
-                origin: req.headers.origin || "",
+                payload: payloadData, 
+                origin: req.headers.origin || "", 
                 user_agent: req.headers['user-agent'] || "",
                 session_token: token || "" 
             });
@@ -143,68 +183,125 @@ const aipGuard = (options = { requireLogin: true }) => {
             }
 
         } catch (error) {
-            console.error("WAF Engine Unreachable");
             return res.status(500).json({ error: "Security verification failed." });
         }
-
+        
         next(); 
     };
 };
 
 // ==========================================
-// 🛡️ NEW: IaaS Admin Client SDK
+// 🛡️ Admin Client SDK
 // ==========================================
 class AipAdminClient {
     constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
         if (!apiKey) throw new Error("AIP Admin Client requires an API Key");
         this.apiKey = apiKey;
         this.baseUrl = getSafeMasterUrl(masterUrl);
-        
-        this.client = axios.create({
-            baseURL: this.baseUrl,
-            headers: { 'Authorization': `Bearer ${this.apiKey}` }
+        this.client = axios.create({ 
+            baseURL: this.baseUrl, 
+            headers: { 'Authorization': `Bearer ${this.apiKey}` } 
         });
     }
 
-    // --- User Management ---
-    async getUsers() {
-        const res = await this.client.get('/sdk/admin/users');
-        return res.data;
+    async getUsers() { 
+        const res = await this.client.get('/sdk/admin/users'); 
+        return res.data; 
     }
 
-    async createUser({ name, email, password, role_id, send_email = false }) {
-        const res = await this.client.post('/sdk/admin/users', { name, email, password, role_id, send_email });
-        return res.data;
+    async createUser(data) { 
+        const res = await this.client.post('/sdk/admin/users', data); 
+        return res.data; 
     }
 
-    async updateUser(userId, { name, role_id }) {
-        const res = await this.client.put(`/sdk/admin/users/${userId}`, { name, role_id });
-        return res.data;
+    async updateUser(userId, data) { 
+        const res = await this.client.put(`/sdk/admin/users/${userId}`, data); 
+        return res.data; 
     }
 
-    async updateRBAC(userId, permissions) {
-        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions });
-        return res.data;
+    async updateRBAC(userId, permissions) { 
+        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions }); 
+        return res.data; 
     }
 
-    async deleteUser(userId) {
-        const res = await this.client.delete(`/sdk/admin/users/${userId}`);
-        return res.data;
+    async deleteUser(userId) { 
+        const res = await this.client.delete(`/sdk/admin/users/${userId}`); 
+        return res.data; 
     }
 
-    // --- Role Management ---
-    async getRoles() {
-        const res = await this.client.get('/sdk/admin/roles');
-        return res.data;
+    async getRoles() { 
+        const res = await this.client.get('/sdk/admin/roles'); 
+        return res.data; 
     }
 
-    async createRole({ name, slug, permissions }) {
-        const res = await this.client.post('/sdk/admin/roles', { name, slug, permissions });
-        return res.data;
+    async createRole(data) { 
+        const res = await this.client.post('/sdk/admin/roles', data); 
+        return res.data; 
+    }
+}
+
+// ==========================================
+// 🛡️ End-User IAM Client SDK
+// ==========================================
+class AipIAMClient {
+    constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
+        if (!apiKey) throw new Error("AIP IAM Client requires an API Key");
+        this.apiKey = apiKey;
+        this.baseUrl = getSafeMasterUrl(masterUrl);
+        this.client = axios.create({ baseURL: this.baseUrl });
+    }
+
+    async loginUser(req, res, credentials) {
+        let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
+        const forwardedFor = req.headers['x-forwarded-for'];
+        
+        if (forwardedFor) {
+            clientIp = Array.isArray(forwardedFor) 
+                ? forwardedFor[0].trim() 
+                : forwardedFor.split(',')[0].trim();
+        }
+
+        const authRes = await this.client.post('/iam/auth', { 
+            api_key: this.apiKey, 
+            ip: clientIp, 
+            ...credentials 
+        });
+        
+        if (authRes.data.session_token) {
+            const isProd = process.env.NODE_ENV === 'production';
+            
+            if (typeof res.cookie === 'function') {
+                res.cookie('aip_session', authRes.data.session_token, { 
+                    httpOnly: true, 
+                    secure: isProd, 
+                    sameSite: isProd ? 'none' : 'lax', 
+                    path: '/', 
+                    maxAge: 12 * 60 * 60 * 1000 
+                });
+            } else {
+                res.setHeader('Set-Cookie', `aip_session=${authRes.data.session_token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`);
+            }
+        }
+        return authRes.data;
+    }
+
+    logoutUser(res) {
+        const isProd = process.env.NODE_ENV === 'production';
+        
+        if (typeof res.clearCookie === 'function') {
+            res.clearCookie('aip_session', { 
+                path: '/', 
+                sameSite: isProd ? 'none' : 'lax', 
+                secure: isProd 
+            });
+        } else {
+            res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
+        }
     }
 }
 
-// 🛡️ Attach the Admin Client directly to the Guard export for backward compatibility
+// Attach the clients directly to the Guard export for easy importing
 aipGuard.AipAdminClient = AipAdminClient;
+aipGuard.AipIAMClient = AipIAMClient;
 
 module.exports = aipGuard;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aip-master-node-sumit",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
   "main": "index.js",
   "scripts": {