aip-master-node-sumit 1.0.8 → 1.0.11

package/index.js

@@ -10,7 +10,7 @@ const getSafeMasterUrl = (url) => {
     return clean;
 };
 
-// 🛡️ THE FIX: Bulletproof Native Cookie Parser (Handles JWT padding '=')
+// 🛡️ Bulletproof Native Cookie Parser (Handles JWT padding '=')
 const parseRawCookies = (cookieHeader) => {
     if (!cookieHeader) return {};
 
@@ -36,7 +36,9 @@ if (API_KEY) {
                 headers: { 'Authorization': `Bearer ${API_KEY}` },
                 timeout: 5000 
             });
-        } catch (err) {}
+        } catch (err) {
+            // Silently fail so the client's app doesn't crash if Master API is updating
+        }
     };
     sendHeartbeat(); 
     setInterval(sendHeartbeat, 5 * 60 * 1000);
@@ -61,6 +63,7 @@ const aipGuard = (options = { requireLogin: true }) => {
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
 
+        // Handle preflight requests gracefully
         if (req.method === 'OPTIONS') {
             res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-AIP-Token, X-Requested-With, Accept');
@@ -79,24 +82,34 @@ const aipGuard = (options = { requireLogin: true }) => {
             return res.status(413).json({ error: "AIP Infrastructure Shield: Payload Too Large." });
         }
 
-        // 🛡️ THE FIX: Smart Cookie Extraction & Removed Vulnerable Query Tokens
-        const cookies = req.cookies || parseRawCookies(req.headers.cookie);
-        let token = cookies.aip_session;
+        // ==========================================
+        // 🛡️ THE FIX: Strict Header Priority (Bearer overrides Cookies)
+        // ==========================================
+        let token = null;
 
-        if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
+        // 1. Check Explicit Headers FIRST
+        if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
             token = req.headers.authorization.split(' ')[1];
-        } else if (!token && req.headers['x-aip-token']) {
+        } else if (req.headers['x-aip-token']) {
             token = req.headers['x-aip-token'];
+        } 
+        // 2. Fallback to browser cookies ONLY if no explicit headers exist
+        else {
+            const cookies = req.cookies || parseRawCookies(req.headers.cookie);
+            token = cookies.aip_session;
         }
 
         // ==========================================
         // 🛡️ LAYER 2: IDENTITY CHECK & RBAC
         // ==========================================
         if (options.requireLogin) {
-            if (!token) return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
+            if (!token) {
+                return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
+            }
 
             try {
                 const currentAction = req.method + " " + (req.baseUrl + req.path);
+                
                 const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
                     { session_token: token, action: currentAction }, 
                     { headers: { 'Authorization': `Bearer ${API_KEY}` } }
@@ -104,13 +117,20 @@ const aipGuard = (options = { requireLogin: true }) => {
 
                 req.user = authRes.data.user; 
 
-                // 🛡️ THE FIX: Native Node.js Fallback for Set-Cookie (Framework Agnostic)
+                // 🛡️ Native Node.js Fallback for Set-Cookie (Framework Agnostic)
                 const isProd = process.env.NODE_ENV === 'production';
+                
                 if (typeof res.cookie === 'function') {
+                    // Express.js environment
                     res.cookie('aip_session', token, { 
-                        httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000
+                        httpOnly: true, 
+                        secure: isProd, 
+                        sameSite: isProd ? 'none' : 'lax', 
+                        path: '/', 
+                        maxAge: 12 * 60 * 60 * 1000
                     });
                 } else {
+                    // Raw Node.js or alternate framework environment
                     const cookieStr = `aip_session=${token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`;
                     res.setHeader('Set-Cookie', cookieStr);
                 }
@@ -118,11 +138,15 @@ const aipGuard = (options = { requireLogin: true }) => {
             } catch (error) {
                 const status = error.response?.status || 500;
                 const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
-
                 const isProd = process.env.NODE_ENV === 'production';
+
                 if (status === 401) {
                     if (typeof res.clearCookie === 'function') {
-                        res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
+                        res.clearCookie('aip_session', { 
+                            path: '/', 
+                            sameSite: isProd ? 'none' : 'lax', 
+                            secure: isProd 
+                        });
                     } else {
                         res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
                     }
@@ -136,16 +160,28 @@ const aipGuard = (options = { requireLogin: true }) => {
         // 🛡️ LAYER 3: WAF THREAT SCAN
         // ==========================================
         try {
-            const payloadData = JSON.stringify({ body: req.body || {}, query: req.query || {} });
+            const payloadData = JSON.stringify({ 
+                body: req.body || {}, 
+                query: req.query || {} 
+            });
+            
             const forwardedFor = req.headers['x-forwarded-for'];
             let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
+            
             if (forwardedFor) {
-                clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
+                clientIp = Array.isArray(forwardedFor) 
+                    ? forwardedFor[0].trim() 
+                    : forwardedFor.split(',')[0].trim();
             }
 
             const wafRes = await axios.post(`${AIP_MASTER_API}/verify`, {
-                api_key: API_KEY, ip: clientIp, method: req.method, url: req.originalUrl,
-                payload: payloadData, origin: req.headers.origin || "", user_agent: req.headers['user-agent'] || "",
+                api_key: API_KEY, 
+                ip: clientIp, 
+                method: req.method, 
+                url: req.originalUrl,
+                payload: payloadData, 
+                origin: req.headers.origin || "", 
+                user_agent: req.headers['user-agent'] || "",
                 session_token: token || "" 
             });
 
@@ -156,26 +192,64 @@ const aipGuard = (options = { requireLogin: true }) => {
         } catch (error) {
             return res.status(500).json({ error: "Security verification failed." });
         }
+        
         next(); 
     };
 };
 
+// ==========================================
+// 🛡️ Admin Client SDK
+// ==========================================
 class AipAdminClient {
     constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
         if (!apiKey) throw new Error("AIP Admin Client requires an API Key");
         this.apiKey = apiKey;
         this.baseUrl = getSafeMasterUrl(masterUrl);
-        this.client = axios.create({ baseURL: this.baseUrl, headers: { 'Authorization': `Bearer ${this.apiKey}` } });
+        this.client = axios.create({ 
+            baseURL: this.baseUrl, 
+            headers: { 'Authorization': `Bearer ${this.apiKey}` } 
+        });
+    }
+
+    async getUsers() { 
+        const res = await this.client.get('/sdk/admin/users'); 
+        return res.data; 
+    }
+
+    async createUser(data) { 
+        const res = await this.client.post('/sdk/admin/users', data); 
+        return res.data; 
+    }
+
+    async updateUser(userId, data) { 
+        const res = await this.client.put(`/sdk/admin/users/${userId}`, data); 
+        return res.data; 
+    }
+
+    async updateRBAC(userId, permissions) { 
+        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions }); 
+        return res.data; 
+    }
+
+    async deleteUser(userId) { 
+        const res = await this.client.delete(`/sdk/admin/users/${userId}`); 
+        return res.data; 
+    }
+
+    async getRoles() { 
+        const res = await this.client.get('/sdk/admin/roles'); 
+        return res.data; 
+    }
+
+    async createRole(data) { 
+        const res = await this.client.post('/sdk/admin/roles', data); 
+        return res.data; 
     }
-    async getUsers() { const res = await this.client.get('/sdk/admin/users'); return res.data; }
-    async createUser(data) { const res = await this.client.post('/sdk/admin/users', data); return res.data; }
-    async updateUser(userId, data) { const res = await this.client.put(`/sdk/admin/users/${userId}`, data); return res.data; }
-    async updateRBAC(userId, permissions) { const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions }); return res.data; }
-    async deleteUser(userId) { const res = await this.client.delete(`/sdk/admin/users/${userId}`); return res.data; }
-    async getRoles() { const res = await this.client.get('/sdk/admin/roles'); return res.data; }
-    async createRole(data) { const res = await this.client.post('/sdk/admin/roles', data); return res.data; }
 }
 
+// ==========================================
+// 🛡️ End-User IAM Client SDK
+// ==========================================
 class AipIAMClient {
     constructor(apiKey = process.env.AIP_MASTER_API_KEY, masterUrl = process.env.AIP_MASTER_URL) {
         if (!apiKey) throw new Error("AIP IAM Client requires an API Key");
@@ -183,33 +257,58 @@ class AipIAMClient {
         this.baseUrl = getSafeMasterUrl(masterUrl);
         this.client = axios.create({ baseURL: this.baseUrl });
     }
+
     async loginUser(req, res, credentials) {
         let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
         const forwardedFor = req.headers['x-forwarded-for'];
-        if (forwardedFor) clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
+        
+        if (forwardedFor) {
+            clientIp = Array.isArray(forwardedFor) 
+                ? forwardedFor[0].trim() 
+                : forwardedFor.split(',')[0].trim();
+        }
 
-        const authRes = await this.client.post('/iam/auth', { api_key: this.apiKey, ip: clientIp, ...credentials });
+        const authRes = await this.client.post('/iam/auth', { 
+            api_key: this.apiKey, 
+            ip: clientIp, 
+            ...credentials 
+        });
         
         if (authRes.data.session_token) {
             const isProd = process.env.NODE_ENV === 'production';
+            
             if (typeof res.cookie === 'function') {
-                res.cookie('aip_session', authRes.data.session_token, { httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000 });
+                res.cookie('aip_session', authRes.data.session_token, { 
+                    httpOnly: true, 
+                    secure: isProd, 
+                    sameSite: isProd ? 'none' : 'lax', 
+                    path: '/', 
+                    maxAge: 12 * 60 * 60 * 1000 
+                });
             } else {
                 res.setHeader('Set-Cookie', `aip_session=${authRes.data.session_token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`);
             }
         }
         return authRes.data;
     }
+
     logoutUser(res) {
         const isProd = process.env.NODE_ENV === 'production';
+        
         if (typeof res.clearCookie === 'function') {
-            res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
+            res.clearCookie('aip_session', { 
+                path: '/', 
+                sameSite: isProd ? 'none' : 'lax', 
+                secure: isProd 
+            });
         } else {
             res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
         }
     }
 }
 
+// Attach the clients directly to the Guard export for easy importing
 aipGuard.AipAdminClient = AipAdminClient;
 aipGuard.AipIAMClient = AipIAMClient;
+
 module.exports = aipGuard;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aip-master-node-sumit",
-  "version": "1.0.8",
+  "version": "1.0.11",
   "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
   "main": "index.js",
   "scripts": {