aip-master-node-sumit 1.0.9 → 1.0.12

package/index.js

@@ -10,10 +10,9 @@ const getSafeMasterUrl = (url) => {
     return clean;
 };
 
-// 🛡️ THE FIX: Bulletproof Native Cookie Parser (Handles JWT padding '=')
+// 🛡️ Bulletproof Native Cookie Parser (Handles JWT padding '=')
 const parseRawCookies = (cookieHeader) => {
     if (!cookieHeader) return {};
-
     return cookieHeader.split(';').reduce((acc, cookie) => {
         const index = cookie.indexOf('=');
         if (index < 0) return acc;
@@ -44,37 +43,38 @@ if (API_KEY) {
     setInterval(sendHeartbeat, 5 * 60 * 1000);
 }
 
-const aipGuard = (options = { requireLogin: true }) => {
+// 🛡️ THE FIX: Added manageCors and enableWaf options for total developer control
+const aipGuard = (options = { requireLogin: true, manageCors: false, enableWaf: true }) => {
     return async (req, res, next) => {
         
         // ==========================================
-        // 🛡️ LAYER 0: DYNAMIC CORS & SECURITY HEADERS
+        // 🛡️ LAYER 0: DYNAMIC CORS (Opt-in only!)
         // ==========================================
-        const origin = req.headers.origin || req.headers.Origin;
-        
-        if (origin) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-            res.setHeader('Access-Control-Allow-Credentials', 'true');
-        } else {
-            res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
-        }
-        
-        res.setHeader('X-Frame-Options', 'DENY');
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-
-        // Handle preflight requests gracefully
-        if (req.method === 'OPTIONS') {
-            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-AIP-Token, X-Requested-With, Accept');
-            return res.status(200).end();
+        if (options.manageCors) {
+            const origin = req.headers.origin || req.headers.Origin;
+            
+            if (origin) {
+                res.setHeader('Access-Control-Allow-Origin', origin);
+                res.setHeader('Access-Control-Allow-Credentials', 'true');
+            } else {
+                res.setHeader('Access-Control-Allow-Origin', process.env.AIP_ALLOWED_ORIGIN || '*');
+            }
+            
+            res.setHeader('X-Frame-Options', 'DENY');
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+
+            if (req.method === 'OPTIONS') {
+                res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');
+                res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-AIP-Token, X-Requested-With, Accept');
+                return res.status(200).end();
+            }
         }
 
         // ==========================================
         // 🛡️ LAYER 1: INFRASTRUCTURE SHIELD 
         // ==========================================
         const MAX_PAYLOAD_BYTES = 2 * 1024 * 1024;
-
         if (req.headers['transfer-encoding'] && req.headers['transfer-encoding'].includes('chunked')) {
             return res.status(411).json({ error: "AIP Infrastructure Shield: Chunked encoding rejected." });
         }
@@ -82,92 +82,47 @@ const aipGuard = (options = { requireLogin: true }) => {
             return res.status(413).json({ error: "AIP Infrastructure Shield: Payload Too Large." });
         }
 
-        // 🛡️ THE FIX: Smart Cookie Extraction & Removed Vulnerable Query Tokens
-        const cookies = req.cookies || parseRawCookies(req.headers.cookie);
-        let token = cookies.aip_session;
-
-        if (!token && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
+        // ==========================================
+        // 🛡️ TOKEN EXTRACTION
+        // ==========================================
+        let token = null;
+        if (req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) {
             token = req.headers.authorization.split(' ')[1];
-        } else if (!token && req.headers['x-aip-token']) {
+        } else if (req.headers['x-aip-token']) {
             token = req.headers['x-aip-token'];
+        } else {
+            const cookies = req.cookies || parseRawCookies(req.headers.cookie);
+            token = cookies.aip_session;
         }
 
-        // ==========================================
-        // 🛡️ LAYER 2: IDENTITY CHECK & RBAC
-        // ==========================================
-        if (options.requireLogin) {
-            if (!token) {
-                return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
-            }
-
-            try {
-                const currentAction = req.method + " " + (req.baseUrl + req.path);
-                
-                const authRes = await axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
-                    { session_token: token, action: currentAction }, 
-                    { headers: { 'Authorization': `Bearer ${API_KEY}` } }
-                );
-
-                req.user = authRes.data.user; 
-
-                // 🛡️ THE FIX: Native Node.js Fallback for Set-Cookie (Framework Agnostic)
-                const isProd = process.env.NODE_ENV === 'production';
-                
-                if (typeof res.cookie === 'function') {
-                    // Express.js environment
-                    res.cookie('aip_session', token, { 
-                        httpOnly: true, 
-                        secure: isProd, 
-                        sameSite: isProd ? 'none' : 'lax', 
-                        path: '/', 
-                        maxAge: 12 * 60 * 60 * 1000
-                    });
-                } else {
-                    // Raw Node.js or alternate framework environment
-                    const cookieStr = `aip_session=${token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`;
-                    res.setHeader('Set-Cookie', cookieStr);
-                }
-
-            } catch (error) {
-                const status = error.response?.status || 500;
-                const errMsg = error.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
-                const isProd = process.env.NODE_ENV === 'production';
-
-                if (status === 401) {
-                    if (typeof res.clearCookie === 'function') {
-                        res.clearCookie('aip_session', { 
-                            path: '/', 
-                            sameSite: isProd ? 'none' : 'lax', 
-                            secure: isProd 
-                        });
-                    } else {
-                        res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
-                    }
-                }
-                
-                return res.status(status === 401 ? 401 : 403).json({ error: errMsg });
-            }
+        if (options.requireLogin && !token) {
+            return res.status(401).json({ error: "Unauthorized: Missing AIP Session Token" });
         }
 
         // ==========================================
-        // 🛡️ LAYER 3: WAF THREAT SCAN
+        // 🛡️ THE FIX: PARALLEL LAYER 2 (IAM) & LAYER 3 (WAF)
+        // Cuts latency entirely in half!
         // ==========================================
-        try {
-            const payloadData = JSON.stringify({ 
-                body: req.body || {}, 
-                query: req.query || {} 
-            });
-            
+        let authPromise = null;
+        let wafPromise = null;
+
+        if (options.requireLogin && token) {
+            const currentAction = req.method + " " + (req.baseUrl + req.path);
+            authPromise = axios.post(`${AIP_MASTER_API}/iam/verify-session`, 
+                { session_token: token, action: currentAction }, 
+                { headers: { 'Authorization': `Bearer ${API_KEY}` } }
+            );
+        }
+
+        if (options.enableWaf !== false) {
+            const payloadData = JSON.stringify({ body: req.body || {}, query: req.query || {} });
             const forwardedFor = req.headers['x-forwarded-for'];
             let clientIp = req.ip || (req.connection && req.connection.remoteAddress) || "0.0.0.0";
-            
             if (forwardedFor) {
-                clientIp = Array.isArray(forwardedFor) 
-                    ? forwardedFor[0].trim() 
-                    : forwardedFor.split(',')[0].trim();
+                clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
             }
 
-            const wafRes = await axios.post(`${AIP_MASTER_API}/verify`, {
+            wafPromise = axios.post(`${AIP_MASTER_API}/verify`, {
                 api_key: API_KEY, 
                 ip: clientIp, 
                 method: req.method, 
@@ -177,13 +132,58 @@ const aipGuard = (options = { requireLogin: true }) => {
                 user_agent: req.headers['user-agent'] || "",
                 session_token: token || "" 
             });
+        }
 
-            if (wafRes.data.action === "block") {
-                return res.status(403).json({ error: `AIP Firewall Blocked Request: ${wafRes.data.reason}` });
+        try {
+            // Execute both promises at the exact same time
+            const [authOutcome, wafOutcome] = await Promise.allSettled([
+                authPromise || Promise.resolve(null),
+                wafPromise || Promise.resolve(null)
+            ]);
+
+            // Handle Identity Rejections (401s)
+            if (options.requireLogin && authOutcome.status === 'rejected') {
+                const status = authOutcome.reason.response?.status || 500;
+                const errMsg = authOutcome.reason.response?.data?.error || "AIP Identity Blocked: Invalid Token.";
+                const isProd = process.env.NODE_ENV === 'production';
+                
+                if (status === 401) {
+                    if (typeof res.clearCookie === 'function') {
+                        res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
+                    } else {
+                        res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
+                    }
+                }
+                return res.status(status === 401 ? 401 : 403).json({ error: errMsg });
+            }
+
+            // Bind User Data to Request if successful
+            if (authOutcome.status === 'fulfilled' && authOutcome.value) {
+                req.user = authOutcome.value.data.user;
+                
+                // Refresh Cookie
+                const isProd = process.env.NODE_ENV === 'production';
+                if (typeof res.cookie === 'function') {
+                    res.cookie('aip_session', token, { 
+                        httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000
+                    });
+                } else {
+                    res.setHeader('Set-Cookie', `aip_session=${token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`);
+                }
+            }
+
+            // Handle WAF Blocks (400, 403, 500s)
+            if (options.enableWaf !== false) {
+                if (wafOutcome.status === 'rejected') {
+                    return res.status(500).json({ error: "Security verification failed to connect to AIP Master." });
+                }
+                if (wafOutcome.status === 'fulfilled' && wafOutcome.value && wafOutcome.value.data.action === "block") {
+                    return res.status(403).json({ error: `AIP Firewall Blocked Request: ${wafOutcome.value.data.reason}` });
+                }
             }
 
         } catch (error) {
-            return res.status(500).json({ error: "Security verification failed." });
+            return res.status(500).json({ error: "Critical internal security failure." });
         }
         
         next(); 
@@ -205,37 +205,37 @@ class AipAdminClient {
     }
 
     async getUsers() { 
-        const res = await this.client.get('/sdk/admin/users'); 
+        const res = await this.client.get('/sdk/admin/users');
         return res.data; 
     }
 
     async createUser(data) { 
-        const res = await this.client.post('/sdk/admin/users', data); 
+        const res = await this.client.post('/sdk/admin/users', data);
         return res.data; 
     }
 
     async updateUser(userId, data) { 
-        const res = await this.client.put(`/sdk/admin/users/${userId}`, data); 
+        const res = await this.client.put(`/sdk/admin/users/${userId}`, data);
         return res.data; 
     }
 
     async updateRBAC(userId, permissions) { 
-        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions }); 
+        const res = await this.client.put(`/sdk/admin/users/${userId}/rbac`, { permissions });
         return res.data; 
     }
 
     async deleteUser(userId) { 
-        const res = await this.client.delete(`/sdk/admin/users/${userId}`); 
+        const res = await this.client.delete(`/sdk/admin/users/${userId}`);
         return res.data; 
     }
 
     async getRoles() { 
-        const res = await this.client.get('/sdk/admin/roles'); 
+        const res = await this.client.get('/sdk/admin/roles');
         return res.data; 
     }
 
     async createRole(data) { 
-        const res = await this.client.post('/sdk/admin/roles', data); 
+        const res = await this.client.post('/sdk/admin/roles', data);
         return res.data; 
     }
 }
@@ -256,9 +256,7 @@ class AipIAMClient {
         const forwardedFor = req.headers['x-forwarded-for'];
         
         if (forwardedFor) {
-            clientIp = Array.isArray(forwardedFor) 
-                ? forwardedFor[0].trim() 
-                : forwardedFor.split(',')[0].trim();
+            clientIp = Array.isArray(forwardedFor) ? forwardedFor[0].trim() : forwardedFor.split(',')[0].trim();
         }
 
         const authRes = await this.client.post('/iam/auth', { 
@@ -266,17 +264,12 @@ class AipIAMClient {
             ip: clientIp, 
             ...credentials 
         });
-        
+
         if (authRes.data.session_token) {
             const isProd = process.env.NODE_ENV === 'production';
-            
             if (typeof res.cookie === 'function') {
                 res.cookie('aip_session', authRes.data.session_token, { 
-                    httpOnly: true, 
-                    secure: isProd, 
-                    sameSite: isProd ? 'none' : 'lax', 
-                    path: '/', 
-                    maxAge: 12 * 60 * 60 * 1000 
+                    httpOnly: true, secure: isProd, sameSite: isProd ? 'none' : 'lax', path: '/', maxAge: 12 * 60 * 60 * 1000 
                 });
             } else {
                 res.setHeader('Set-Cookie', `aip_session=${authRes.data.session_token}; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=43200`);
@@ -285,15 +278,20 @@ class AipIAMClient {
         return authRes.data;
     }
 
+    // 🛡️ THE FIX: Solves the 404 error! Developers can now cleanly verify a token manually.
+    async verifyToken(token) {
+        if (!token) throw new Error("Token is required");
+        const res = await this.client.post('/iam/verify-session', 
+            { session_token: token }, 
+            { headers: { 'Authorization': `Bearer ${this.apiKey}` } }
+        );
+        return res.data;
+    }
+
     logoutUser(res) {
         const isProd = process.env.NODE_ENV === 'production';
-        
         if (typeof res.clearCookie === 'function') {
-            res.clearCookie('aip_session', { 
-                path: '/', 
-                sameSite: isProd ? 'none' : 'lax', 
-                secure: isProd 
-            });
+            res.clearCookie('aip_session', { path: '/', sameSite: isProd ? 'none' : 'lax', secure: isProd });
         } else {
             res.setHeader('Set-Cookie', `aip_session=; HttpOnly; ${isProd ? 'Secure; SameSite=None' : 'SameSite=Lax'}; Path=/; Max-Age=0`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aip-master-node-sumit",
-  "version": "1.0.9",
+  "version": "1.0.12",
   "description": "Enterprise-grade WAF and IAM security middleware for Node.js.",
   "main": "index.js",
   "scripts": {