archicore 0.1.9 → 0.2.1

package/dist/server/services/audit-service.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Audit Log Service for ArchiCore
+ *
+ * Logs user actions for security and compliance purposes
+ * Supports PostgreSQL (primary) with JSON file fallback
+ */
+export type AuditAction = 'auth.login' | 'auth.logout' | 'auth.register' | 'auth.password_change' | 'auth.device_login' | 'user.update' | 'user.tier_change' | 'user.delete' | 'project.create' | 'project.delete' | 'project.analyze' | 'project.simulate' | 'project.ask' | 'project.docs' | 'github.connect' | 'github.disconnect' | 'github.repo_connect' | 'github.repo_disconnect' | 'github.webhook_received' | 'api.key_create' | 'api.key_revoke' | 'api.request' | 'admin.login' | 'admin.user_update' | 'admin.user_delete' | 'admin.tier_change' | 'admin.view_logs';
+export type AuditSeverity = 'info' | 'warning' | 'critical';
+export interface AuditLogEntry {
+    id: string;
+    timestamp: Date;
+    userId?: string;
+    username?: string;
+    action: AuditAction;
+    severity: AuditSeverity;
+    ip?: string;
+    userAgent?: string;
+    details?: Record<string, any>;
+    success: boolean;
+    errorMessage?: string;
+}
+export interface AuditLogQuery {
+    userId?: string;
+    action?: AuditAction;
+    severity?: AuditSeverity;
+    startDate?: Date;
+    endDate?: Date;
+    success?: boolean;
+    limit?: number;
+    offset?: number;
+}
+export declare class AuditService {
+    private dataDir;
+    private logs;
+    private jsonInitialized;
+    private saveTimeout;
+    constructor(dataDir?: string);
+    private useDatabase;
+    private ensureJsonInitialized;
+    private saveJson;
+    private generateId;
+    private getSeverity;
+    private rowToEntry;
+    /**
+     * Log an action
+     */
+    log(params: {
+        userId?: string;
+        username?: string;
+        action: AuditAction;
+        ip?: string;
+        userAgent?: string;
+        details?: Record<string, any>;
+        success?: boolean;
+        errorMessage?: string;
+    }): Promise<AuditLogEntry>;
+    /**
+     * Query audit logs
+     */
+    query(params?: AuditLogQuery): Promise<{
+        logs: AuditLogEntry[];
+        total: number;
+    }>;
+    /**
+     * Get recent logs for a user
+     */
+    getUserLogs(userId: string, limit?: number): Promise<AuditLogEntry[]>;
+    /**
+     * Get failed login attempts for an IP
+     */
+    getFailedLogins(ip: string, since: Date): Promise<number>;
+    /**
+     * Get statistics
+     */
+    getStats(days?: number): Promise<{
+        totalActions: number;
+        uniqueUsers: number;
+        failedLogins: number;
+        criticalEvents: number;
+        actionCounts: Record<string, number>;
+    }>;
+    /**
+     * Clear old logs (retention policy)
+     */
+    cleanup(retentionDays?: number): Promise<number>;
+}
+export declare const auditService: AuditService;
+//# sourceMappingURL=audit-service.d.ts.map

package/dist/server/services/audit-service.js

@@ -0,0 +1,380 @@
+/**
+ * Audit Log Service for ArchiCore
+ *
+ * Logs user actions for security and compliance purposes
+ * Supports PostgreSQL (primary) with JSON file fallback
+ */
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { join } from 'path';
+import { Logger } from '../../utils/logger.js';
+import { db } from './database.js';
+const DATA_DIR = '.archicore';
+const AUDIT_FILE = 'audit-logs.json';
+const MAX_LOGS_IN_MEMORY = 10000;
+const MAX_LOGS_IN_FILE = 100000;
+// Singleton instance
+let instance = null;
+export class AuditService {
+    dataDir = DATA_DIR;
+    // JSON fallback
+    logs = [];
+    jsonInitialized = false;
+    saveTimeout = null;
+    constructor(dataDir = DATA_DIR) {
+        if (instance) {
+            return instance;
+        }
+        this.dataDir = dataDir;
+        instance = this;
+    }
+    useDatabase() {
+        return db.isAvailable();
+    }
+    // ========== JSON FALLBACK METHODS ==========
+    async ensureJsonInitialized() {
+        if (this.jsonInitialized)
+            return;
+        try {
+            await mkdir(this.dataDir, { recursive: true });
+        }
+        catch { }
+        try {
+            const path = join(this.dataDir, AUDIT_FILE);
+            const data = await readFile(path, 'utf-8');
+            const parsed = JSON.parse(data);
+            this.logs = parsed.logs.map(log => ({
+                ...log,
+                timestamp: new Date(log.timestamp)
+            }));
+        }
+        catch {
+            this.logs = [];
+        }
+        this.jsonInitialized = true;
+    }
+    async saveJson() {
+        if (this.saveTimeout) {
+            clearTimeout(this.saveTimeout);
+        }
+        this.saveTimeout = setTimeout(async () => {
+            try {
+                const path = join(this.dataDir, AUDIT_FILE);
+                if (this.logs.length > MAX_LOGS_IN_FILE) {
+                    this.logs = this.logs.slice(-MAX_LOGS_IN_FILE);
+                }
+                const data = {
+                    logs: this.logs,
+                    lastRotation: new Date()
+                };
+                await writeFile(path, JSON.stringify(data, null, 2));
+            }
+            catch (error) {
+                Logger.error('Failed to save audit logs:', error);
+            }
+        }, 1000);
+    }
+    // ========== HELPER METHODS ==========
+    generateId() {
+        return 'audit_' + Date.now().toString(36) + '_' + Math.random().toString(36).substr(2, 9);
+    }
+    getSeverity(action, success) {
+        if (action.startsWith('admin.') ||
+            action === 'auth.password_change' ||
+            action === 'user.delete' ||
+            action === 'api.key_revoke') {
+            return success ? 'warning' : 'critical';
+        }
+        if ((action === 'auth.login' && !success) ||
+            action === 'auth.register' ||
+            action === 'project.delete' ||
+            action === 'github.disconnect') {
+            return 'warning';
+        }
+        return 'info';
+    }
+    rowToEntry(row) {
+        return {
+            id: row.id,
+            timestamp: row.created_at,
+            userId: row.user_id || undefined,
+            username: row.username || undefined,
+            action: row.action,
+            severity: row.severity,
+            ip: row.ip || undefined,
+            userAgent: row.user_agent || undefined,
+            details: row.details || undefined,
+            success: row.success,
+            errorMessage: row.error_message || undefined
+        };
+    }
+    // ========== PUBLIC API ==========
+    /**
+     * Log an action
+     */
+    async log(params) {
+        const success = params.success !== false;
+        const id = this.generateId();
+        const severity = this.getSeverity(params.action, success);
+        if (this.useDatabase()) {
+            try {
+                await db.query(`INSERT INTO audit_logs (id, user_id, username, action, severity, ip, user_agent, details, success, error_message)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`, [
+                    id,
+                    params.userId || null,
+                    params.username || null,
+                    params.action,
+                    severity,
+                    params.ip || null,
+                    params.userAgent || null,
+                    params.details ? JSON.stringify(params.details) : null,
+                    success,
+                    params.errorMessage || null
+                ]);
+                const entry = {
+                    id,
+                    timestamp: new Date(),
+                    userId: params.userId,
+                    username: params.username,
+                    action: params.action,
+                    severity,
+                    ip: params.ip,
+                    userAgent: params.userAgent,
+                    details: params.details,
+                    success,
+                    errorMessage: params.errorMessage
+                };
+                if (entry.severity === 'critical') {
+                    Logger.warn(`[AUDIT] Critical event: ${entry.action} by ${entry.username || entry.userId || 'unknown'}`);
+                }
+                return entry;
+            }
+            catch (error) {
+                Logger.error('Audit log error:', error);
+                // Fall through to JSON fallback
+            }
+        }
+        // JSON fallback
+        await this.ensureJsonInitialized();
+        const entry = {
+            id,
+            timestamp: new Date(),
+            userId: params.userId,
+            username: params.username,
+            action: params.action,
+            severity,
+            ip: params.ip,
+            userAgent: params.userAgent,
+            details: params.details,
+            success,
+            errorMessage: params.errorMessage
+        };
+        this.logs.push(entry);
+        if (this.logs.length > MAX_LOGS_IN_MEMORY) {
+            this.logs = this.logs.slice(-MAX_LOGS_IN_MEMORY);
+        }
+        await this.saveJson();
+        if (entry.severity === 'critical') {
+            Logger.warn(`[AUDIT] Critical event: ${entry.action} by ${entry.username || entry.userId || 'unknown'}`);
+        }
+        return entry;
+    }
+    /**
+     * Query audit logs
+     */
+    async query(params = {}) {
+        if (this.useDatabase()) {
+            try {
+                const conditions = ['1=1'];
+                const values = [];
+                let paramIndex = 1;
+                if (params.userId) {
+                    conditions.push(`user_id = $${paramIndex++}`);
+                    values.push(params.userId);
+                }
+                if (params.action) {
+                    conditions.push(`action = $${paramIndex++}`);
+                    values.push(params.action);
+                }
+                if (params.severity) {
+                    conditions.push(`severity = $${paramIndex++}`);
+                    values.push(params.severity);
+                }
+                if (params.success !== undefined) {
+                    conditions.push(`success = $${paramIndex++}`);
+                    values.push(params.success);
+                }
+                if (params.startDate) {
+                    conditions.push(`created_at >= $${paramIndex++}`);
+                    values.push(params.startDate);
+                }
+                if (params.endDate) {
+                    conditions.push(`created_at <= $${paramIndex++}`);
+                    values.push(params.endDate);
+                }
+                const whereClause = conditions.join(' AND ');
+                // Get total count
+                const countResult = await db.query(`SELECT COUNT(*) as count FROM audit_logs WHERE ${whereClause}`, values);
+                const total = parseInt(countResult.rows[0].count, 10);
+                // Get paginated results
+                const limit = params.limit || 50;
+                const offset = params.offset || 0;
+                const result = await db.query(`SELECT * FROM audit_logs WHERE ${whereClause} ORDER BY created_at DESC LIMIT $${paramIndex++} OFFSET $${paramIndex++}`, [...values, limit, offset]);
+                return {
+                    logs: result.rows.map(row => this.rowToEntry(row)),
+                    total
+                };
+            }
+            catch (error) {
+                Logger.error('Audit query error:', error);
+                return { logs: [], total: 0 };
+            }
+        }
+        // JSON fallback
+        await this.ensureJsonInitialized();
+        let filtered = [...this.logs];
+        if (params.userId) {
+            filtered = filtered.filter(log => log.userId === params.userId);
+        }
+        if (params.action) {
+            filtered = filtered.filter(log => log.action === params.action);
+        }
+        if (params.severity) {
+            filtered = filtered.filter(log => log.severity === params.severity);
+        }
+        if (params.success !== undefined) {
+            filtered = filtered.filter(log => log.success === params.success);
+        }
+        if (params.startDate) {
+            filtered = filtered.filter(log => log.timestamp >= params.startDate);
+        }
+        if (params.endDate) {
+            filtered = filtered.filter(log => log.timestamp <= params.endDate);
+        }
+        filtered.sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+        const total = filtered.length;
+        const offset = params.offset || 0;
+        const limit = params.limit || 50;
+        filtered = filtered.slice(offset, offset + limit);
+        return { logs: filtered, total };
+    }
+    /**
+     * Get recent logs for a user
+     */
+    async getUserLogs(userId, limit = 20) {
+        const result = await this.query({ userId, limit });
+        return result.logs;
+    }
+    /**
+     * Get failed login attempts for an IP
+     */
+    async getFailedLogins(ip, since) {
+        if (this.useDatabase()) {
+            try {
+                const result = await db.query(`SELECT COUNT(*) as count FROM audit_logs WHERE action = $1 AND success = false AND ip = $2 AND created_at >= $3`, ['auth.login', ip, since]);
+                return parseInt(result.rows[0].count, 10);
+            }
+            catch (error) {
+                Logger.error('Failed logins query error:', error);
+                return 0;
+            }
+        }
+        await this.ensureJsonInitialized();
+        return this.logs.filter(log => log.action === 'auth.login' &&
+            !log.success &&
+            log.ip === ip &&
+            log.timestamp >= since).length;
+    }
+    /**
+     * Get statistics
+     */
+    async getStats(days = 7) {
+        const since = new Date(Date.now() - days * 24 * 60 * 60 * 1000);
+        if (this.useDatabase()) {
+            try {
+                // Total actions
+                const totalResult = await db.query('SELECT COUNT(*) as count FROM audit_logs WHERE created_at >= $1', [since]);
+                const totalActions = parseInt(totalResult.rows[0].count, 10);
+                // Unique users
+                const usersResult = await db.query('SELECT COUNT(DISTINCT user_id) as count FROM audit_logs WHERE created_at >= $1 AND user_id IS NOT NULL', [since]);
+                const uniqueUsers = parseInt(usersResult.rows[0].count, 10);
+                // Failed logins
+                const failedResult = await db.query(`SELECT COUNT(*) as count FROM audit_logs WHERE action = 'auth.login' AND success = false AND created_at >= $1`, [since]);
+                const failedLogins = parseInt(failedResult.rows[0].count, 10);
+                // Critical events
+                const criticalResult = await db.query(`SELECT COUNT(*) as count FROM audit_logs WHERE severity = 'critical' AND created_at >= $1`, [since]);
+                const criticalEvents = parseInt(criticalResult.rows[0].count, 10);
+                // Action counts
+                const actionResult = await db.query('SELECT action, COUNT(*) as count FROM audit_logs WHERE created_at >= $1 GROUP BY action', [since]);
+                const actionCounts = {};
+                for (const row of actionResult.rows) {
+                    actionCounts[row.action] = parseInt(row.count, 10);
+                }
+                return {
+                    totalActions,
+                    uniqueUsers,
+                    failedLogins,
+                    criticalEvents,
+                    actionCounts
+                };
+            }
+            catch (error) {
+                Logger.error('Audit stats error:', error);
+                return {
+                    totalActions: 0,
+                    uniqueUsers: 0,
+                    failedLogins: 0,
+                    criticalEvents: 0,
+                    actionCounts: {}
+                };
+            }
+        }
+        // JSON fallback
+        await this.ensureJsonInitialized();
+        const recentLogs = this.logs.filter(log => log.timestamp >= since);
+        const uniqueUsers = new Set(recentLogs.map(log => log.userId).filter(Boolean));
+        const actionCounts = {};
+        for (const log of recentLogs) {
+            actionCounts[log.action] = (actionCounts[log.action] || 0) + 1;
+        }
+        return {
+            totalActions: recentLogs.length,
+            uniqueUsers: uniqueUsers.size,
+            failedLogins: recentLogs.filter(log => log.action === 'auth.login' && !log.success).length,
+            criticalEvents: recentLogs.filter(log => log.severity === 'critical').length,
+            actionCounts
+        };
+    }
+    /**
+     * Clear old logs (retention policy)
+     */
+    async cleanup(retentionDays = 90) {
+        const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+        if (this.useDatabase()) {
+            try {
+                const result = await db.query('DELETE FROM audit_logs WHERE created_at < $1', [cutoff]);
+                const removed = result.rowCount ?? 0;
+                if (removed > 0) {
+                    Logger.info(`Audit logs cleanup: removed ${removed} old entries`);
+                }
+                return removed;
+            }
+            catch (error) {
+                Logger.error('Audit cleanup error:', error);
+                return 0;
+            }
+        }
+        // JSON fallback
+        await this.ensureJsonInitialized();
+        const before = this.logs.length;
+        this.logs = this.logs.filter(log => log.timestamp >= cutoff);
+        const removed = before - this.logs.length;
+        if (removed > 0) {
+            await this.saveJson();
+            Logger.info(`Audit logs cleanup: removed ${removed} old entries`);
+        }
+        return removed;
+    }
+}
+// Export singleton instance
+export const auditService = new AuditService();
+//# sourceMappingURL=audit-service.js.map

package/dist/server/services/auth-service.d.ts

@@ -1,5 +1,7 @@
 /**
  * Authentication Service for ArchiCore
+ *
+ * Supports PostgreSQL (primary) with JSON file fallback
  */
 import { User, SubscriptionTier, AuthResponse } from '../../types/user.js';
 export declare class AuthService {
@@ -7,13 +9,11 @@ export declare class AuthService {
     private dataDir;
     private users;
     private sessions;
-    private initialized;
+    private jsonInitialized;
     constructor(dataDir?: string);
-    /**
-     * Get singleton instance of AuthService
-     */
     static getInstance(): AuthService;
-    private ensureInitialized;
+    private useDatabase;
+    private ensureJsonInitialized;
     private createDefaultAdmin;
     private saveUsers;
     private saveSessions;
@@ -21,6 +21,8 @@ export declare class AuthService {
     private createEmptyUsage;
     private generateToken;
     private sanitizeUser;
+    private rowToUser;
+    private dbCreateDefaultAdmin;
     register(email: string, username: string, password: string): Promise<AuthResponse>;
     login(email: string, password: string): Promise<AuthResponse>;
     oauthLogin(provider: 'github' | 'google', profile: {
@@ -41,5 +43,9 @@ export declare class AuthService {
     getAllUsers(): Promise<Omit<User, 'passwordHash'>[]>;
     deleteUser(userId: string): Promise<boolean>;
     updateUser(userId: string, updates: Partial<Pick<User, 'username' | 'email' | 'avatar'>>): Promise<boolean>;
+    /**
+     * Initialize database and create default admin if needed
+     */
+    initDatabase(): Promise<void>;
 }
 //# sourceMappingURL=auth-service.d.ts.map