chrome-cdp-cli 1.5.0 → 1.6.0

package/dist/proxy/server/FileSystemSecurity.js

@@ -0,0 +1,358 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSystemSecurity = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const logger_1 = require("../../utils/logger");
+class FileSystemSecurity {
+    constructor(config) {
+        this.logger = (0, logger_1.createLogger)({ component: 'FileSystemSecurity' });
+        const homeDir = os.homedir();
+        const configDir = path.join(homeDir, '.chrome-cdp-cli');
+        this.config = {
+            allowedDirectories: [
+                configDir,
+                path.join(configDir, 'logs'),
+                path.join(configDir, 'config'),
+                '/tmp',
+                os.tmpdir()
+            ],
+            configDirectory: configDir,
+            logDirectory: path.join(configDir, 'logs'),
+            enablePermissionChecks: true,
+            enableDataSanitization: true,
+            maxFileSize: 100 * 1024 * 1024,
+            ...config
+        };
+        this.allowedPaths = new Set();
+        this.initializeAllowedPaths();
+        this.ensureDirectoriesExist();
+        this.logger.info('File system security initialized', {
+            config: this.sanitizeConfigForLogging(this.config)
+        });
+    }
+    initializeAllowedPaths() {
+        for (const dir of this.config.allowedDirectories) {
+            try {
+                const resolvedPath = path.resolve(dir);
+                this.allowedPaths.add(resolvedPath);
+                this.allowedPaths.add(path.join(resolvedPath, 'proxy'));
+                this.allowedPaths.add(path.join(resolvedPath, 'temp'));
+            }
+            catch (error) {
+                this.logger.warn(`Failed to resolve allowed directory: ${dir}`, { error });
+            }
+        }
+    }
+    ensureDirectoriesExist() {
+        const requiredDirs = [
+            this.config.configDirectory,
+            this.config.logDirectory
+        ];
+        for (const dir of requiredDirs) {
+            try {
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+                    this.logger.info(`Created directory with secure permissions: ${dir}`);
+                }
+                else {
+                    this.checkAndFixDirectoryPermissions(dir);
+                }
+            }
+            catch (error) {
+                this.logger.error(`Failed to create/secure directory: ${dir}`, error);
+            }
+        }
+    }
+    isPathAllowed(filePath) {
+        try {
+            const resolvedPath = path.resolve(filePath);
+            const normalizedPath = path.normalize(resolvedPath);
+            for (const allowedPath of this.allowedPaths) {
+                if (normalizedPath.startsWith(allowedPath)) {
+                    return true;
+                }
+            }
+            this.logger.logSecurityEvent('unauthorized_path_access', 'Attempted access to unauthorized path', {
+                requestedPath: filePath,
+                resolvedPath,
+                allowedPaths: Array.from(this.allowedPaths)
+            });
+            return false;
+        }
+        catch (error) {
+            this.logger.logSecurityEvent('path_validation_error', 'Error validating file path', {
+                requestedPath: filePath,
+                error: error.message
+            });
+            return false;
+        }
+    }
+    async readFileSecurely(filePath) {
+        if (!this.isPathAllowed(filePath)) {
+            throw new Error(`Access denied: Path not allowed - ${filePath}`);
+        }
+        try {
+            const stats = await fs.promises.stat(filePath);
+            if (stats.size > this.config.maxFileSize) {
+                throw new Error(`File too large: ${stats.size} bytes (max: ${this.config.maxFileSize})`);
+            }
+            const content = await fs.promises.readFile(filePath, 'utf8');
+            this.logger.debug('Secure file read completed', {
+                filePath: this.sanitizePath(filePath),
+                fileSize: stats.size
+            });
+            return this.config.enableDataSanitization ? this.sanitizeFileContent(content) : content;
+        }
+        catch (error) {
+            this.logger.logSecurityEvent('file_read_error', 'Secure file read failed', {
+                filePath: this.sanitizePath(filePath),
+                error: error.message
+            });
+            throw error;
+        }
+    }
+    async writeFileSecurely(filePath, content) {
+        if (!this.isPathAllowed(filePath)) {
+            throw new Error(`Access denied: Path not allowed - ${filePath}`);
+        }
+        try {
+            const sanitizedContent = this.config.enableDataSanitization
+                ? this.sanitizeFileContent(content)
+                : content;
+            const contentSize = Buffer.byteLength(sanitizedContent, 'utf8');
+            if (contentSize > this.config.maxFileSize) {
+                throw new Error(`Content too large: ${contentSize} bytes (max: ${this.config.maxFileSize})`);
+            }
+            const dir = path.dirname(filePath);
+            if (!fs.existsSync(dir)) {
+                await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+            }
+            await fs.promises.writeFile(filePath, sanitizedContent, {
+                encoding: 'utf8',
+                mode: 0o600
+            });
+            this.logger.debug('Secure file write completed', {
+                filePath: this.sanitizePath(filePath),
+                contentSize
+            });
+        }
+        catch (error) {
+            this.logger.logSecurityEvent('file_write_error', 'Secure file write failed', {
+                filePath: this.sanitizePath(filePath),
+                error: error.message
+            });
+            throw error;
+        }
+    }
+    async checkConfigurationSecurity(configPath) {
+        const issues = [];
+        const recommendations = [];
+        try {
+            if (!this.isPathAllowed(configPath)) {
+                issues.push('Configuration file is not in an allowed directory');
+                recommendations.push(`Move configuration to: ${this.config.configDirectory}`);
+                return { isSecure: false, issues, recommendations };
+            }
+            if (!fs.existsSync(configPath)) {
+                issues.push('Configuration file does not exist');
+                recommendations.push('Create configuration file with secure permissions');
+                return { isSecure: false, issues, recommendations };
+            }
+            const stats = await fs.promises.stat(configPath);
+            const mode = stats.mode & parseInt('777', 8);
+            if (mode > parseInt('644', 8)) {
+                issues.push(`Configuration file has overly permissive permissions: ${mode.toString(8)}`);
+                recommendations.push('Set file permissions to 600 (owner read/write only)');
+            }
+            if (mode & parseInt('004', 8)) {
+                issues.push('Configuration file is world-readable');
+                recommendations.push('Remove world-read permissions');
+            }
+            if (mode & parseInt('020', 8)) {
+                issues.push('Configuration file is group-writable');
+                recommendations.push('Remove group-write permissions');
+            }
+            if (stats.size > 1024 * 1024) {
+                issues.push('Configuration file is unusually large');
+                recommendations.push('Review configuration file for unnecessary content');
+            }
+            if (process.getuid && process.getuid() !== 0) {
+                const uid = process.getuid();
+                if (stats.uid !== uid) {
+                    issues.push('Configuration file is not owned by current user');
+                    recommendations.push('Change file ownership to current user');
+                }
+            }
+            const isSecure = issues.length === 0;
+            this.logger.info('Configuration security check completed', {
+                configPath: this.sanitizePath(configPath),
+                isSecure,
+                issueCount: issues.length
+            });
+            return { isSecure, issues, recommendations };
+        }
+        catch (error) {
+            this.logger.logSecurityEvent('config_security_check_error', 'Configuration security check failed', {
+                configPath: this.sanitizePath(configPath),
+                error: error.message
+            });
+            issues.push(`Security check failed: ${error.message}`);
+            return { isSecure: false, issues, recommendations };
+        }
+    }
+    async fixConfigurationPermissions(configPath) {
+        if (!this.isPathAllowed(configPath)) {
+            throw new Error(`Access denied: Path not allowed - ${configPath}`);
+        }
+        try {
+            await fs.promises.chmod(configPath, 0o600);
+            this.logger.info('Configuration file permissions fixed', {
+                configPath: this.sanitizePath(configPath),
+                newPermissions: '600'
+            });
+        }
+        catch (error) {
+            this.logger.logSecurityEvent('permission_fix_error', 'Failed to fix configuration permissions', {
+                configPath: this.sanitizePath(configPath),
+                error: error.message
+            });
+            throw error;
+        }
+    }
+    sanitizeFileContent(content) {
+        let sanitized = content;
+        const sensitivePatterns = [
+            /['"](api[_-]?key|token|secret|password)['"]\s*:\s*['"][^'"]+['"]/gi,
+            /https?:\/\/[^:]+:[^@]+@[^\s]+/gi,
+            /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(RSA\s+)?PRIVATE\s+KEY-----/gi,
+            /eyJ[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*/g,
+            /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,
+            /\b\d{3}-\d{2}-\d{4}\b/g
+        ];
+        for (const pattern of sensitivePatterns) {
+            sanitized = sanitized.replace(pattern, (match) => {
+                this.logger.logSecurityEvent('sensitive_data_sanitized', 'Sensitive data pattern detected and sanitized', {
+                    patternLength: match.length,
+                    patternStart: match.substring(0, 10) + '...'
+                });
+                return '[REDACTED]';
+            });
+        }
+        return sanitized;
+    }
+    sanitizePath(filePath) {
+        const homeDir = os.homedir();
+        return filePath.replace(homeDir, '~');
+    }
+    sanitizeConfigForLogging(config) {
+        return {
+            ...config,
+            allowedDirectories: config.allowedDirectories.map(dir => this.sanitizePath(dir)),
+            configDirectory: this.sanitizePath(config.configDirectory),
+            logDirectory: this.sanitizePath(config.logDirectory)
+        };
+    }
+    checkAndFixDirectoryPermissions(dirPath) {
+        try {
+            const stats = fs.statSync(dirPath);
+            const mode = stats.mode & parseInt('777', 8);
+            if (mode !== parseInt('700', 8)) {
+                fs.chmodSync(dirPath, 0o700);
+                this.logger.info('Fixed directory permissions', {
+                    directory: this.sanitizePath(dirPath),
+                    oldMode: mode.toString(8),
+                    newMode: '700'
+                });
+            }
+        }
+        catch (error) {
+            this.logger.warn('Failed to check/fix directory permissions', {
+                directory: this.sanitizePath(dirPath),
+                error: error.message
+            });
+        }
+    }
+    getConfig() {
+        return { ...this.config };
+    }
+    updateConfig(newConfig) {
+        this.config = { ...this.config, ...newConfig };
+        this.allowedPaths.clear();
+        this.initializeAllowedPaths();
+        this.ensureDirectoriesExist();
+        this.logger.info('File system security configuration updated', {
+            config: this.sanitizeConfigForLogging(this.config)
+        });
+    }
+    addAllowedDirectory(directory) {
+        try {
+            const resolvedPath = path.resolve(directory);
+            this.allowedPaths.add(resolvedPath);
+            this.config.allowedDirectories.push(directory);
+            this.logger.info('Added allowed directory', {
+                directory: this.sanitizePath(directory),
+                resolvedPath: this.sanitizePath(resolvedPath)
+            });
+        }
+        catch (error) {
+            this.logger.error('Failed to add allowed directory', error, {
+                data: { directory: this.sanitizePath(directory) }
+            });
+        }
+    }
+    removeAllowedDirectory(directory) {
+        try {
+            const resolvedPath = path.resolve(directory);
+            this.allowedPaths.delete(resolvedPath);
+            const index = this.config.allowedDirectories.indexOf(directory);
+            if (index > -1) {
+                this.config.allowedDirectories.splice(index, 1);
+            }
+            this.logger.info('Removed allowed directory', {
+                directory: this.sanitizePath(directory),
+                resolvedPath: this.sanitizePath(resolvedPath)
+            });
+        }
+        catch (error) {
+            this.logger.error('Failed to remove allowed directory', error, {
+                data: { directory: this.sanitizePath(directory) }
+            });
+        }
+    }
+}
+exports.FileSystemSecurity = FileSystemSecurity;

package/dist/proxy/server/HealthMonitor.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthMonitor = void 0;
+const logger_1 = require("../../utils/logger");
+class HealthMonitor {
+    constructor(connectionPool) {
+        this.healthChecks = new Map();
+        this.connectionMetrics = new Map();
+        this.isRunning = false;
+        this.healthCheckTimeout = 5000;
+        this.maxConsecutiveFailures = 3;
+        this.connectionPool = connectionPool;
+        this.logger = new logger_1.Logger();
+    }
+    start(intervalMs = 30000) {
+        if (this.checkInterval) {
+            this.logger.warn('Health monitoring already running, stopping previous instance');
+            this.stop();
+        }
+        this.logger.info(`Starting health monitoring with ${intervalMs}ms interval`);
+        this.isRunning = true;
+        this.performHealthChecks().catch(error => {
+            this.logger.error('Initial health check failed:', error);
+        });
+        this.checkInterval = setInterval(async () => {
+            await this.performHealthChecks();
+        }, intervalMs);
+    }
+    stop() {
+        if (this.checkInterval) {
+            clearInterval(this.checkInterval);
+            this.checkInterval = undefined;
+            this.isRunning = false;
+            this.logger.info('Health monitoring stopped');
+        }
+    }
+    isMonitoring() {
+        return this.isRunning;
+    }
+    async checkConnection(connectionId) {
+        const startTime = Date.now();
+        try {
+            const connectionInfo = this.connectionPool.getConnectionInfo(connectionId);
+            if (!connectionInfo) {
+                const result = {
+                    connectionId,
+                    isHealthy: false,
+                    lastCheck: Date.now(),
+                    errorCount: 0,
+                    lastError: 'Connection not found'
+                };
+                this.healthChecks.set(connectionId, result);
+                return result;
+            }
+            const isHealthy = await Promise.race([
+                this.connectionPool.healthCheck(connectionId),
+                new Promise((_, reject) => {
+                    setTimeout(() => reject(new Error('Health check timeout')), this.healthCheckTimeout);
+                })
+            ]);
+            const now = Date.now();
+            const existingResult = this.healthChecks.get(connectionId);
+            const result = {
+                connectionId,
+                isHealthy,
+                lastCheck: now,
+                errorCount: isHealthy ? 0 : (existingResult?.errorCount || 0) + 1,
+                lastError: isHealthy ? undefined : existingResult?.lastError || 'Health check failed'
+            };
+            this.healthChecks.set(connectionId, result);
+            this.updateConnectionMetrics(connectionId, connectionInfo, now - startTime);
+            if (!isHealthy) {
+                this.logger.warn(`Health check failed for connection ${connectionId} (${result.errorCount} consecutive failures)`);
+            }
+            else if (existingResult && !existingResult.isHealthy) {
+                this.logger.info(`Connection ${connectionId} recovered and is now healthy`);
+            }
+            return result;
+        }
+        catch (error) {
+            const now = Date.now();
+            const existingResult = this.healthChecks.get(connectionId);
+            const errorMessage = error instanceof Error ? error.message : 'Unknown health check error';
+            const result = {
+                connectionId,
+                isHealthy: false,
+                lastCheck: now,
+                errorCount: (existingResult?.errorCount || 0) + 1,
+                lastError: errorMessage
+            };
+            this.healthChecks.set(connectionId, result);
+            this.logger.error(`Health check error for connection ${connectionId}:`, error);
+            return result;
+        }
+    }
+    async attemptReconnection(connectionId) {
+        this.logger.info(`Attempting reconnection for connection ${connectionId}`);
+        try {
+            this.incrementReconnectionCount(connectionId);
+            const success = await this.connectionPool.reconnect(connectionId);
+            if (success) {
+                const result = {
+                    connectionId,
+                    isHealthy: true,
+                    lastCheck: Date.now(),
+                    errorCount: 0
+                };
+                this.healthChecks.set(connectionId, result);
+                this.logger.info(`Reconnection successful for connection ${connectionId}`);
+            }
+            else {
+                const existingResult = this.healthChecks.get(connectionId);
+                const result = {
+                    connectionId,
+                    isHealthy: false,
+                    lastCheck: Date.now(),
+                    errorCount: (existingResult?.errorCount || 0) + 1,
+                    lastError: 'Reconnection failed'
+                };
+                this.healthChecks.set(connectionId, result);
+                this.logger.warn(`Reconnection failed for connection ${connectionId}`);
+            }
+            return success;
+        }
+        catch (error) {
+            const existingResult = this.healthChecks.get(connectionId);
+            const errorMessage = error instanceof Error ? error.message : 'Unknown reconnection error';
+            const result = {
+                connectionId,
+                isHealthy: false,
+                lastCheck: Date.now(),
+                errorCount: (existingResult?.errorCount || 0) + 1,
+                lastError: `Reconnection error: ${errorMessage}`
+            };
+            this.healthChecks.set(connectionId, result);
+            this.logger.error(`Reconnection error for connection ${connectionId}:`, error);
+            return false;
+        }
+    }
+    getHealthStatus(connectionId) {
+        return this.healthChecks.get(connectionId) || null;
+    }
+    getAllHealthStatuses() {
+        return Array.from(this.healthChecks.values());
+    }
+    getConnectionMetrics(connectionId) {
+        return this.connectionMetrics.get(connectionId) || null;
+    }
+    getAllConnectionMetrics() {
+        return Array.from(this.connectionMetrics.values());
+    }
+    getHealthStatistics() {
+        const healthStatuses = this.getAllHealthStatuses();
+        const metrics = this.getAllConnectionMetrics();
+        const totalConnections = healthStatuses.length;
+        const healthyConnections = healthStatuses.filter(h => h.isHealthy).length;
+        const unhealthyConnections = totalConnections - healthyConnections;
+        const recentMetrics = metrics.filter(m => m.lastActivity > Date.now() - 300000);
+        const averageResponseTime = recentMetrics.length > 0
+            ? recentMetrics.reduce((sum, m) => sum + (m.lastActivity || 0), 0) / recentMetrics.length
+            : 0;
+        const totalHealthChecks = healthStatuses.reduce((sum, h) => sum + (h.errorCount || 0), 0) + healthyConnections;
+        return {
+            totalConnections,
+            healthyConnections,
+            unhealthyConnections,
+            averageResponseTime,
+            totalHealthChecks
+        };
+    }
+    async forceHealthCheckAll() {
+        const connections = this.connectionPool.getAllConnections();
+        const results = [];
+        for (const connection of connections) {
+            try {
+                const result = await this.checkConnection(connection.id);
+                results.push(result);
+            }
+            catch (error) {
+                this.logger.error(`Force health check failed for connection ${connection.id}:`, error);
+            }
+        }
+        return results;
+    }
+    cleanupHealthData(connectionId) {
+        this.healthChecks.delete(connectionId);
+        this.connectionMetrics.delete(connectionId);
+        this.logger.debug(`Cleaned up health data for connection ${connectionId}`);
+    }
+    async performHealthChecks() {
+        if (!this.isRunning) {
+            return;
+        }
+        const connections = this.connectionPool.getAllConnections();
+        this.logger.debug(`Performing health checks for ${connections.length} connections`);
+        const healthCheckPromises = connections.map(async (connection) => {
+            try {
+                const result = await this.checkConnection(connection.id);
+                if (!result.isHealthy && result.errorCount >= this.maxConsecutiveFailures) {
+                    this.logger.warn(`Connection ${connection.id} has ${result.errorCount} consecutive failures, attempting reconnection`);
+                    await this.attemptReconnection(connection.id);
+                }
+            }
+            catch (error) {
+                this.logger.error(`Health check error for connection ${connection.id}:`, error);
+            }
+        });
+        await Promise.allSettled(healthCheckPromises);
+        const activeConnectionIds = new Set(connections.map(c => c.id));
+        for (const connectionId of this.healthChecks.keys()) {
+            if (!activeConnectionIds.has(connectionId)) {
+                this.cleanupHealthData(connectionId);
+            }
+        }
+        const stats = this.getHealthStatistics();
+        if (stats.totalConnections > 0) {
+            this.logger.debug(`Health check summary: ${stats.healthyConnections}/${stats.totalConnections} healthy connections`);
+        }
+    }
+    updateConnectionMetrics(connectionId, connectionInfo, _responseTime) {
+        const existing = this.connectionMetrics.get(connectionId);
+        const now = Date.now();
+        const metrics = {
+            connectionId,
+            uptime: now - connectionInfo.createdAt,
+            messageCount: existing?.messageCount || 0,
+            requestCount: existing?.requestCount || 0,
+            clientCount: connectionInfo.clientCount,
+            lastActivity: now,
+            reconnectionCount: existing?.reconnectionCount || 0
+        };
+        this.connectionMetrics.set(connectionId, metrics);
+    }
+    incrementReconnectionCount(connectionId) {
+        const existing = this.connectionMetrics.get(connectionId);
+        if (existing) {
+            existing.reconnectionCount++;
+            this.connectionMetrics.set(connectionId, existing);
+        }
+    }
+}
+exports.HealthMonitor = HealthMonitor;