claude-flow-novice 2.0.3 → 2.0.5

package/dist/src/web/api/middleware/auth.js

@@ -0,0 +1,203 @@
+/**
+ * Authentication Middleware
+ *
+ * JWT and API key authentication for the transparency API server
+ *
+ * @module web/api/middleware/auth
+ */ import jwt from "jsonwebtoken";
+/**
+ * JWT Authentication Middleware
+ */ export function authMiddleware(config) {
+    return (req, res, next)=>{
+        // Skip authentication for health check and API documentation
+        if (req.path === '/health' || req.path === '/api') {
+            return next();
+        }
+        // Try JWT authentication first
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            try {
+                const decoded = jwt.verify(token, config.jwtSecret);
+                req.user = {
+                    id: decoded.sub || decoded.id,
+                    username: decoded.username,
+                    role: decoded.role || 'user',
+                    permissions: decoded.permissions || []
+                };
+                return next();
+            } catch (error) {
+            // Invalid JWT, try API key authentication
+            }
+        }
+        // Try API key authentication
+        const apiKey = req.headers['x-api-key'];
+        if (apiKey && apiKey === config.apiKey) {
+            req.apiKey = apiKey;
+            return next();
+        }
+        // Check for basic auth (for development/testing)
+        const basicAuth = req.headers.authorization;
+        if (basicAuth && basicAuth.startsWith('Basic ')) {
+            try {
+                const credentials = Buffer.from(basicAuth.substring(6), 'base64').toString();
+                const [username, password] = credentials.split(':');
+                // Simple development authentication (replace with proper auth in production)
+                if (config.environment === 'development' && username === 'admin' && password === 'admin') {
+                    req.user = {
+                        id: 'dev-admin',
+                        username: 'admin',
+                        role: 'admin',
+                        permissions: [
+                            'read',
+                            'write',
+                            'admin'
+                        ]
+                    };
+                    return next();
+                }
+            } catch (error) {
+            // Invalid basic auth
+            }
+        }
+        // No valid authentication found
+        if (config.environment === 'development') {
+            // Allow unauthenticated access in development with warning
+            console.warn('Unauthenticated request in development mode:', req.method, req.path);
+            req.user = {
+                id: 'dev-anonymous',
+                username: 'anonymous',
+                role: 'user',
+                permissions: [
+                    'read'
+                ]
+            };
+            return next();
+        }
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Authentication required',
+            timestamp: new Date().toISOString()
+        });
+    };
+}
+/**
+ * Role-based authorization middleware
+ */ export function requireRole(requiredRole) {
+    return (req, res, next)=>{
+        if (!req.user) {
+            return res.status(401).json({
+                error: 'Unauthorized',
+                message: 'Authentication required',
+                timestamp: new Date().toISOString()
+            });
+        }
+        if (req.user.role !== requiredRole && req.user.role !== 'admin') {
+            return res.status(403).json({
+                error: 'Forbidden',
+                message: `Requires ${requiredRole} role`,
+                timestamp: new Date().toISOString()
+            });
+        }
+        next();
+    };
+}
+/**
+ * Permission-based authorization middleware
+ */ export function requirePermission(permission) {
+    return (req, res, next)=>{
+        if (!req.user) {
+            return res.status(401).json({
+                error: 'Unauthorized',
+                message: 'Authentication required',
+                timestamp: new Date().toISOString()
+            });
+        }
+        const hasPermission = req.user.permissions?.includes(permission) || req.user.role === 'admin' || req.user.permissions?.includes('*');
+        if (!hasPermission) {
+            return res.status(403).json({
+                error: 'Forbidden',
+                message: `Requires ${permission} permission`,
+                timestamp: new Date().toISOString()
+            });
+        }
+        next();
+    };
+}
+/**
+ * Optional authentication middleware (doesn't fail if no auth)
+ */ export function optionalAuth(config) {
+    return (req, res, next)=>{
+        // Try JWT authentication
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            try {
+                const decoded = jwt.verify(token, config.jwtSecret);
+                req.user = {
+                    id: decoded.sub || decoded.id,
+                    username: decoded.username,
+                    role: decoded.role || 'user',
+                    permissions: decoded.permissions || []
+                };
+            } catch (error) {
+            // Invalid JWT, ignore
+            }
+        }
+        // Try API key authentication
+        const apiKey = req.headers['x-api-key'];
+        if (apiKey && apiKey === config.apiKey) {
+            req.apiKey = apiKey;
+        }
+        next();
+    };
+}
+/**
+ * WebSocket authentication helper
+ */ export function authenticateWebSocket(socket, config) {
+    const token = socket.handshake.auth.token || socket.handshake.headers.authorization?.replace('Bearer ', '');
+    if (!token) {
+        return false;
+    }
+    try {
+        // JWT authentication
+        const decoded = jwt.verify(token, config.jwtSecret);
+        socket.data.user = {
+            id: decoded.sub || decoded.id,
+            username: decoded.username,
+            role: decoded.role || 'user',
+            permissions: decoded.permissions || []
+        };
+        return true;
+    } catch (error) {
+        // API key authentication
+        if (token === config.apiKey) {
+            socket.data.apiKey = token;
+            socket.data.user = {
+                id: 'api-key-user',
+                username: 'api-key',
+                role: 'service',
+                permissions: [
+                    'read',
+                    'write'
+                ]
+            };
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Generate JWT token for user
+ */ export function generateToken(user, config) {
+    return jwt.sign({
+        sub: user.id,
+        username: user.username,
+        role: user.role,
+        permissions: user.permissions
+    }, config.jwtSecret, {
+        expiresIn: config.jwtExpiration,
+        issuer: 'transparency-api',
+        audience: 'transparency-dashboard'
+    });
+}

package/dist/src/web/api/middleware/cache.js

@@ -0,0 +1,273 @@
+/**
+ * Cache Middleware
+ *
+ * Response caching middleware for the transparency API server
+ *
+ * @module web/api/middleware/cache
+ */ function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+/**
+ * Cache middleware factory
+ */ export function cacheMiddleware(cache, defaultTtl = 5000 // 5 seconds
+) {
+    return (req, res, next)=>{
+        // Only cache GET requests
+        if (req.method !== 'GET') {
+            return next();
+        }
+        // Generate cache key
+        const cacheKey = generateCacheKey(req);
+        // Check if we have a valid cached response
+        const cached = cache.get(cacheKey);
+        if (cached && Date.now() - cached.timestamp < cached.ttl) {
+            // Add cache headers
+            res.setHeader('X-Cache', 'HIT');
+            res.setHeader('X-Cache-Age', Math.floor((Date.now() - cached.timestamp) / 1000));
+            if (cached.etag) {
+                res.setHeader('ETag', cached.etag);
+            }
+            return res.json(cached.data);
+        }
+        // Intercept res.json to cache the response
+        const originalJson = res.json;
+        res.json = function(data) {
+            // Only cache successful responses
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+                const ttl = getCacheTtl(req, defaultTtl);
+                const etag = generateETag(data);
+                // Cache the response
+                cache.set(cacheKey, {
+                    data,
+                    timestamp: Date.now(),
+                    ttl,
+                    etag
+                });
+                // Add cache headers
+                res.setHeader('X-Cache', 'MISS');
+                res.setHeader('X-Cache-TTL', Math.floor(ttl / 1000));
+                res.setHeader('Cache-Control', `public, max-age=${Math.floor(ttl / 1000)}`);
+                if (etag) {
+                    res.setHeader('ETag', etag);
+                }
+            }
+            return originalJson.call(this, data);
+        };
+        next();
+    };
+}
+/**
+ * Generate cache key from request
+ */ function generateCacheKey(req) {
+    const url = new URL(req.originalUrl, `http://${req.headers.host}`);
+    // Include query parameters in cache key
+    const queryParams = new URLSearchParams(url.search);
+    queryParams.sort(); // Sort for consistent keys
+    const queryString = queryParams.toString();
+    const path = url.pathname;
+    // Include user ID if authenticated (for user-specific caching)
+    const userId = req.user?.id || 'anonymous';
+    return `${req.method}:${path}:${queryString}:${userId}`;
+}
+/**
+ * Get cache TTL based on request characteristics
+ */ function getCacheTtl(req, defaultTtl) {
+    // Different TTLs for different endpoints
+    const path = req.path;
+    if (path.includes('/metrics')) {
+        return 10000; // 10 seconds for metrics
+    }
+    if (path.includes('/status')) {
+        return 2000; // 2 seconds for status
+    }
+    if (path.includes('/events')) {
+        return 5000; // 5 seconds for events
+    }
+    if (path.includes('/hierarchy')) {
+        return 30000; // 30 seconds for hierarchy (changes less frequently)
+    }
+    if (path.includes('/analytics')) {
+        return 60000; // 1 minute for analytics
+    }
+    return defaultTtl;
+}
+/**
+ * Generate ETag for response data
+ */ function generateETag(data) {
+    const crypto = require('crypto');
+    const hash = crypto.createHash('md5');
+    hash.update(JSON.stringify(data));
+    return `"${hash.digest('hex')}"`;
+}
+/**
+ * Conditional request middleware (ETag support)
+ */ export function conditionalRequest() {
+    return (req, res, next)=>{
+        const ifNoneMatch = req.get('If-None-Match');
+        // This will be checked in the cache middleware
+        if (ifNoneMatch) {
+            req.ifNoneMatch = ifNoneMatch;
+        }
+        next();
+    };
+}
+/**
+ * Cache invalidation middleware
+ */ export function invalidateCache(cache) {
+    return (req, res, next)=>{
+        // Invalidate cache for POST, PUT, DELETE, PATCH requests
+        if ([
+            'POST',
+            'PUT',
+            'DELETE',
+            'PATCH'
+        ].includes(req.method)) {
+            const pattern = getInvalidationPattern(req);
+            // Remove matching cache entries
+            for (const key of cache.keys()){
+                if (key.includes(pattern)) {
+                    cache.delete(key);
+                }
+            }
+        }
+        next();
+    };
+}
+/**
+ * Get cache invalidation pattern for request
+ */ function getInvalidationPattern(req) {
+    const path = req.path;
+    if (path.includes('/agents')) {
+        return '/agents';
+    }
+    if (path.includes('/status')) {
+        return '/status';
+    }
+    if (path.includes('/events')) {
+        return '/events';
+    }
+    if (path.includes('/metrics')) {
+        return '/metrics';
+    }
+    if (path.includes('/hierarchy')) {
+        return '/hierarchy';
+    }
+    return path;
+}
+/**
+ * Cache warming middleware
+ */ export function warmCache(cache, warmupFn) {
+    return async (req, res, next)=>{
+        // Run cache warmup on first request
+        if (cache.size === 0 && req.path === '/health') {
+            try {
+                await warmupFn();
+            } catch (error) {
+                console.error('Cache warmup failed:', error);
+            }
+        }
+        next();
+    };
+}
+/**
+ * Memory-based cache store
+ */ export class MemoryCache {
+    /**
+   * Get cache entry
+   */ get(key) {
+        const entry = this.cache.get(key);
+        if (entry && Date.now() - entry.timestamp < entry.ttl) {
+            return entry;
+        }
+        if (entry) {
+            this.cache.delete(key);
+        }
+        return undefined;
+    }
+    /**
+   * Set cache entry
+   */ set(key, data, ttl = 5000) {
+        // Remove oldest entries if cache is full
+        if (this.cache.size >= this.maxSize) {
+            const oldestKey = this.cache.keys().next().value;
+            this.cache.delete(oldestKey);
+        }
+        this.cache.set(key, {
+            data,
+            timestamp: Date.now(),
+            ttl
+        });
+    }
+    /**
+   * Delete cache entry
+   */ delete(key) {
+        return this.cache.delete(key);
+    }
+    /**
+   * Clear cache
+   */ clear() {
+        this.cache.clear();
+    }
+    /**
+   * Get cache size
+   */ size() {
+        return this.cache.size;
+    }
+    /**
+   * Get cache statistics
+   */ getStats() {
+        const entries = Array.from(this.cache.entries()).map(([key, entry])=>({
+                key,
+                age: Date.now() - entry.timestamp,
+                ttl: entry.ttl,
+                size: JSON.stringify(entry.data).length
+            }));
+        return {
+            size: this.cache.size,
+            maxSize: this.maxSize,
+            entries
+        };
+    }
+    /**
+   * Clean up expired entries
+   */ cleanup() {
+        const now = Date.now();
+        const keysToDelete = [];
+        for (const [key, entry] of this.cache.entries()){
+            if (now - entry.timestamp >= entry.ttl) {
+                keysToDelete.push(key);
+            }
+        }
+        for (const key of keysToDelete){
+            this.cache.delete(key);
+        }
+    }
+    /**
+   * Destroy cache store
+   */ destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+        }
+        this.clear();
+    }
+    constructor(maxSize = 1000, cleanupIntervalMs = 60000){
+        _define_property(this, "cache", new Map());
+        _define_property(this, "maxSize", void 0);
+        _define_property(this, "cleanupInterval", void 0);
+        this.maxSize = maxSize;
+        // Clean up expired entries periodically
+        this.cleanupInterval = setInterval(()=>{
+            this.cleanup();
+        }, cleanupIntervalMs);
+    }
+}