claude-flow-novice 2.0.3 → 2.0.5

package/dist/src/web/api/middleware/error-handler.js

@@ -0,0 +1,257 @@
+/**
+ * Error Handler Middleware
+ *
+ * Centralized error handling for the transparency API server
+ *
+ * @module web/api/middleware/error-handler
+ */ function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+/**
+ * API Error class
+ */ export class ApiError extends Error {
+    constructor(message, statusCode = 500, isOperational = true, code, details){
+        super(message), _define_property(this, "statusCode", void 0), _define_property(this, "isOperational", void 0), _define_property(this, "code", void 0), _define_property(this, "details", void 0);
+        this.name = 'ApiError';
+        this.statusCode = statusCode;
+        this.isOperational = isOperational;
+        this.code = code;
+        this.details = details;
+        // Maintains proper stack trace for where our error was thrown (only available on V8)
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, ApiError);
+        }
+    }
+}
+/**
+ * Validation Error class
+ */ export class ValidationError extends ApiError {
+    constructor(message, details){
+        super(message, 400, true, 'VALIDATION_ERROR', details);
+        this.name = 'ValidationError';
+    }
+}
+/**
+ * Not Found Error class
+ */ export class NotFoundError extends ApiError {
+    constructor(resource, id){
+        const message = id ? `${resource} with id '${id}' not found` : `${resource} not found`;
+        super(message, 404, true, 'NOT_FOUND', {
+            resource,
+            id
+        });
+        this.name = 'NotFoundError';
+    }
+}
+/**
+ * Unauthorized Error class
+ */ export class UnauthorizedError extends ApiError {
+    constructor(message = 'Unauthorized'){
+        super(message, 401, true, 'UNAUTHORIZED');
+        this.name = 'UnauthorizedError';
+    }
+}
+/**
+ * Forbidden Error class
+ */ export class ForbiddenError extends ApiError {
+    constructor(message = 'Forbidden'){
+        super(message, 403, true, 'FORBIDDEN');
+        this.name = 'ForbiddenError';
+    }
+}
+/**
+ * Rate Limit Error class
+ */ export class RateLimitError extends ApiError {
+    constructor(message = 'Rate limit exceeded'){
+        super(message, 429, true, 'RATE_LIMIT_EXCEEDED');
+        this.name = 'RateLimitError';
+    }
+}
+/**
+ * Error Handler Middleware Factory
+ */ export function errorHandler(logger) {
+    return (err, req, res, next)=>{
+        // Default error values
+        let statusCode = 500;
+        let errorCode = 'INTERNAL_SERVER_ERROR';
+        let message = 'Internal server error';
+        let details = undefined;
+        let isOperational = false;
+        // Handle known error types
+        if (err instanceof ApiError) {
+            statusCode = err.statusCode;
+            errorCode = err.code || 'API_ERROR';
+            message = err.message;
+            details = err.details;
+            isOperational = err.isOperational;
+        } else if (err.name === 'ValidationError') {
+            statusCode = 400;
+            errorCode = 'VALIDATION_ERROR';
+            message = err.message;
+            isOperational = true;
+        } else if (err.name === 'CastError') {
+            statusCode = 400;
+            errorCode = 'INVALID_ID';
+            message = 'Invalid ID format';
+            isOperational = true;
+        } else if (err.name === 'JsonWebTokenError') {
+            statusCode = 401;
+            errorCode = 'INVALID_TOKEN';
+            message = 'Invalid authentication token';
+            isOperational = true;
+        } else if (err.name === 'TokenExpiredError') {
+            statusCode = 401;
+            errorCode = 'TOKEN_EXPIRED';
+            message = 'Authentication token expired';
+            isOperational = true;
+        } else if (err.name === 'MulterError') {
+            statusCode = 400;
+            errorCode = 'FILE_UPLOAD_ERROR';
+            message = 'File upload error';
+            isOperational = true;
+        } else if (err.name === 'SyntaxError' && err.type === 'entity.parse.failed') {
+            statusCode = 400;
+            errorCode = 'INVALID_JSON';
+            message = 'Invalid JSON in request body';
+            isOperational = true;
+        }
+        // Log error
+        const logData = {
+            error: {
+                name: err.name,
+                message: err.message,
+                code: errorCode,
+                statusCode,
+                isOperational,
+                stack: err.stack
+            },
+            request: {
+                method: req.method,
+                url: req.originalUrl,
+                ip: req.ip,
+                userAgent: req.get('User-Agent'),
+                user: req.user?.id || 'anonymous'
+            },
+            details
+        };
+        if (isOperational) {
+            logger.warn('Operational error', logData);
+        } else {
+            logger.error('Non-operational error', logData);
+        }
+        // Build error response
+        const errorResponse = {
+            error: errorCode,
+            message,
+            timestamp: new Date().toISOString(),
+            requestId: req.requestId || 'unknown'
+        };
+        // Include details in development or for operational errors
+        if (process.env.NODE_ENV === 'development' || isOperational) {
+            if (details) {
+                errorResponse.details = details;
+            }
+            if (process.env.NODE_ENV === 'development') {
+                errorResponse.stack = err.stack;
+            }
+        }
+        // Include request path for debugging
+        if (process.env.NODE_ENV === 'development') {
+            errorResponse.path = req.path;
+            errorResponse.method = req.method;
+        }
+        res.status(statusCode).json(errorResponse);
+    };
+}
+/**
+ * Async Error Wrapper
+ *
+ * Wraps async route handlers to automatically catch errors
+ */ export function asyncHandler(fn) {
+    return (req, res, next)=>{
+        Promise.resolve(fn(req, res, next)).catch(next);
+    };
+}
+/**
+ * 404 Handler
+ */ export function notFoundHandler(req, res) {
+    res.status(404).json({
+        error: 'NOT_FOUND',
+        message: `Endpoint ${req.method} ${req.originalUrl} not found`,
+        timestamp: new Date().toISOString()
+    });
+}
+/**
+ * Create error from validation result
+ */ export function createValidationError(validationResult) {
+    const details = validationResult.errors?.map((error)=>({
+            field: error.path || error.field,
+            message: error.message,
+            value: error.value
+        }));
+    return new ValidationError('Validation failed', details);
+}
+/**
+ * Handle Prisma errors (if using Prisma ORM)
+ */ export function handlePrismaError(err) {
+    switch(err.code){
+        case 'P2002':
+            return new ApiError('Unique constraint violation', 409, true, 'UNIQUE_VIOLATION', {
+                target: err.meta?.target
+            });
+        case 'P2025':
+            return new NotFoundError('Record', err.meta?.cause);
+        case 'P2003':
+            return new ValidationError('Foreign key constraint violation', {
+                field: err.meta?.field_name
+            });
+        case 'P2014':
+            return new ApiError('Relation violation', 400, true, 'RELATION_VIOLATION', {
+                relation: err.meta?.relation_name
+            });
+        case 'P2021':
+            return new ApiError('Table does not exist', 500, false, 'TABLE_NOT_FOUND', {
+                table: err.meta?.table
+            });
+        default:
+            return new ApiError('Database error', 500, false, 'DATABASE_ERROR', {
+                code: err.code,
+                message: err.message
+            });
+    }
+}
+/**
+ * Handle Mongoose errors (if using Mongoose ODM)
+ */ export function handleMongooseError(err) {
+    if (err.name === 'ValidationError') {
+        const details = Object.keys(err.errors).map((key)=>({
+                field: key,
+                message: err.errors[key].message,
+                value: err.errors[key].value
+            }));
+        return new ValidationError('Validation failed', details);
+    }
+    if (err.name === 'CastError') {
+        return new ValidationError(`Invalid ${err.path}: ${err.value}`);
+    }
+    if (err.code === 11000) {
+        const field = Object.keys(err.keyPattern)[0];
+        return new ApiError('Duplicate field value', 409, true, 'DUPLICATE_FIELD', {
+            field
+        });
+    }
+    return new ApiError('Database error', 500, false, 'DATABASE_ERROR', {
+        name: err.name,
+        message: err.message
+    });
+}

package/dist/src/web/api/middleware/request-logger.js

@@ -0,0 +1,215 @@
+/**
+ * Request Logger Middleware
+ *
+ * HTTP request logging middleware for the transparency API server
+ *
+ * @module web/api/middleware/request-logger
+ */ import { v4 as uuidv4 } from "uuid";
+/**
+ * Request Logger Middleware Factory
+ */ export function requestLogger(logger) {
+    return (req, res, next)=>{
+        // Generate unique request ID
+        const requestId = uuidv4().slice(0, 8);
+        req.requestId = requestId;
+        req.startTime = Date.now();
+        // Set request ID in response headers
+        res.setHeader('X-Request-ID', requestId);
+        // Log request start
+        const requestLog = {
+            requestId,
+            method: req.method,
+            url: req.originalUrl,
+            ip: req.ip || req.connection.remoteAddress,
+            userAgent: req.get('User-Agent'),
+            contentLength: req.get('Content-Length') || 0,
+            contentType: req.get('Content-Type'),
+            referer: req.get('Referer'),
+            user: req.user?.id || 'anonymous',
+            timestamp: new Date().toISOString()
+        };
+        logger.info('Request started', requestLog);
+        // Override res.end to log response
+        const originalEnd = res.end;
+        res.end = function(...args) {
+            // Calculate duration
+            const duration = req.startTime ? Date.now() - req.startTime : 0;
+            // Log response
+            const responseLog = {
+                requestId,
+                method: req.method,
+                url: req.originalUrl,
+                statusCode: res.statusCode,
+                contentLength: res.get('Content-Length') || 0,
+                duration: `${duration}ms`,
+                ip: req.ip || req.connection.remoteAddress,
+                user: req.user?.id || 'anonymous',
+                timestamp: new Date().toISOString()
+            };
+            // Log based on status code
+            if (res.statusCode >= 500) {
+                logger.error('Request completed with server error', responseLog);
+            } else if (res.statusCode >= 400) {
+                logger.warn('Request completed with client error', responseLog);
+            } else if (res.statusCode >= 300) {
+                logger.info('Request completed with redirect', responseLog);
+            } else {
+                logger.info('Request completed successfully', responseLog);
+            }
+            // Call original end
+            originalEnd.apply(this, args);
+        };
+        next();
+    };
+}
+/**
+ * Performance Logger Middleware
+ *
+ * Logs slow requests and performance metrics
+ */ export function performanceLogger(logger, thresholdMs = 1000) {
+    return (req, res, next)=>{
+        const startTime = Date.now();
+        res.on('finish', ()=>{
+            const duration = Date.now() - startTime;
+            if (duration > thresholdMs) {
+                logger.warn('Slow request detected', {
+                    requestId: req.requestId,
+                    method: req.method,
+                    url: req.originalUrl,
+                    duration: `${duration}ms`,
+                    threshold: `${thresholdMs}ms`,
+                    statusCode: res.statusCode,
+                    user: req.user?.id || 'anonymous'
+                });
+            }
+        });
+        next();
+    };
+}
+/**
+ * Security Logger Middleware
+ *
+ * Logs security-related events and suspicious activity
+ */ export function securityLogger(logger) {
+    return (req, res, next)=>{
+        // Log suspicious user agents
+        const userAgent = req.get('User-Agent') || '';
+        const suspiciousPatterns = [
+            /bot/i,
+            /crawler/i,
+            /scanner/i,
+            /sqlmap/i,
+            /nikto/i,
+            /nmap/i,
+            /curl/i,
+            /wget/i
+        ];
+        if (suspiciousPatterns.some((pattern)=>pattern.test(userAgent))) {
+            logger.warn('Suspicious user agent detected', {
+                requestId: req.requestId,
+                userAgent,
+                ip: req.ip,
+                url: req.originalUrl,
+                method: req.method,
+                timestamp: new Date().toISOString()
+            });
+        }
+        // Log requests to sensitive endpoints
+        const sensitiveEndpoints = [
+            '/api/v1/system',
+            '/api/v1/admin',
+            '/api/v1/users',
+            '/api/v1/auth'
+        ];
+        if (sensitiveEndpoints.some((endpoint)=>req.path.startsWith(endpoint))) {
+            logger.info('Access to sensitive endpoint', {
+                requestId: req.requestId,
+                endpoint: req.path,
+                method: req.method,
+                ip: req.ip,
+                user: req.user?.id || 'anonymous',
+                timestamp: new Date().toISOString()
+            });
+        }
+        // Log failed authentication attempts
+        res.on('finish', ()=>{
+            if (res.statusCode === 401 && req.path.includes('/auth')) {
+                logger.warn('Authentication failed', {
+                    requestId: req.requestId,
+                    path: req.path,
+                    method: req.method,
+                    ip: req.ip,
+                    userAgent,
+                    timestamp: new Date().toISOString()
+                });
+            }
+            // Log authorization failures
+            if (res.statusCode === 403) {
+                logger.warn('Authorization failed', {
+                    requestId: req.requestId,
+                    path: req.path,
+                    method: req.method,
+                    ip: req.ip,
+                    user: req.user?.id || 'anonymous',
+                    timestamp: new Date().toISOString()
+                });
+            }
+        });
+        next();
+    };
+}
+/**
+ * API Metrics Logger Middleware
+ *
+ * Logs API usage metrics for monitoring and analytics
+ */ export function metricsLogger(logger) {
+    const metrics = {
+        requests: 0,
+        errors: 0,
+        totalDuration: 0,
+        endpointCounts: new Map(),
+        methodCounts: new Map(),
+        statusCounts: new Map()
+    };
+    // Log metrics every 5 minutes
+    setInterval(()=>{
+        if (metrics.requests > 0) {
+            logger.info('API metrics summary', {
+                period: '5 minutes',
+                totalRequests: metrics.requests,
+                errorRate: `${(metrics.errors / metrics.requests * 100).toFixed(2)}%`,
+                averageDuration: `${(metrics.totalDuration / metrics.requests).toFixed(2)}ms`,
+                topEndpoints: Array.from(metrics.endpointCounts.entries()).sort((a, b)=>b[1] - a[1]).slice(0, 10),
+                methodDistribution: Object.fromEntries(metrics.methodCounts),
+                statusDistribution: Object.fromEntries(metrics.statusCounts)
+            });
+            // Reset metrics
+            metrics.requests = 0;
+            metrics.errors = 0;
+            metrics.totalDuration = 0;
+            metrics.endpointCounts.clear();
+            metrics.methodCounts.clear();
+            metrics.statusCounts.clear();
+        }
+    }, 5 * 60 * 1000);
+    return (req, res, next)=>{
+        const startTime = Date.now();
+        res.on('finish', ()=>{
+            const duration = Date.now() - startTime;
+            const endpoint = `${req.method} ${req.route?.path || req.path}`;
+            // Update metrics
+            metrics.requests++;
+            metrics.totalDuration += duration;
+            if (res.statusCode >= 400) {
+                metrics.errors++;
+            }
+            // Count endpoints
+            metrics.endpointCounts.set(endpoint, (metrics.endpointCounts.get(endpoint) || 0) + 1);
+            // Count methods
+            metrics.methodCounts.set(req.method, (metrics.methodCounts.get(req.method) || 0) + 1);
+            // Count status codes
+            metrics.statusCounts.set(res.statusCode, (metrics.statusCounts.get(res.statusCode) || 0) + 1);
+        });
+        next();
+    };
+}