claude-flow-novice 2.0.4 → 2.0.5

package/dist/src/web/api/config/api-config.js

@@ -0,0 +1,184 @@
+/**
+ * API Server Configuration
+ *
+ * Configuration settings for the transparency API server
+ * including security, CORS, rate limiting, and other options.
+ *
+ * @module web/api/config/api-config
+ */ /**
+ * Create default API configuration
+ */ export function createApiConfig() {
+    const env = process.env.NODE_ENV || 'development';
+    return {
+        port: parseInt(process.env.API_PORT || '3001', 10),
+        host: process.env.API_HOST || 'localhost',
+        environment: env,
+        // CORS configuration
+        corsOrigins: env === 'production' ? process.env.CORS_ORIGINS?.split(',') || [
+            'https://localhost:3000'
+        ] : [
+            'http://localhost:3000',
+            'http://localhost:3001',
+            'http://127.0.0.1:3000'
+        ],
+        // Rate limiting
+        rateLimitWindowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '900000', 10),
+        rateLimitMax: parseInt(process.env.RATE_LIMIT_MAX || '100', 10),
+        // Security
+        sessionSecret: process.env.SESSION_SECRET || 'change-me-in-production',
+        jwtSecret: process.env.JWT_SECRET || 'change-me-in-production',
+        jwtExpiration: process.env.JWT_EXPIRATION || '24h',
+        apiKey: process.env.API_KEY || 'change-me-in-production',
+        // Logging
+        logLevel: process.env.LOG_LEVEL || 'info',
+        // Performance
+        cacheTtl: parseInt(process.env.CACHE_TTL || '5000', 10),
+        enableCompression: process.env.ENABLE_COMPRESSION !== 'false',
+        // HTTPS
+        enableHttps: process.env.ENABLE_HTTPS === 'true',
+        sslCertPath: process.env.SSL_CERT_PATH,
+        sslKeyPath: process.env.SSL_KEY_PATH,
+        // Metrics
+        enableMetrics: process.env.ENABLE_METRICS !== 'false',
+        metricsIntervalMs: parseInt(process.env.METRICS_INTERVAL_MS || '60000', 10),
+        // Request handling
+        maxRequestBodySize: process.env.MAX_REQUEST_BODY_SIZE || '10mb',
+        requestTimeoutMs: parseInt(process.env.REQUEST_TIMEOUT_MS || '30000', 10),
+        // WebSocket
+        websocketPingTimeoutMs: parseInt(process.env.WS_PING_TIMEOUT_MS || '60000', 10),
+        websocketPingIntervalMs: parseInt(process.env.WS_PING_INTERVAL_MS || '25000', 10),
+        maxWebSocketConnections: parseInt(process.env.MAX_WS_CONNECTIONS || '100', 10),
+        // Features
+        enableRequestLogging: process.env.ENABLE_REQUEST_LOGGING !== 'false',
+        enableDetailedErrors: env === 'development',
+        // API info
+        apiVersion: process.env.API_VERSION || '1.0.0',
+        serverName: process.env.SERVER_NAME || 'Transparency API Server'
+    };
+}
+/**
+ * Validate API configuration
+ */ export function validateApiConfig(config) {
+    const errors = [];
+    if (config.port < 1 || config.port > 65535) {
+        errors.push('Port must be between 1 and 65535');
+    }
+    if (config.rateLimitWindowMs < 1000) {
+        errors.push('Rate limit window must be at least 1000ms');
+    }
+    if (config.rateLimitMax < 1) {
+        errors.push('Rate limit max must be at least 1');
+    }
+    if (config.cacheTtl < 0) {
+        errors.push('Cache TTL cannot be negative');
+    }
+    if (config.requestTimeoutMs < 1000) {
+        errors.push('Request timeout must be at least 1000ms');
+    }
+    if (config.websocketPingTimeoutMs < 5000) {
+        errors.push('WebSocket ping timeout must be at least 5000ms');
+    }
+    if (config.websocketPingIntervalMs < 1000) {
+        errors.push('WebSocket ping interval must be at least 1000ms');
+    }
+    if (config.maxWebSocketConnections < 1) {
+        errors.push('Max WebSocket connections must be at least 1');
+    }
+    if (config.enableHttps && (!config.sslCertPath || !config.sslKeyPath)) {
+        errors.push('SSL certificate and key paths are required when HTTPS is enabled');
+    }
+    // In production, check for proper security settings
+    if (config.environment === 'production') {
+        const insecureDefaults = [
+            config.sessionSecret === 'change-me-in-production',
+            config.jwtSecret === 'change-me-in-production',
+            config.apiKey === 'change-me-in-production'
+        ];
+        if (insecureDefaults.some(Boolean)) {
+            errors.push('Production environment requires secure secrets and API keys');
+        }
+        if (config.corsOrigins.includes('*') || config.corsOrigins.includes('http://localhost:*')) {
+            errors.push('Production environment should not use wildcard or localhost CORS origins');
+        }
+        if (config.enableDetailedErrors) {
+            errors.push('Detailed errors should be disabled in production');
+        }
+    }
+    return errors;
+}
+/**
+ * Create CORS options from configuration
+ */ export function createCorsOptions(config) {
+    return {
+        origin: (origin, callback)=>{
+            // Allow requests with no origin (like mobile apps or curl requests)
+            if (!origin) return callback(null, true);
+            if (config.corsOrigins.includes('*') || config.corsOrigins.includes(origin) || config.corsOrigins.some((allowed)=>{
+                // Support wildcard patterns like http://localhost:*
+                if (allowed.includes('*')) {
+                    const pattern = allowed.replace('*', '.*');
+                    const regex = new RegExp(`^${pattern}$`);
+                    return regex.test(origin);
+                }
+                return false;
+            })) {
+                callback(null, true);
+            } else {
+                callback(new Error('Not allowed by CORS'), false);
+            }
+        },
+        methods: [
+            'GET',
+            'POST',
+            'PUT',
+            'DELETE',
+            'PATCH',
+            'OPTIONS'
+        ],
+        allowedHeaders: [
+            'Content-Type',
+            'Authorization',
+            'X-Requested-With',
+            'X-API-Key'
+        ],
+        credentials: true,
+        preflightContinue: false,
+        optionsSuccessStatus: 204
+    };
+}
+/**
+ * Get environment-specific configuration overrides
+ */ export function getEnvironmentOverrides(env) {
+    switch(env){
+        case 'production':
+            return {
+                logLevel: 'warn',
+                enableDetailedErrors: false,
+                enableRequestLogging: false,
+                cacheTtl: 30000,
+                rateLimitMax: 1000,
+                requestTimeoutMs: 60000
+            };
+        case 'test':
+            return {
+                port: 0,
+                host: '127.0.0.1',
+                logLevel: 'error',
+                enableRequestLogging: false,
+                enableMetrics: false,
+                cacheTtl: 100,
+                rateLimitMax: 1000,
+                maxWebSocketConnections: 10
+            };
+        case 'development':
+        default:
+            return {
+                logLevel: 'debug',
+                enableDetailedErrors: true,
+                enableRequestLogging: true,
+                enableMetrics: true,
+                cacheTtl: 5000,
+                rateLimitMax: 1000
+            };
+    }
+}

package/dist/src/web/api/middleware/auth.js

@@ -0,0 +1,203 @@
+/**
+ * Authentication Middleware
+ *
+ * JWT and API key authentication for the transparency API server
+ *
+ * @module web/api/middleware/auth
+ */ import jwt from "jsonwebtoken";
+/**
+ * JWT Authentication Middleware
+ */ export function authMiddleware(config) {
+    return (req, res, next)=>{
+        // Skip authentication for health check and API documentation
+        if (req.path === '/health' || req.path === '/api') {
+            return next();
+        }
+        // Try JWT authentication first
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            try {
+                const decoded = jwt.verify(token, config.jwtSecret);
+                req.user = {
+                    id: decoded.sub || decoded.id,
+                    username: decoded.username,
+                    role: decoded.role || 'user',
+                    permissions: decoded.permissions || []
+                };
+                return next();
+            } catch (error) {
+            // Invalid JWT, try API key authentication
+            }
+        }
+        // Try API key authentication
+        const apiKey = req.headers['x-api-key'];
+        if (apiKey && apiKey === config.apiKey) {
+            req.apiKey = apiKey;
+            return next();
+        }
+        // Check for basic auth (for development/testing)
+        const basicAuth = req.headers.authorization;
+        if (basicAuth && basicAuth.startsWith('Basic ')) {
+            try {
+                const credentials = Buffer.from(basicAuth.substring(6), 'base64').toString();
+                const [username, password] = credentials.split(':');
+                // Simple development authentication (replace with proper auth in production)
+                if (config.environment === 'development' && username === 'admin' && password === 'admin') {
+                    req.user = {
+                        id: 'dev-admin',
+                        username: 'admin',
+                        role: 'admin',
+                        permissions: [
+                            'read',
+                            'write',
+                            'admin'
+                        ]
+                    };
+                    return next();
+                }
+            } catch (error) {
+            // Invalid basic auth
+            }
+        }
+        // No valid authentication found
+        if (config.environment === 'development') {
+            // Allow unauthenticated access in development with warning
+            console.warn('Unauthenticated request in development mode:', req.method, req.path);
+            req.user = {
+                id: 'dev-anonymous',
+                username: 'anonymous',
+                role: 'user',
+                permissions: [
+                    'read'
+                ]
+            };
+            return next();
+        }
+        return res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Authentication required',
+            timestamp: new Date().toISOString()
+        });
+    };
+}
+/**
+ * Role-based authorization middleware
+ */ export function requireRole(requiredRole) {
+    return (req, res, next)=>{
+        if (!req.user) {
+            return res.status(401).json({
+                error: 'Unauthorized',
+                message: 'Authentication required',
+                timestamp: new Date().toISOString()
+            });
+        }
+        if (req.user.role !== requiredRole && req.user.role !== 'admin') {
+            return res.status(403).json({
+                error: 'Forbidden',
+                message: `Requires ${requiredRole} role`,
+                timestamp: new Date().toISOString()
+            });
+        }
+        next();
+    };
+}
+/**
+ * Permission-based authorization middleware
+ */ export function requirePermission(permission) {
+    return (req, res, next)=>{
+        if (!req.user) {
+            return res.status(401).json({
+                error: 'Unauthorized',
+                message: 'Authentication required',
+                timestamp: new Date().toISOString()
+            });
+        }
+        const hasPermission = req.user.permissions?.includes(permission) || req.user.role === 'admin' || req.user.permissions?.includes('*');
+        if (!hasPermission) {
+            return res.status(403).json({
+                error: 'Forbidden',
+                message: `Requires ${permission} permission`,
+                timestamp: new Date().toISOString()
+            });
+        }
+        next();
+    };
+}
+/**
+ * Optional authentication middleware (doesn't fail if no auth)
+ */ export function optionalAuth(config) {
+    return (req, res, next)=>{
+        // Try JWT authentication
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            try {
+                const decoded = jwt.verify(token, config.jwtSecret);
+                req.user = {
+                    id: decoded.sub || decoded.id,
+                    username: decoded.username,
+                    role: decoded.role || 'user',
+                    permissions: decoded.permissions || []
+                };
+            } catch (error) {
+            // Invalid JWT, ignore
+            }
+        }
+        // Try API key authentication
+        const apiKey = req.headers['x-api-key'];
+        if (apiKey && apiKey === config.apiKey) {
+            req.apiKey = apiKey;
+        }
+        next();
+    };
+}
+/**
+ * WebSocket authentication helper
+ */ export function authenticateWebSocket(socket, config) {
+    const token = socket.handshake.auth.token || socket.handshake.headers.authorization?.replace('Bearer ', '');
+    if (!token) {
+        return false;
+    }
+    try {
+        // JWT authentication
+        const decoded = jwt.verify(token, config.jwtSecret);
+        socket.data.user = {
+            id: decoded.sub || decoded.id,
+            username: decoded.username,
+            role: decoded.role || 'user',
+            permissions: decoded.permissions || []
+        };
+        return true;
+    } catch (error) {
+        // API key authentication
+        if (token === config.apiKey) {
+            socket.data.apiKey = token;
+            socket.data.user = {
+                id: 'api-key-user',
+                username: 'api-key',
+                role: 'service',
+                permissions: [
+                    'read',
+                    'write'
+                ]
+            };
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Generate JWT token for user
+ */ export function generateToken(user, config) {
+    return jwt.sign({
+        sub: user.id,
+        username: user.username,
+        role: user.role,
+        permissions: user.permissions
+    }, config.jwtSecret, {
+        expiresIn: config.jwtExpiration,
+        issuer: 'transparency-api',
+        audience: 'transparency-dashboard'
+    });
+}

package/dist/src/web/api/middleware/cache.js

@@ -0,0 +1,273 @@
+/**
+ * Cache Middleware
+ *
+ * Response caching middleware for the transparency API server
+ *
+ * @module web/api/middleware/cache
+ */ function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+/**
+ * Cache middleware factory
+ */ export function cacheMiddleware(cache, defaultTtl = 5000 // 5 seconds
+) {
+    return (req, res, next)=>{
+        // Only cache GET requests
+        if (req.method !== 'GET') {
+            return next();
+        }
+        // Generate cache key
+        const cacheKey = generateCacheKey(req);
+        // Check if we have a valid cached response
+        const cached = cache.get(cacheKey);
+        if (cached && Date.now() - cached.timestamp < cached.ttl) {
+            // Add cache headers
+            res.setHeader('X-Cache', 'HIT');
+            res.setHeader('X-Cache-Age', Math.floor((Date.now() - cached.timestamp) / 1000));
+            if (cached.etag) {
+                res.setHeader('ETag', cached.etag);
+            }
+            return res.json(cached.data);
+        }
+        // Intercept res.json to cache the response
+        const originalJson = res.json;
+        res.json = function(data) {
+            // Only cache successful responses
+            if (res.statusCode >= 200 && res.statusCode < 300) {
+                const ttl = getCacheTtl(req, defaultTtl);
+                const etag = generateETag(data);
+                // Cache the response
+                cache.set(cacheKey, {
+                    data,
+                    timestamp: Date.now(),
+                    ttl,
+                    etag
+                });
+                // Add cache headers
+                res.setHeader('X-Cache', 'MISS');
+                res.setHeader('X-Cache-TTL', Math.floor(ttl / 1000));
+                res.setHeader('Cache-Control', `public, max-age=${Math.floor(ttl / 1000)}`);
+                if (etag) {
+                    res.setHeader('ETag', etag);
+                }
+            }
+            return originalJson.call(this, data);
+        };
+        next();
+    };
+}
+/**
+ * Generate cache key from request
+ */ function generateCacheKey(req) {
+    const url = new URL(req.originalUrl, `http://${req.headers.host}`);
+    // Include query parameters in cache key
+    const queryParams = new URLSearchParams(url.search);
+    queryParams.sort(); // Sort for consistent keys
+    const queryString = queryParams.toString();
+    const path = url.pathname;
+    // Include user ID if authenticated (for user-specific caching)
+    const userId = req.user?.id || 'anonymous';
+    return `${req.method}:${path}:${queryString}:${userId}`;
+}
+/**
+ * Get cache TTL based on request characteristics
+ */ function getCacheTtl(req, defaultTtl) {
+    // Different TTLs for different endpoints
+    const path = req.path;
+    if (path.includes('/metrics')) {
+        return 10000; // 10 seconds for metrics
+    }
+    if (path.includes('/status')) {
+        return 2000; // 2 seconds for status
+    }
+    if (path.includes('/events')) {
+        return 5000; // 5 seconds for events
+    }
+    if (path.includes('/hierarchy')) {
+        return 30000; // 30 seconds for hierarchy (changes less frequently)
+    }
+    if (path.includes('/analytics')) {
+        return 60000; // 1 minute for analytics
+    }
+    return defaultTtl;
+}
+/**
+ * Generate ETag for response data
+ */ function generateETag(data) {
+    const crypto = require('crypto');
+    const hash = crypto.createHash('md5');
+    hash.update(JSON.stringify(data));
+    return `"${hash.digest('hex')}"`;
+}
+/**
+ * Conditional request middleware (ETag support)
+ */ export function conditionalRequest() {
+    return (req, res, next)=>{
+        const ifNoneMatch = req.get('If-None-Match');
+        // This will be checked in the cache middleware
+        if (ifNoneMatch) {
+            req.ifNoneMatch = ifNoneMatch;
+        }
+        next();
+    };
+}
+/**
+ * Cache invalidation middleware
+ */ export function invalidateCache(cache) {
+    return (req, res, next)=>{
+        // Invalidate cache for POST, PUT, DELETE, PATCH requests
+        if ([
+            'POST',
+            'PUT',
+            'DELETE',
+            'PATCH'
+        ].includes(req.method)) {
+            const pattern = getInvalidationPattern(req);
+            // Remove matching cache entries
+            for (const key of cache.keys()){
+                if (key.includes(pattern)) {
+                    cache.delete(key);
+                }
+            }
+        }
+        next();
+    };
+}
+/**
+ * Get cache invalidation pattern for request
+ */ function getInvalidationPattern(req) {
+    const path = req.path;
+    if (path.includes('/agents')) {
+        return '/agents';
+    }
+    if (path.includes('/status')) {
+        return '/status';
+    }
+    if (path.includes('/events')) {
+        return '/events';
+    }
+    if (path.includes('/metrics')) {
+        return '/metrics';
+    }
+    if (path.includes('/hierarchy')) {
+        return '/hierarchy';
+    }
+    return path;
+}
+/**
+ * Cache warming middleware
+ */ export function warmCache(cache, warmupFn) {
+    return async (req, res, next)=>{
+        // Run cache warmup on first request
+        if (cache.size === 0 && req.path === '/health') {
+            try {
+                await warmupFn();
+            } catch (error) {
+                console.error('Cache warmup failed:', error);
+            }
+        }
+        next();
+    };
+}
+/**
+ * Memory-based cache store
+ */ export class MemoryCache {
+    /**
+   * Get cache entry
+   */ get(key) {
+        const entry = this.cache.get(key);
+        if (entry && Date.now() - entry.timestamp < entry.ttl) {
+            return entry;
+        }
+        if (entry) {
+            this.cache.delete(key);
+        }
+        return undefined;
+    }
+    /**
+   * Set cache entry
+   */ set(key, data, ttl = 5000) {
+        // Remove oldest entries if cache is full
+        if (this.cache.size >= this.maxSize) {
+            const oldestKey = this.cache.keys().next().value;
+            this.cache.delete(oldestKey);
+        }
+        this.cache.set(key, {
+            data,
+            timestamp: Date.now(),
+            ttl
+        });
+    }
+    /**
+   * Delete cache entry
+   */ delete(key) {
+        return this.cache.delete(key);
+    }
+    /**
+   * Clear cache
+   */ clear() {
+        this.cache.clear();
+    }
+    /**
+   * Get cache size
+   */ size() {
+        return this.cache.size;
+    }
+    /**
+   * Get cache statistics
+   */ getStats() {
+        const entries = Array.from(this.cache.entries()).map(([key, entry])=>({
+                key,
+                age: Date.now() - entry.timestamp,
+                ttl: entry.ttl,
+                size: JSON.stringify(entry.data).length
+            }));
+        return {
+            size: this.cache.size,
+            maxSize: this.maxSize,
+            entries
+        };
+    }
+    /**
+   * Clean up expired entries
+   */ cleanup() {
+        const now = Date.now();
+        const keysToDelete = [];
+        for (const [key, entry] of this.cache.entries()){
+            if (now - entry.timestamp >= entry.ttl) {
+                keysToDelete.push(key);
+            }
+        }
+        for (const key of keysToDelete){
+            this.cache.delete(key);
+        }
+    }
+    /**
+   * Destroy cache store
+   */ destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+        }
+        this.clear();
+    }
+    constructor(maxSize = 1000, cleanupIntervalMs = 60000){
+        _define_property(this, "cache", new Map());
+        _define_property(this, "maxSize", void 0);
+        _define_property(this, "cleanupInterval", void 0);
+        this.maxSize = maxSize;
+        // Clean up expired entries periodically
+        this.cleanupInterval = setInterval(()=>{
+            this.cleanup();
+        }, cleanupIntervalMs);
+    }
+}