devspy-tool 1.0.0

package/routes/scan.js

@@ -0,0 +1,334 @@
+const express = require("express");
+const router = express.Router();
+const { SessionEngine } = require("../puppeteer/interceptor");
+const { sessionStore, SESSION_TTL_MS } = require("../puppeteer/sessionStore");
+
+// ─── Active manual sessions (one at a time for local dev tool) ──────────────
+let activeSession = null;
+let activeManualScanId = null;
+
+function isValidUrl(string) {
+  try {
+    const url = new URL(string);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// ─── POST /api/scan — Automated scan ────────────────────────────────────────
+
+router.post("/", async (req, res) => {
+  const {
+    url,
+    waitTime = 10000,
+    login = null,
+    explorePages = false,
+    postLoginUrl = null,
+  } = req.body;
+
+  if (!url) {
+    return res.status(400).json({ success: false, error: "URL is required." });
+  }
+  if (!isValidUrl(url)) {
+    return res.status(400).json({
+      success: false,
+      error: "Invalid URL. Must start with http:// or https://",
+    });
+  }
+
+  try {
+    const engine = new SessionEngine();
+
+    // keepAlive=true so the browser stays open for replay
+    const requests = await engine.runAutoScan(url, {
+      waitTime,
+      login,
+      deepExplore: explorePages,
+      postLoginUrl,
+      keepAlive: true,
+    });
+
+    // Store the session for replay
+    const scanId = sessionStore.store(engine);
+
+    return res.json({
+      success: true,
+      scanId,
+      scannedUrl: url,
+      count: requests.length,
+      requests,
+      sessionTTL: SESSION_TTL_MS,
+    });
+  } catch (err) {
+    console.error("[Scan Error]", err.message);
+    return res.status(500).json({
+      success: false,
+      error: "Scan failed. " + err.message,
+    });
+  }
+});
+
+// ─── POST /api/scan/manual — Start manual session ───────────────────────────
+
+router.post("/manual", async (req, res) => {
+  if (process.env.RENDER) {
+    return res.status(403).json({
+      success: false,
+      error: "Manual mode is only available when running DevSpy locally via npx due to browser requirements.",
+    });
+  }
+
+  // Only one manual session at a time
+  if (activeSession && activeSession.isRunning) {
+    return res.status(409).json({
+      success: false,
+      error: "A manual session is already running. Stop it first.",
+    });
+  }
+
+  const { url, login = null, postLoginUrl = null } = req.body;
+
+  if (!url || !isValidUrl(url)) {
+    return res.status(400).json({ success: false, error: "Valid URL is required." });
+  }
+
+  try {
+    activeSession = new SessionEngine();
+    await activeSession.startManualSession(url, { login, postLoginUrl });
+
+    return res.json({
+      success: true,
+      message: "Manual session started. Browser is open.",
+      streamUrl: "/api/scan/manual/stream",
+    });
+  } catch (err) {
+    console.error("[Manual Start Error]", err.message);
+    activeSession = null;
+    return res.status(500).json({
+      success: false,
+      error: "Failed to start manual session: " + err.message,
+    });
+  }
+});
+
+// ─── GET /api/scan/manual/stream — SSE live stream of captured APIs ─────────
+
+router.get("/manual/stream", (req, res) => {
+  if (!activeSession || !activeSession.isRunning) {
+    return res.status(404).json({ success: false, error: "No active manual session." });
+  }
+
+  // Set up SSE
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+    "Access-Control-Allow-Origin": process.env.FRONTEND_URL || "*",
+    "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept",
+    "Access-Control-Allow-Methods": "GET, OPTIONS",
+  });
+
+  // Send initial count
+  res.write(`data: ${JSON.stringify({ type: "init", count: activeSession.captureCount })}\n\n`);
+
+  // Stream new captures
+  const onCapture = (entry) => {
+    res.write(`data: ${JSON.stringify({ type: "api", entry })}\n\n`);
+  };
+
+  activeSession.on("apiCaptured", onCapture);
+
+  // Heartbeat every 15s to keep connection alive
+  const heartbeat = setInterval(() => {
+    res.write(`data: ${JSON.stringify({ type: "heartbeat", count: activeSession?.captureCount || 0 })}\n\n`);
+  }, 15000);
+
+  // Cleanup on disconnect
+  req.on("close", () => {
+    clearInterval(heartbeat);
+    if (activeSession) {
+      activeSession.removeListener("apiCaptured", onCapture);
+    }
+  });
+});
+
+// ─── POST /api/scan/manual/stop — Stop manual session ───────────────────────
+
+router.post("/manual/stop", async (req, res) => {
+  if (!activeSession || !activeSession.isRunning) {
+    return res.status(404).json({ success: false, error: "No active manual session." });
+  }
+
+  try {
+    // keepAlive=true so the browser stays open for replay
+    const results = await activeSession.stopManualSession(true);
+
+    // Store the session for replay
+    const scanId = sessionStore.store(activeSession);
+    activeManualScanId = scanId;
+    activeSession = null;
+
+    return res.json({
+      success: true,
+      scanId,
+      count: results.length,
+      requests: results,
+      sessionTTL: SESSION_TTL_MS,
+    });
+  } catch (err) {
+    console.error("[Manual Stop Error]", err.message);
+    activeSession = null;
+    return res.status(500).json({
+      success: false,
+      error: "Failed to stop session: " + err.message,
+    });
+  }
+});
+
+// ─── GET /api/scan/manual/status — Check session status ─────────────────────
+
+router.get("/manual/status", (req, res) => {
+  res.json({
+    success: true,
+    running: !!activeSession?.isRunning,
+    count: activeSession?.captureCount || 0,
+  });
+});
+
+// ─── POST /api/scan/replay — Session-aware replay ───────────────────────────
+//
+// Two modes:
+//   1. scanId provided → replay inside Puppeteer page context (authenticated)
+//   2. No scanId       → plain server-side fetch (fallback, may fail for auth APIs)
+
+router.post("/replay", async (req, res) => {
+  const { scanId, url, method = "GET", headers = {}, body } = req.body;
+
+  if (!url) {
+    return res.status(400).json({ success: false, error: "URL is required." });
+  }
+
+  // ── Mode 1: Session-aware replay ──
+  if (scanId) {
+    const engine = sessionStore.get(scanId);
+
+    if (!engine) {
+      return res.status(404).json({
+        success: false,
+        error: "Session expired or not found. Try a plain replay or re-scan.",
+        sessionExpired: true,
+      });
+    }
+
+    if (!engine.isAlive) {
+      await sessionStore.destroy(scanId);
+      return res.status(410).json({
+        success: false,
+        error: "Browser session has closed. Re-scan to create a new session.",
+        sessionExpired: true,
+      });
+    }
+
+    try {
+      const result = await engine.replayInContext({
+        url,
+        method,
+        headers: headers || {},
+        body: body || undefined,
+      });
+
+      // Extend the session TTL
+      sessionStore.touch(scanId);
+
+      return res.json({
+        success: true,
+        mode: "session",
+        status: result.status,
+        statusText: result.statusText,
+        headers: result.headers,
+        body: result.body,
+      });
+    } catch (err) {
+      console.error("[Replay Error]", err.message);
+      return res.status(500).json({
+        success: false,
+        mode: "session",
+        error: "Session replay failed: " + err.message,
+      });
+    }
+  }
+
+  // ── Mode 2: Plain server-side fetch (fallback) ──
+  try {
+    const fetchOptions = {
+      method,
+      headers: headers || {},
+    };
+
+    // Attach body for non-GET/HEAD requests
+    if (body && method !== "GET" && method !== "HEAD") {
+      fetchOptions.body =
+        typeof body === "string" ? body : JSON.stringify(body);
+    }
+
+    const upstream = await fetch(url, fetchOptions);
+
+    // Collect response headers
+    const responseHeaders = {};
+    upstream.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+
+    let responseBody;
+    try {
+      responseBody = await upstream.text();
+    } catch {
+      responseBody = "";
+    }
+
+    return res.json({
+      success: true,
+      mode: "proxy",
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: responseHeaders,
+      body: responseBody,
+    });
+  } catch (err) {
+    console.error("[Replay Error]", err.message);
+    return res.status(500).json({
+      success: false,
+      error: "Replay failed: " + err.message,
+    });
+  }
+});
+
+// ─── GET /api/scan/session/status — Check if a session is alive ─────────────
+
+router.get("/session/status", (req, res) => {
+  const { scanId } = req.query;
+  if (!scanId) {
+    return res.json({
+      success: true,
+      sessions: sessionStore.list(),
+    });
+  }
+
+  const engine = sessionStore.get(scanId);
+  res.json({
+    success: true,
+    alive: !!(engine && engine.isAlive),
+    scanId,
+  });
+});
+
+// ─── DELETE /api/scan/session/:scanId — Close a session ─────────────────────
+
+router.delete("/session/:scanId", async (req, res) => {
+  const { scanId } = req.params;
+  await sessionStore.destroy(scanId);
+  res.json({ success: true, message: `Session ${scanId} closed.` });
+});
+
+module.exports = router;

package/server.js

@@ -0,0 +1,44 @@
+const express = require("express");
+const cors = require("cors");
+const path = require("path");
+const fs = require("fs");
+const { PORT } = require("./config");
+const scanRoute = require("./routes/scan");
+
+const app = express();
+
+const corsOptions = {
+    origin: process.env.FRONTEND_URL || "*",
+    methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allowedHeaders: ["Content-Type", "Authorization"]
+};
+app.use(cors(corsOptions)); // allow React frontend to call this later
+app.use(express.json());
+
+// Routes
+app.get("/health", (req, res) => {
+    res.json({ status: "Backend is running" });
+});
+
+app.get("/ping", (req, res) => {
+    res.send("pong");
+});
+
+app.use("/api/scan", scanRoute);
+
+// Serve frontend dist if it exists (for NPX package)
+const distPath = path.join(__dirname, "dist");
+if (fs.existsSync(distPath)) {
+    app.use(express.static(distPath));
+    app.use((req, res, next) => {
+        if (req.method === "GET" && !req.path.startsWith("/api")) {
+            res.sendFile(path.join(distPath, "index.html"));
+        } else {
+            next();
+        }
+    });
+}
+
+app.listen(PORT, () => {
+    console.log(`[Server] Running on http://localhost:${PORT}`);
+});