elsabro 2.3.0 → 3.7.0

package/templates/enterprise-sso-config.json

@@ -0,0 +1,438 @@
+{
+  "sso": {
+    "enabled": true,
+    "version": "3.6.0",
+
+    "manager": {
+      "defaultProvider": null,
+      "sessionTimeout": 28800,
+      "singleLogout": true,
+      "mfaRequired": false,
+      "allowedDomains": [],
+      "ipAllowlist": []
+    },
+
+    "tokenEncryption": {
+      "algorithm": "RS256",
+      "publicKeyPath": ".elsabro/keys/sso-public.pem",
+      "privateKeyPath": ".elsabro/keys/sso-private.pem",
+      "keyRotationDays": 90,
+      "issuer": "elsabro",
+      "audience": "elsabro-app"
+    },
+
+    "tokens": {
+      "accessTokenTTL": 3600,
+      "refreshTokenTTL": 604800,
+      "idTokenTTL": 3600,
+      "encryptSensitiveTokens": true
+    },
+
+    "sessions": {
+      "maxConcurrentPerUser": 5,
+      "absoluteTimeout": 86400,
+      "inactivityTimeout": 28800,
+      "bindToIP": false,
+      "bindToUserAgent": false,
+      "persistSessions": true,
+      "sessionStorePath": ".elsabro/sessions"
+    },
+
+    "mfa": {
+      "enabled": false,
+      "required": false,
+      "allowedMethods": ["totp", "sms", "email", "push", "webauthn"],
+      "rememberDevice": true,
+      "rememberDeviceDays": 30,
+      "requireForSensitiveActions": true,
+      "sensitiveActions": [
+        "settings.update",
+        "password.change",
+        "mfa.disable",
+        "api-key.create",
+        "user.delete"
+      ]
+    },
+
+    "providers": {
+      "okta": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Okta",
+        "clientId": "${OKTA_CLIENT_ID}",
+        "clientSecret": "${OKTA_CLIENT_SECRET}",
+        "issuer": "https://${OKTA_DOMAIN}/oauth2/default",
+        "scopes": ["openid", "profile", "email", "groups"],
+        "responseType": "code",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/okta",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "groups": "groups"
+        },
+        "roleMapping": {
+          "Everyone": "user",
+          "Engineering": "developer",
+          "Admins": "admin",
+          "Security": "security-admin"
+        },
+        "clockTolerance": 120
+      },
+
+      "azure-ad": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Azure AD",
+        "clientId": "${AZURE_CLIENT_ID}",
+        "clientSecret": "${AZURE_CLIENT_SECRET}",
+        "issuer": "https://login.microsoftonline.com/${AZURE_TENANT_ID}/v2.0",
+        "scopes": ["openid", "profile", "email", "User.Read", "GroupMember.Read.All"],
+        "responseType": "code",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/azure",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "groups": "groups",
+          "customClaims": {
+            "department": "department",
+            "jobTitle": "jobTitle",
+            "officeLocation": "officeLocation"
+          }
+        },
+        "roleMapping": {
+          "Global Administrators": "admin",
+          "Application Administrators": "app-admin",
+          "Developers": "developer",
+          "Users": "user"
+        },
+        "clockTolerance": 120
+      },
+
+      "google": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Google Workspace",
+        "clientId": "${GOOGLE_CLIENT_ID}",
+        "clientSecret": "${GOOGLE_CLIENT_SECRET}",
+        "issuer": "https://accounts.google.com",
+        "scopes": [
+          "openid",
+          "profile",
+          "email",
+          "https://www.googleapis.com/auth/admin.directory.group.readonly"
+        ],
+        "responseType": "code",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/google",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "hostedDomain": null,
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "customClaims": {
+            "picture": "picture",
+            "hostedDomain": "hd"
+          }
+        },
+        "clockTolerance": 120
+      },
+
+      "auth0": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Auth0",
+        "clientId": "${AUTH0_CLIENT_ID}",
+        "clientSecret": "${AUTH0_CLIENT_SECRET}",
+        "issuer": "https://${AUTH0_DOMAIN}/",
+        "scopes": ["openid", "profile", "email"],
+        "responseType": "code",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/auth0",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "roles": "https://app.example.com/roles",
+          "customClaims": {
+            "permissions": "https://app.example.com/permissions"
+          }
+        },
+        "clockTolerance": 120
+      },
+
+      "keycloak": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Keycloak",
+        "clientId": "${KEYCLOAK_CLIENT_ID}",
+        "clientSecret": "${KEYCLOAK_CLIENT_SECRET}",
+        "issuer": "${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}",
+        "scopes": ["openid", "profile", "email", "roles"],
+        "responseType": "code",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/keycloak",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "groups": "groups",
+          "roles": "realm_access.roles"
+        },
+        "roleMapping": {
+          "realm-admin": "admin",
+          "realm-user": "user",
+          "app-developer": "developer"
+        },
+        "clockTolerance": 120
+      },
+
+      "generic-saml": {
+        "enabled": false,
+        "type": "saml",
+        "name": "Corporate SAML IdP",
+        "entityId": "${APP_URL}/saml/metadata",
+        "assertionConsumerServiceUrl": "${APP_URL}/api/auth/callback/saml",
+        "singleLogoutServiceUrl": "${APP_URL}/api/auth/logout/saml",
+        "certificatePath": ".elsabro/certs/saml-sp.crt",
+        "privateKeyPath": ".elsabro/certs/saml-sp.key",
+        "signAuthnRequests": true,
+        "wantAssertionsSigned": true,
+        "wantResponseSigned": true,
+        "signatureAlgorithm": "sha256",
+        "identityProviderMetadataUrl": "${IDP_METADATA_URL}",
+        "identityProviderMetadata": null,
+        "attributeMapping": {
+          "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+          "name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+          "firstName": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
+          "lastName": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
+          "groups": "http://schemas.xmlsoap.org/claims/Group",
+          "customMappings": {
+            "department": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department",
+            "employeeId": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/employeeid"
+          }
+        },
+        "roleMapping": {
+          "Administrators": "admin",
+          "Developers": "developer",
+          "Users": "user"
+        },
+        "allowedClockSkewSeconds": 120
+      },
+
+      "generic-oidc": {
+        "enabled": false,
+        "type": "oidc",
+        "name": "Custom OIDC Provider",
+        "clientId": "${OIDC_CLIENT_ID}",
+        "clientSecret": "${OIDC_CLIENT_SECRET}",
+        "issuer": "${OIDC_ISSUER}",
+        "authorizationEndpoint": null,
+        "tokenEndpoint": null,
+        "userInfoEndpoint": null,
+        "jwksUri": null,
+        "endSessionEndpoint": null,
+        "scopes": ["openid", "profile", "email"],
+        "responseType": "code",
+        "responseMode": "query",
+        "usePKCE": true,
+        "redirectUri": "${APP_URL}/api/auth/callback/oidc",
+        "postLogoutRedirectUri": "${APP_URL}",
+        "attributeMapping": {
+          "email": "email",
+          "name": "name",
+          "firstName": "given_name",
+          "lastName": "family_name",
+          "groups": "groups",
+          "roles": "roles"
+        },
+        "clockTolerance": 120
+      }
+    },
+
+    "scim": {
+      "enabled": false,
+      "endpoint": "${SCIM_ENDPOINT}",
+      "bearerToken": "${SCIM_BEARER_TOKEN}",
+      "syncInterval": 3600000,
+      "provisionOnSync": true,
+      "deprovisionOnSync": false,
+      "userSchema": "urn:ietf:params:scim:schemas:core:2.0:User",
+      "groupSchema": "urn:ietf:params:scim:schemas:core:2.0:Group",
+      "pageSize": 100,
+      "retryAttempts": 3,
+      "retryDelay": 5000
+    },
+
+    "authorization": {
+      "jitProvisioning": true,
+      "defaultRole": "user",
+      "syncGroupsOnLogin": true,
+      "removeStaleGroups": false,
+      "groupAttribute": "groups",
+      "roleAttribute": "roles",
+      "roleMappingStrategy": "merge",
+      "adminGroups": ["Administrators", "Admins", "admin"],
+      "customRoleMappings": {}
+    },
+
+    "security": {
+      "stateTokenTTL": 600,
+      "nonceTTL": 600,
+      "csrfProtection": true,
+      "httpOnly": true,
+      "secure": true,
+      "sameSite": "lax",
+      "allowedRedirectDomains": [],
+      "blocklistTokens": true,
+      "revokeOnLogout": true
+    },
+
+    "audit": {
+      "enabled": true,
+      "logPath": ".elsabro/logs/sso-audit.log",
+      "logLevel": "info",
+      "includeTokenDetails": false,
+      "retentionDays": 90,
+      "events": {
+        "auth.initiated": true,
+        "auth.completed": true,
+        "auth.failed": true,
+        "auth.ip_blocked": true,
+        "auth.domain_blocked": true,
+        "session.created": true,
+        "session.refreshed": true,
+        "session.terminated": true,
+        "logout": true,
+        "mfa.required": true,
+        "mfa.verified": true,
+        "mfa.failed": true,
+        "provider.registered": true,
+        "provider.updated": true,
+        "scim.sync.started": true,
+        "scim.sync.completed": true,
+        "scim.user.created": true,
+        "scim.user.updated": true,
+        "scim.user.deactivated": true
+      },
+      "alerts": {
+        "enabled": true,
+        "multipleAuthFailures": {
+          "enabled": true,
+          "threshold": 5,
+          "windowMinutes": 5
+        },
+        "unusualLoginLocation": {
+          "enabled": false,
+          "trustedCountries": []
+        },
+        "afterHoursLogin": {
+          "enabled": false,
+          "startHour": 8,
+          "endHour": 18,
+          "timezone": "UTC"
+        }
+      }
+    },
+
+    "ui": {
+      "loginPath": "/login",
+      "callbackPath": "/api/auth/callback",
+      "logoutPath": "/api/auth/logout",
+      "errorPath": "/auth/error",
+      "selectProviderPath": "/auth/select-provider",
+      "showProviderSelector": true,
+      "rememberLastProvider": true,
+      "brandingEnabled": true,
+      "customLogoUrl": null,
+      "customCss": null
+    },
+
+    "cli": {
+      "commands": {
+        "configure": {
+          "enabled": true,
+          "interactive": true
+        },
+        "status": {
+          "enabled": true,
+          "showSecrets": false
+        },
+        "test": {
+          "enabled": true,
+          "timeout": 30000
+        },
+        "sessions": {
+          "enabled": true,
+          "maxDisplay": 100
+        },
+        "scim": {
+          "enabled": true,
+          "dryRun": false
+        },
+        "metadata": {
+          "enabled": true,
+          "formats": ["xml", "json"]
+        },
+        "certs": {
+          "enabled": true,
+          "autoRotate": false
+        },
+        "audit": {
+          "enabled": true,
+          "exportFormats": ["json", "csv"]
+        }
+      }
+    },
+
+    "integration": {
+      "rbacManager": {
+        "enabled": true,
+        "syncRolesOnLogin": true
+      },
+      "auditLogger": {
+        "enabled": true,
+        "logAllEvents": true
+      },
+      "secretsVault": {
+        "enabled": true,
+        "storeTokens": false
+      },
+      "eventBus": {
+        "enabled": true,
+        "publishEvents": true
+      }
+    },
+
+    "advanced": {
+      "debug": false,
+      "traceRequests": false,
+      "mockProviders": false,
+      "bypassForDevelopment": false,
+      "developmentEmails": [],
+      "customMiddleware": [],
+      "hooks": {
+        "beforeAuth": null,
+        "afterAuth": null,
+        "beforeLogout": null,
+        "afterLogout": null,
+        "onProvisionUser": null,
+        "onUpdateUser": null
+      }
+    }
+  }
+}

package/templates/events-config.json

@@ -0,0 +1,148 @@
+{
+  "events": {
+    "enabled": true,
+    "version": "1.0.0",
+
+    "bus": {
+      "maxListeners": 100,
+      "defaultTimeout": 30000,
+      "errorHandling": "log",
+      "asyncDelivery": true
+    },
+
+    "store": {
+      "enabled": true,
+      "backend": "file",
+      "path": ".elsabro/events",
+      "retention": {
+        "maxEvents": 10000,
+        "maxAge": "30d"
+      },
+      "snapshots": {
+        "enabled": true,
+        "frequency": 100
+      },
+      "deadLetterQueue": {
+        "enabled": true,
+        "maxSize": 1000,
+        "retentionDays": 7
+      },
+      "indexing": {
+        "enabled": true,
+        "fields": ["topic", "correlationId", "timestamp"]
+      }
+    },
+
+    "webhooks": {
+      "enabled": true,
+      "endpoints": [],
+      "signing": {
+        "enabled": true,
+        "algorithm": "sha256",
+        "header": "X-ELSABRO-Signature"
+      },
+      "retry": {
+        "maxAttempts": 3,
+        "backoff": "exponential",
+        "initialDelay": 1000,
+        "maxDelay": 30000
+      },
+      "timeout": 30000,
+      "maxPayloadSize": 1048576
+    },
+
+    "topics": {
+      "agent": {
+        "started": { "retention": "7d", "indexed": true },
+        "completed": { "retention": "30d", "indexed": true },
+        "failed": { "retention": "90d", "indexed": true }
+      },
+      "flow": {
+        "started": { "retention": "7d", "indexed": true },
+        "node.entered": { "retention": "3d", "indexed": false },
+        "node.exited": { "retention": "3d", "indexed": false },
+        "completed": { "retention": "30d", "indexed": true },
+        "failed": { "retention": "90d", "indexed": true }
+      },
+      "task": {
+        "created": { "retention": "30d", "indexed": true },
+        "status.changed": { "retention": "30d", "indexed": true },
+        "completed": { "retention": "30d", "indexed": true }
+      },
+      "checkpoint": {
+        "created": { "retention": "90d", "indexed": true },
+        "restored": { "retention": "90d", "indexed": true }
+      },
+      "memory": {
+        "stored": { "retention": "7d", "indexed": false },
+        "retrieved": { "retention": "3d", "indexed": false },
+        "expired": { "retention": "7d", "indexed": false }
+      },
+      "sandbox": {
+        "started": { "retention": "7d", "indexed": true },
+        "completed": { "retention": "7d", "indexed": true },
+        "failed": { "retention": "30d", "indexed": true }
+      },
+      "interrupt": {
+        "triggered": { "retention": "30d", "indexed": true },
+        "resolved": { "retention": "30d", "indexed": true }
+      }
+    },
+
+    "subscriptions": {
+      "defaults": {
+        "ack": "auto",
+        "maxRetries": 3,
+        "retryDelay": 1000,
+        "timeout": 30000
+      },
+      "queues": {
+        "enabled": false,
+        "maxSize": 10000,
+        "persistence": "memory"
+      }
+    },
+
+    "projections": {
+      "enabled": true,
+      "autoRebuild": true,
+      "definitions": [
+        {
+          "name": "task-summary",
+          "events": ["task.*"],
+          "handler": "projections/task-summary.js"
+        },
+        {
+          "name": "agent-metrics",
+          "events": ["agent.*"],
+          "handler": "projections/agent-metrics.js"
+        },
+        {
+          "name": "flow-history",
+          "events": ["flow.*"],
+          "handler": "projections/flow-history.js"
+        }
+      ]
+    },
+
+    "monitoring": {
+      "enabled": true,
+      "metrics": {
+        "eventRate": true,
+        "deliveryLatency": true,
+        "errorRate": true,
+        "queueDepth": true
+      },
+      "alerts": {
+        "highErrorRate": {
+          "threshold": 0.1,
+          "window": "5m"
+        },
+        "highLatency": {
+          "threshold": 5000,
+          "window": "1m"
+        }
+      }
+    }
+  }
+}