hedgequantx 1.8.48 → 2.3.0

package/src/services/session.js

@@ -6,16 +6,18 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { encrypt, decrypt, maskSensitive } = require('../security');
-const { ProjectXService } = require('./projectx');
-const { RithmicService } = require('./rithmic');
-const { TradovateService } = require('./tradovate');
+const crypto = require('crypto');
+const { encrypt, decrypt, maskSensitive, secureWipe } = require('../security/encryption');
+const { SECURITY } = require('../config/settings');
+const { logger } = require('../utils/logger');
 
-const SESSION_DIR = path.join(os.homedir(), '.hedgequantx');
-const SESSION_FILE = path.join(SESSION_DIR, 'session.enc');
+const log = logger.scope('Session');
+
+const SESSION_DIR = path.join(os.homedir(), SECURITY.SESSION_DIR);
+const SESSION_FILE = path.join(SESSION_DIR, SECURITY.SESSION_FILE);
 
 /**
- * Secure session storage with AES-256 encryption
+ * Secure session storage with AES-256-GCM encryption
  */
 const storage = {
   /**
@@ -24,22 +26,27 @@ const storage = {
    */
   _ensureDir() {
     if (!fs.existsSync(SESSION_DIR)) {
-      fs.mkdirSync(SESSION_DIR, { recursive: true, mode: 0o700 });
+      fs.mkdirSync(SESSION_DIR, { recursive: true, mode: SECURITY.DIR_PERMISSIONS });
+      log.debug('Created session directory');
     }
   },
 
   /**
    * Saves sessions with encryption
    * @param {Array} sessions - Sessions to save
+   * @returns {boolean} Success status
    */
   save(sessions) {
     try {
       this._ensureDir();
       const data = JSON.stringify(sessions);
       const encrypted = encrypt(data);
-      fs.writeFileSync(SESSION_FILE, encrypted, { mode: 0o600 });
-    } catch (e) {
-      // Silently fail - don't expose errors
+      fs.writeFileSync(SESSION_FILE, encrypted, { mode: SECURITY.FILE_PERMISSIONS });
+      log.debug('Session saved', { count: sessions.length });
+      return true;
+    } catch (err) {
+      log.error('Failed to save session', { error: err.message });
+      return false;
     }
   },
 
@@ -49,34 +56,59 @@ const storage = {
    */
   load() {
     try {
-      if (fs.existsSync(SESSION_FILE)) {
-        const encrypted = fs.readFileSync(SESSION_FILE, 'utf8');
-        const decrypted = decrypt(encrypted);
-        if (decrypted) {
-          return JSON.parse(decrypted);
-        }
+      if (!fs.existsSync(SESSION_FILE)) {
+        return [];
+      }
+      
+      const encrypted = fs.readFileSync(SESSION_FILE, 'utf8');
+      const decrypted = decrypt(encrypted);
+      
+      if (!decrypted) {
+        log.warn('Session decryption failed - clearing');
+        this.clear();
+        return [];
       }
-    } catch (e) {
-      // Session corrupted or from different machine - clear it
+      
+      const sessions = JSON.parse(decrypted);
+      log.debug('Session loaded', { count: sessions.length });
+      return sessions;
+    } catch (err) {
+      log.error('Failed to load session', { error: err.message });
       this.clear();
+      return [];
     }
-    return [];
   },
 
   /**
    * Securely clears session data
+   * @returns {boolean} Success status
    */
   clear() {
     try {
       if (fs.existsSync(SESSION_FILE)) {
         // Overwrite with random data before deleting
         const size = fs.statSync(SESSION_FILE).size;
-        fs.writeFileSync(SESSION_FILE, require('crypto').randomBytes(size));
+        if (size > 0) {
+          fs.writeFileSync(SESSION_FILE, crypto.randomBytes(size));
+        }
         fs.unlinkSync(SESSION_FILE);
+        log.debug('Session cleared securely');
       }
-    } catch (e) {
-      // Ignore errors
+      return true;
+    } catch (err) {
+      log.error('Failed to clear session', { error: err.message });
+      return false;
     }
+  },
+};
+
+// Lazy load services to avoid circular dependencies
+let ProjectXService, RithmicService, TradovateService;
+const loadServices = () => {
+  if (!ProjectXService) {
+    ({ ProjectXService } = require('./projectx'));
+    ({ RithmicService } = require('./rithmic'));
+    ({ TradovateService } = require('./tradovate'));
   }
 };
 
@@ -84,12 +116,12 @@ const storage = {
  * Multi-connection manager with secure token handling
  */
 const connections = {
-  /** @type {Array} Active connections */
+  /** @type {Array<{type: string, service: Object, propfirm: string, propfirmKey: string, token: string, connectedAt: Date}>} */
   services: [],
 
   /**
    * Adds a new connection
-   * @param {string} type - Connection type (projectx, rithmic, etc.)
+   * @param {string} type - Connection type (projectx, rithmic, tradovate)
    * @param {Object} service - Service instance
    * @param {string} [propfirm] - PropFirm name
    * @param {string} [token] - Auth token
@@ -99,10 +131,12 @@ const connections = {
       type,
       service,
       propfirm,
+      propfirmKey: service.propfirmKey,
       token: token || service.token,
-      connectedAt: new Date()
+      connectedAt: new Date(),
     });
     this.saveToStorage();
+    log.info('Connection added', { type, propfirm: propfirm || type });
   },
 
   /**
@@ -119,12 +153,12 @@ const connections = {
       if (conn.type === 'projectx') {
         session.token = conn.service.token || conn.token;
       } else if (conn.type === 'rithmic' || conn.type === 'tradovate') {
-        // Save encrypted credentials for reconnection
         session.credentials = conn.service.credentials;
       }
       
       return session;
     });
+    
     storage.save(sessions);
   },
 
@@ -133,84 +167,110 @@ const connections = {
    * @returns {Promise<boolean>} True if sessions were restored
    */
   async restoreFromStorage() {
+    loadServices();
     const sessions = storage.load();
     
+    if (!sessions.length) {
+      return false;
+    }
+    
+    log.info('Restoring sessions', { count: sessions.length });
+    
     for (const session of sessions) {
       try {
-        if (session.type === 'projectx' && session.token) {
-          const propfirmKey = session.propfirmKey || session.propfirm.toLowerCase().replace(/ /g, '_');
-          const service = new ProjectXService(propfirmKey);
-          service.token = session.token;
-
-          // Validate token is still valid
-          const userResult = await service.getUser();
-          if (userResult.success) {
-            this.services.push({
-              type: session.type,
-              service,
-              propfirm: session.propfirm,
-              propfirmKey: propfirmKey,
-              token: session.token,
-              connectedAt: new Date()
-            });
-          }
-        } else if (session.type === 'rithmic' && session.credentials) {
-          const propfirmKey = session.propfirmKey || 'apex_rithmic';
-          const service = new RithmicService(propfirmKey);
-          
-          // Try to reconnect
-          const result = await service.login(session.credentials.username, session.credentials.password);
-          if (result.success) {
-            this.services.push({
-              type: session.type,
-              service,
-              propfirm: session.propfirm,
-              propfirmKey: propfirmKey,
-              connectedAt: new Date()
-            });
-          }
-        } else if (session.type === 'tradovate' && session.credentials) {
-          const propfirmKey = session.propfirmKey || 'tradovate';
-          const service = new TradovateService(propfirmKey);
-          
-          // Try to reconnect
-          const result = await service.login(session.credentials.username, session.credentials.password);
-          if (result.success) {
-            this.services.push({
-              type: session.type,
-              service,
-              propfirm: session.propfirm,
-              propfirmKey: propfirmKey,
-              connectedAt: new Date()
-            });
-          }
-        }
-      } catch (e) {
-        // Invalid session - skip
+        await this._restoreSession(session);
+      } catch (err) {
+        log.warn('Failed to restore session', { type: session.type, error: err.message });
       }
     }
     
     return this.services.length > 0;
   },
 
+  /**
+   * Restores a single session
+   * @private
+   */
+  async _restoreSession(session) {
+    const { type, propfirm, propfirmKey } = session;
+    
+    if (type === 'projectx' && session.token) {
+      const service = new ProjectXService(propfirmKey || 'topstep');
+      service.token = session.token;
+      
+      const userResult = await service.getUser();
+      if (userResult.success) {
+        this.services.push({
+          type,
+          service,
+          propfirm,
+          propfirmKey,
+          token: session.token,
+          connectedAt: new Date(),
+        });
+        log.debug('ProjectX session restored');
+      }
+    } else if (type === 'rithmic' && session.credentials) {
+      const service = new RithmicService(propfirmKey || 'apex_rithmic');
+      const result = await service.login(session.credentials.username, session.credentials.password);
+      
+      if (result.success) {
+        this.services.push({
+          type,
+          service,
+          propfirm,
+          propfirmKey,
+          connectedAt: new Date(),
+        });
+        log.debug('Rithmic session restored');
+      }
+    } else if (type === 'tradovate' && session.credentials) {
+      const service = new TradovateService(propfirmKey || 'tradovate');
+      const result = await service.login(session.credentials.username, session.credentials.password);
+      
+      if (result.success) {
+        this.services.push({
+          type,
+          service,
+          propfirm,
+          propfirmKey,
+          connectedAt: new Date(),
+        });
+        log.debug('Tradovate session restored');
+      }
+    }
+  },
+
   /**
    * Removes a connection by index
    * @param {number} index - Connection index
    */
   remove(index) {
-    if (index >= 0 && index < this.services.length) {
-      const conn = this.services[index];
-      if (conn.service && conn.service.logout) {
+    if (index < 0 || index >= this.services.length) return;
+    
+    const conn = this.services[index];
+    
+    if (conn.service?.logout) {
+      try {
         conn.service.logout();
+      } catch (err) {
+        log.warn('Logout failed', { error: err.message });
       }
-      this.services.splice(index, 1);
-      this.saveToStorage();
     }
+    
+    // Clear credentials from memory
+    if (conn.service?.credentials) {
+      conn.service.credentials = null;
+    }
+    
+    this.services.splice(index, 1);
+    this.saveToStorage();
+    log.info('Connection removed', { type: conn.type });
   },
 
   /**
    * Gets all connections
-   * @returns {Array} All connections
+   * @returns {Array}
    */
   getAll() {
     return this.services;
@@ -219,7 +279,7 @@ const connections = {
   /**
    * Gets connections by type
    * @param {string} type - Connection type
-   * @returns {Array} Filtered connections
+   * @returns {Array}
    */
   getByType(type) {
     return this.services.filter(c => c.type === type);
@@ -227,7 +287,7 @@ const connections = {
 
   /**
    * Gets connection count
-   * @returns {number} Number of connections
+   * @returns {number}
    */
   count() {
     return this.services.length;
@@ -235,7 +295,7 @@ const connections = {
 
   /**
    * Gets all accounts from all connections
-   * @returns {Promise<Array>} All accounts
+   * @returns {Promise<Array>}
    */
   async getAllAccounts() {
     const allAccounts = [];
@@ -243,18 +303,19 @@ const connections = {
     for (const conn of this.services) {
       try {
         const result = await conn.service.getTradingAccounts();
+        
         if (result.success && result.accounts) {
-          result.accounts.forEach(account => {
+          for (const account of result.accounts) {
             allAccounts.push({
               ...account,
               connectionType: conn.type,
               propfirm: conn.propfirm || conn.type,
-              service: conn.service
+              service: conn.service,
             });
-          });
+          }
         }
-      } catch (e) {
-        // Skip failed connections
+      } catch (err) {
+        log.warn('Failed to get accounts', { type: conn.type, error: err.message });
       }
     }
     
@@ -263,31 +324,27 @@ const connections = {
 
   /**
    * Gets the service for a specific account
-   * @param {string|number} accountId - Account ID to find
-   * @returns {Object|null} Service instance or null
+   * @param {string|number} accountId - Account ID
+   * @returns {Object|null}
    */
   getServiceForAccount(accountId) {
     for (const conn of this.services) {
-      try {
-        // Check if this service has this account
-        if (conn.service && conn.service.accounts) {
-          const found = conn.service.accounts.find(acc => 
-            acc.accountId == accountId || 
-            acc.rithmicAccountId == accountId ||
-            acc.accountName == accountId
-          );
-          if (found) return conn.service;
-        }
-      } catch (e) {
-        // Skip
-      }
+      if (!conn.service?.accounts) continue;
+      
+      const found = conn.service.accounts.find(acc =>
+        acc.accountId == accountId ||
+        acc.rithmicAccountId == accountId ||
+        acc.accountName == accountId
+      );
+      
+      if (found) return conn.service;
     }
     return null;
   },
 
   /**
    * Checks if any connection is active
-   * @returns {boolean} True if connected
+   * @returns {boolean}
    */
   isConnected() {
     return this.services.length > 0;
@@ -297,27 +354,40 @@ const connections = {
    * Disconnects all connections and clears sessions
    */
   disconnectAll() {
-    this.services.forEach(conn => {
-      if (conn.service && conn.service.logout) {
-        conn.service.logout();
+    for (const conn of this.services) {
+      try {
+        if (conn.service?.logout) {
+          conn.service.logout();
+        }
+        if (conn.service?.disconnect) {
+          conn.service.disconnect();
+        }
+        // Clear credentials
+        if (conn.service?.credentials) {
+          conn.service.credentials = null;
+        }
+      } catch (err) {
+        log.warn('Disconnect failed', { type: conn.type, error: err.message });
       }
-    });
+    }
+    
     this.services = [];
     storage.clear();
+    log.info('All connections disconnected');
   },
 
   /**
    * Gets masked connection info for logging
-   * @returns {Array} Masked connection info
+   * @returns {Array}
    */
   getInfo() {
     return this.services.map(conn => ({
       type: conn.type,
       propfirm: conn.propfirm,
       token: maskSensitive(conn.token),
-      connectedAt: conn.connectedAt
+      connectedAt: conn.connectedAt,
     }));
-  }
+  },
 };
 
 module.exports = { storage, connections };