hi-secure 1.0.0

package/src/managers/AuthManager.ts

@@ -0,0 +1,237 @@
+// import { JWTAdapter } from "../adapters/JWTAdapter.js";
+// import { GoogleAdapter } from "../adapters/GoggleAdapter.js";
+// import { AdapterError } from "../core/errors/AdapterError.js";
+// import { HttpError } from "../core/errors/HttpErrror.js";
+// import { Request, Response, NextFunction } from "express";
+// import { logError, logWarn, logInfo } from "../logging";
+
+// export interface AuthOptions {
+//     jwtSecret: string;
+//     jwtExpiresIn?: string | number | undefined;
+//     googleClientId?: string | undefined;
+// }
+
+// export class AuthManager {
+//     private jwtAdapter: JWTAdapter;
+//     private googleAdapter?: GoogleAdapter;
+
+//     constructor(opts: AuthOptions) {
+//         if (!opts.jwtSecret)
+//             throw new AdapterError("jwtSecret required in AuthOptions");
+
+//         logInfo("AuthManager initialized");
+
+//         this.jwtAdapter = new JWTAdapter({
+//             secret: opts.jwtSecret,
+//             expiresIn: opts.jwtExpiresIn ?? undefined,
+//         });
+
+//         if (opts.googleClientId) {
+//             this.googleAdapter = new GoogleAdapter(opts.googleClientId);
+//             logInfo("GoogleAdapter enabled");
+//         }
+//     }
+
+//     sign(payload: object, options?: { expiresIn?: string | number }) {
+//         logInfo("JWT Sign called");
+//         return this.jwtAdapter.sign(payload, options);
+//     }
+
+//     verify(token: string) {
+//         logInfo("JWT Verify called");
+//         return this.jwtAdapter.verify(token);
+//     }
+
+//     async verifyGoogleIdToken(idToken: string) {
+//         if (!this.googleAdapter)
+//             throw new AdapterError("GoogleAdapter not configured.");
+
+//         logInfo("Google ID Token verify called");
+
+//         try {
+//             return await this.googleAdapter.verifyIdToken(idToken);
+//         } catch (err: any) {
+//             logError("Google ID Token verification failed", { error: err?.message });
+//             throw HttpError.Unauthorized("Invalid Google ID token");
+//         }
+//     }
+
+//     protect(options?: { required?: boolean }) {
+//         const required = options?.required ?? true;
+
+//         return (req: Request, res: Response, next: NextFunction) => {
+//             const header = req.headers["authorization"] || req.headers["Authorization"];
+
+//             if (!header) {
+//                 if (required) {
+//                     logWarn("Missing Authorization header", {
+//                         path: req.path,
+//                         method: req.method
+//                     });
+//                     return next(HttpError.Unauthorized("Missing Authorization header"));
+//                 }
+//                 return next();
+//             }
+
+//             const [type, token] = String(header).split(" ");
+
+//             if (type !== "Bearer" || !token) {
+//                 logWarn("Invalid Authorization header", {
+//                     path: req.path,
+//                     method: req.method
+//                 });
+//                 return next(HttpError.Unauthorized("Invalid Authorization header"));
+//             }
+
+//             try {
+//                 const decoded = this.verify(token);
+//                 (req as any).auth = decoded;
+//                 return next();
+//             } catch (err: any) {
+//                 logError("JWT verify failed", {
+//                     error: err?.message,
+//                     path: req.path,
+//                     method: req.method
+//                 });
+//                 return next(HttpError.Unauthorized("Invalid or expired token"));
+//             }
+//         };
+//     }
+// }
+
+
+
+// src/managers/AuthManager.ts - FIXED
+import { JWTAdapter } from "../adapters/JWTAdapter.js";
+import { GoogleAdapter } from "../adapters/GoogleAdapter.js";
+import { AdapterError } from "../core/errors/AdapterError.js";
+import { HttpError } from "../core/errors/HttpErrror.js";
+import { Request, Response, NextFunction } from "express";
+import { logError, logWarn, logInfo } from "../logging";
+
+export interface AuthOptions {
+    jwtSecret: string;
+    jwtExpiresIn?: string | number;
+    googleClientId?: string;
+}
+
+export interface ProtectOptions {
+    required?: boolean;
+    roles?: string[];
+}
+
+export class AuthManager {
+    private jwtAdapter: JWTAdapter;
+    private googleAdapter?: GoogleAdapter;
+
+    constructor(opts: AuthOptions) {
+        if (!opts.jwtSecret) {
+            throw new AdapterError("jwtSecret required in AuthOptions");
+        }
+
+        if (opts.jwtSecret.length < 32) {
+            logWarn("⚠ JWT secret is less than 32 characters - consider using a stronger secret");
+        }
+
+        logInfo("AuthManager initialized");
+
+        this.jwtAdapter = new JWTAdapter({
+            secret: opts.jwtSecret,
+            expiresIn: opts.jwtExpiresIn ?? "1d",
+        });
+
+        if (opts.googleClientId) {
+            this.googleAdapter = new GoogleAdapter(opts.googleClientId);
+            logInfo("GoogleAdapter enabled");
+        }
+    }
+
+    sign(payload: object, options?: { expiresIn?: string | number, jti?: string }) {
+        logInfo("JWT Sign called");
+        return this.jwtAdapter.sign(payload, options);
+    }
+
+    verify(token: string) {
+        logInfo("JWT Verify called");
+        return this.jwtAdapter.verify(token);
+    }
+
+    async verifyGoogleIdToken(idToken: string) {
+        if (!this.googleAdapter) {
+            throw new AdapterError("GoogleAdapter not configured.");
+        }
+
+        logInfo("Google ID Token verify called");
+
+        try {
+            return await this.googleAdapter.verifyIdToken(idToken);
+        } catch (err: any) {
+            logError("Google ID Token verification failed", { error: err?.message });
+            throw HttpError.Unauthorized("Invalid Google ID token");
+        }
+    }
+
+    protect(options?: ProtectOptions) {
+        const required = options?.required ?? true;
+        const roles = options?.roles;
+
+        return (req: Request, res: Response, next: NextFunction) => {
+            const header = req.headers["authorization"];
+
+            // If auth is not required, skip authentication
+            if (!required && !header) {
+                return next();
+            }
+
+            // If auth is required but no header
+            if (!header) {
+                logWarn("Missing Authorization header", {
+                    path: req.path,
+                    method: req.method
+                });
+                return next(HttpError.Unauthorized("Missing Authorization header"));
+            }
+
+            // Parse Bearer token
+            const [type, token] = String(header).split(" ");
+            if (type !== "Bearer" || !token) {
+                logWarn("Invalid Authorization header", {
+                    path: req.path,
+                    method: req.method
+                });
+                return next(HttpError.Unauthorized("Invalid Authorization header"));
+            }
+
+            try {
+                // Verify JWT
+                const decoded = this.verify(token);
+                
+                // Attach to request
+                (req as any).auth = decoded;
+                (req as any).user = decoded; // Common pattern
+                
+                // Role-based authorization
+                if (roles && roles.length > 0) {
+                    const userRole = (decoded as any).role || (decoded as any).roles?.[0];
+                    if (!userRole || !roles.includes(userRole)) {
+                        logWarn("Insufficient permissions", {
+                            path: req.path,
+                            requiredRoles: roles,
+                            userRole
+                        });
+                        return next(HttpError.Forbidden("Insufficient permissions"));
+                    }
+                }
+                
+                return next();
+            } catch (err: any) {
+                logError("JWT verify failed", {
+                    error: err?.message,
+                    path: req.path,
+                    method: req.method
+                });
+                return next(HttpError.Unauthorized("Invalid or expired token"));
+            }
+        };
+    }
+}

package/src/managers/CorsManager.ts

@@ -0,0 +1,58 @@
+// import cors from "cors";
+// import { logger } from "../logging";
+// import { AdapterError } from "../core/errors/AdapterError.js";
+
+// export class CorsManager {
+
+//     middleware(options?: any) {
+//         try {
+//             // options = undefined → use default CORS
+//             return options ? cors(options) : cors();
+
+//         } catch (err: any) {
+//             logger.error("❌ CORS Manager: failed to create CORS middleware", {
+//                 error: err?.message || err,
+//                 options
+//             });
+//             throw new AdapterError("CORS middleware initialization failed.");
+//         }
+//     }
+// }
+
+
+
+// src/managers/CorsManager.ts - IMPROVED
+import cors from "cors";
+import { logger } from "../logging";
+import { AdapterError } from "../core/errors/AdapterError.js";
+
+export class CorsManager {
+    
+    middleware(options?: any) {
+        try {
+            const defaultOptions = {
+                origin: '*',
+                methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+                allowedHeaders: ['Content-Type', 'Authorization'],
+                credentials: false,
+                maxAge: 86400 // 24 hours
+            };
+            
+            const finalOptions = options ? { ...defaultOptions, ...options } : defaultOptions;
+            
+            logger.debug("🔧 CORS configured", {
+                origin: finalOptions.origin,
+                methods: finalOptions.methods
+            });
+            
+            return cors(finalOptions);
+            
+        } catch (err: any) {
+            logger.error("❌ CORS Manager: failed to create CORS middleware", {
+                error: err?.message || err,
+                options
+            });
+            throw new AdapterError("CORS middleware initialization failed.");
+        }
+    }
+}

package/src/managers/HashManager.ts

@@ -0,0 +1,390 @@
+// // // import { AdapterError } from "../core/errors/AdapterError";
+// // // import { HiSecureConfig } from "../core/config";
+// // // import { logger } from "../logging";
+
+// // // export class HashManager {
+// // //     private config: HiSecureConfig["hashing"];
+// // //     private primaryAdapter: {
+// // //         hash: (value: string) => Promise<string>;
+// // //         verify: (value: string, hashed: string) => Promise<boolean>;
+// // //     };
+// // //     private fallbackAdapter: {
+// // //         hash: (value: string) => Promise<string>;
+// // //         verify: (value: string, hashed: string) => Promise<boolean>;
+// // //     } | null;
+
+// // //     constructor(
+// // //         config: HiSecureConfig["hashing"],
+// // //         primaryAdapter: any,
+// // //         fallbackAdapter: any
+// // //     ) {
+// // //         this.config = config;
+// // //         this.primaryAdapter = primaryAdapter;
+// // //         this.fallbackAdapter = fallbackAdapter;
+// // //     }
+
+// // //     /**
+// // //      * Hash a password using primary adapter (Argon2)
+// // //      * If it fails → fallback (Bcrypt)
+// // //      */
+// // //     async hash(value: string): Promise<string> {
+// // //         try {
+// // //             return await this.primaryAdapter.hash(value);
+// // //         } catch (err: any) {
+// // //             logger.warn("⚠ Primary hashing failed — switching to fallback", {
+// // //                 error: err?.message,
+// // //             });
+
+// // //             if (!this.fallbackAdapter) {
+// // //                 throw new AdapterError(
+// // //                     "Primary hashing failed and no fallback adapter is configured."
+// // //                 );
+// // //             }
+
+// // //             try {
+// // //                 return await this.fallbackAdapter.hash(value);
+// // //             } catch (fallbackErr: any) {
+// // //                 logger.error("❌ Fallback hashing failed", {
+// // //                     error: fallbackErr?.message,
+// // //                 });
+// // //                 throw new AdapterError(
+// // //                     "Both primary and fallback hashing failed."
+// // //                 );
+// // //             }
+// // //         }
+// // //     }
+
+// // //     /**
+// // //      * Verify using primary hashing method.
+// // //      * If mismatch OR failure → use fallback.
+// // //      */
+// // //     async verify(value: string, hashed: string): Promise<boolean> {
+// // //         try {
+// // //             return await this.primaryAdapter.verify(value, hashed);
+// // //         } catch (err: any) {
+// // //             logger.warn("⚠ Primary verify failed — trying fallback", {
+// // //                 error: err?.message,
+// // //             });
+
+// // //             if (!this.fallbackAdapter) {
+// // //                 throw new AdapterError(
+// // //                     "Primary verify failed and no fallback adapter is configured."
+// // //                 );
+// // //             }
+
+// // //             try {
+// // //                 return await this.fallbackAdapter.verify(value, hashed);
+// // //             } catch (fallbackErr: any) {
+// // //                 logger.error("❌ Fallback verify failed", {
+// // //                     error: fallbackErr?.message,
+// // //                 });
+
+// // //                 throw new AdapterError(
+// // //                     "Both primary and fallback verify failed."
+// // //                 );
+// // //             }
+// // //         }
+// // //     }
+// // // }
+
+
+
+
+
+
+
+// // import { AdapterError } from "../core/errors/AdapterError.js";
+// // import { HiSecureConfig } from "../core/config.js";
+// // import { logger } from "../logging";
+
+// // interface HashAdapter {
+// //     hash(value: string): Promise<string>;
+// //     verify(value: string, hashed: string): Promise<boolean>;
+// // }
+
+// // export class HashManager {
+// //     private config: HiSecureConfig["hashing"];
+// //     private primaryAdapter: HashAdapter;
+// //     private fallbackAdapter: HashAdapter | null;
+
+// //     constructor(
+// //         config: HiSecureConfig["hashing"],
+// //         primaryAdapter: HashAdapter,
+// //         fallbackAdapter: HashAdapter | null
+// //     ) {
+// //         this.config = config;
+// //         this.primaryAdapter = primaryAdapter;
+// //         this.fallbackAdapter = fallbackAdapter;
+// //     }
+
+// //     async hash(value: string): Promise<string> {
+// //         try {
+// //             return await this.primaryAdapter.hash(value);
+// //         } catch (err: any) {
+// //             logger.warn("⚠ Primary hashing failed — trying fallback", {
+// //                 error: err?.message,
+// //             });
+
+// //             if (!this.fallbackAdapter) {
+// //                 throw new AdapterError(
+// //                     "Primary hashing failed and no fallback adapter configured."
+// //                 );
+// //             }
+
+// //             try {
+// //                 return await this.fallbackAdapter.hash(value);
+// //             } catch (fallbackErr: any) {
+// //                 logger.error("❌ Fallback hashing failed", {
+// //                     error: fallbackErr?.message,
+// //                 });
+// //                 throw new AdapterError(
+// //                     "Both primary and fallback hashing failed."
+// //                 );
+// //             }
+// //         }
+// //     }
+
+// //     async verify(value: string, hashed: string): Promise<boolean> {
+// //         try {
+// //             return await this.primaryAdapter.verify(value, hashed);
+// //         } catch (err: any) {
+// //             logger.warn("⚠ Primary verify failed — trying fallback", {
+// //                 error: err?.message,
+// //             });
+
+// //             if (!this.fallbackAdapter) {
+// //                 throw new AdapterError(
+// //                     "Primary verify failed and no fallback adapter configured."
+// //                 );
+// //             }
+
+// //             try {
+// //                 return await this.fallbackAdapter.verify(value, hashed);
+// //             } catch (fallbackErr: any) {
+// //                 logger.error("❌ Fallback verify failed", {
+// //                     error: fallbackErr?.message,
+// //                 });
+// //                 throw new AdapterError(
+// //                     "Both primary and fallback verify failed."
+// //                 );
+// //             }
+// //         }
+// //     }
+// // }
+
+
+
+// // src/managers/HashManager.ts - FIXED
+// import { AdapterError } from "../core/errors/AdapterError.js";
+// import { HiSecureConfig } from "../core/types/HiSecureConfig.js";
+// import { logger } from "../logging";
+
+// interface HashAdapter {
+//     hash(value: string): Promise<string>;
+//     verify(value: string, hashed: string): Promise<boolean>;
+//     getAlgorithm(): string;
+// }
+
+// export interface HashResult {
+//     hash: string;
+//     algorithm: string;
+//     usedFallback: boolean;
+// }
+
+// export class HashManager {
+//     private config: HiSecureConfig["hashing"];
+//     private primaryAdapter: HashAdapter;
+//     private fallbackAdapter: HashAdapter | null;
+
+//     constructor(
+//         config: HiSecureConfig["hashing"],
+//         primaryAdapter: HashAdapter,
+//         fallbackAdapter: HashAdapter | null
+//     ) {
+//         this.config = config;
+//         this.primaryAdapter = primaryAdapter;
+//         this.fallbackAdapter = fallbackAdapter;
+//     }
+
+//     async hash(value: string, options?: { allowFallback?: boolean }): Promise<HashResult> {
+//         try {
+//             const hash = await this.primaryAdapter.hash(value);
+//             return {
+//                 hash,
+//                 algorithm: this.config.primary,
+//                 usedFallback: false
+//             };
+//         } catch (err: any) {
+//             logger.warn("⚠ Primary hashing failed", {
+//                 error: err.message,
+//                 algorithm: this.config.primary
+//             });
+
+//             if (!options?.allowFallback || !this.fallbackAdapter) {
+//                 throw new AdapterError(
+//                     `Primary hashing (${this.config.primary}) failed. Fallback not allowed.`
+//                 );
+//             }
+
+//             try {
+//                 const hash = await this.fallbackAdapter.hash(value);
+                
+//                 // Log security downgrade warning
+//                 logger.warn("⚠ SECURITY DOWNGRADE: Using fallback hashing", {
+//                     from: this.config.primary,
+//                     to: this.config.fallback
+//                 });
+                
+//                 return {
+//                     hash,
+//                     algorithm: this.config.fallback || 'bcrypt',
+//                     usedFallback: true
+//                 };
+//             } catch (fallbackErr: any) {
+//                 logger.error("❌ Fallback hashing failed", {
+//                     error: fallbackErr?.message,
+//                 });
+//                 throw new AdapterError(
+//                     "Both primary and fallback hashing failed."
+//                 );
+//             }
+//         }
+//     }
+
+//     async verify(value: string, hashed: string): Promise<boolean> {
+//         // Try primary adapter first
+//         try {
+//             return await this.primaryAdapter.verify(value, hashed);
+//         } catch (primaryErr: any) {
+//             logger.warn("⚠ Primary verify failed", {
+//                 error: primaryErr?.message,
+//             });
+
+//             // If fallback exists, try it
+//             if (this.fallbackAdapter) {
+//                 try {
+//                     return await this.fallbackAdapter.verify(value, hashed);
+//                 } catch (fallbackErr: any) {
+//                     logger.error("❌ Fallback verify failed", {
+//                         error: fallbackErr?.message,
+//                     });
+//                     throw new AdapterError(
+//                         "Both primary and fallback verify failed."
+//                     );
+//                 }
+//             }
+            
+//             throw new AdapterError(
+//                 "Primary verify failed and no fallback adapter configured."
+//             );
+//         }
+//     }
+// }
+
+
+// src/managers/HashManager.ts - COMPLETE FIXED
+import { AdapterError } from "../core/errors/AdapterError.js";
+import { HiSecureConfig } from "../core/types/HiSecureConfig.js";
+import { logger } from "../logging";
+
+interface HashAdapter {
+    hash(value: string): Promise<string>;
+    verify(value: string, hashed: string): Promise<boolean>;
+    // ❌ getAlgorithm() REMOVED - Not needed in adapters
+}
+
+export interface HashResult {
+    hash: string;
+    algorithm: string;
+    usedFallback: boolean;
+}
+
+export class HashManager {
+    private config: HiSecureConfig["hashing"];
+    private primaryAdapter: HashAdapter;
+    private fallbackAdapter: HashAdapter | null;
+
+    constructor(
+        config: HiSecureConfig["hashing"],
+        primaryAdapter: HashAdapter,
+        fallbackAdapter: HashAdapter | null
+    ) {
+        this.config = config;
+        this.primaryAdapter = primaryAdapter;
+        this.fallbackAdapter = fallbackAdapter;
+    }
+
+    async hash(value: string, options?: { allowFallback?: boolean }): Promise<HashResult> {
+        try {
+            const hash = await this.primaryAdapter.hash(value);
+            return {
+                hash,
+                algorithm: this.config.primary,
+                usedFallback: false
+            };
+        } catch (err: any) {
+            logger.warn("⚠ Primary hashing failed", {
+                error: err.message,
+                algorithm: this.config.primary
+            });
+
+            if (!options?.allowFallback || !this.fallbackAdapter) {
+                throw new AdapterError(
+                    `Primary hashing (${this.config.primary}) failed. Fallback not allowed.`
+                );
+            }
+
+            try {
+                const hash = await this.fallbackAdapter.hash(value);
+                
+                // Log security downgrade warning
+                logger.warn("⚠ SECURITY DOWNGRADE: Using fallback hashing", {
+                    from: this.config.primary,
+                    to: this.config.fallback
+                });
+                
+                return {
+                    hash,
+                    algorithm: this.config.fallback || 'bcrypt',
+                    usedFallback: true
+                };
+            } catch (fallbackErr: any) {
+                logger.error("❌ Fallback hashing failed", {
+                    error: fallbackErr?.message,
+                });
+                throw new AdapterError(
+                    "Both primary and fallback hashing failed."
+                );
+            }
+        }
+    }
+
+    async verify(value: string, hashed: string): Promise<boolean> {
+        // Try primary adapter first
+        try {
+            return await this.primaryAdapter.verify(value, hashed);
+        } catch (primaryErr: any) {
+            logger.warn("⚠ Primary verify failed", {
+                error: primaryErr?.message,
+            });
+
+            // If fallback exists, try it
+            if (this.fallbackAdapter) {
+                try {
+                    return await this.fallbackAdapter.verify(value, hashed);
+                } catch (fallbackErr: any) {
+                    logger.error("❌ Fallback verify failed", {
+                        error: fallbackErr?.message,
+                    });
+                    throw new AdapterError(
+                        "Both primary and fallback verify failed."
+                    );
+                }
+            }
+            
+            throw new AdapterError(
+                "Primary verify failed and no fallback adapter configured."
+            );
+        }
+    }
+}