hi-secure 1.0.15 → 1.0.17

package/src/managers/AuthManager.ts

@@ -1,11 +1,10 @@
-import { JWTAdapter } from "../adapters/JWTAdapter.js";
-import { GoogleAdapter } from "../adapters/GoogleAdapter.js";
-import { AdapterError } from "../core/errors/AdapterError.js";
-import { HttpError } from "../core/errors/HttpError.js";
+import { JWTAdapter } from "../adapters/JWTAdapter";
+import { GoogleAdapter } from "../adapters/GoogleAdapter";
+import { AdapterError } from "../core/errors/AdapterError";
+import { HttpError } from "../core/errors/HttpError";
 import { Request, Response, NextFunction } from "express";
 import { logger } from "../logging";
 
-
 export interface AuthOptions {
     jwtSecret: string;
     jwtExpiresIn?: string | number;
@@ -27,29 +26,47 @@ export class AuthManager {
         }
 
         if (opts.jwtSecret.length < 32) {
-            logger.warn(" JWT secret is less than 32 characters - consider using a stronger secret");
+            logger.warn("Weak JWT secret detected", {
+                layer: "auth-manager",
+                operation: "init",
+                secretLength: opts.jwtSecret.length
+            });
         }
 
-        logger.info("AuthManager initialized");
+        logger.info("AuthManager initialized", {
+            layer: "auth-manager",
+            jwtExpiresIn: opts.jwtExpiresIn ?? "1d",
+            googleEnabled: !!opts.googleClientId
+        });
 
         this.jwtAdapter = new JWTAdapter({
             secret: opts.jwtSecret,
-            expiresIn: opts.jwtExpiresIn ?? "1d",
+            expiresIn: opts.jwtExpiresIn ?? "1d"
         });
 
         if (opts.googleClientId) {
             this.googleAdapter = new GoogleAdapter(opts.googleClientId);
-            logger.info("GoogleAdapter enabled");
+            logger.info("Google authentication enabled", {
+                layer: "auth-manager"
+            });
         }
     }
 
-    sign(payload: object, options?: { expiresIn?: string | number, jti?: string }) {
-        logger.info("JWT Sign called");
+    sign(payload: object, options?: { expiresIn?: string | number; jti?: string }) {
+        logger.info("JWT sign requested", {
+            layer: "auth-manager",
+            operation: "sign"
+        });
+
         return this.jwtAdapter.sign(payload, options);
     }
 
     verify(token: string) {
-        logger.info("JWT Verify called");
+        logger.info("JWT verify requested", {
+            layer: "auth-manager",
+            operation: "verify"
+        });
+
         return this.jwtAdapter.verify(token);
     }
 
@@ -58,12 +75,20 @@ export class AuthManager {
             throw new AdapterError("GoogleAdapter not configured.");
         }
 
-        logger.info("Google ID Token verify called");
+        logger.info("Google ID token verification requested", {
+            layer: "auth-manager",
+            operation: "google-verify"
+        });
 
         try {
             return await this.googleAdapter.verifyIdToken(idToken);
         } catch (err: any) {
-            logger.error("Google ID Token verification failed", { error: err?.message });
+            logger.error("Google ID token verification failed", {
+                layer: "auth-manager",
+                operation: "google-verify",
+                reason: err?.message
+            });
+
             throw HttpError.Unauthorized("Invalid Google ID token");
         }
     }
@@ -72,27 +97,28 @@ export class AuthManager {
         const required = options?.required ?? true;
         const roles = options?.roles;
 
-        return (req: Request, res: Response, next: NextFunction) => {
+        return (req: Request, _res: Response, next: NextFunction) => {
             const header = req.headers["authorization"];
 
-            
             if (!required && !header) {
                 return next();
             }
 
-           
             if (!header) {
-                logger.warn("Missing Authorization header", {
+                logger.warn("Authorization header missing", {
+                    layer: "auth-manager",
+                    operation: "protect",
                     path: req.path,
                     method: req.method
                 });
                 return next(HttpError.Unauthorized("Missing Authorization header"));
             }
 
-          
             const [type, token] = String(header).split(" ");
             if (type !== "Bearer" || !token) {
-                logger.warn("Invalid Authorization header", {
+                logger.warn("Invalid Authorization header format", {
+                    layer: "auth-manager",
+                    operation: "protect",
                     path: req.path,
                     method: req.method
                 });
@@ -100,36 +126,40 @@ export class AuthManager {
             }
 
             try {
-
-                // Verify JWT
                 const decoded = this.verify(token);
-                
-                // Attach to request
+
                 (req as any).auth = decoded;
-                (req as any).user = decoded; 
-                
-                // Role-based authorization - role added Middleware
+                (req as any).user = decoded;
+
                 if (roles && roles.length > 0) {
-                    const userRole = (decoded as any).role || (decoded as any).roles?.[0];
+                    const userRole =
+                        (decoded as any).role || (decoded as any).roles?.[0];
+
                     if (!userRole || !roles.includes(userRole)) {
-                        logger.warn("Insufficient permissions", {
+                        logger.warn("Access denied: insufficient role", {
+                            layer: "auth-manager",
+                            operation: "authorize",
                             path: req.path,
                             requiredRoles: roles,
                             userRole
                         });
+
                         return next(HttpError.Forbidden("Insufficient permissions"));
                     }
                 }
-                
+
                 return next();
             } catch (err: any) {
-                logger.error("JWT verify failed", {
-                    error: err?.message,
+                logger.error("JWT authentication failed", {
+                    layer: "auth-manager",
+                    operation: "protect",
                     path: req.path,
-                    method: req.method
+                    method: req.method,
+                    reason: err?.message
                 });
+
                 return next(HttpError.Unauthorized("Invalid or expired token"));
             }
         };
     }
-}
+}

package/src/managers/CorsManager.ts

@@ -1,34 +1,41 @@
 import cors from "cors";
 import { logger } from "../logging";
-import { AdapterError } from "../core/errors/AdapterError.js";
+import { AdapterError } from "../core/errors/AdapterError";
 
 export class CorsManager {
-    
     middleware(options?: any) {
         try {
             const defaultOptions = {
-                origin: '*',
-                methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
-                allowedHeaders: ['Content-Type', 'Authorization'],
+                origin: "*",
+                methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
+                allowedHeaders: ["Content-Type", "Authorization"],
                 credentials: false,
                 maxAge: 86400
             };
-            
-            const finalOptions = options ? { ...defaultOptions, ...options } : defaultOptions;
-            
-            logger.debug("CORS configured", {
+
+            const finalOptions = options
+                ? { ...defaultOptions, ...options }
+                : defaultOptions;
+
+            // ✅ visible + clean log
+            logger.info("CORS middleware configured", {
+                layer: "cors-manager",
+                operation: "init",
                 origin: finalOptions.origin,
-                methods: finalOptions.methods
+                methods: finalOptions.methods,
+                credentials: finalOptions.credentials
             });
-            
+
             return cors(finalOptions);
-            
+
         } catch (err: any) {
-            logger.error(" CORS Manager: failed to create CORS middleware", {
-                error: err?.message || err,
-                options
+            logger.error("CORS middleware initialization failed", {
+                layer: "cors-manager",
+                operation: "init",
+                reason: err?.message
             });
+
             throw new AdapterError("CORS middleware initialization failed.");
         }
     }
-}
+}

package/src/managers/HashManager.ts

@@ -1,5 +1,5 @@
-import { AdapterError } from "../core/errors/AdapterError.js";
-import { HiSecureConfig } from "../core/types/HiSecureConfig.js";
+import { AdapterError } from "../core/errors/AdapterError";
+import { HiSecureConfig } from "../core/types/HiSecureConfig";
 import { logger } from "../logging";
 
 interface HashAdapter {
@@ -26,20 +26,33 @@ export class HashManager {
         this.config = config;
         this.primaryAdapter = primaryAdapter;
         this.fallbackAdapter = fallbackAdapter;
+
+        logger.info("HashManager initialized", {
+            layer: "hash-manager",
+            primary: config.primary,
+            fallbackEnabled: !!fallbackAdapter
+        });
     }
 
-    async hash(value: string, options?: { allowFallback?: boolean }): Promise<HashResult> {
+    async hash(
+        value: string,
+        options?: { allowFallback?: boolean }
+    ): Promise<HashResult> {
         try {
             const hash = await this.primaryAdapter.hash(value);
+
             return {
                 hash,
                 algorithm: this.config.primary,
                 usedFallback: false
             };
+
         } catch (err: any) {
             logger.warn("Primary hashing failed", {
-                error: err.message,
-                algorithm: this.config.primary
+                layer: "hash-manager",
+                operation: "hash",
+                algorithm: this.config.primary,
+                reason: err?.message
             });
 
             if (!options?.allowFallback || !this.fallbackAdapter) {
@@ -50,22 +63,30 @@ export class HashManager {
 
             try {
                 const hash = await this.fallbackAdapter.hash(value);
-                
-                // Log security downgrade warning
-                logger.warn("SECURITY DOWNGRADE: Using fallback hashing", {
+
+                // ⚠️ security downgrade log (VERY GOOD PRACTICE)
+                logger.warn("Hashing fallback used (security downgrade)", {
+                    layer: "hash-manager",
+                    operation: "hash",
                     from: this.config.primary,
                     to: this.config.fallback
                 });
-                
+
                 return {
                     hash,
-                    algorithm: this.config.fallback || 'bcrypt',
+                    algorithm: this.config.fallback || "bcrypt",
                     usedFallback: true
                 };
+
             } catch (fallbackErr: any) {
                 logger.error("Fallback hashing failed", {
-                    error: fallbackErr?.message,
+                    layer: "hash-manager",
+                    operation: "hash",
+                    from: this.config.primary,
+                    to: this.config.fallback,
+                    reason: fallbackErr?.message
                 });
+
                 throw new AdapterError(
                     "Both primary and fallback hashing failed."
                 );
@@ -74,31 +95,39 @@ export class HashManager {
     }
 
     async verify(value: string, hashed: string): Promise<boolean> {
-        //  primary adapter - first
         try {
             return await this.primaryAdapter.verify(value, hashed);
+
         } catch (primaryErr: any) {
-            logger.warn("Primary verify failed", {
-                error: primaryErr?.message,
+            logger.warn("Primary hash verification failed", {
+                layer: "hash-manager",
+                operation: "verify",
+                algorithm: this.config.primary,
+                reason: primaryErr?.message
             });
 
-            //  fallback exists -  try it
             if (this.fallbackAdapter) {
                 try {
                     return await this.fallbackAdapter.verify(value, hashed);
+
                 } catch (fallbackErr: any) {
-                    logger.error(" Fallback verify failed", {
-                        error: fallbackErr?.message,
+                    logger.error("Fallback hash verification failed", {
+                        layer: "hash-manager",
+                        operation: "verify",
+                        from: this.config.primary,
+                        to: this.config.fallback,
+                        reason: fallbackErr?.message
                     });
+
                     throw new AdapterError(
                         "Both primary and fallback verify failed."
                     );
                 }
             }
-            
+
             throw new AdapterError(
                 "Primary verify failed and no fallback adapter configured."
             );
         }
     }
-}
+}

package/src/managers/JsonManager.ts

@@ -1,19 +1,35 @@
 import express from "express";
 import qs from "qs";
 import { logger } from "../logging";
-import { AdapterError } from "../core/errors/AdapterError.js";
+import { AdapterError } from "../core/errors/AdapterError";
 
 export class JsonManager {
     middleware(options?: any) {
         try {
             const defaultOptions = {
-                limit: '1mb',
+                limit: "1mb",
                 inflate: true,
                 strict: true
             };
-            return express.json({ ...defaultOptions, ...(options || {}) });
+
+            const finalOptions = { ...defaultOptions, ...(options || {}) };
+
+            logger.info("JSON body parser configured", {
+                layer: "json-manager",
+                operation: "json",
+                limit: finalOptions.limit,
+                strict: finalOptions.strict
+            });
+
+            return express.json(finalOptions);
+
         } catch (err: any) {
-            logger.error("JSON Manager: failed to create JSON parser");
+            logger.error("JSON body parser initialization failed", {
+                layer: "json-manager",
+                operation: "json",
+                reason: err?.message
+            });
+
             throw new AdapterError("JSON parser initialization failed.");
         }
     }
@@ -22,38 +38,64 @@ export class JsonManager {
         try {
             const defaultOptions = {
                 extended: true,
-                limit: '1mb',
+                limit: "1mb",
                 parameterLimit: 1000
             };
-            const opts = { ...defaultOptions, ...(options || {}) };
-            return express.urlencoded(opts);
+
+            const finalOptions = { ...defaultOptions, ...(options || {}) };
+
+            logger.info("URL-encoded parser configured", {
+                layer: "json-manager",
+                operation: "urlencoded",
+                limit: finalOptions.limit,
+                parameterLimit: finalOptions.parameterLimit
+            });
+
+            return express.urlencoded(finalOptions);
+
         } catch (err: any) {
-            logger.error("URL-encoded parser failed");
+            logger.error("URL-encoded parser initialization failed", {
+                layer: "json-manager",
+                operation: "urlencoded",
+                reason: err?.message
+            });
+
             throw new AdapterError("URL-encoded parser initialization failed.");
         }
     }
 
     queryParser(options?: any) {
-        return (req: any, res: any, next: any) => {
+        return (req: any, _res: any, next: any) => {
             try {
-                if (!req.parsedQuery && req.url.includes('?')) {
+                if (!req.parsedQuery && req.url.includes("?")) {
                     const queryString = req.url.split("?")[1] || "";
+
                     const parsed = qs.parse(queryString, {
                         depth: 5,
                         parameterLimit: 100,
                         ...options
                     });
-                    
+
                     req.parsedQuery = parsed;
-                    logger.debug(" Query parsed", {
-                        keys: Object.keys(parsed)
+
+                    // ✅ visible + safe info
+                    logger.info("Query parameters parsed", {
+                        layer: "json-manager",
+                        operation: "query-parse",
+                        keyCount: Object.keys(parsed).length
                     });
                 }
+
                 next();
             } catch (err: any) {
-                logger.error("Failed to parse query", { error: err?.message });
+                logger.error("Query parsing failed", {
+                    layer: "json-manager",
+                    operation: "query-parse",
+                    reason: err?.message
+                });
+
                 next(new AdapterError("Query parsing failed."));
             }
         };
     }
-}
+}

package/src/managers/RateLimitManager.ts

@@ -1,5 +1,5 @@
-import { HiSecureConfig } from "../core/types/HiSecureConfig.js";
-import { AdapterError } from "../core/errors/AdapterError.js";
+import { HiSecureConfig } from "../core/types/HiSecureConfig";
+import { AdapterError } from "../core/errors/AdapterError";
 import { logger } from "../logging";
 
 interface RateLimiterAdapter {
@@ -19,26 +19,33 @@ export class RateLimitManager {
         this.config = config;
         this.primaryAdapter = primaryAdapter;
         this.fallbackAdapter = fallbackAdapter;
+
+        logger.info("RateLimitManager initialized", {
+            layer: "rate-limit-manager",
+            primaryConfigured: true,
+            fallbackConfigured: !!fallbackAdapter
+        });
     }
 
     middleware(opts?: { mode?: "strict" | "relaxed" | "api"; options?: any }) {
         let finalOptions: any = {};
+        const mode = opts?.mode || "default";
 
-        if (opts?.mode === "strict") {
+        if (mode === "strict") {
             finalOptions = {
                 windowMs: 10_000,
                 max: 5,
                 message: "Too many requests, please slow down."
             };
-        } else if (opts?.mode === "relaxed") {
+        } else if (mode === "relaxed") {
             finalOptions = {
                 windowMs: 60_000,
                 max: 100,
                 message: "Rate limit exceeded."
             };
-        } else if (opts?.mode === "api") {
+        } else if (mode === "api") {
             finalOptions = {
-                windowMs: 15 * 60 * 1000, 
+                windowMs: 15 * 60 * 1000,
                 max: 100,
                 message: "API rate limit exceeded."
             };
@@ -47,63 +54,88 @@ export class RateLimitManager {
                 windowMs: this.config.windowMs,
                 max: this.config.maxRequests,
                 message: this.config.message,
-                standardHeaders: true,      
-                legacyHeaders: false        
+                standardHeaders: true,
+                legacyHeaders: false
             };
         }
 
         if (opts?.options) {
-            const allowedOverrides = ['message', 'skipFailedRequests', 'standardHeaders', 'legacyHeaders'];
+            const allowedOverrides = [
+                "message",
+                "skipFailedRequests",
+                "standardHeaders",
+                "legacyHeaders"
+            ];
+
             for (const key of allowedOverrides) {
                 if (opts.options[key] !== undefined) {
                     finalOptions[key] = opts.options[key];
                 }
             }
-            
+
             const attemptedOverrides = Object.keys(opts.options).filter(
-                k => !allowedOverrides.includes(k) && k !== 'mode'
+                k => !allowedOverrides.includes(k) && k !== "mode"
             );
+
             if (attemptedOverrides.length > 0) {
                 logger.warn("Rate limit overrides ignored", {
-                    preset: opts?.mode || 'default',
+                    layer: "rate-limit-manager",
+                    operation: "configure",
+                    mode,
                     ignoredOptions: attemptedOverrides
                 });
             }
         }
 
-        if (finalOptions.standardHeaders === undefined) {
-            finalOptions.standardHeaders = true;
-        }
-        if (finalOptions.legacyHeaders === undefined) {
-            finalOptions.legacyHeaders = false;
-        }
+        finalOptions.standardHeaders ??= true;
+        finalOptions.legacyHeaders ??= false;
 
         try {
-            logger.info("Applying rate limiting", {
-                mode: opts?.mode || 'default',
+            logger.info("Rate limiting applied", {
+                layer: "rate-limit-manager",
+                operation: "apply",
+                mode,
                 windowMs: finalOptions.windowMs,
                 max: finalOptions.max
             });
-            
+
             return this.primaryAdapter.getMiddleware(finalOptions);
+
         } catch (err: any) {
-            logger.warn("Primary rate limiter failed → fallback", {
-                error: err?.message
+            logger.warn("Primary rate limiter failed", {
+                layer: "rate-limit-manager",
+                operation: "apply",
+                mode,
+                reason: err?.message
             });
 
             if (!this.fallbackAdapter) {
-                throw new AdapterError("Rate limiters failed; no fallback adapter.");
+                throw new AdapterError(
+                    "Rate limiters failed; no fallback adapter configured."
+                );
             }
 
             try {
-                logger.info("Using fallback rate limiter");
+                logger.warn("Using fallback rate limiter", {
+                    layer: "rate-limit-manager",
+                    operation: "fallback",
+                    mode
+                });
+
                 return this.fallbackAdapter.getMiddleware(finalOptions);
+
             } catch (fallbackErr: any) {
-                logger.error("Fallback limiter also failed", {
-                    error: fallbackErr?.message
+                logger.error("Fallback rate limiter failed", {
+                    layer: "rate-limit-manager",
+                    operation: "fallback",
+                    mode,
+                    reason: fallbackErr?.message
                 });
-                throw new AdapterError("Both primary and fallback limiters failed.");
+
+                throw new AdapterError(
+                    "Both primary and fallback rate limiters failed."
+                );
             }
         }
     }
-}
+}