iri-shield 1.2.0

package/src/mongodb-storage.js

@@ -0,0 +1,237 @@
+'use strict';
+
+const { MemoryStorage } = require('./storage');
+
+/**
+ * MongoStorage — MongoDB-backed storage for iri-shield.
+ *
+ * Graceful fallback: if MongoDB is not available (connection fails within 3s),
+ * the class silently falls back to pure in-memory operation.
+ * No error is thrown — the server continues running normally.
+ */
+class MongoStorage extends MemoryStorage {
+  constructor(options = {}) {
+    super(options);
+    this.mongoUrl = options.mongoUrl || 'mongodb://localhost:27017/iri-shield';
+    this.dbName = options.dbName || 'iri-shield';
+    this.connected = false;
+    this.client = null;
+    this.db = null;
+    this._cols = {};
+
+    // Start connection asynchronously — does not block constructor
+    this._connect();
+  }
+
+  async _connect() {
+    try {
+      let MongoClient;
+      try {
+        ({ MongoClient } = require('mongodb'));
+      } catch {
+        // mongodb package not installed — silently use memory-only
+        return;
+      }
+
+      const client = new MongoClient(this.mongoUrl, {
+        serverSelectionTimeoutMS: 3000,
+        connectTimeoutMS: 3000,
+        socketTimeoutMS: 3000
+      });
+
+      await client.connect();
+      this.client = client;
+      this.db = client.db(this.dbName);
+      this.connected = true;
+
+      // Initialize collections and TTL indexes
+      await this._initCollections();
+
+      // Load persistent blocks into memory
+      await this._loadPersistentBlocks();
+
+      console.log('[iri-shield] MongoDB connected:', this.mongoUrl);
+    } catch (err) {
+      // Graceful fallback — not a fatal error
+      console.warn('[iri-shield] MongoDB not available, using memory storage. Reason:', err.message);
+      this.connected = false;
+    }
+  }
+
+  async _initCollections() {
+    const db = this.db;
+
+    // Requests: TTL 7 days
+    const requests = db.collection('iri_requests');
+    await requests.createIndex({ createdAt: 1 }, { expireAfterSeconds: 7 * 24 * 60 * 60 });
+    await requests.createIndex({ ip: 1 });
+
+    // Events: TTL 30 days
+    const events = db.collection('iri_events');
+    await events.createIndex({ createdAt: 1 }, { expireAfterSeconds: 30 * 24 * 60 * 60 });
+    await events.createIndex({ riskLevel: 1 });
+
+    // Clients: no TTL
+    const clients = db.collection('iri_clients');
+    await clients.createIndex({ clientId: 1 }, { unique: true });
+
+    // Blocks: no TTL (managed manually)
+    const blocks = db.collection('iri_blocks');
+    await blocks.createIndex({ ip: 1 }, { unique: true });
+
+    // Alerts: no TTL
+    const alerts = db.collection('iri_alerts');
+    await alerts.createIndex({ clientId: 1 }, { unique: true });
+
+    this._cols = { requests, events, clients, blocks, alerts };
+  }
+
+  async _loadPersistentBlocks() {
+    if (!this.connected) return;
+    try {
+      const rows = await this._cols.blocks.find({}).toArray();
+      for (const row of rows) {
+        if (!row.expiresAt || row.expiresAt > Date.now()) {
+          this.blocks.set(row.ip, {
+            reason: row.reason || '',
+            score: row.score || 0,
+            manual: Boolean(row.manual),
+            blockedAt: row.blockedAt || null,
+            expiresAt: row.expiresAt || null
+          });
+        }
+      }
+    } catch { /* ignore */ }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+
+  _safe(fn) {
+    // Fire-and-forget — never awaited, never throws
+    if (!this.connected) return;
+    Promise.resolve().then(fn).catch(() => {});
+  }
+
+  // ---------------------------------------------------------------------------
+  // Request recording
+  // ---------------------------------------------------------------------------
+
+  recordRequest(request) {
+    super.recordRequest(request);
+    this._safe(() =>
+      this._cols.requests.insertOne({
+        ...request,
+        createdAt: new Date(),
+        blocked: Boolean(request.blocked)
+      })
+    );
+  }
+
+  // ---------------------------------------------------------------------------
+  // Events
+  // ---------------------------------------------------------------------------
+
+  recordEvent(event) {
+    super.recordEvent(event);
+    this._safe(() =>
+      this._cols.events.updateOne(
+        { id: event.id },
+        { $set: { ...event, createdAt: new Date() } },
+        { upsert: true }
+      )
+    );
+  }
+
+  // ---------------------------------------------------------------------------
+  // Clients
+  // ---------------------------------------------------------------------------
+
+  recordClient(client) {
+    const row = super.recordClient(client);
+    this._safe(() =>
+      this._cols.clients.updateOne(
+        { clientId: row.clientId },
+        { $set: { ...row, updatedAt: new Date() } },
+        { upsert: true }
+      )
+    );
+    return row;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Blocks (persistent)
+  // ---------------------------------------------------------------------------
+
+  blockIp(ip, block) {
+    super.blockIp(ip, block);
+    this._safe(() =>
+      this._cols.blocks.updateOne(
+        { ip },
+        { $set: { ip, ...block, updatedAt: new Date() } },
+        { upsert: true }
+      )
+    );
+  }
+
+  unblockIp(ip) {
+    const result = super.unblockIp(ip);
+    this._safe(() => this._cols.blocks.deleteOne({ ip }));
+    return result;
+  }
+
+  manualBlockIp(ip, options = {}) {
+    super.manualBlockIp(ip, options);
+    const block = this.blocks.get(ip);
+    if (block) {
+      this._safe(() =>
+        this._cols.blocks.updateOne(
+          { ip },
+          { $set: { ip, ...block, manual: true, updatedAt: new Date() } },
+          { upsert: true }
+        )
+      );
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Alerts (persistent)
+  // ---------------------------------------------------------------------------
+
+  recordAlert(clientId, alertData) {
+    super.recordAlert(clientId, alertData);
+    const a = this.alerts.get(clientId);
+    if (!a) return;
+    this._safe(() =>
+      this._cols.alerts.updateOne(
+        { clientId },
+        { $set: { ...a, updatedAt: new Date() } },
+        { upsert: true }
+      )
+    );
+  }
+
+  dismissAlert(clientId) {
+    const result = super.dismissAlert(clientId);
+    this._safe(() =>
+      this._cols.alerts.updateOne({ clientId }, { $set: { dismissed: true } })
+    );
+    return result;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Stats
+  // ---------------------------------------------------------------------------
+
+  getStats() {
+    return {
+      ...super.getStats(),
+      storageMode: this.connected ? 'mongodb' : 'mongodb_fallback_memory',
+      mongoUrl: this.mongoUrl,
+      mongoConnected: this.connected
+    };
+  }
+}
+
+module.exports = { MongoStorage };

package/src/redactor.js

@@ -0,0 +1,104 @@
+'use strict';
+
+// ---------------------------------------------------------------------------
+// Redactor — PII and secrets redaction for responses AND request logs
+// ---------------------------------------------------------------------------
+
+const valuePatterns = [
+  /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+  /\b(?:\+?91[-\s]?)?[6-9]\d{9}\b/g,
+  /\b(?:\+?1[-\s]?)?\(?\d{3}\)?[-\s]?\d{3}[-\s]?\d{4}\b/g,
+  /\b(?:Bearer\s+)?[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\b/g,
+  /\b(?:sk|pk|api|key|secret)(?:_mock|_live|_test|_key|_secret)?_[A-Za-z0-9_-]{10,}\b/gi
+];
+
+/**
+ * Deep-redact a payload (response body or object)
+ * @param {*} payload
+ * @param {object} options  — { mask, fields[] }
+ * @returns {{ value: *, redactions: number }}
+ */
+function redactPayload(payload, options) {
+  options = options || {};
+  const state = { redactions: 0, mask: options.mask || '[REDACTED]', fields: normalizeFields(options.fields || []) };
+  const value = redactValue(payload, state);
+  return { value, redactions: state.redactions };
+}
+
+/**
+ * Redact a request body object before storing in logs
+ * Only redacts known sensitive field names — does NOT scan string values
+ * (to avoid false positives on legitimate request data)
+ * @param {object|string} body
+ * @param {object} options
+ * @returns {object|string}
+ */
+function redactRequestBody(body, options) {
+  options = options || {};
+  if (!body) return body;
+  if (typeof body === 'string') {
+    // Best-effort: replace known field patterns in JSON strings
+    try {
+      const parsed = JSON.parse(body);
+      const result = redactPayload(parsed, options);
+      return JSON.stringify(result.value);
+    } catch (_) {
+      return body; // not JSON, return as-is
+    }
+  }
+  if (typeof body === 'object') {
+    return redactPayload(body, options).value;
+  }
+  return body;
+}
+
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+
+function normalizeFields(fields) {
+  return new Set(fields.map(function(f) { return String(f).toLowerCase().replace(/[^a-z0-9]/g, ''); }));
+}
+
+function isSensitiveKey(key, fieldsSet) {
+  if (!key) return false;
+  const clean = String(key).toLowerCase().replace(/[^a-z0-9]/g, '');
+  if (fieldsSet.has(clean)) return true;
+  for (const f of fieldsSet) {
+    if (f.length >= 4 && clean.includes(f)) return true;
+  }
+  return false;
+}
+
+function redactValue(value, state, key) {
+  key = key || '';
+  if (value == null) return value;
+  if (isSensitiveKey(key, state.fields)) {
+    state.redactions += 1;
+    return state.mask;
+  }
+  if (typeof value === 'string') return redactString(value, state);
+  if (Array.isArray(value)) return value.map(function(item) { return redactValue(item, state); });
+  if (typeof value === 'object') {
+    const output = {};
+    for (const childKey of Object.keys(value)) {
+      output[childKey] = redactValue(value[childKey], state, childKey);
+    }
+    return output;
+  }
+  return value;
+}
+
+function redactString(value, state) {
+  let output = value;
+  for (const pattern of valuePatterns) {
+    pattern.lastIndex = 0;
+    output = output.replace(pattern, function() {
+      state.redactions += 1;
+      return state.mask;
+    });
+  }
+  return output;
+}
+
+module.exports = { redactPayload, redactRequestBody, valuePatterns };

package/src/rules.js

@@ -0,0 +1,113 @@
+'use strict';
+
+// ---------------------------------------------------------------------------
+// Custom & Built-in Rule Engine
+// Evaluates configurable rules against incoming requests
+// ---------------------------------------------------------------------------
+
+/**
+ * Apply custom rules defined in config.rules.customRules[]
+ * Each custom rule can match on: endpoint, method, ip, userAgent, body fields
+ */
+function applyCustomRules(req, config) {
+  const customRules = config.rules && config.rules.customRules ? config.rules.customRules : [];
+  const scoreParts = [];
+  const threats = [];
+  const reasons = [];
+  const breakdown = [];
+
+  if (!customRules.length) return { score: 0, threats, reasons, breakdown };
+
+  const endpoint = (req.originalUrl || req.url || '/').toLowerCase();
+  const method = (req.method || 'GET').toUpperCase();
+  const userAgent = (
+    (req.iriShieldClient && req.iriShieldClient.userAgent) ||
+    req.headers['user-agent'] || ''
+  ).toLowerCase();
+  const ip = (req.iriShieldClient && req.iriShieldClient.ip) || '';
+
+  for (const rule of customRules) {
+    if (!rule || !rule.name) continue;
+
+    let matched = false;
+
+    // Endpoint match (string or regex)
+    if (rule.match && rule.match.endpoint) {
+      const pattern = rule.match.endpoint;
+      if (typeof pattern === 'string') {
+        matched = endpoint.includes(pattern.toLowerCase());
+      } else if (pattern instanceof RegExp) {
+        matched = pattern.test(endpoint);
+      }
+    }
+
+    // Method match
+    if (matched && rule.match && rule.match.method) {
+      const methods = Array.isArray(rule.match.method)
+        ? rule.match.method.map(function(m) { return m.toUpperCase(); })
+        : [rule.match.method.toUpperCase()];
+      if (!methods.includes(method)) matched = false;
+    }
+
+    // UserAgent match
+    if (rule.match && rule.match.userAgent) {
+      const uaPattern = rule.match.userAgent;
+      if (typeof uaPattern === 'string') {
+        matched = userAgent.includes(uaPattern.toLowerCase());
+      } else if (uaPattern instanceof RegExp) {
+        matched = uaPattern.test(userAgent);
+      }
+    }
+
+    // IP match (exact or prefix)
+    if (rule.match && rule.match.ip) {
+      matched = ip.startsWith(rule.match.ip);
+    }
+
+    // Body field match
+    if (rule.match && rule.match.bodyField && req.body && typeof req.body === 'object') {
+      const entries = Object.entries(rule.match.bodyField);
+      if (entries.length > 0) {
+        const field = entries[0][0];
+        const value = entries[0][1];
+        if (field && value !== undefined) {
+          matched = String(req.body[field] || '').toLowerCase().includes(String(value).toLowerCase());
+        }
+      }
+    }
+
+    if (matched) {
+      const pts = rule.score || 25;
+      scoreParts.push(pts);
+      threats.push('custom_rule_' + rule.name);
+      reasons.push(rule.reason || 'custom_rule_' + rule.name + '_matched');
+      breakdown.push({
+        rule: 'custom_rule_' + rule.name,
+        label: rule.label || 'Custom Rule: ' + rule.name,
+        points: pts,
+        category: 'custom',
+        confidence: rule.confidence || 85
+      });
+    }
+  }
+
+  const score = scoreParts.reduce(function(s, v) { return s + v; }, 0);
+  return { score, threats, reasons, breakdown };
+}
+
+/**
+ * Check if a built-in rule is enabled via config.rules.{ruleName}: true/false
+ * Defaults to true
+ */
+function isRuleEnabled(config, ruleName) {
+  if (!config.rules) return true;
+  const key = camelCase(ruleName);
+  if (config.rules[key] === false) return false;
+  return true;
+}
+
+function camelCase(str) {
+  return str.replace(/_([a-z])/g, function(_, c) { return c.toUpperCase(); });
+}
+
+module.exports = { applyCustomRules, isRuleEnabled, camelCase };