libastion 0.0.1

package/src/audit/index.js

@@ -0,0 +1,128 @@
+const db = require('../db');
+const logger = require('../logger');
+
+const service = 'audit';
+
+/**
+ * Create a new audit session
+ */
+function createSession(userId, hostId, clientIp) {
+  const result = db.prepare(
+    'INSERT INTO audit_sessions (user_id, host_id, client_ip) VALUES (?, ?, ?)'
+  ).run(userId, hostId, clientIp);
+
+  return {
+    id: result.lastInsertRowid,
+    userId,
+    hostId,
+    clientIp,
+  };
+}
+
+/**
+ * End an audit session
+ */
+function endSession(sessionId, status = 'closed') {
+  db.prepare(
+    'UPDATE audit_sessions SET end_time = datetime(\'now\'), status = ? WHERE id = ?'
+  ).run(status, sessionId);
+}
+
+/**
+ * Record a command
+ */
+function recordCommand(sessionId, command, blocked = false) {
+  db.prepare(
+    'INSERT INTO audit_commands (session_id, command, blocked) VALUES (?, ?, ?)'
+  ).run(sessionId, command, blocked ? 1 : 0);
+}
+
+/**
+ * Record a file transfer
+ */
+function recordTransfer(sessionId, direction, filePath, size = 0) {
+  db.prepare(
+    'INSERT INTO audit_transfers (session_id, direction, path, size) VALUES (?, ?, ?, ?)'
+  ).run(sessionId, direction, filePath, size);
+}
+
+/**
+ * Record a port forward
+ */
+function recordForward(sessionId, fwdType, srcAddr, srcPort, dstAddr, dstPort) {
+  db.prepare(
+    'INSERT INTO audit_forwards (session_id, fwd_type, src_addr, src_port, dst_addr, dst_port) VALUES (?, ?, ?, ?, ?, ?)'
+  ).run(sessionId, fwdType, srcAddr, srcPort, dstAddr, dstPort);
+}
+
+/**
+ * Query audit commands
+ */
+function queryCommands(sessionId, options = {}) {
+  let sql = 'SELECT * FROM audit_commands WHERE session_id = ?';
+  const params = [sessionId];
+
+  if (options.since) {
+    sql += ' AND timestamp >= ?';
+    params.push(options.since);
+  }
+  if (options.until) {
+    sql += ' AND timestamp <= ?';
+    params.push(options.until);
+  }
+  if (options.command) {
+    sql += ' AND command LIKE ?';
+    params.push(`%${options.command}%`);
+  }
+  if (options.blocked !== undefined) {
+    sql += ' AND blocked = ?';
+    params.push(options.blocked ? 1 : 0);
+  }
+
+  sql += ' ORDER BY timestamp DESC';
+  if (options.limit) {
+    sql += ' LIMIT ?';
+    params.push(options.limit);
+  }
+
+  return db.prepare(sql).all(...params);
+}
+
+/**
+ * Query sessions
+ */
+function querySessions(options = {}) {
+  let sql = 'SELECT s.*, u.username, h.name as host_name, h.host as host_addr FROM audit_sessions s JOIN users u ON u.id = s.user_id JOIN hosts h ON h.id = s.host_id WHERE 1=1';
+  const params = [];
+
+  if (options.userId) {
+    sql += ' AND s.user_id = ?';
+    params.push(options.userId);
+  }
+  if (options.hostId) {
+    sql += ' AND s.host_id = ?';
+    params.push(options.hostId);
+  }
+  if (options.since) {
+    sql += ' AND s.start_time >= ?';
+    params.push(options.since);
+  }
+  if (options.until) {
+    sql += ' AND s.start_time <= ?';
+    params.push(options.until);
+  }
+  if (options.status) {
+    sql += ' AND s.status = ?';
+    params.push(options.status);
+  }
+
+  sql += ' ORDER BY s.start_time DESC';
+  if (options.limit) {
+    sql += ' LIMIT ?';
+    params.push(options.limit);
+  }
+
+  return db.prepare(sql).all(...params);
+}
+
+module.exports = { createSession, endSession, recordCommand, recordTransfer, recordForward, queryCommands, querySessions };

package/src/auth/index.js

@@ -0,0 +1,98 @@
+const db = require('../db');
+const bcrypt = require('bcryptjs');
+const logger = require('../logger');
+const config = require('../config');
+
+const service = 'auth';
+
+// Create initial admin user if not exists
+function initDefaults() {
+  const user = db.prepare('SELECT id FROM users WHERE username = ?').get('admin');
+  if (!user) {
+    const hash = bcrypt.hashSync('admin123', 10);
+    db.prepare(
+      'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)'
+    ).run('admin', hash, 'admin');
+    logger.info(`${service}: Created default admin user`, { username: 'admin' });
+  }
+}
+
+// Authenticate user by password
+function authenticate(username, password) {
+  const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
+  if (!user) {
+    logger.warn(`${service}: User not found`, { username });
+    return null;
+  }
+
+  // Check if locked
+  if (user.status === 'locked' && user.locked_until) {
+    const now = Date.now();
+    if (now < user.locked_until) {
+      logger.warn(`${service}: User locked`, { username });
+      return null;
+    } else {
+      // Lock expired, reset
+      db.prepare('UPDATE users SET status = ?, failed_attempts = 0, locked_until = NULL WHERE id = ?').run('active', user.id);
+    }
+  }
+
+  // Verify password
+  const valid = bcrypt.compareSync(password, user.password_hash);
+  if (!valid) {
+    // Increment failed attempts
+    const newAttempts = user.failed_attempts + 1;
+    let status = user.status;
+    let lockedUntil = user.locked_until;
+
+    if (newAttempts >= config.auth.maxFailedAttempts) {
+      status = 'locked';
+      lockedUntil = Date.now() + config.auth.lockDurationSec * 1000;
+    }
+
+    db.prepare(
+      'UPDATE users SET failed_attempts = ?, status = ?, locked_until = ? WHERE id = ?'
+    ).run(newAttempts, status, lockedUntil, user.id);
+
+    logger.warn(`${service}: Failed login attempt`, { username, attempts: newAttempts });
+    return null;
+  }
+
+  // Reset failed attempts on successful login
+  if (user.failed_attempts > 0) {
+    db.prepare('UPDATE users SET failed_attempts = 0, status = ?, locked_until = NULL WHERE id = ?').run('active', user.id);
+  }
+
+  return {
+    id: user.id,
+    username: user.username,
+    role: user.role,
+  };
+}
+
+// Get user's authorized hosts
+function getUserHosts(userId) {
+  const rows = db.prepare(`
+    SELECT h.* FROM hosts h
+    JOIN user_host_perms uhp ON uhp.host_id = h.id
+    WHERE uhp.user_id = ?
+  `).all(userId);
+  return rows;
+}
+
+// Create user
+function createUser(username, password, role = 'user') {
+  const hash = bcrypt.hashSync(password, 10);
+  const result = db.prepare(
+    'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)'
+  ).run(username, hash, role);
+  return { id: result.lastInsertRowid, username, role };
+}
+
+// Update user password
+function updatePassword(userId, newPassword) {
+  const hash = bcrypt.hashSync(newPassword, 10);
+  db.prepare('UPDATE users SET password_hash = ?, updated_at = datetime(\'now\') WHERE id = ?').run(hash, userId);
+}
+
+module.exports = { initDefaults, authenticate, getUserHosts, createUser, updatePassword };

package/src/cli/index.js

@@ -0,0 +1,179 @@
+const { Command } = require('commander');
+const { createUser, updatePassword } = require('../auth');
+const { addHost, listHosts, grantAccess, revokeAccess } = require('../hosts');
+const { querySessions, queryCommands } = require('../audit');
+const logger = require('../logger');
+
+const service = 'cli';
+
+const program = new Command();
+
+program
+  .name('bastion')
+  .description('CLI for bastion host management')
+  .version('0.1.0');
+
+// User commands
+program
+  .command('add-user')
+  .description('Add a new user')
+  .argument('<username>', 'Username')
+  .argument('<password>', 'Password')
+  .option('-r, --role <role>', 'User role (admin/auditor/user)', 'user')
+  .action(async (username, password, options) => {
+    try {
+      const user = createUser(username, password, options.role);
+      console.log(`✓ User created: ${user.username} (role: ${user.role}, id: ${user.id})`);
+    } catch (e) {
+      console.error(`✗ Error: ${e.message}`);
+    }
+  });
+
+program
+  .command('update-password')
+  .description('Update user password')
+  .argument('<username>', 'Username')
+  .argument('<password>', 'New password')
+  .action(async (username, password) => {
+    const db = require('../db');
+    const user = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
+    if (!user) {
+      console.error(`✗ User not found: ${username}`);
+      return;
+    }
+    updatePassword(user.id, password);
+    console.log(`✓ Password updated for: ${username}`);
+  });
+
+// Host commands
+program
+  .command('add-host')
+  .description('Add a target host')
+  .argument('<name>', 'Host name (display name)')
+  .argument('<host>', 'Host address')
+  .argument('<port>', 'SSH port')
+  .argument('<username>', 'SSH username')
+  .argument('<password>', 'SSH password')
+  .action(async (name, host, port, username, password) => {
+    try {
+      const hostInfo = addHost(name, host, parseInt(port, 10), username, password);
+      console.log(`✓ Host added: ${hostInfo.name} (${hostInfo.host}:${hostInfo.port})`);
+    } catch (e) {
+      console.error(`✗ Error: ${e.message}`);
+    }
+  });
+
+program
+  .command('list-hosts')
+  .description('List all target hosts')
+  .action(async () => {
+    const hosts = listHosts();
+    if (hosts.length === 0) {
+      console.log('No hosts configured.');
+      return;
+    }
+    console.log('\nTarget Hosts:');
+    console.log('─'.repeat(80));
+    hosts.forEach(h => {
+      console.log(`  ID: ${h.id}`);
+      console.log(`  Name: ${h.name}`);
+      console.log(`  Address: ${h.host}:${h.port}`);
+      console.log(`  Username: ${h.username}`);
+      console.log('─'.repeat(80));
+    });
+  });
+
+// Permission commands
+program
+  .command('grant')
+  .description('Grant a user access to a host')
+  .argument('<username>', 'Username')
+  .argument('<host-name>', 'Host name (display name)')
+  .action(async (username, hostName) => {
+    const db = require('../db');
+    const user = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
+    if (!user) {
+      console.error(`✗ User not found: ${username}`);
+      return;
+    }
+    const host = db.prepare('SELECT id FROM hosts WHERE name = ?').get(hostName);
+    if (!host) {
+      console.error(`✗ Host not found: ${hostName}`);
+      return;
+    }
+    grantAccess(user.id, host.id);
+    console.log(`✓ Granted: ${username} -> ${hostName}`);
+  });
+
+// Audit commands
+program
+  .command('list-sessions')
+  .description('List audit sessions')
+  .option('-u, --user <id>', 'Filter by user ID')
+  .option('-H, --host <id>', 'Filter by host ID')
+  .option('-s, --since <date>', 'Filter since date (YYYY-MM-DD)')
+  .option('-e, --until <date>', 'Filter until date (YYYY-MM-DD)')
+  .option('--active', 'Show only active sessions')
+  .option('-l, --limit <n>', 'Limit results', '20')
+  .action(async (options) => {
+    const sessions = querySessions({
+      userId: options.user ? parseInt(options.user) : undefined,
+      hostId: options.host ? parseInt(options.host) : undefined,
+      since: options.since,
+      until: options.until,
+      status: options.active ? 'active' : undefined,
+      limit: parseInt(options.limit, 10),
+    });
+
+    if (sessions.length === 0) {
+      console.log('No sessions found.');
+      return;
+    }
+
+    console.log('\nAudit Sessions:');
+    console.log('─'.repeat(120));
+    sessions.forEach(s => {
+      console.log(`  ID: ${s.id}`);
+      console.log(`  User: ${s.username}`);
+      console.log(`  Host: ${s.host_name} (${s.host_addr}:${22})`);
+      console.log(`  Client IP: ${s.client_ip}`);
+      console.log(`  Status: ${s.status}`);
+      console.log(`  Started: ${s.start_time}`);
+      if (s.end_time) console.log(`  Ended: ${s.end_time}`);
+      console.log('─'.repeat(120));
+    });
+  });
+
+program
+  .command('show-commands')
+  .description('Show audit commands for a session')
+  .argument('<session-id>', 'Session ID')
+  .option('-s, --since <date>', 'Filter since')
+  .option('-e, --until <date>', 'Filter until')
+  .option('-c, --command <pattern>', 'Filter by command pattern')
+  .option('--blocked', 'Show only blocked commands')
+  .option('-l, --limit <n>', 'Limit results', '50')
+  .action(async (sessionId, options) => {
+    const commands = queryCommands(parseInt(sessionId, 10), {
+      since: options.since,
+      until: options.until,
+      command: options.command,
+      blocked: options.blocked,
+      limit: parseInt(options.limit, 10),
+    });
+
+    if (commands.length === 0) {
+      console.log('No commands found for this session.');
+      return;
+    }
+
+    console.log(`\nCommands for Session #${sessionId}:`);
+    console.log('─'.repeat(100));
+    commands.forEach(c => {
+      const blockMarker = c.blocked ? ' [BLOCKED]' : '';
+      console.log(`  ${c.timestamp}  ${c.command}${blockMarker}`);
+    });
+  });
+
+// Execute
+program.parse();

package/src/config/index.js

@@ -0,0 +1,31 @@
+require('dotenv').config();
+const fs = require('fs');
+const path = require('path');
+
+let config = {};
+
+try {
+  config = JSON.parse(
+    fs.readFileSync(path.join(__dirname, '..', '..', 'config.json'), 'utf-8')
+  );
+} catch (e) {
+  console.error('Failed to load config.json:', e.message);
+}
+
+module.exports = {
+  server: {
+    port: parseInt(process.env.BASTION_PORT || config.server?.port || 2222, 10),
+    maxSessions: config.server?.maxSessions || 50,
+    sessionTimeoutSec: config.server?.sessionTimeoutSec || 1800,
+    idleTimeoutSec: config.server?.idleTimeoutSec || 900,
+  },
+  auth: {
+    maxFailedAttempts: config.auth?.maxFailedAttempts || 5,
+    lockDurationSec: config.auth?.lockDurationSec || 900,
+  },
+  policy: {
+    blockedCommands: config.policy?.blockedCommands || [],
+  },
+  masterKey: process.env.BASTION_MASTER_KEY || '',
+  logLevel: process.env.BASTION_LOG_LEVEL || config.logLevel || 'info',
+};

package/src/crypto.js

@@ -0,0 +1,52 @@
+const crypto = require('crypto');
+const config = require('../config');
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 32;
+const TAG_LENGTH = 16;
+
+function deriveKey(masterKey) {
+  // Simple key derivation: hash master key
+  return crypto.createHash('sha256').update(masterKey).digest();
+}
+
+function encrypt(text, masterKey) {
+  if (!masterKey) throw new Error('Master key is not set');
+
+  const salt = crypto.randomBytes(SALT_LENGTH);
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const key = deriveKey(masterKey);
+
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  let encrypted = cipher.update(text, 'utf-8', 'hex');
+  encrypted += cipher.final('hex');
+  const tag = cipher.getAuthTag().toString('hex');
+
+  // Format: salt:iv:tag:encrypted
+  return [salt.toString('hex'), iv.toString('hex'), tag, encrypted].join(':');
+}
+
+function decrypt(encryptedText, masterKey) {
+  if (!masterKey) throw new Error('Master key is not set');
+
+  const parts = encryptedText.split(':');
+  if (parts.length !== 4) throw new Error('Invalid encrypted format');
+
+  const salt = Buffer.from(parts[0], 'hex');
+  const iv = Buffer.from(parts[1], 'hex');
+  const tag = Buffer.from(parts[2], 'hex');
+  const encrypted = parts[3];
+
+  const key = deriveKey(masterKey);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+
+  let decrypted = decipher.update(encrypted, 'hex', 'utf-8');
+  decrypted += decipher.final('utf-8');
+
+  return decrypted;
+}
+
+module.exports = { encrypt, decrypt };

package/src/db/index.js

@@ -0,0 +1,116 @@
+const { DatabaseSync } = require('node:sqlite');
+const path = require('path');
+const fs = require('fs');
+
+const DB_DIR = path.join(__dirname, '..', '..', 'data');
+const DB_PATH = path.join(DB_DIR, 'bastion.db');
+
+// Ensure data directory exists
+if (!fs.existsSync(DB_DIR)) {
+  fs.mkdirSync(DB_DIR, { recursive: true });
+}
+
+const db = new DatabaseSync(DB_PATH);
+
+// Enable WAL mode and foreign keys
+db.exec('PRAGMA journal_mode = WAL');
+db.exec('PRAGMA foreign_keys = ON');
+
+// SQL schema
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    username TEXT UNIQUE NOT NULL,
+    password_hash TEXT NOT NULL,
+    role TEXT NOT NULL DEFAULT 'user' CHECK(role IN ('admin', 'auditor', 'user')),
+    status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'locked', 'disabled')),
+    failed_attempts INTEGER NOT NULL DEFAULT 0,
+    locked_until INTEGER,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS hosts (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    host TEXT NOT NULL,
+    port INTEGER NOT NULL DEFAULT 22,
+    username TEXT NOT NULL,
+    auth_type TEXT NOT NULL DEFAULT 'password' CHECK(auth_type IN ('password', 'keyboard-interactive')),
+    credential_enc TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS user_host_perms (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    host_id INTEGER NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id),
+    FOREIGN KEY (host_id) REFERENCES hosts(id),
+    UNIQUE(user_id, host_id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_user_host_perms_user ON user_host_perms(user_id);
+  CREATE INDEX IF NOT EXISTS idx_user_host_perms_host ON user_host_perms(host_id);
+
+  CREATE TABLE IF NOT EXISTS audit_sessions (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    host_id INTEGER NOT NULL,
+    client_ip TEXT NOT NULL,
+    start_time TEXT NOT NULL DEFAULT (datetime('now')),
+    end_time TEXT,
+    status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'closed', 'error')),
+    FOREIGN KEY (user_id) REFERENCES users(id),
+    FOREIGN KEY (host_id) REFERENCES hosts(id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_audit_sessions_user ON audit_sessions(user_id);
+  CREATE INDEX IF NOT EXISTS idx_audit_sessions_host ON audit_sessions(host_id);
+  CREATE INDEX IF NOT EXISTS idx_audit_sessions_start ON audit_sessions(start_time);
+
+  CREATE TABLE IF NOT EXISTS audit_commands (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id INTEGER NOT NULL,
+    command TEXT NOT NULL,
+    timestamp TEXT NOT NULL DEFAULT (datetime('now')),
+    blocked INTEGER NOT NULL DEFAULT 0,
+    FOREIGN KEY (session_id) REFERENCES audit_sessions(id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_audit_commands_session ON audit_commands(session_id);
+  CREATE INDEX IF NOT EXISTS idx_audit_commands_timestamp ON audit_commands(timestamp);
+
+  CREATE TABLE IF NOT EXISTS audit_transfers (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id INTEGER NOT NULL,
+    direction TEXT NOT NULL CHECK(direction IN ('upload', 'download')),
+    path TEXT NOT NULL,
+    size INTEGER NOT NULL DEFAULT 0,
+    timestamp TEXT NOT NULL DEFAULT (datetime('now')),
+    FOREIGN KEY (session_id) REFERENCES audit_sessions(id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_audit_transfers_session ON audit_transfers(session_id);
+
+  CREATE TABLE IF NOT EXISTS audit_forwards (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    session_id INTEGER NOT NULL,
+    fwd_type TEXT NOT NULL CHECK(fwd_type IN ('direct-tcpip', 'forwarded-tcpip')),
+    src_addr TEXT NOT NULL,
+    src_port INTEGER NOT NULL,
+    dst_addr TEXT NOT NULL,
+    dst_port INTEGER NOT NULL,
+    timestamp TEXT NOT NULL DEFAULT (datetime('now')),
+    FOREIGN KEY (session_id) REFERENCES audit_sessions(id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_audit_forwards_session ON audit_forwards(session_id);
+`;
+
+// Execute schema
+db.exec(SCHEMA);
+
+module.exports = db;

package/src/hosts/index.js

@@ -0,0 +1,63 @@
+const db = require('../db');
+const { encrypt, decrypt } = require('../crypto');
+const logger = require('../logger');
+const config = require('../config');
+
+const service = 'hosts';
+
+// Add host with credential encryption
+function addHost(name, host, port, username, password) {
+  const credEnc = encrypt(password, config.masterKey);
+  const result = db.prepare(
+    'INSERT INTO hosts (name, host, port, username, credential_enc) VALUES (?, ?, ?, ?, ?)'
+  ).run(name, host, port, username, credEnc);
+
+  logger.info(`${service}: Added host`, { hostId: result.lastInsertRowid, name, host, port });
+
+  return {
+    id: result.lastInsertRowid,
+    name,
+    host,
+    port,
+    username,
+  };
+}
+
+// Get host by ID with decrypted credential
+function getHost(id) {
+  const row = db.prepare('SELECT * FROM hosts WHERE id = ?').get(id);
+  if (!row) return null;
+
+  try {
+    row.credential = decrypt(row.credential_enc, config.masterKey);
+  } catch (e) {
+    logger.error(`${service}: Failed to decrypt credential`, { id, error: e.message });
+    row.credential = null;
+  }
+
+  return row;
+}
+
+// List all hosts (credentials not decrypted)
+function listHosts() {
+  return db.prepare('SELECT id, name, host, port, username, created_at FROM hosts').all();
+}
+
+// Grant user access to host
+function grantAccess(userId, hostId) {
+  const result = db.prepare(
+    'INSERT INTO user_host_perms (user_id, host_id) VALUES (?, ?)'
+  ).run(userId, hostId);
+
+  logger.info(`${service}: Granted access`, { userId, hostId });
+  return { id: result.lastInsertRowid };
+}
+
+// Remove grant
+function revokeAccess(userId, hostId) {
+  db.prepare(
+    'DELETE FROM user_host_perms WHERE user_id = ? AND host_id = ?'
+  ).run(userId, hostId);
+}
+
+module.exports = { addHost, getHost, listHosts, grantAccess, revokeAccess };

package/src/logger.js

@@ -0,0 +1,31 @@
+const winston = require('winston');
+const config = require('./config');
+
+const logger = winston.createLogger({
+  level: config.logLevel,
+  format: winston.format.combine(
+    winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
+    winston.format.errors({ stack: true }),
+    winston.format.printf(({ timestamp, level, message, service, ...meta }) => {
+      const prefix = service ? `[${service}]` : '';
+      return `${timestamp} ${level} ${prefix} ${message}`;
+    })
+  ),
+  transports: [
+    new winston.transports.Console({
+      format: winston.format.combine(
+        winston.format.colorize(),
+        winston.format.simple()
+      ),
+    }),
+    new winston.transports.File({
+      filename: 'logs/error.log',
+      level: 'error',
+    }),
+    new winston.transports.File({
+      filename: 'logs/combined.log',
+    }),
+  ],
+});
+
+module.exports = logger;