libastion 0.0.1

package/src/policy/index.js

@@ -0,0 +1,32 @@
+const config = require('../config');
+const logger = require('../logger');
+
+const service = 'policy';
+
+// Pre-compile regex patterns
+const blockedPatterns = config.policy.blockedCommands.map(pattern => ({
+  pattern: new RegExp(pattern, 'i'),
+  original: pattern,
+}));
+
+/**
+ * Check if a command is blocked
+ * @param {string} command - The command to check
+ * @returns {{ blocked: boolean, reason: string | null }}
+ */
+function checkCommand(command) {
+  if (!command || !command.trim()) {
+    return { blocked: false, reason: null };
+  }
+
+  for (const { pattern, original } of blockedPatterns) {
+    if (pattern.test(command.trim())) {
+      logger.warn(`${service}: Command blocked`, { command, pattern: original });
+      return { blocked: true, reason: `Command "${command.trim()}" is blocked by policy` };
+    }
+  }
+
+  return { blocked: false, reason: null };
+}
+
+module.exports = { checkCommand };

package/src/session/index.js

@@ -0,0 +1,140 @@
+const { Client } = require('ssh2');
+const config = require('../config');
+const logger = require('../logger');
+const audit = require('../audit');
+
+const service = 'session';
+
+// Active session counter
+let activeSessions = 0;
+
+/**
+ * Create SSH client connection to target host
+ */
+function createClientConnection(hostInfo, userId, sessionId, serverStream) {
+  return new Promise((resolve, reject) => {
+    const client = new Client();
+
+    client.on('ready', () => {
+      logger.info(`${service}: SSH client connected to target`, {
+        host: hostInfo.host,
+        port: hostInfo.port,
+        userId,
+        sessionId,
+      });
+      resolve(client);
+    });
+
+    client.on('error', (err) => {
+      logger.error(`${service}: SSH client error`, { error: err.message, host: hostInfo.host });
+      audit.endSession(sessionId, 'error');
+      reject(err);
+    });
+
+    client.on('close', () => {
+      logger.info(`${service}: SSH client closed`, { sessionId });
+      audit.endSession(sessionId, 'closed');
+      activeSessions--;
+    });
+
+    // Connect to target host
+    client.connect({
+      host: hostInfo.host,
+      port: hostInfo.port || 22,
+      username: hostInfo.username,
+      password: hostInfo.credential,
+      readyTimeout: 20000,
+    });
+  });
+}
+
+/**
+ * Handle shell session (interactive terminal)
+ */
+async function handleShell(client, sessionId) {
+  return new Promise((resolve, reject) => {
+    client.shell({
+      term: 'xterm',
+      cols: 80,
+      rows: 30,
+    }, (err, stream) => {
+      if (err) {
+        logger.error(`${service}: Shell creation error`, { error: err.message });
+        reject(err);
+        return;
+      }
+
+      logger.info(`${service}: Shell session started`, { sessionId });
+      activeSessions++;
+
+      // Set idle timeout
+      let idleTimer = setTimeout(() => {
+        logger.warn(`${service}: Session timed out (idle)`, { sessionId });
+        stream.end();
+        resolve();
+      }, config.server.idleTimeoutSec * 1000);
+
+      stream.on('data', (data) => {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+          logger.warn(`${service}: Session timed out (idle)`, { sessionId });
+          stream.end();
+          resolve();
+        }, config.server.idleTimeoutSec * 1000);
+      });
+
+      resolve(stream);
+    });
+  });
+}
+
+/**
+ * Handle exec session (single command)
+ */
+async function handleExec(client, command, sessionId) {
+  return new Promise((resolve, reject) => {
+    activeSessions++;
+
+    client.exec(command, (err, stream) => {
+      if (err) {
+        logger.error(`${service}: Exec error`, { error: err.message });
+        reject(err);
+        return;
+      }
+
+      resolve(stream);
+    });
+  });
+}
+
+/**
+ * Bridge two streams bidirectionally with command audit
+ */
+function bridgeStreams(serverStream, clientStream, sessionId) {
+  // Server -> Client
+  serverStream.on('data', (data) => {
+    clientStream.write(data);
+  });
+
+  // Client -> Server (interactive shell passthrough, command audit happens in session handle)
+  clientStream.on('data', (data) => {
+    serverStream.write(data);
+  });
+
+  // Close propagation
+  serverStream.on('close', () => {
+    clientStream.end();
+  });
+  clientStream.on('close', () => {
+    serverStream.end();
+  });
+}
+
+module.exports = {
+  createClientConnection,
+  handleShell,
+  handleExec,
+  bridgeStreams,
+  getActiveSessions: () => activeSessions,
+  getMaxSessions: () => config.server.maxSessions,
+};