n8n-workflow-builder-mcp 0.1.0

package/src/middleware/rateLimiter.js

@@ -0,0 +1,82 @@
+/**
+ * Rate Limiter Middleware
+ * 
+ * Protects the API from excessive requests
+ */
+
+const { logger } = require('../utils/logger');
+const { createErrorResponse } = require('../utils/mcp');
+const { logSecurityEvent } = require('../utils/securityLogger');
+
+// In-memory store for rate limiting (in production, use Redis or similar)
+const requestCounts = {};
+
+// Constants
+const WINDOW_MS = 60 * 1000; // 1 minute
+const MAX_REQUESTS_PER_WINDOW = 100; // 100 requests per minute
+
+/**
+ * Simple rate limiter middleware
+ * 
+ * @param {Object} req - Express request object
+ * @param {Object} res - Express response object
+ * @param {Function} next - Express next middleware function
+ */
+const rateLimiter = (req, res, next) => {
+    const ip = req.ip || req.connection.remoteAddress;
+    const now = Date.now();
+
+    // Initialize or reset window
+    if (!requestCounts[ip] || requestCounts[ip].windowStart < now - WINDOW_MS) {
+        requestCounts[ip] = {
+            windowStart: now,
+            count: 1
+        };
+        return next();
+    }
+
+    // Increment count for existing window
+    requestCounts[ip].count++;
+
+    // Check if too many requests
+    if (requestCounts[ip].count > MAX_REQUESTS_PER_WINDOW) {
+        // Log rate limit
+        logger.warn(`Rate limit exceeded for IP: ${ip}`);
+
+        // Security log
+        logSecurityEvent({
+            level: 'warn',
+            eventType: 'rate_limit_exceeded',
+            ip,
+            details: {
+                count: requestCounts[ip].count,
+                window: WINDOW_MS,
+                limit: MAX_REQUESTS_PER_WINDOW
+            }
+        });
+
+        // Create error response
+        const errorResponse = createErrorResponse(
+            'Too many requests, please try again later',
+            'RATE_LIMIT_EXCEEDED',
+            429,
+            {
+                retryAfter: Math.ceil((requestCounts[ip].windowStart + WINDOW_MS - now) / 1000)
+            }
+        );
+
+        // Set retry header
+        res.setHeader(
+            'Retry-After',
+            Math.ceil((requestCounts[ip].windowStart + WINDOW_MS - now) / 1000)
+        );
+
+        return res.status(429).json({ error: errorResponse.error });
+    }
+
+    next();
+};
+
+module.exports = {
+    rateLimiter
+}; 

package/src/middleware/validation.js

@@ -0,0 +1,241 @@
+/**
+ * Input Validation Middleware
+ * 
+ * Provides JSON Schema validation for API endpoints and request sanitization.
+ */
+
+const Ajv = require('ajv');
+const addFormats = require('ajv-formats');
+const { createErrorResponse } = require('../utils/mcp');
+const { logger } = require('../utils/logger');
+const { logValidationFailure } = require('../utils/securityLogger');
+
+// Initialize AJV with additional options
+const ajv = new Ajv({
+    allErrors: true,
+    removeAdditional: 'all',  // Remove additional properties not in schema
+    useDefaults: true,        // Apply default values from schema
+    coerceTypes: true         // Convert data types when possible
+});
+
+// Add format validators (email, date, uri, etc.)
+addFormats(ajv);
+
+/**
+ * Creates a validation middleware for a specific schema
+ * 
+ * @param {Object} schema - JSON Schema object to validate against
+ * @param {string} property - Request property to validate (body, query, params)
+ * @returns {Function} Express middleware function
+ */
+const validateSchema = (schema, property = 'body') => {
+    const validate = ajv.compile(schema);
+
+    return (req, res, next) => {
+        const data = req[property];
+        const valid = validate(data);
+
+        if (!valid) {
+            // Format validation errors for response
+            const formattedErrors = formatValidationErrors(validate.errors);
+
+            // Regular logging
+            logger.warn(`Validation error for ${req.method} ${req.path}: ${JSON.stringify(formattedErrors)}`);
+
+            // Security logging
+            const clientIp = req.ip || req.connection.remoteAddress;
+            const userId = req.auth ? (req.auth.user ? req.auth.user.id : null) : null;
+
+            // Log each validation error separately
+            Object.keys(formattedErrors).forEach(field => {
+                logValidationFailure({
+                    ip: clientIp,
+                    userId,
+                    endpoint: req.path,
+                    method: req.method,
+                    violationType: 'schema_validation',
+                    inputField: field
+                });
+            });
+
+            const errorResponse = createErrorResponse(
+                'Validation failed',
+                'VALIDATION_ERROR',
+                400,
+                formattedErrors
+            );
+
+            return res.status(errorResponse.status).json({ error: errorResponse.error });
+        }
+
+        next();
+    };
+};
+
+/**
+ * Format validation errors into a more user-friendly structure
+ * 
+ * @param {Array} errors - AJV validation errors
+ * @returns {Object} Formatted errors by field
+ */
+const formatValidationErrors = (errors) => {
+    const formattedErrors = {};
+
+    for (const error of errors) {
+        // Extract the field name from the error path
+        const path = error.instancePath.substring(1).split('/');
+        const field = path.length ? path[path.length - 1] : error.params.missingProperty || 'value';
+
+        // Initialize the field in the errors object if it doesn't exist
+        if (!formattedErrors[field]) {
+            formattedErrors[field] = [];
+        }
+
+        // Add the error message for this field
+        let message = error.message;
+
+        // Customize messages for specific error types
+        if (error.keyword === 'required') {
+            message = `Missing required field: ${error.params.missingProperty}`;
+        } else if (error.keyword === 'additionalProperties') {
+            message = `Unexpected field: ${error.params.additionalProperty}`;
+        }
+
+        formattedErrors[field].push(message);
+    }
+
+    return formattedErrors;
+};
+
+/**
+ * Sanitize input data to prevent injection attacks
+ * 
+ * @param {*} data - Data to sanitize
+ * @returns {*} Sanitized data
+ */
+const sanitizeInput = (data) => {
+    if (typeof data === 'string') {
+        // Basic sanitization for strings
+        return data
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#x27;')
+            .replace(/\//g, '&#x2F;')
+            .replace(/`/g, '&#96;');
+    }
+
+    if (data && typeof data === 'object') {
+        if (Array.isArray(data)) {
+            // Recursively sanitize array items
+            return data.map(item => sanitizeInput(item));
+        } else {
+            // Recursively sanitize object properties
+            const sanitized = {};
+            for (const [key, value] of Object.entries(data)) {
+                sanitized[key] = sanitizeInput(value);
+            }
+            return sanitized;
+        }
+    }
+
+    // Return non-string, non-object values as is
+    return data;
+};
+
+/**
+ * Creates a sanitization middleware
+ * 
+ * @param {string} property - Request property to sanitize (body, query, params)
+ * @returns {Function} Express middleware function
+ */
+const sanitizeRequest = (property = 'body') => {
+    return (req, res, next) => {
+        if (req[property]) {
+            req[property] = sanitizeInput(req[property]);
+        }
+        next();
+    };
+};
+
+/**
+ * Validate workflow-specific inputs
+ */
+const validateWorkflow = (req, res, next) => {
+    const { name, description } = req.body;
+    const clientIp = req.ip || req.connection.remoteAddress;
+    const userId = req.auth?.userId || 'anonymous';
+
+    // Name must be provided
+    if (!name) {
+        // Log validation failure
+        logValidationFailure({
+            ip: clientIp,
+            userId,
+            endpoint: req.path,
+            method: req.method,
+            violationType: 'required_field_missing',
+            inputField: 'name'
+        });
+
+        const errorResponse = createErrorResponse(
+            'Workflow name is required',
+            'MISSING_REQUIRED_FIELD',
+            400
+        );
+
+        return res.status(400).json({ error: errorResponse.error });
+    }
+
+    // Name length validation
+    if (name.length > 100) {
+        // Log validation failure
+        logValidationFailure({
+            ip: clientIp,
+            userId,
+            endpoint: req.path,
+            method: req.method,
+            violationType: 'field_too_long',
+            inputField: 'name'
+        });
+
+        const errorResponse = createErrorResponse(
+            'Workflow name cannot exceed 100 characters',
+            'FIELD_TOO_LONG',
+            400
+        );
+
+        return res.status(400).json({ error: errorResponse.error });
+    }
+
+    // Description length validation
+    if (description && description.length > 500) {
+        // Log validation failure
+        logValidationFailure({
+            ip: clientIp,
+            userId,
+            endpoint: req.path,
+            method: req.method,
+            violationType: 'field_too_long',
+            inputField: 'description'
+        });
+
+        const errorResponse = createErrorResponse(
+            'Workflow description cannot exceed 500 characters',
+            'FIELD_TOO_LONG',
+            400
+        );
+
+        return res.status(400).json({ error: errorResponse.error });
+    }
+
+    next();
+};
+
+module.exports = {
+    validateSchema,
+    sanitizeRequest,
+    sanitizeInput,
+    formatValidationErrors,
+    validateWorkflow
+}; 

package/src/models/credential.js

@@ -0,0 +1,359 @@
+/**
+ * Credential Model
+ * 
+ * Handles secure credential storage and retrieval with encryption.
+ */
+
+const fs = require('fs').promises;
+const path = require('path');
+const { encrypt, decrypt, generateKey } = require('../utils/encryption');
+const { logger } = require('../utils/logger');
+
+// Configuration
+let config;
+try {
+    config = require('../../config/default');
+} catch (err) {
+    logger.error('Failed to load config', { error: err.message });
+    config = {
+        auth: { encryptionKey: process.env.ENCRYPTION_KEY }
+    };
+}
+
+// Storage location for credentials
+const CREDENTIALS_DIR = path.join(process.cwd(), 'config', 'credentials');
+const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
+
+// Get master encryption key from environment or generate one
+const MASTER_KEY = process.env.ENCRYPTION_KEY ||
+    config.auth?.encryptionKey ||
+    (() => {
+        logger.warn('No encryption key found, generating one. THIS SHOULD NOT BE USED IN PRODUCTION.');
+        const key = generateKey();
+        logger.warn(`Generated encryption key: ${key}. Add this to your environment variables as ENCRYPTION_KEY.`);
+        return key;
+    })();
+
+// Ensure credentials directory exists
+const ensureCredentialsDir = async () => {
+    try {
+        await fs.mkdir(CREDENTIALS_DIR, { recursive: true });
+    } catch (error) {
+        logger.error('Failed to create credentials directory', { error: error.message });
+        throw new Error('Failed to create credentials directory');
+    }
+};
+
+// Initialize credentials storage
+const initCredentialsStorage = async () => {
+    await ensureCredentialsDir();
+
+    try {
+        // Check if credentials file exists
+        await fs.access(CREDENTIALS_FILE);
+    } catch (error) {
+        // Create an empty credentials file
+        await fs.writeFile(CREDENTIALS_FILE, JSON.stringify({ credentials: {}, meta: { version: '1.0', keyId: 'v1' } }));
+        logger.info('Created new credentials file');
+    }
+};
+
+/**
+ * Loads credentials from storage
+ * 
+ * @returns {Object} Credentials data
+ */
+const loadCredentials = async () => {
+    try {
+        await ensureCredentialsDir();
+        const data = await fs.readFile(CREDENTIALS_FILE, 'utf8');
+        return JSON.parse(data);
+    } catch (error) {
+        logger.error('Failed to load credentials', { error: error.message });
+
+        // If file doesn't exist or is corrupted, create a new one
+        if (error.code === 'ENOENT' || error instanceof SyntaxError) {
+            const emptyData = { credentials: {}, meta: { version: '1.0', keyId: 'v1' } };
+            await fs.writeFile(CREDENTIALS_FILE, JSON.stringify(emptyData));
+            return emptyData;
+        }
+
+        throw new Error('Failed to load credentials');
+    }
+};
+
+/**
+ * Saves credentials to storage
+ * 
+ * @param {Object} data - Credentials data
+ */
+const saveCredentials = async (data) => {
+    try {
+        await ensureCredentialsDir();
+        await fs.writeFile(CREDENTIALS_FILE, JSON.stringify(data, null, 2));
+    } catch (error) {
+        logger.error('Failed to save credentials', { error: error.message });
+        throw new Error('Failed to save credentials');
+    }
+};
+
+/**
+ * Stores a credential securely
+ * 
+ * @param {string} name - Identifier for the credential
+ * @param {Object} data - Credential data to store
+ * @param {Object} options - Additional options
+ * @param {string} options.type - Type of credential (e.g., 'api', 'oauth')
+ * @param {string} options.keyId - Key identifier for encryption (for key rotation)
+ * @returns {Object} Status of the operation
+ */
+const storeCredential = async (name, data, options = {}) => {
+    if (!name || typeof name !== 'string') {
+        throw new Error('Credential name is required');
+    }
+
+    if (!data) {
+        throw new Error('Credential data is required');
+    }
+
+    try {
+        const credentialsData = await loadCredentials();
+        const keyId = options.keyId || credentialsData.meta.keyId || 'v1';
+
+        // Encrypt the credential data
+        const encryptedData = encrypt(data, MASTER_KEY, keyId);
+
+        // Store with metadata
+        credentialsData.credentials[name] = {
+            encrypted: encryptedData,
+            type: options.type || 'generic',
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString()
+        };
+
+        await saveCredentials(credentialsData);
+
+        return {
+            success: true,
+            name,
+            message: `Credential "${name}" stored successfully`
+        };
+    } catch (error) {
+        logger.error('Failed to store credential', { name, error: error.message });
+        throw new Error(`Failed to store credential "${name}": ${error.message}`);
+    }
+};
+
+/**
+ * Retrieves a stored credential
+ * 
+ * @param {string} name - Name of the credential to retrieve
+ * @returns {Object} Decrypted credential data
+ */
+const getCredential = async (name) => {
+    if (!name || typeof name !== 'string') {
+        throw new Error('Credential name is required');
+    }
+
+    try {
+        const credentialsData = await loadCredentials();
+
+        if (!credentialsData.credentials[name]) {
+            throw new Error(`Credential "${name}" not found`);
+        }
+
+        const encryptedData = credentialsData.credentials[name].encrypted;
+
+        // Decrypt the credential data
+        const decryptedData = decrypt(encryptedData, MASTER_KEY);
+
+        return {
+            data: decryptedData,
+            type: credentialsData.credentials[name].type,
+            createdAt: credentialsData.credentials[name].createdAt,
+            updatedAt: credentialsData.credentials[name].updatedAt
+        };
+    } catch (error) {
+        logger.error('Failed to retrieve credential', { name, error: error.message });
+        throw new Error(`Failed to retrieve credential "${name}": ${error.message}`);
+    }
+};
+
+/**
+ * Updates a stored credential
+ * 
+ * @param {string} name - Name of the credential to update
+ * @param {Object} data - New credential data
+ * @param {Object} options - Additional options
+ * @returns {Object} Status of the operation
+ */
+const updateCredential = async (name, data, options = {}) => {
+    if (!name || typeof name !== 'string') {
+        throw new Error('Credential name is required');
+    }
+
+    if (!data) {
+        throw new Error('Credential data is required');
+    }
+
+    try {
+        const credentialsData = await loadCredentials();
+
+        if (!credentialsData.credentials[name]) {
+            throw new Error(`Credential "${name}" not found`);
+        }
+
+        const keyId = options.keyId || credentialsData.meta.keyId || 'v1';
+
+        // Encrypt the credential data
+        const encryptedData = encrypt(data, MASTER_KEY, keyId);
+
+        // Update the credential
+        credentialsData.credentials[name] = {
+            ...credentialsData.credentials[name],
+            encrypted: encryptedData,
+            updatedAt: new Date().toISOString()
+        };
+
+        // Update type if provided
+        if (options.type) {
+            credentialsData.credentials[name].type = options.type;
+        }
+
+        await saveCredentials(credentialsData);
+
+        return {
+            success: true,
+            name,
+            message: `Credential "${name}" updated successfully`
+        };
+    } catch (error) {
+        logger.error('Failed to update credential', { name, error: error.message });
+        throw new Error(`Failed to update credential "${name}": ${error.message}`);
+    }
+};
+
+/**
+ * Deletes a stored credential
+ * 
+ * @param {string} name - Name of the credential to delete
+ * @returns {Object} Status of the operation
+ */
+const deleteCredential = async (name) => {
+    if (!name || typeof name !== 'string') {
+        throw new Error('Credential name is required');
+    }
+
+    try {
+        const credentialsData = await loadCredentials();
+
+        if (!credentialsData.credentials[name]) {
+            throw new Error(`Credential "${name}" not found`);
+        }
+
+        // Delete the credential
+        delete credentialsData.credentials[name];
+
+        await saveCredentials(credentialsData);
+
+        return {
+            success: true,
+            name,
+            message: `Credential "${name}" deleted successfully`
+        };
+    } catch (error) {
+        logger.error('Failed to delete credential', { name, error: error.message });
+        throw new Error(`Failed to delete credential "${name}": ${error.message}`);
+    }
+};
+
+/**
+ * Lists all available credentials (without sensitive data)
+ * 
+ * @returns {Object[]} List of credentials with metadata
+ */
+const listCredentials = async () => {
+    try {
+        const credentialsData = await loadCredentials();
+
+        return Object.entries(credentialsData.credentials).map(([name, cred]) => ({
+            name,
+            type: cred.type,
+            createdAt: cred.createdAt,
+            updatedAt: cred.updatedAt
+        }));
+    } catch (error) {
+        logger.error('Failed to list credentials', { error: error.message });
+        throw new Error('Failed to list credentials');
+    }
+};
+
+/**
+ * Rotates the encryption key for all credentials
+ * 
+ * @param {string} newKeyId - New key identifier
+ * @returns {Object} Status of the operation
+ */
+const rotateEncryptionKey = async (newKeyId = `v${Date.now()}`) => {
+    try {
+        const credentialsData = await loadCredentials();
+        const currentKeyId = credentialsData.meta.keyId || 'v1';
+
+        // Skip if key ID is the same
+        if (newKeyId === currentKeyId) {
+            return {
+                success: true,
+                message: 'Key already up to date, no rotation needed',
+                keyId: currentKeyId
+            };
+        }
+
+        // Re-encrypt all credentials with the new key ID
+        for (const [name, cred] of Object.entries(credentialsData.credentials)) {
+            try {
+                // Decrypt with current key
+                const decryptedData = decrypt(cred.encrypted, MASTER_KEY);
+
+                // Re-encrypt with new key ID
+                cred.encrypted = encrypt(decryptedData, MASTER_KEY, newKeyId);
+                cred.updatedAt = new Date().toISOString();
+            } catch (error) {
+                logger.error(`Failed to rotate key for credential "${name}"`, { error: error.message });
+                // Continue with other credentials
+            }
+        }
+
+        // Update metadata
+        credentialsData.meta.keyId = newKeyId;
+        credentialsData.meta.keyRotatedAt = new Date().toISOString();
+
+        await saveCredentials(credentialsData);
+
+        return {
+            success: true,
+            message: `Encryption key rotated successfully to "${newKeyId}"`,
+            keyId: newKeyId
+        };
+    } catch (error) {
+        logger.error('Failed to rotate encryption key', { error: error.message });
+        throw new Error('Failed to rotate encryption key');
+    }
+};
+
+// Initialize credentials storage on module load
+(async () => {
+    try {
+        await initCredentialsStorage();
+    } catch (error) {
+        logger.error('Failed to initialize credentials storage', { error: error.message });
+    }
+})();
+
+module.exports = {
+    storeCredential,
+    getCredential,
+    updateCredential,
+    deleteCredential,
+    listCredentials,
+    rotateEncryptionKey
+};