n8n-workflow-builder-mcp 0.1.0

package/src/utils/encryption.js

@@ -0,0 +1,164 @@
+/**
+ * Encryption Utilities
+ * 
+ * Provides functions for encrypting and decrypting sensitive data.
+ * Uses AES-256-GCM for authenticated encryption with strong security properties.
+ */
+
+const crypto = require('crypto');
+const { logger } = require('./logger');
+
+// Encryption configuration
+const ENCRYPTION_CONFIG = {
+    ALGORITHM: 'aes-256-gcm',
+    KEY_LENGTH: 32, // 256 bits for AES-256
+    IV_LENGTH: 16,  // 128 bits
+    AUTH_TAG_LENGTH: 16 // 128 bits
+};
+
+// In-memory key cache, used to support key rotation
+// In production, this should be replaced with a secure key management system
+const keyCache = new Map();
+
+/**
+ * Generates a random encryption key
+ * 
+ * @returns {Buffer} Random encryption key
+ */
+const generateEncryptionKey = () => {
+    return crypto.randomBytes(ENCRYPTION_CONFIG.KEY_LENGTH);
+};
+
+/**
+ * Derives an encryption key from a master key and a key identifier
+ * This allows for key rotation by changing the key identifier
+ * 
+ * @param {string} masterKey - The master encryption key
+ * @param {string} keyId - Key identifier (e.g., a version number)
+ * @returns {Buffer} Derived encryption key
+ */
+const deriveKey = (masterKey, keyId) => {
+    // Check if key is already in cache
+    const cacheKey = `${masterKey}:${keyId}`;
+    if (keyCache.has(cacheKey)) {
+        return keyCache.get(cacheKey);
+    }
+
+    // Derive key using HKDF (HMAC-based Key Derivation Function)
+    const derivedKey = crypto.hkdfSync(
+        'sha256',
+        Buffer.from(masterKey, 'hex'),
+        Buffer.from(keyId, 'utf8'),
+        Buffer.from('n8n-credential-encryption'),
+        ENCRYPTION_CONFIG.KEY_LENGTH
+    );
+
+    // Cache the derived key
+    keyCache.set(cacheKey, derivedKey);
+
+    return derivedKey;
+};
+
+/**
+ * Encrypts data using AES-256-GCM
+ * 
+ * @param {string|Object} data - Data to encrypt
+ * @param {string} masterKey - Encryption key in hex format
+ * @param {string} keyId - Key identifier for key rotation
+ * @returns {string} Encrypted data as a structured string
+ */
+const encrypt = (data, masterKey, keyId = 'v1') => {
+    try {
+        // Convert data to string if it's an object
+        const dataString = typeof data === 'object' ? JSON.stringify(data) : data;
+
+        // Generate random initialization vector
+        const iv = crypto.randomBytes(ENCRYPTION_CONFIG.IV_LENGTH);
+
+        // Derive the encryption key
+        const key = deriveKey(masterKey, keyId);
+
+        // Create cipher
+        const cipher = crypto.createCipheriv(ENCRYPTION_CONFIG.ALGORITHM, key, iv);
+
+        // Encrypt the data
+        let encrypted = cipher.update(dataString, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+
+        // Get authentication tag
+        const authTag = cipher.getAuthTag().toString('hex');
+
+        // Format: VERSION:KEY_ID:IV:AUTH_TAG:ENCRYPTED_DATA
+        return `1:${keyId}:${iv.toString('hex')}:${authTag}:${encrypted}`;
+    } catch (error) {
+        logger.error('Encryption failed', { error: error.message });
+        throw new Error('Failed to encrypt data');
+    }
+};
+
+/**
+ * Decrypts data previously encrypted with the encrypt function
+ * 
+ * @param {string} encryptedData - Encrypted data string
+ * @param {string} masterKey - Encryption key in hex format
+ * @returns {string|Object} Decrypted data
+ */
+const decrypt = (encryptedData, masterKey) => {
+    try {
+        // Parse the encrypted data
+        const parts = encryptedData.split(':');
+
+        if (parts.length !== 5) {
+            throw new Error('Invalid encrypted data format');
+        }
+
+        const [version, keyId, ivHex, authTagHex, encrypted] = parts;
+
+        // Check version
+        if (version !== '1') {
+            throw new Error(`Unsupported encryption version: ${version}`);
+        }
+
+        // Convert IV and auth tag from hex to Buffer
+        const iv = Buffer.from(ivHex, 'hex');
+        const authTag = Buffer.from(authTagHex, 'hex');
+
+        // Derive the key
+        const key = deriveKey(masterKey, keyId);
+
+        // Create decipher
+        const decipher = crypto.createDecipheriv(ENCRYPTION_CONFIG.ALGORITHM, key, iv);
+        decipher.setAuthTag(authTag);
+
+        // Decrypt the data
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+
+        // Try to parse as JSON if possible
+        try {
+            return JSON.parse(decrypted);
+        } catch {
+            // Return as string if not valid JSON
+            return decrypted;
+        }
+    } catch (error) {
+        logger.error('Decryption failed', { error: error.message });
+        throw new Error('Failed to decrypt data');
+    }
+};
+
+/**
+ * Generates a new encryption key in hex format
+ * 
+ * @returns {string} New encryption key in hex format
+ */
+const generateKey = () => {
+    return crypto.randomBytes(ENCRYPTION_CONFIG.KEY_LENGTH).toString('hex');
+};
+
+module.exports = {
+    encrypt,
+    decrypt,
+    generateKey,
+    deriveKey
+}; 

package/src/utils/logger.js

@@ -0,0 +1,84 @@
+/**
+ * Logger Utility
+ * 
+ * Centralized logger configuration for consistent logging
+ */
+
+const winston = require('winston');
+const fs = require('fs');
+const path = require('path');
+
+// Ensure logs directory exists
+const LOGS_DIR = process.env.LOGS_DIR || path.join(process.cwd(), 'logs');
+if (!fs.existsSync(LOGS_DIR)) {
+    try {
+        fs.mkdirSync(LOGS_DIR, { recursive: true });
+    } catch (error) {
+        console.error(`Failed to create logs directory: ${error.message}`);
+    }
+}
+
+// Define log levels
+const levels = {
+    error: 0,
+    warn: 1,
+    info: 2,
+    http: 3,
+    debug: 4,
+};
+
+// Define log colors
+const colors = {
+    error: 'red',
+    warn: 'yellow',
+    info: 'green',
+    http: 'magenta',
+    debug: 'blue',
+};
+
+// Add colors to winston
+winston.addColors(colors);
+
+// Define log format
+const format = winston.format.combine(
+    winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss:ms' }),
+    winston.format.printf(
+        (info) => `${info.timestamp} ${info.level}: ${info.message}`,
+    ),
+);
+
+// Define transports
+const transports = [
+    // Console output with colors
+    new winston.transports.Console({
+        format: winston.format.combine(
+            winston.format.colorize({ all: true }),
+            winston.format.printf(
+                (info) => `${info.timestamp} ${info.level}: ${info.message}`,
+            ),
+        ),
+    }),
+    // Always log to combined.log
+    new winston.transports.File({
+        filename: path.join(LOGS_DIR, 'combined.log'),
+    }),
+    // Error logs to error.log
+    new winston.transports.File({
+        filename: path.join(LOGS_DIR, 'error.log'),
+        level: 'error',
+    }),
+];
+
+// Create the logger
+const logger = winston.createLogger({
+    level: process.env.LOG_LEVEL || 'info',
+    levels,
+    format,
+    transports,
+    // Don't exit on error
+    exitOnError: false,
+});
+
+module.exports = {
+    logger,
+}; 

package/src/utils/mcp.js

@@ -0,0 +1,85 @@
+/**
+ * MCP Utilities
+ * 
+ * Utilities for MCP protocol handling
+ */
+
+/**
+ * Format tool definitions for MCP response
+ * 
+ * @param {Object} tools - Tool definitions object
+ * @returns {Array} - Array of formatted tool definitions
+ */
+const formatToolDefinitions = (tools) => {
+    return Object.keys(tools).map(key => {
+        const tool = tools[key];
+        return {
+            name: tool.name,
+            description: tool.description,
+            parameters: tool.input_schema,
+            returns: tool.output_schema
+        };
+    });
+};
+
+/**
+ * Create a standardized success response
+ * 
+ * @param {Object} data - Response data
+ * @param {number} status - HTTP status code (default: 200)
+ * @returns {Object} - Formatted response object
+ */
+const createSuccessResponse = (data, status = 200) => {
+    return {
+        status,
+        data
+    };
+};
+
+/**
+ * Create a standardized error response
+ * 
+ * @param {string} message - Error message
+ * @param {string} code - Error code
+ * @param {number} status - HTTP status code (default: 400)
+ * @param {Object} details - Additional error details
+ * @returns {Object} - Formatted error response
+ */
+const createErrorResponse = (message, code = 'ERROR', status = 400, details = {}) => {
+    return {
+        status,
+        error: {
+            message,
+            code,
+            details
+        }
+    };
+};
+
+/**
+ * Parse tool name from request to standardized format
+ * 
+ * @param {string} name - Tool name from request
+ * @returns {string} - Standardized tool name
+ */
+const parseToolName = (name) => {
+    if (!name) return null;
+
+    // Handle different tool naming conventions
+    // e.g., 'node.search', 'node-search', 'nodeSearch' -> 'node_search'
+
+    // Replace dots and dashes with underscores
+    let parsedName = name.replace(/[.-]/g, '_');
+
+    // Convert camelCase to snake_case
+    parsedName = parsedName.replace(/([a-z])([A-Z])/g, '$1_$2').toLowerCase();
+
+    return parsedName;
+};
+
+module.exports = {
+    formatToolDefinitions,
+    createSuccessResponse,
+    createErrorResponse,
+    parseToolName
+}; 

package/src/utils/securityLogger.js

@@ -0,0 +1,109 @@
+/**
+ * Security Logger
+ * 
+ * Specialized logger for security-related events with structured data
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { logger } = require('./logger');
+
+// Configuration
+const SECURITY_LOG_DIR = process.env.SECURITY_LOG_DIR || path.join(process.cwd(), 'logs');
+const SECURITY_LOG_FILE = path.join(SECURITY_LOG_DIR, 'security.log');
+
+// Ensure logs directory exists
+if (!fs.existsSync(SECURITY_LOG_DIR)) {
+    try {
+        fs.mkdirSync(SECURITY_LOG_DIR, { recursive: true });
+    } catch (error) {
+        logger.error(`Failed to create security log directory: ${error.message}`);
+    }
+}
+
+/**
+ * Log a security event to the security log file
+ * 
+ * @param {Object} options - Event details
+ * @param {string} options.level - Log level (info, warn, error)
+ * @param {string} options.eventType - Type of security event
+ * @param {string} options.userId - User who performed the action (if known)
+ * @param {string} options.ip - IP address of the request
+ * @param {Object} options.details - Additional event details
+ */
+const logSecurityEvent = (options) => {
+    const {
+        level = 'info',
+        eventType,
+        userId = 'anonymous',
+        ip = 'unknown',
+        details = {}
+    } = options;
+
+    // Create structured log entry
+    const logEntry = {
+        timestamp: new Date().toISOString(),
+        level,
+        eventType,
+        userId,
+        ip,
+        details
+    };
+
+    // Write to security log file
+    try {
+        fs.appendFileSync(
+            SECURITY_LOG_FILE,
+            JSON.stringify(logEntry) + '\n'
+        );
+    } catch (error) {
+        logger.error(`Failed to write to security log: ${error.message}`);
+    }
+
+    // Also log to regular logger
+    logger[level](`Security event: ${eventType}`, {
+        userId,
+        ip,
+        ...details
+    });
+};
+
+/**
+ * Log validation failures (special case of security events)
+ * 
+ * @param {Object} options - Validation failure details
+ * @param {string} options.ip - Client IP address
+ * @param {string} options.userId - User ID if authenticated
+ * @param {string} options.endpoint - API endpoint
+ * @param {string} options.method - HTTP method
+ * @param {string} options.violationType - Type of validation violation
+ * @param {string} options.inputField - Field that caused the violation
+ */
+const logValidationFailure = (options) => {
+    const {
+        ip,
+        userId,
+        endpoint,
+        method,
+        violationType,
+        inputField
+    } = options;
+
+    logSecurityEvent({
+        level: 'warn',
+        eventType: 'validation_failure',
+        userId,
+        ip,
+        details: {
+            endpoint,
+            method,
+            violationType,
+            inputField
+        }
+    });
+};
+
+module.exports = {
+    logSecurityEvent,
+    logValidationFailure
+};