secure-gateway-sdk 1.0.0 → 1.0.1

package/README.md

@@ -21,9 +21,9 @@ const app = express();
 // Mount the Security Gateway to any route string (e.g. /api)
 app.use('/api', SecurityGateway({
     jwtSecret: 'process.env.MY_SECRET', // Required: For verifying tokens
-    authTarget: 'http://localhost:7001', // Your custom configured Auth backend
-    enclaveTarget: 'http://localhost:4000', // Your Enclave
-    auditTarget: 'http://localhost:5000' 
+    authTarget: 'http://<auth-host>:<port>', 
+    enclaveTarget: 'http://<enclave-host>:<port>', 
+    auditTarget: 'http://<audit-host>:<port>' 
 }));
 
 app.listen(3000, () => {

package/index.js

@@ -1,15 +1,10 @@
 const express = require('express');
 const { createProxyMiddleware } = require('http-proxy-middleware');
 const { createSecurityMiddleware } = require('./middleware/security');
-const { createMLSMiddleware } = require('./middleware/mls'); // <--- Import MLS Engine
+const { createMLSMiddleware } = require('./middleware/mls');
 
 /**
  * Universal Security Gateway Library (Publishable SDK)
- * Dynamic configuration for securing any microservice architecture.
- *
- * @param {Object} options Configuration Object
- * @param {string} options.jwtSecret The verification secret for Tokens
- * @param {Array} options.routes Array defining paths, targets, and protection logic
  */
 function SecurityGateway(options) {
     const router = express.Router();
@@ -22,64 +17,49 @@ function SecurityGateway(options) {
 
     if (options.routes && Array.isArray(options.routes)) {
         options.routes.forEach(route => {
-            const proxyConfig = {
-                target: route.target,
-                changeOrigin: true
-            };
-
-            // Custom rewrite rules provided by the implementing developer
-            if (route.pathRewrite) {
-                proxyConfig.pathRewrite = route.pathRewrite;
-            }
-
-            // Chain middlewares dynamically depending on if route is protected
             const middlewares = [];
+
             if (route.protected) {
-                // Step 1: Extract and verify JWT
                 middlewares.push(verifyToken);
-                
-                // Step 2: Inject Bell-LaPadula rules if clearance is specified for the route!
                 if (route.requiredClearance) {
                     middlewares.push(createMLSMiddleware(route.requiredClearance));
-                    // middlewares.push('S');
                 }
             }
-            
-            // Step 3: Physically Forward the Request
+
             if (route.useSecureChannel) {
                 const EnclaveClient = require('./lib/enclave-client');
-                const enclaveClient = new EnclaveClient(route.target, options.enclave?.mrenclave);
+                // Security params are now pulled directly from the ROUTE config!
+                const enclaveClient = new EnclaveClient(route.target, route.mrenclave);
                 const BLSAuditSim = require('./lib/bls');
-                const blsAudit = new BLSAuditSim(options.bls?.privateKey);
+                const blsAudit = new BLSAuditSim(route.blsPrivateKey);
 
-                // Express json parser for the proxy to read the body before encryption
                 middlewares.push(express.json());
                 middlewares.push(async (req, res) => {
                     try {
                         const payload = req.body && Object.keys(req.body).length > 0 ? req.body : { action: "read_data" };
                         const token = req.headers['authorization']?.split(' ')[1];
-                        
-                        // Execute over ECDH secure channel
+
                         const result = await enclaveClient.execute(payload, token);
-                        
-                        // Generate Audit Log
+
                         const logEntry = {
                             timestamp: new Date().toISOString(),
-                            user: req.user.username,
-                            clearance: req.user.clearance,
-                            action: 'enclave_execution',
+                            user: req.user?.username || req.user?.sub || 'anonymous',
+                            clearance: req.user?.clearance || 'N/A',
+                            action: route.actionName || 'gateway_access',
+                            resource: route.path,
                             status: 'SUCCESS'
                         };
+                        
                         const sigData = blsAudit.signAndAggregate(logEntry);
                         Object.assign(logEntry, sigData);
-                        
-                        // Send log asynchronously
-                        if (options.auditTarget) {
-                            fetch(options.auditTarget + '/log', {
+
+                        // Audit target is now also route-specific!
+                        if (route.auditUrl) {
+                            fetch(route.auditUrl + '/log', {
                                 method: 'POST',
                                 headers: { 'Content-Type': 'application/json' },
                                 body: JSON.stringify(logEntry)
-                            }).catch(e => console.error('[Proxy] Failed to send audit log'));
+                            }).catch(() => {});
                         }
 
                         res.json(result);
@@ -88,20 +68,27 @@ function SecurityGateway(options) {
                     }
                 });
             } else {
+                const proxyConfig = {
+                    target: route.target,
+                    changeOrigin: true
+                };
+                if (route.pathRewrite) proxyConfig.pathRewrite = route.pathRewrite;
                 middlewares.push(createProxyMiddleware(proxyConfig));
             }
 
             router.use(route.path, ...middlewares);
-            
-            console.log(`[SecurityGateway] Shield mounted: ${route.path} -> ${route.target} (Protected: ${!!route.protected}, MLS: ${route.requiredClearance || 'None'})`);
+            console.log(`[SecurityGateway] Shield mounted: ${route.path} -> ${route.target}`);
         });
     }
 
     return router;
 }
 
+const { SecureChannel } = require('./lib/crypto');
+
 module.exports = {
     SecurityGateway,
     createSecurityMiddleware,
-    createMLSMiddleware
+    createMLSMiddleware,
+    SecureChannel
 };

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "secure-gateway-sdk",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "scripts": {
-    "dev": "echo 'Proxy is an SDK library and cannot be run directly. Import it into your own server script.' && exit 0"
+    "dev": "node server.js"
   },
   "dependencies": {
     "cors": "^2.8.6",

package/server.js

@@ -0,0 +1,22 @@
+require('dotenv').config({ path: '../.env' });
+const express = require('express');
+const { SecurityGateway } = require('./index');
+
+const app = express();
+const PORT = process.env.PROXY_PORT || 3000;
+
+const gatewayRoutes = require('../config/gateway-routes.json');
+
+// Initialize the Security Gateway as a standalone server
+app.use('/api', SecurityGateway({
+    jwtSecret: process.env.JWT_SECRET,
+    routes: gatewayRoutes
+}));
+
+app.get('/', (req, res) => {
+    res.json({ message: 'Security Gateway Standalone Server is running.' });
+});
+
+app.listen(PORT, () => {
+    console.log(`[Proxy] Standalone Gateway running on port ${PORT}`);
+});