secure-gateway-sdk 1.0.1 → 1.2.1

package/README.md

@@ -1,70 +1,101 @@
-# Security Gateway SDK - Proxy Library
+# Secure Gateway SDK - Proxy Library
 
-This package is a drop-in API Gateway library designed to secure and route traffic to a microservice ecosystem containing Auth, Enclave, and Audit endpoints. 
+This package is a modular API Gateway router library designed to secure and route traffic to a microservice ecosystem (Auth, Enclave, and Audit endpoints).
 
-It acts exclusively as an Express Middleware router.
+## 1. Installation
 
-## How to use this Library
+Install the package via the npm registry:
 
-As a third-party developer (Client), you will include this library inside your own backend express server to instantly spin up the Security Gateway shield over your logic.
+```bash
+npm install secure-gateway-sdk
+```
+
+---
+
+## 2. Setup Requirements
+
+To use this library, your Node.js/Express application must have:
+* **Express** installed as a peer dependency.
+* **JSON Parsing Middleware** (`express.json()`) mounted before the gateway.
+* An active **JWT Token Secret** to decode and verify client identities.
 
-### 1. Installation
-Ensure you have the gateway folder available in your workspace (or published via NPM if deployed).
+---
+
+## 3. Integration Code Example
+
+Create your gateway server (e.g., `gateway.js`) and mount the middleware as follows:
 
-### 2. Integration Example (Your main app)
 ```javascript
 const express = require('express');
-const { SecurityGateway } = require('security-gateway-sdk/proxy');
+const { SecurityGateway } = require('secure-gateway-sdk');
 
 const app = express();
 
-// Mount the Security Gateway to any route string (e.g. /api)
+// Required to parse JSON payloads for secure TEE channels
+app.use(express.json());
+
+// Initialize and mount the gateway router
 app.use('/api', SecurityGateway({
-    jwtSecret: 'process.env.MY_SECRET', // Required: For verifying tokens
-    authTarget: 'http://<auth-host>:<port>', 
-    enclaveTarget: 'http://<enclave-host>:<port>', 
-    auditTarget: 'http://<audit-host>:<port>' 
+    jwtSecret: process.env.JWT_SECRET || 'your_secret_signing_key',
+    routes: [
+        {
+            path: '/auth',
+            target: 'http://<auth-service-host>:<port>',
+            protected: false
+        },
+        {
+            path: '/enclave',
+            target: 'http://<enclave-service-host>:<port>',
+            protected: true,
+            requiredClearance: 'TS',
+            useSecureChannel: true,
+            mrenclave: 'YOUR_EXPECTED_MRENCLAVE_HASH',
+            blsPrivateKey: process.env.BLS_PRIVATE_KEY || 'your_bls_private_key',
+            auditUrl: 'http://<audit-service-host>:<port>',
+            actionName: 'SECURE_COMPUTE'
+        }
+    ],
+    rbacPolicies: {
+        admin: { resources: ['*'], actions: ['*'] },
+        user: { resources: ['/enclave'], actions: ['GET'] }
+    },
+    mlsLattice: {
+        'U': 10,
+        'S': 30,
+        'TS': 40
+    }
 }));
 
-app.listen(3000, () => {
-    console.log('Main Application running on port 3000');
+const PORT = process.env.PORT || 3000;
+app.listen(PORT, () => {
+    console.log(`Security Gateway active on port ${PORT}`);
 });
 ```
 
-### Routing Rules Under the Hood
-Once mounted (for example at `/api`), the library automatically protects traffic:
-* `POST /api/auth/register` -> Publicly proxies to `authTarget`
-* `GET /api/enclave/data` -> Instantly intercepted! Extracts JWT, validates against `jwtSecret`, and passes to `enclaveTarget` only if valid.
-
 ---
 
-## Testing (cURL Examples)
-
-Since we mounted the `SecurityGateway` directly into the Auth service, the Gateway is currently running actively on `http://localhost:7001/api`. You can use these commands to test the integration:
-
-### 1. Register a new user (Public Route)
-```bash
-curl -X POST http://localhost:7001/api/auth/register \
--H "Content-Type: application/json" \
--d '{"username": "test_user", "password": "password123", "role": "admin"}'
-```
-
-### 2. Login to get a JWT Token (Public Route)
-```bash
-curl -X POST http://localhost:7001/api/auth/login \
--H "Content-Type: application/json" \
--d '{"username": "test_user", "password": "password123"}'
-```
-
-### 3. Access the Enclave (Protected Route - Success)
-Replace `<YOUR_TOKEN>` with the token string received from the login command.
-```bash
-curl -X GET http://localhost:7001/api/enclave \
--H "Authorization: Bearer <YOUR_TOKEN>"
-```
-
-### 4. Access the Enclave (Protected Route - Failure)
-If you try to access the enclave without attaching the token header, the SDK will proactively block you.
-```bash
-curl -X GET http://localhost:7001/api/enclave
-```
+## 4. Configuration Reference
+
+### SecurityGateway Options
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| `jwtSecret` | String | Yes | Secret key used to verify client JWT signatures. |
+| `routes` | Array | Yes | List of route definitions to protect and proxy. |
+| `rbacPolicies` | Object | No | Map of roles to allowed resources and request methods. |
+| `mlsLattice` | Object | No | Clearance level hierarchy definitions (e.g., `U`, `S`, `TS`). |
+| `rateLimit` | Object | No | Custom intervals and maximum requests for the rate limiters. |
+
+### Route Object Schema
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| `path` | String | Yes | Route mount path (e.g., `/enclave`). |
+| `target` | String | Yes | Microservice downstream target URL. |
+| `protected` | Boolean | Yes | Whether requests require JWT authentication and RBAC validation. |
+| `requiredClearance`| String | No | Level needed to pass Bell-LaPadula clearance validation. |
+| `useSecureChannel` | Boolean | No | Toggles automated TEE Handshake (ECDH key exchange). |
+| `mrenclave` | String | No | Expected hardware enclave hash identity. |
+| `blsPrivateKey` | String | No | Private key used to sign transaction aggregate proofs. |
+| `auditUrl` | String | No | Endpoint of the centralized Cryptographic Audit Log Service. |
+| `actionName` | String | No | Identifier label for the audited action type. |

package/index.js

@@ -1,7 +1,10 @@
 const express = require('express');
+const fetch = require('node-fetch');
 const { createProxyMiddleware } = require('http-proxy-middleware');
 const { createSecurityMiddleware } = require('./middleware/security');
 const { createMLSMiddleware } = require('./middleware/mls');
+const { createRBACMiddleware } = require('./middleware/rbac');
+const { createGlobalRateLimit, createAuthRateLimit, createSensitiveRateLimit } = require('./middleware/rateLimit');
 
 /**
  * Universal Security Gateway Library (Publishable SDK)
@@ -13,25 +16,49 @@ function SecurityGateway(options) {
         throw new Error('[SecurityGateway] Fatal: "jwtSecret" must be provided in configuration options.');
     }
 
+    // --- Availability: Rate Limiting & DDoS Protection ---
+    const globalLimiter = createGlobalRateLimit(options.rateLimit?.global);
+    const authLimiter = createAuthRateLimit(options.rateLimit?.auth);
+    const sensitiveLimiter = createSensitiveRateLimit(options.rateLimit?.sensitive);
+
+    // Apply global rate limit to ALL requests through the gateway
+    router.use(globalLimiter);
+    console.log('[SecurityGateway] DDoS Protection: Global rate limiter active');
+
     const verifyToken = createSecurityMiddleware(options.jwtSecret);
+    const rbacMiddleware = createRBACMiddleware(options.rbacPolicies);
+    const enclaveClients = new Map(); // Cache to maintain persistent secure sessions
+    const blsAuditInstances = new Map(); // Cache to maintain aggregate signatures per route
 
     if (options.routes && Array.isArray(options.routes)) {
         options.routes.forEach(route => {
             const middlewares = [];
 
             if (route.protected) {
+                // Stricter rate limit on sensitive/protected endpoints
+                middlewares.push(sensitiveLimiter);
                 middlewares.push(verifyToken);
+                middlewares.push(rbacMiddleware);
                 if (route.requiredClearance) {
-                    middlewares.push(createMLSMiddleware(route.requiredClearance));
+                    middlewares.push(createMLSMiddleware(route.requiredClearance, options.mlsLattice));
                 }
             }
 
             if (route.useSecureChannel) {
                 const EnclaveClient = require('./lib/enclave-client');
-                // Security params are now pulled directly from the ROUTE config!
-                const enclaveClient = new EnclaveClient(route.target, route.mrenclave);
                 const BLSAuditSim = require('./lib/bls');
-                const blsAudit = new BLSAuditSim(route.blsPrivateKey);
+                
+                // Get or Create a persistent client for this specific target
+                if (!enclaveClients.has(route.target)) {
+                    enclaveClients.set(route.target, new EnclaveClient(route.target, route.mrenclave));
+                }
+                const enclaveClient = enclaveClients.get(route.target);
+
+                // Get or Create a persistent BLS instance to maintain aggregate signatures
+                if (!blsAuditInstances.has(route.path)) {
+                    blsAuditInstances.set(route.path, new BLSAuditSim(route.blsPrivateKey));
+                }
+                const blsAudit = blsAuditInstances.get(route.path);
 
                 middlewares.push(express.json());
                 middlewares.push(async (req, res) => {
@@ -68,6 +95,8 @@ function SecurityGateway(options) {
                     }
                 });
             } else {
+                // Auth endpoints get brute-force protection
+                middlewares.push(authLimiter);
                 const proxyConfig = {
                     target: route.target,
                     changeOrigin: true
@@ -90,5 +119,8 @@ module.exports = {
     SecurityGateway,
     createSecurityMiddleware,
     createMLSMiddleware,
-    SecureChannel
+    SecureChannel,
+    createGlobalRateLimit,
+    createAuthRateLimit,
+    createSensitiveRateLimit
 };

package/lib/enclave-client.js

@@ -1,5 +1,6 @@
 const { SecureChannel } = require('./crypto');
 const crypto = require('crypto');
+const fetch = require('node-fetch');
 
 /**
  * EnclaveClient acts as the secure intermediary between the Proxy and the TEE.
@@ -46,33 +47,73 @@ class EnclaveClient {
         console.log('[Proxy->Enclave] Attestation successful. ECDH secure channel established.');
     }
 
+    async seal(payload, label, token) {
+        if (!this.isAttested) await this.attestAndHandshake();
+        const encrypted = this.channel.encrypt(payload);
+        const response = await fetch(`${this.enclaveUrl}/seal`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+            body: JSON.stringify({ ...encrypted, label })
+        });
+        return response.json();
+    }
+
+    async unseal(label, token) {
+        if (!this.isAttested) await this.attestAndHandshake();
+        const response = await fetch(`${this.enclaveUrl}/unseal`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
+            body: JSON.stringify({ label })
+        });
+        const data = await response.json();
+        if (!response.ok) throw new Error(data.error || 'Unseal failed');
+        return this.channel.decrypt(data);
+    }
+
     async execute(payload, token) {
         // If we haven't verified the enclave yet, do it now
         if (!this.isAttested) {
             await this.attestAndHandshake();
         }
 
-        // Encrypt the payload using AES-256-GCM
-        const encrypted = this.channel.encrypt(payload);
-        
-        // Send to Enclave
-        const response = await fetch(`${this.enclaveUrl}/execute`, {
-            method: 'POST',
-            headers: { 
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${token}` // Pass the user's JWT to prove they passed proxy auth
-            },
-            body: JSON.stringify(encrypted)
-        });
+        try {
+            // Encrypt the payload using AES-256-GCM
+            const encrypted = this.channel.encrypt(payload);
+            
+            // Send to Enclave
+            const response = await fetch(`${this.enclaveUrl}/execute`, {
+                method: 'POST',
+                headers: { 
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${token}` 
+                },
+                body: JSON.stringify(encrypted)
+            });
 
-        const data = await response.json();
-        
-        if (!response.ok) {
-            throw new Error(data.error || 'Execution failed');
-        }
+            const data = await response.json();
+            
+            if (!response.ok) {
+                // AUTO-RETRY LOGIC: If enclave restarted, re-attest once
+                if (data.error && data.error.includes("Shared secret not computed")) {
+                    console.warn('[Proxy] Enclave session lost. Re-attesting and retrying...');
+                    this.isAttested = false;
+                    await this.attestAndHandshake();
+                    return this.execute(payload, token); // Recursive retry
+                }
+                throw new Error(data.error || 'Execution failed');
+            }
 
-        // Decrypt the response
-        return this.channel.decrypt(data);
+            // Decrypt the response
+            return this.channel.decrypt(data);
+        } catch (error) {
+            // If encryption failed because secret was somehow null (concurrency), retry
+            if (error.message.includes("not computed")) {
+                this.isAttested = false;
+                await this.attestAndHandshake();
+                return this.execute(payload, token);
+            }
+            throw error;
+        }
     }
 }
 

package/middleware/mls.js

@@ -3,15 +3,16 @@
  * Implements Bell-LaPadula Lattice logic for the SDK.
  */
 
-const LATTICE = {
+const DEFAULT_LATTICE = {
     'U': 10, // Unclassified
     'C': 20, // Confidential
     'S': 30, // Secret
     'TS': 40 // Top Secret
 };
 
-function createMLSMiddleware(routeRequiredClearance) {
-    const routeLevel = LATTICE[routeRequiredClearance?.toUpperCase()];
+function createMLSMiddleware(routeRequiredClearance, customLattice) {
+    const lattice = customLattice || DEFAULT_LATTICE;
+    const routeLevel = lattice[routeRequiredClearance?.toUpperCase()];
 
     if (!routeLevel) {
         throw new Error(`[MLS Engine] Fatal: Invalid clearance level provided: ${routeRequiredClearance}. Must be U, C, S, or TS.`);
@@ -24,12 +25,16 @@ function createMLSMiddleware(routeRequiredClearance) {
             return res.status(403).json({ error: 'MLS Blocked: User clearance level is not defined.' });
         }
 
-        const userLevel = LATTICE[req.user.clearance.toUpperCase()];
+        const userLevel = lattice[req.user.clearance.toUpperCase()];
         if (!userLevel) {
             return res.status(403).json({ error: `MLS Blocked: Unknown user clearance header '${req.user.clearance}'` });
         }
 
-        const isRead = ['GET', 'HEAD', 'OPTIONS'].includes(req.method);
+        // Secure execution or TEE retrieval endpoints are functionally reads (requesting sensitive output)
+        const isRead = ['GET', 'HEAD', 'OPTIONS'].includes(req.method) || 
+                       req.path.includes('/enclave') || 
+                       req.path.includes('/execute') || 
+                       req.path.includes('/unseal');
         const isWrite = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
 
         // ----------------------------------------------------

package/middleware/rateLimit.js

@@ -0,0 +1,108 @@
+const rateLimit = require('express-rate-limit');
+
+/**
+ * Rate Limiting & DDoS Protection Middleware
+ * 
+ * Provides the Availability property of the CIA triad by preventing
+ * resource exhaustion through excessive requests.
+ * 
+ * Three tiers of protection:
+ * 1. Global rate limit — caps total requests per IP
+ * 2. Auth rate limit — stricter limit on login/register (brute-force protection)
+ * 3. Sensitive route rate limit — strictest limit on protected endpoints
+ */
+
+const isDev = process.env.NODE_ENV === 'development';
+
+/**
+ * Creates a global rate limiter for all gateway traffic.
+ * Default: 100 requests per 15 minutes per IP.
+ * In development, window is 15 seconds to allow fast simulator resets.
+ */
+function createGlobalRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_GLOBAL_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_GLOBAL_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_GLOBAL_MAX 
+        ? parseInt(process.env.RATE_LIMIT_GLOBAL_MAX) 
+        : (options.max || 100);
+
+    return rateLimit({
+        windowMs,
+        max,
+        standardHeaders: true,                            // Return rate limit info in headers
+        legacyHeaders: false,
+        message: {
+            error: 'Too many requests from this IP. Please try again later.',
+            retryAfterMs: windowMs
+        },
+        handler: (req, res, next, options) => {
+            console.warn(`[DDoS Protection] Global rate limit exceeded for IP: ${req.ip}`);
+            res.status(429).json(options.message);
+        }
+    });
+}
+
+/**
+ * Creates a strict rate limiter for authentication endpoints.
+ * Default: 10 requests per 15 minutes per IP (brute-force protection).
+ * In development, window is 15 seconds to allow fast simulator resets.
+ */
+function createAuthRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_AUTH_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_AUTH_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_AUTH_MAX 
+        ? parseInt(process.env.RATE_LIMIT_AUTH_MAX) 
+        : (options.max || 10);
+
+    return rateLimit({
+        windowMs,
+        max,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: {
+            error: 'Too many authentication attempts. Account protection triggered.',
+            retryAfterMs: windowMs
+        },
+        handler: (req, res, next, options) => {
+            console.warn(`[DDoS Protection] Auth rate limit exceeded for IP: ${req.ip} on ${req.path}`);
+            res.status(429).json(options.message);
+        }
+    });
+}
+
+/**
+ * Creates a strict rate limiter for sensitive/protected routes (e.g., Enclave access).
+ * Default: 20 requests per 15 minutes per IP.
+ * In development, window is 15 seconds and max is 10 to guarantee simulator triggers and resets.
+ */
+function createSensitiveRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_SENSITIVE_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_SENSITIVE_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_SENSITIVE_MAX 
+        ? parseInt(process.env.RATE_LIMIT_SENSITIVE_MAX) 
+        : (options.max || (isDev ? 10 : 20));
+
+    return rateLimit({
+        windowMs,
+        max,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: {
+            error: 'Too many requests to protected resource. Access temporarily restricted.',
+            retryAfterMs: windowMs
+        },
+        handler: (req, res, next, options) => {
+            console.warn(`[DDoS Protection] Sensitive route rate limit exceeded for IP: ${req.ip}`);
+            res.status(429).json(options.message);
+        }
+    });
+}
+
+module.exports = {
+    createGlobalRateLimit,
+    createAuthRateLimit,
+    createSensitiveRateLimit
+};

package/middleware/rbac.js

@@ -0,0 +1,54 @@
+/**
+ * RBAC Engine (Role-Based Access Control)
+ * Enforces policies provided at initialization.
+ */
+
+function createRBACMiddleware(policies) {
+    if (!policies) {
+        console.warn('[RBAC Engine] Warning: No policies provided. All access will be denied.');
+    }
+
+    return (req, res, next) => {
+        // verifyToken MUST run before this middleware so req.user exists
+        if (!req.user || !req.user.role) {
+            console.error('[RBAC Engine] Missing role from JWT Payload!');
+            return res.status(403).json({ error: 'RBAC Blocked: User role is not defined.' });
+        }
+
+        const userRole = req.user.role.toLowerCase();
+        const policy = policies ? policies[userRole] : null;
+
+        if (!policy) {
+            return res.status(403).json({ error: `RBAC Blocked: No policy defined for role '${userRole}'` });
+        }
+
+        const { resources, actions } = policy;
+        const requestPath = req.path;
+        const requestMethod = req.method.toUpperCase();
+
+        // 1. Check Action Permission
+        if (!actions.includes('*') && !actions.includes(requestMethod)) {
+            console.warn(`[RBAC] Blocked Action: Role(${userRole}) cannot perform ${requestMethod}`);
+            return res.status(403).json({ error: `RBAC Violation: Your role (${userRole}) is not permitted to perform ${requestMethod} operations.` });
+        }
+
+        // 2. Check Resource Permission (Simple glob-like matching)
+        const hasAccess = resources.some(pattern => {
+            if (pattern === '*') return true;
+            const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+            return regex.test(requestPath);
+        });
+
+        if (!hasAccess) {
+            console.warn(`[RBAC] Blocked Resource: Role(${userRole}) cannot access ${requestPath}`);
+            return res.status(403).json({ error: `RBAC Violation: Your role (${userRole}) does not have access to the resource ${requestPath}.` });
+        }
+
+        console.log(`[RBAC Engine] Passed policy checks for user ${req.user.sub} (Role: ${userRole})`);
+        next();
+    };
+}
+
+module.exports = {
+    createRBACMiddleware
+};

package/package.json

@@ -1,15 +1,17 @@
 {
   "name": "secure-gateway-sdk",
-  "version": "1.0.1",
+  "version": "1.2.1",
   "scripts": {
-    "dev": "node server.js"
+    "dev": "nodemon server.js"
   },
   "dependencies": {
     "cors": "^2.8.6",
     "dotenv": "^16.6.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.5.2",
     "http-proxy-middleware": "^3.0.5",
-    "jsonwebtoken": "^9.0.3"
+    "jsonwebtoken": "^9.0.3",
+    "node-fetch": "^2.7.0"
   },
   "description": "This package is a drop-in API Gateway library designed to secure and route traffic to a microservice ecosystem containing Auth, Enclave, and Audit endpoints.",
   "main": "index.js",

package/server.js

@@ -1,20 +1,69 @@
-require('dotenv').config({ path: '../.env' });
+const dotenv = require('dotenv');
+const fs = require('fs');
+const path = require('path');
+
+// Robust workspace-aware dotenv loading
+if (fs.existsSync(path.join(process.cwd(), '.env'))) {
+    dotenv.config({ path: path.join(process.cwd(), '.env') });
+} else if (fs.existsSync(path.join(process.cwd(), '..', '.env'))) {
+    dotenv.config({ path: path.join(process.cwd(), '..', '.env') });
+} else {
+    dotenv.config();
+}
 const express = require('express');
+const cors = require('cors');
 const { SecurityGateway } = require('./index');
 
 const app = express();
+app.use(cors());
+
 const PORT = process.env.PROXY_PORT || 3000;
 
-const gatewayRoutes = require('../config/gateway-routes.json');
+/**
+ * PROJECT-AGNOSTIC CONFIG LOADER
+ * The proxy no longer reaches out to '../config'. 
+ * It looks for a 'gateway-config.json' in the current working directory 
+ * or a path specified by GATEWAY_CONFIG_PATH.
+ */
+let configPath = process.env.GATEWAY_CONFIG_PATH 
+    ? path.resolve(process.env.GATEWAY_CONFIG_PATH) 
+    : path.join(process.cwd(), 'gateway-config.json');
+
+// Robust fallback: check parent directory if not found in current working directory
+if (!fs.existsSync(configPath)) {
+    const parentConfigPath = path.join(process.cwd(), '..', 'gateway-config.json');
+    if (fs.existsSync(parentConfigPath)) {
+        configPath = parentConfigPath;
+    }
+}
+
+let gatewayConfig = { routes: [], rbacPolicies: {}, mlsLattice: {} };
+
+if (fs.existsSync(configPath)) {
+    try {
+        gatewayConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        console.log(`[Proxy] Configuration loaded from: ${configPath}`);
+    } catch (err) {
+        console.error(`[Proxy] Failed to parse config at ${configPath}:`, err.message);
+    }
+} else {
+    console.warn(`[Proxy] Warning: No config file found at ${configPath}. Using defaults.`);
+}
 
-// Initialize the Security Gateway as a standalone server
+// Initialize the Security Gateway using the injected configuration
 app.use('/api', SecurityGateway({
-    jwtSecret: process.env.JWT_SECRET,
-    routes: gatewayRoutes
+    jwtSecret: process.env.JWT_SECRET || 'fallback_secret',
+    routes: gatewayConfig.routes || [],
+    rbacPolicies: gatewayConfig.rbacPolicies || {},
+    mlsLattice: gatewayConfig.mlsLattice || {}
 }));
 
 app.get('/', (req, res) => {
-    res.json({ message: 'Security Gateway Standalone Server is running.' });
+    res.json({ 
+        message: 'Security Gateway Standalone Server is running.',
+        config_source: configPath,
+        active_routes: (gatewayConfig.routes || []).length
+    });
 });
 
 app.listen(PORT, () => {