secure-gateway-sdk 1.1.0 → 1.2.1

package/index.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const fetch = require('node-fetch');
 const { createProxyMiddleware } = require('http-proxy-middleware');
 const { createSecurityMiddleware } = require('./middleware/security');
 const { createMLSMiddleware } = require('./middleware/mls');

package/lib/enclave-client.js

@@ -1,5 +1,6 @@
 const { SecureChannel } = require('./crypto');
 const crypto = require('crypto');
+const fetch = require('node-fetch');
 
 /**
  * EnclaveClient acts as the secure intermediary between the Proxy and the TEE.

package/middleware/rateLimit.js

@@ -12,22 +12,32 @@ const rateLimit = require('express-rate-limit');
  * 3. Sensitive route rate limit — strictest limit on protected endpoints
  */
 
+const isDev = process.env.NODE_ENV === 'development';
+
 /**
  * Creates a global rate limiter for all gateway traffic.
  * Default: 100 requests per 15 minutes per IP.
+ * In development, window is 15 seconds to allow fast simulator resets.
  */
 function createGlobalRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_GLOBAL_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_GLOBAL_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_GLOBAL_MAX 
+        ? parseInt(process.env.RATE_LIMIT_GLOBAL_MAX) 
+        : (options.max || 100);
+
     return rateLimit({
-        windowMs: options.windowMs || 15 * 60 * 1000,   // 15 minutes
-        max: options.max || 100,                          // 100 requests per window
+        windowMs,
+        max,
         standardHeaders: true,                            // Return rate limit info in headers
         legacyHeaders: false,
         message: {
             error: 'Too many requests from this IP. Please try again later.',
-            retryAfterMs: options.windowMs || 15 * 60 * 1000
+            retryAfterMs: windowMs
         },
         handler: (req, res, next, options) => {
-            console.warn(`[DDoS Protection] Rate limit exceeded for IP: ${req.ip}`);
+            console.warn(`[DDoS Protection] Global rate limit exceeded for IP: ${req.ip}`);
             res.status(429).json(options.message);
         }
     });
@@ -36,16 +46,24 @@ function createGlobalRateLimit(options = {}) {
 /**
  * Creates a strict rate limiter for authentication endpoints.
  * Default: 10 requests per 15 minutes per IP (brute-force protection).
+ * In development, window is 15 seconds to allow fast simulator resets.
  */
 function createAuthRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_AUTH_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_AUTH_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_AUTH_MAX 
+        ? parseInt(process.env.RATE_LIMIT_AUTH_MAX) 
+        : (options.max || 10);
+
     return rateLimit({
-        windowMs: options.windowMs || 15 * 60 * 1000,   // 15 minutes
-        max: options.max || 10,                           // 10 login attempts per window
+        windowMs,
+        max,
         standardHeaders: true,
         legacyHeaders: false,
         message: {
             error: 'Too many authentication attempts. Account protection triggered.',
-            retryAfterMs: options.windowMs || 15 * 60 * 1000
+            retryAfterMs: windowMs
         },
         handler: (req, res, next, options) => {
             console.warn(`[DDoS Protection] Auth rate limit exceeded for IP: ${req.ip} on ${req.path}`);
@@ -57,16 +75,24 @@ function createAuthRateLimit(options = {}) {
 /**
  * Creates a strict rate limiter for sensitive/protected routes (e.g., Enclave access).
  * Default: 20 requests per 15 minutes per IP.
+ * In development, window is 15 seconds and max is 10 to guarantee simulator triggers and resets.
  */
 function createSensitiveRateLimit(options = {}) {
+    const windowMs = process.env.RATE_LIMIT_SENSITIVE_WINDOW_MS 
+        ? parseInt(process.env.RATE_LIMIT_SENSITIVE_WINDOW_MS) 
+        : (options.windowMs || (isDev ? 15 * 1000 : 15 * 60 * 1000));
+    const max = process.env.RATE_LIMIT_SENSITIVE_MAX 
+        ? parseInt(process.env.RATE_LIMIT_SENSITIVE_MAX) 
+        : (options.max || (isDev ? 10 : 20));
+
     return rateLimit({
-        windowMs: options.windowMs || 15 * 60 * 1000,   // 15 minutes
-        max: options.max || 20,                           // 20 requests per window
+        windowMs,
+        max,
         standardHeaders: true,
         legacyHeaders: false,
         message: {
             error: 'Too many requests to protected resource. Access temporarily restricted.',
-            retryAfterMs: options.windowMs || 15 * 60 * 1000
+            retryAfterMs: windowMs
         },
         handler: (req, res, next, options) => {
             console.warn(`[DDoS Protection] Sensitive route rate limit exceeded for IP: ${req.ip}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-gateway-sdk",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "scripts": {
     "dev": "nodemon server.js"
   },
@@ -10,7 +10,8 @@
     "express": "^5.2.1",
     "express-rate-limit": "^8.5.2",
     "http-proxy-middleware": "^3.0.5",
-    "jsonwebtoken": "^9.0.3"
+    "jsonwebtoken": "^9.0.3",
+    "node-fetch": "^2.7.0"
   },
   "description": "This package is a drop-in API Gateway library designed to secure and route traffic to a microservice ecosystem containing Auth, Enclave, and Audit endpoints.",
   "main": "index.js",