snow-flow 1.3.24 → 1.3.27

package/dist/utils/flow-structure-builder.js

@@ -64,7 +64,7 @@ function generateFlowComponents(flowDefinition, flowSysId) {
         type: 'flow',
         status: 'published',
         active: true,
-        run_as: 'system',
+        run_as: 'user', // 🔒 SEC-001 FIX: Default to 'user' to prevent privilege escalation
         sys_class_name: 'sys_hub_flow',
         table: flowDefinition.table,
         category: 'custom',

package/dist/utils/servicenow-client.js

@@ -10,6 +10,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceNowClient = void 0;
 const axios_1 = __importDefault(require("axios"));
+const https_1 = __importDefault(require("https"));
 const snow_oauth_1 = require("./snow-oauth");
 const action_type_cache_1 = require("./action-type-cache");
 const snow_flow_config_js_1 = require("../config/snow-flow-config.js");
@@ -25,12 +26,59 @@ class ServiceNowClient {
         this.lastTokenRefresh = 0;
         this.logger = new logger_1.Logger('ServiceNowClient');
         this.oauth = new snow_oauth_1.ServiceNowOAuth();
+        // 🔒 SSL/TLS Certificate Validation Fix: Add proper HTTPS agent with certificate validation
+        const httpsAgent = new https_1.default.Agent({
+            rejectUnauthorized: true, // Enforce certificate validation
+            checkServerIdentity: (hostname, cert) => {
+                // Custom certificate validation for ServiceNow instances
+                // Allow *.service-now.com and user-configured instances
+                const validHosts = [
+                    /.*\.service-now\.com$/,
+                    /.*\.servicenow\.com$/
+                ];
+                // Get configured instance hostname
+                const instanceUrl = process.env.SNOW_INSTANCE;
+                if (instanceUrl) {
+                    try {
+                        const instanceHostname = new URL(instanceUrl.startsWith('http') ? instanceUrl : `https://${instanceUrl}`).hostname;
+                        validHosts.push(new RegExp(`^${instanceHostname.replace(/\./g, '\\.')}$`));
+                    }
+                    catch (error) {
+                        // Invalid URL format, rely on default validation
+                    }
+                }
+                // Check if hostname matches allowed patterns
+                if (validHosts.some(pattern => pattern.test(hostname))) {
+                    return undefined; // Valid hostname
+                }
+                // For development/testing environments, allow localhost/127.0.0.1
+                if (process.env.NODE_ENV === 'development' &&
+                    (hostname === 'localhost' || hostname === '127.0.0.1' || hostname.startsWith('192.168.'))) {
+                    return undefined;
+                }
+                return new Error(`Certificate hostname mismatch: ${hostname} not allowed`);
+            },
+            secureProtocol: 'TLSv1_2_method', // Enforce TLS 1.2 minimum
+            ciphers: [
+                'ECDHE-RSA-AES128-GCM-SHA256',
+                'ECDHE-RSA-AES256-GCM-SHA384',
+                'ECDHE-RSA-AES128-SHA256',
+                'ECDHE-RSA-AES256-SHA384'
+            ].join(':'), // Only allow secure ciphers
+            honorCipherOrder: true,
+            maxVersion: 'TLSv1.3',
+            minVersion: 'TLSv1.2'
+        });
         this.client = axios_1.default.create({
             timeout: snow_flow_config_js_1.snowFlowConfig.servicenow.timeout,
             headers: {
                 'Content-Type': 'application/json',
                 'Accept': 'application/json'
-            }
+            },
+            httpsAgent, // Use secure HTTPS agent with certificate validation
+            // Additional security headers
+            maxRedirects: 5,
+            validateStatus: (status) => status < 400 // Reject 4xx and 5xx by default
         });
         // 🔧 CRITICAL FIX: Add makeRequest method to Axios instance to fix phantom calls
         // Some code expects makeRequest to exist on this.client (the Axios instance)
@@ -1328,7 +1376,7 @@ snow_create_flow({
                 active: true, // Always create as active
                 internal_name: this.sanitizeInternalName(flow.name),
                 category: flow.category || 'custom',
-                run_as: flow.run_as || 'system', // 🔧 FIX: Default to 'system' for proper execution
+                run_as: flow.run_as || 'user', // 🔒 SEC-001 FIX: Default to 'user' to prevent privilege escalation
                 status: 'published', // 🔧 FIX: Ensure flow is published, not draft
                 validated: true, // 🔧 FIX: Mark as validated to allow activation
                 // Include complete flow definition to prevent corruption

package/dist/utils/snow-oauth.js

@@ -21,10 +21,33 @@ const snow_flow_config_js_1 = require("../config/snow-flow-config.js");
 const unified_auth_store_js_1 = require("./unified-auth-store.js");
 class ServiceNowOAuth {
     constructor() {
+        // 🔒 SEC-002 FIX: Add rate limiting to prevent authentication bypass attacks
+        this.lastTokenRequest = 0;
+        this.tokenRequestCount = 0;
+        this.TOKEN_REQUEST_WINDOW_MS = 60000; // 1 minute window
+        this.MAX_TOKEN_REQUESTS_PER_WINDOW = 10; // Max 10 token requests per minute
         // Store tokens in user's home directory
         const configDir = process.env.SNOW_FLOW_HOME || (0, path_1.join)(os_1.default.homedir(), '.snow-flow');
         this.tokenPath = (0, path_1.join)(configDir, 'auth.json');
     }
+    /**
+     * 🔒 SEC-002 FIX: Check rate limiting for token requests to prevent brute force attacks
+     */
+    checkTokenRequestRateLimit() {
+        const now = Date.now();
+        // Reset counter if window has passed
+        if (now - this.lastTokenRequest > this.TOKEN_REQUEST_WINDOW_MS) {
+            this.tokenRequestCount = 0;
+            this.lastTokenRequest = now;
+        }
+        // Check if within rate limit
+        if (this.tokenRequestCount >= this.MAX_TOKEN_REQUESTS_PER_WINDOW) {
+            console.warn('🔒 Rate limit exceeded: Too many token requests. Please wait before retrying.');
+            return false;
+        }
+        this.tokenRequestCount++;
+        return true;
+    }
     /**
      * Generate a random state parameter for CSRF protection
      */
@@ -62,8 +85,27 @@ class ServiceNowOAuth {
     /**
      * Initialize OAuth flow - opens browser and handles callback
      */
+    /**
+     * 🔧 CRIT-002 FIX: Normalize instance URL to prevent trailing slash 400 errors
+     */
+    normalizeInstanceUrl(instance) {
+        // Remove any trailing slashes that cause 400 errors
+        let normalized = instance.replace(/\/+$/, '');
+        // Add https:// if missing
+        if (!normalized.startsWith('http://') && !normalized.startsWith('https://')) {
+            normalized = `https://${normalized}`;
+        }
+        // Ensure .service-now.com suffix if it's just the instance name
+        if (!normalized.includes('.service-now.com') && !normalized.includes('localhost') && !normalized.includes('127.0.0.1')) {
+            const instanceName = normalized.replace('https://', '').replace('http://', '');
+            normalized = `https://${instanceName}.service-now.com`;
+        }
+        return normalized;
+    }
     async authenticate(instance, clientId, clientSecret) {
         try {
+            // 🔧 CRIT-002 FIX: Apply URL normalization
+            const normalizedInstance = this.normalizeInstanceUrl(instance);
             // Validate client secret format
             const secretValidation = this.validateClientSecret(clientSecret);
             if (!secretValidation.valid) {
@@ -94,15 +136,15 @@ class ServiceNowOAuth {
                     error: `Port ${port} is already in use. Please free up the port and try again.`
                 };
             }
-            // Store credentials temporarily (remove trailing slash from instance)
+            // Store credentials temporarily with normalized instance
             this.credentials = {
-                instance: instance.replace(/\/$/, ''),
+                instance: normalizedInstance.replace('https://', '').replace('http://', ''),
                 clientId,
                 clientSecret,
                 redirectUri
             };
             console.log('🚀 Starting ServiceNow OAuth flow...');
-            console.log(`📋 Instance: ${instance}`);
+            console.log(`📋 Instance: ${normalizedInstance}`);
             console.log(`🔐 Client ID: ${clientId}`);
             console.log(`🔗 Redirect URI: ${redirectUri}`);
             // Generate state parameter for CSRF protection
@@ -110,18 +152,18 @@ class ServiceNowOAuth {
             // Generate PKCE parameters
             this.generatePKCE();
             // Generate authorization URL
-            const authUrl = this.generateAuthUrl(instance, clientId, redirectUri);
+            const authUrl = this.generateAuthUrl(this.credentials.instance, clientId, redirectUri);
             console.log('\n🌐 Authorization URL generated:');
             console.log(`${authUrl}\n`);
             // Start local server to handle callback
             const authResult = await this.startCallbackServer(redirectUri, port);
             if (authResult.success && authResult.accessToken) {
-                // Save tokens
+                // Save tokens with normalized instance
                 await this.saveTokens({
                     accessToken: authResult.accessToken,
                     refreshToken: authResult.refreshToken || '',
                     expiresIn: authResult.expiresIn || 3600,
-                    instance: instance.replace(/\/$/, ''),
+                    instance: this.credentials.instance,
                     clientId,
                     clientSecret
                 });
@@ -303,6 +345,13 @@ class ServiceNowOAuth {
      */
     async exchangeCodeForTokens(code) {
         try {
+            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
+            if (!this.checkTokenRequestRateLimit()) {
+                return {
+                    success: false,
+                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
+                };
+            }
             const tokenUrl = `https://${this.credentials.instance}/oauth_token.do`;
             const response = await axios_1.default.post(tokenUrl, new URLSearchParams({
                 grant_type: 'authorization_code',
@@ -314,7 +363,8 @@ class ServiceNowOAuth {
             }), {
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded'
-                }
+                },
+                timeout: 15000 // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
             });
             const data = response.data;
             if (data.access_token) {
@@ -434,6 +484,13 @@ class ServiceNowOAuth {
      */
     async refreshAccessToken(tokens) {
         try {
+            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
+            if (!this.checkTokenRequestRateLimit()) {
+                return {
+                    success: false,
+                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
+                };
+            }
             // If no tokens provided, load from file
             if (!tokens) {
                 tokens = await this.loadTokens();
@@ -453,7 +510,8 @@ class ServiceNowOAuth {
             }), {
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded'
-                }
+                },
+                timeout: 15000 // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
             });
             const data = response.data;
             if (data.access_token) {

package/dist/utils/xml-first-flow-generator.js

@@ -124,26 +124,47 @@ class XMLFirstFlowGenerator {
             .replace(/\t/g, '	'); // Preserve tabs
         return escaped;
     }
+    /**
+     * 🛡️ Apply security defaults to flow definition - BUG-004 FIX
+     */
+    applySecurityDefaults(flowDef) {
+        // 🔒 SECURITY GUARD: Never allow public access unless explicitly and safely configured
+        const secureFlowDef = {
+            ...flowDef,
+            // Override with secure defaults - these CANNOT be accidentally public
+            accessible_from: 'package_private', // FORCE secure default
+            run_as: flowDef.run_as || 'user' // Default to user, not system
+        };
+        // 🚨 Log security override for audit trail
+        if (flowDef.accessible_from && flowDef.accessible_from !== 'package_private') {
+            console.log('🛡️ SECURITY OVERRIDE: Flow access forced to package_private for security');
+            console.log(`   • Original: ${flowDef.accessible_from}`);
+            console.log(`   • Applied: package_private (secure)`);
+        }
+        return secureFlowDef;
+    }
     /**
      * Generate complete Update Set XML for a flow
      * Based on REAL ServiceNow XML structure research
      */
     generateFlowUpdateSetXML(flowDef) {
+        // 🔒 BUG-004 FIX: Apply security defaults FIRST
+        const secureFlowDef = this.applySecurityDefaults(flowDef);
         this.flowSysId = this.generateSysId();
         const timestamp = new Date().toISOString();
-        const internalName = flowDef.internal_name || this.generateInternalName(flowDef.name);
+        const internalName = secureFlowDef.internal_name || this.generateInternalName(secureFlowDef.name);
         // Generate all component sys_ids upfront
         const updateSetSysId = this.generateSysId();
         const snapshotSysId = this.generateSysId();
         const triggerSysId = this.generateSysId();
-        const activitySysIds = flowDef.activities.map(() => this.generateSysId());
+        const activitySysIds = secureFlowDef.activities.map(() => this.generateSysId());
         const logicSysIds = []; // For flow logic connections
         // Calculate logic chain sys_ids
         for (let i = 0; i < activitySysIds.length + 2; i++) {
             logicSysIds.push(this.generateSysId());
         }
         // Build the complete flow definition JSON for snapshot
-        const flowDefinitionJson = this.buildFlowDefinitionJson(flowDef, triggerSysId, activitySysIds);
+        const flowDefinitionJson = this.buildFlowDefinitionJson(secureFlowDef, triggerSysId, activitySysIds);
         // Generate XML - MUST use sys_remote_update_set for imports!
         const xml = `<?xml version="1.0" encoding="UTF-8"?>
 <unload unload_date="${timestamp}">
@@ -151,7 +172,7 @@ class XMLFirstFlowGenerator {
   <sys_remote_update_set action="INSERT_OR_UPDATE">
     <sys_id>${updateSetSysId}</sys_id>
     <name>${this.escapeXml(this.updateSetName)}</name>
-    <description>Flow import: ${this.escapeXml(flowDef.name)}</description>
+    <description>Flow import: ${this.escapeXml(secureFlowDef.name)}</description>
     <remote_sys_id>${updateSetSysId}</remote_sys_id>
     <state>loaded</state>
     <application>global</application>
@@ -165,7 +186,7 @@ class XMLFirstFlowGenerator {
     <action>INSERT_OR_UPDATE</action>
     <application>global</application>
     <name>sys_hub_flow_${this.flowSysId}</name>
-    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_flow"><sys_hub_flow action="INSERT_OR_UPDATE"><sys_id>${this.flowSysId}</sys_id><name>${this.escapeXml(flowDef.name)}</name><internal_name>${this.escapeXml(internalName)}</internal_name><description>${this.escapeXml(flowDef.description)}</description><active>true</active><type>flow</type><category>custom</category><sys_scope display_value="Global">global</sys_scope><sys_app display_value="Global">global</sys_app><sys_package display_value="Global" source="global">global</sys_package><access>${flowDef.accessible_from || 'package_private'}</access><run_as>${flowDef.run_as || 'user'}</run_as><sys_class_name>sys_hub_flow</sys_class_name><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on><sys_domain>global</sys_domain><sys_domain_path>/</sys_domain_path><sys_updated_by>admin</sys_updated_by><sys_updated_on>${timestamp}</sys_updated_on><latest_snapshot>${snapshotSysId}</latest_snapshot><master_snapshot>${snapshotSysId}</master_snapshot><natlang/><copied_from/><copied_from_name/><show_draft_actions>false</show_draft_actions><show_row_wfr_actions>false</show_row_wfr_actions><show_wf_actions>false</show_wf_actions><sys_overrides/><sys_policy/></sys_hub_flow></record_update>]]></payload>
+    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_flow"><sys_hub_flow action="INSERT_OR_UPDATE"><sys_id>${this.flowSysId}</sys_id><name>${this.escapeXml(secureFlowDef.name)}</name><internal_name>${this.escapeXml(internalName)}</internal_name><description>${this.escapeXml(secureFlowDef.description)}</description><active>true</active><type>flow</type><category>custom</category><sys_scope display_value="Global">global</sys_scope><sys_app display_value="Global">global</sys_app><sys_package display_value="Global" source="global">global</sys_package><access>${secureFlowDef.accessible_from}</access><run_as>${secureFlowDef.run_as}</run_as><sys_class_name>sys_hub_flow</sys_class_name><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on><sys_domain>global</sys_domain><sys_domain_path>/</sys_domain_path><sys_updated_by>admin</sys_updated_by><sys_updated_on>${timestamp}</sys_updated_on><latest_snapshot>${snapshotSysId}</latest_snapshot><master_snapshot>${snapshotSysId}</master_snapshot><natlang/><copied_from/><copied_from_name/><show_draft_actions>false</show_draft_actions><show_row_wfr_actions>false</show_row_wfr_actions><show_wf_actions>false</show_wf_actions><sys_overrides/><sys_policy/></sys_hub_flow></record_update>]]></payload>
     <remote_update_set>${updateSetSysId}</remote_update_set>
     <source_table>sys_hub_flow</source_table>
     <sys_recorded_at>${timestamp}</sys_recorded_at>
@@ -179,7 +200,7 @@ class XMLFirstFlowGenerator {
     <action>INSERT_OR_UPDATE</action>
     <application>global</application>
     <name>sys_hub_flow_snapshot_${snapshotSysId}</name>
-    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_flow_snapshot"><sys_hub_flow_snapshot action="INSERT_OR_UPDATE"><sys_id>${snapshotSysId}</sys_id><name>${this.escapeXml(flowDef.name)}</name><flow>${this.flowSysId}</flow><note>Initial version</note><snapshot>${this.escapeForXml(JSON.stringify(flowDefinitionJson, null, 2))}</snapshot><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on></sys_hub_flow_snapshot></record_update>]]></payload>
+    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_flow_snapshot"><sys_hub_flow_snapshot action="INSERT_OR_UPDATE"><sys_id>${snapshotSysId}</sys_id><name>${this.escapeXml(secureFlowDef.name)}</name><flow>${this.flowSysId}</flow><note>Initial version</note><snapshot>${this.escapeForXml(JSON.stringify(flowDefinitionJson, null, 2))}</snapshot><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on></sys_hub_flow_snapshot></record_update>]]></payload>
     <remote_update_set>${updateSetSysId}</remote_update_set>
     <source_table>sys_hub_flow_snapshot</source_table>
     <type>Flow Designer Snapshot</type>
@@ -191,13 +212,13 @@ class XMLFirstFlowGenerator {
     <action>INSERT_OR_UPDATE</action>
     <application>global</application>
     <name>sys_hub_trigger_instance_${triggerSysId}</name>
-    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_trigger_instance"><sys_hub_trigger_instance action="INSERT_OR_UPDATE"><sys_id>${triggerSysId}</sys_id><flow>${this.flowSysId}</flow><trigger_type>${this.getTriggerTypeId(flowDef.trigger_type)}</trigger_type><table>${flowDef.table || ''}</table><condition>${this.escapeXml(flowDef.trigger_condition || '')}</condition><order>100</order><active>true</active><sys_class_name>sys_hub_trigger_instance</sys_class_name><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on><sys_domain>global</sys_domain><sys_domain_path>/</sys_domain_path></sys_hub_trigger_instance></record_update>]]></payload>
+    <payload><![CDATA[<?xml version="1.0" encoding="UTF-8"?><record_update table="sys_hub_trigger_instance"><sys_hub_trigger_instance action="INSERT_OR_UPDATE"><sys_id>${triggerSysId}</sys_id><flow>${this.flowSysId}</flow><trigger_type>${this.getTriggerTypeId(secureFlowDef.trigger_type)}</trigger_type><table>${secureFlowDef.table || ''}</table><condition>${this.escapeXml(secureFlowDef.trigger_condition || '')}</condition><order>100</order><active>true</active><sys_class_name>sys_hub_trigger_instance</sys_class_name><sys_created_by>admin</sys_created_by><sys_created_on>${timestamp}</sys_created_on><sys_domain>global</sys_domain><sys_domain_path>/</sys_domain_path></sys_hub_trigger_instance></record_update>]]></payload>
     <remote_update_set>${updateSetSysId}</remote_update_set>
     <source_table>sys_hub_trigger_instance</source_table>
     <type>Flow Designer Trigger</type>
   </sys_update_xml>
 
-  ${this.generateActionInstancesXML(flowDef.activities, activitySysIds, timestamp, updateSetSysId)}
+  ${this.generateActionInstancesXML(secureFlowDef.activities, activitySysIds, timestamp, updateSetSysId)}
   ${this.generateFlowLogicXML(triggerSysId, activitySysIds, logicSysIds, timestamp, updateSetSysId)}
 </unload>`;
         return xml;
@@ -432,6 +453,12 @@ class XMLFirstFlowGenerator {
     getActionTypeId(actionType) {
         return exports.ACTION_TYPE_SYS_IDS[actionType] || exports.ACTION_TYPE_SYS_IDS['script'];
     }
+    /**
+     * Generate complete Flow XML - alias for backward compatibility
+     */
+    generateCompleteFlowXML(flowDef) {
+        return this.generateFlowUpdateSetXML(flowDef);
+    }
     /**
      * Save XML to file
      */

package/dist/version.js

@@ -7,12 +7,24 @@ exports.VERSION_INFO = exports.VERSION = void 0;
 exports.getVersionString = getVersionString;
 exports.getLatestFeatures = getLatestFeatures;
 exports.isLatestVersion = isLatestVersion;
-exports.VERSION = '1.3.23';
+exports.VERSION = '1.3.27';
 exports.VERSION_INFO = {
     version: exports.VERSION,
     name: 'Snow-Flow',
     description: 'ServiceNow Queen Agent - Hive-Mind Intelligence for ServiceNow Development',
     features: {
+        '1.3.27': [
+            '🤖 AUTONOMOUS SYSTEMS: All 4 autonomous systems now ENABLED BY DEFAULT in swarm command!',
+            '✅ SELF-DOCUMENTING: Automatic documentation generation and updates (default: enabled)',
+            '💰 COST OPTIMIZATION: AI-driven cost management with auto-optimization (default: enabled)',
+            '🔐 COMPLIANCE MONITORING: Multi-framework compliance with auto-remediation (default: enabled)',
+            '🏥 SELF-HEALING: Predictive failure detection with automatic recovery (default: enabled)',
+            '⚙️ FLEXIBLE CONTROL: Use --no-autonomous-* flags to disable specific systems',
+            '🚫 GLOBAL DISABLE: Use --no-autonomous-all to disable all autonomous systems',
+            '💪 FORCE OVERRIDE: Use --autonomous-all to force enable all (overrides --no- flags)',
+            '🎯 PERFECT ORCHESTRATOR: True "één command voor alles" - zero manual intervention needed!',
+            'Based on user request: "oke maar kunnen we het niet als standaard aanzetten dat al deze dingen beschikbaar zijn?"'
+        ],
         '1.3.16': [
             '🔄 VERSION BUMP: Clean version update for npm publish',
             '✨ INCLUDES: All improvements from v1.3.15',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snow-flow",
-  "version": "1.3.24",
+  "version": "1.3.27",
   "description": "ServiceNow Queen Agent - Hive-Mind Intelligence for ServiceNow Development inspired by claude-flow. Transform complex workflows into elegant one-command orchestration.",
   "main": "dist/index.js",
   "type": "commonjs",