ts-workflow-engine-lite 2.1.0

package/dist/src/api/middleware/rateLimitStore.js

@@ -0,0 +1,44 @@
+export class MemoryRateLimitStore {
+    store = new Map();
+    lastCleanup = Date.now();
+    async hit(key, windowMs, maxRequests) {
+        const now = Date.now();
+        this.maybeCleanup(now, windowMs);
+        const entry = this.store.get(key);
+        if (!entry || now > entry.resetTime) {
+            this.store.set(key, {
+                count: 1,
+                resetTime: now + windowMs,
+            });
+            return {
+                allowed: true,
+                remaining: maxRequests - 1,
+                resetTime: now + windowMs,
+            };
+        }
+        if (entry.count >= maxRequests) {
+            return {
+                allowed: false,
+                remaining: 0,
+                resetTime: entry.resetTime,
+            };
+        }
+        entry.count++;
+        return {
+            allowed: true,
+            remaining: maxRequests - entry.count,
+            resetTime: entry.resetTime,
+        };
+    }
+    maybeCleanup(now, windowMs) {
+        if (now - this.lastCleanup < windowMs)
+            return;
+        this.lastCleanup = now;
+        for (const [key, entry] of this.store) {
+            if (now > entry.resetTime) {
+                this.store.delete(key);
+            }
+        }
+    }
+}
+//# sourceMappingURL=rateLimitStore.js.map

package/dist/src/api/middleware/rateLimitStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimitStore.js","sourceRoot":"","sources":["../../../../src/api/middleware/rateLimitStore.ts"],"names":[],"mappings":"AAyBA,MAAM,OAAO,oBAAoB;IACvB,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC1C,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEjC,KAAK,CAAC,GAAG,CACP,GAAW,EACX,QAAgB,EAChB,WAAmB;QAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,GAAG,GAAG,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,WAAW,GAAG,CAAC;gBAC1B,SAAS,EAAE,GAAG,GAAG,QAAQ;aAC1B,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,WAAW,GAAG,KAAK,CAAC,KAAK;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW,EAAE,QAAgB;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,QAAQ;YAAE,OAAO;QAC9C,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/api/middleware/rbac.d.ts

@@ -0,0 +1,12 @@
+import type { NextFunction, Request, Response } from "express";
+export type Role = "admin" | "operator" | "viewer";
+export type Resource = "workflow" | "instance" | "event" | "config" | "ai" | "template";
+export type Action = "read" | "write" | "delete" | "execute";
+export interface Permission {
+    resource: Resource;
+    action: Action;
+}
+export declare function getPermissionsForRole(role: Role): Permission[];
+export declare function hasPermission(role: Role, permission: Permission): boolean;
+export declare function rbacMiddleware(requiredPermission: Permission): (req: Request, res: Response, next: NextFunction) => void;
+export declare function requireRole(...roles: Role[]): (req: Request, res: Response, next: NextFunction) => void;

package/dist/src/api/middleware/rbac.js

@@ -0,0 +1,120 @@
+import { Logger } from "../../utils/Logger.js";
+import { isAuthEnabled } from "../utils/authConfig.js";
+const ROLE_PERMISSIONS = {
+    admin: [
+        { resource: "workflow", action: "read" },
+        { resource: "workflow", action: "write" },
+        { resource: "workflow", action: "delete" },
+        { resource: "workflow", action: "execute" },
+        { resource: "instance", action: "read" },
+        { resource: "instance", action: "write" },
+        { resource: "instance", action: "delete" },
+        { resource: "instance", action: "execute" },
+        { resource: "event", action: "read" },
+        { resource: "event", action: "write" },
+        { resource: "event", action: "delete" },
+        { resource: "config", action: "read" },
+        { resource: "config", action: "write" },
+        { resource: "ai", action: "read" },
+        { resource: "ai", action: "write" },
+        { resource: "template", action: "read" },
+        { resource: "template", action: "write" },
+        { resource: "template", action: "delete" },
+    ],
+    operator: [
+        { resource: "workflow", action: "read" },
+        { resource: "workflow", action: "write" },
+        { resource: "workflow", action: "execute" },
+        { resource: "instance", action: "read" },
+        { resource: "instance", action: "write" },
+        { resource: "instance", action: "execute" },
+        { resource: "event", action: "read" },
+        { resource: "event", action: "write" },
+        { resource: "ai", action: "read" },
+        { resource: "template", action: "read" },
+        { resource: "template", action: "write" },
+    ],
+    viewer: [
+        { resource: "workflow", action: "read" },
+        { resource: "instance", action: "read" },
+        { resource: "event", action: "read" },
+        { resource: "ai", action: "read" },
+        { resource: "template", action: "read" },
+    ],
+};
+export function getPermissionsForRole(role) {
+    return ROLE_PERMISSIONS[role] || [];
+}
+export function hasPermission(role, permission) {
+    const permissions = ROLE_PERMISSIONS[role] || [];
+    return permissions.some((p) => p.resource === permission.resource && p.action === permission.action);
+}
+export function rbacMiddleware(requiredPermission) {
+    return (req, res, next) => {
+        if (!isAuthEnabled()) {
+            next();
+            return;
+        }
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: "Authentication required",
+            });
+            return;
+        }
+        const role = user.role || "viewer";
+        if (!hasPermission(role, requiredPermission)) {
+            Logger.warn("api", "rbac", "Access denied", {
+                userId: user.id,
+                role,
+                resource: requiredPermission.resource,
+                action: requiredPermission.action,
+                path: req.path,
+                method: req.method,
+            });
+            res.status(403).json({
+                success: false,
+                error: "Insufficient permissions",
+                required: requiredPermission,
+                currentRole: role,
+            });
+            return;
+        }
+        next();
+    };
+}
+export function requireRole(...roles) {
+    return (req, res, next) => {
+        if (!isAuthEnabled()) {
+            next();
+            return;
+        }
+        const user = req.user;
+        if (!user) {
+            res.status(401).json({
+                success: false,
+                error: "Authentication required",
+            });
+            return;
+        }
+        const userRole = user.role || "viewer";
+        if (!roles.includes(userRole)) {
+            Logger.warn("api", "rbac", "Role check failed", {
+                userId: user.id,
+                userRole,
+                requiredRoles: roles,
+                path: req.path,
+            });
+            res.status(403).json({
+                success: false,
+                error: "Insufficient role",
+                required: roles,
+                current: userRole,
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=rbac.js.map

package/dist/src/api/middleware/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../../src/api/middleware/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkCpD,MAAM,gBAAgB,GAA+B;IACnD,KAAK,EAAE;QAEL,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC1C,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3C,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC1C,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3C,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QACrC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACtC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;QACvC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;QACtC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QACvC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACnC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;KAC3C;IACD,QAAQ,EAAE;QAER,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3C,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3C,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QACrC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACtC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;KAC1C;IACD,MAAM,EAAE;QAEN,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QACrC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;QAClC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;KACzC;CACF,CAAC;AAKF,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC9C,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAKD,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,UAAsB;IAC9D,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,WAAW,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAC5E,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,kBAA8B;IAC3D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAE/D,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAI,IAAI,CAAC,IAAa,IAAI,QAAQ,CAAC;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE;gBAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,IAAI;gBACJ,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;gBACrC,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;gBACjC,QAAQ,EAAE,kBAAkB;gBAC5B,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,GAAG,KAAa;IAC1C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAE/D,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yBAAyB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAI,IAAI,CAAC,IAAa,IAAI,QAAQ,CAAC;QAEjD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE;gBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ;gBACR,aAAa,EAAE,KAAK;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}