web-agent-bridge 1.0.0 → 1.1.0

package/server/index.js

@@ -1,5 +1,8 @@
 require('dotenv').config();
 
+const { assertSecretsAtStartup } = require('./config/secrets');
+assertSecretsAtStartup();
+
 const express = require('express');
 const http = require('http');
 const cors = require('cors');
@@ -7,33 +10,80 @@ const helmet = require('helmet');
 const rateLimit = require('express-rate-limit');
 const path = require('path');
 const { setupWebSocket } = require('./ws');
+const { runMigrations } = require('./utils/migrate');
+const { maybeBootstrapAdmin } = require('./models/db');
 
 const authRoutes = require('./routes/auth');
 const apiRoutes = require('./routes/api');
 const licenseRoutes = require('./routes/license');
+const adminRoutes = require('./routes/admin');
+const billingRoutes = require('./routes/billing');
+const noscriptRoutes = require('./routes/noscript');
+const discoveryRoutes = require('./routes/discovery');
+const { handleWebhookRequest } = require('./services/stripe');
 
 const app = express();
 const PORT = process.env.PORT || 3000;
 
-// ─── Security & Middleware ──────────────────────────────────────────────
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'"],
-      styleSrc: ["'self'", "'unsafe-inline'"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "ws:", "wss:"],
-      fontSrc: ["'self'", "https:", "data:"],
-      frameSrc: ["'none'"],
-      frameAncestors: ["'none'"],
-      objectSrc: ["'none'"],
-      baseUri: ["'self'"]
-    }
-  },
-  crossOriginEmbedderPolicy: false
-}));
-app.use(cors());
+app.set('trust proxy', 1);
+
+const corsOrigins = (process.env.ALLOWED_ORIGINS
+  || 'http://localhost:3000,http://127.0.0.1:3000,http://localhost:5173')
+  .split(',')
+  .map((s) => s.trim())
+  .filter(Boolean);
+
+app.use(
+  cors({
+    origin(origin, callback) {
+      if (!origin) return callback(null, true);
+      if (corsOrigins.includes(origin)) return callback(null, true);
+      if (process.env.NODE_ENV !== 'production' && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/i.test(origin)) {
+        return callback(null, true);
+      }
+      return callback(null, false);
+    },
+    credentials: true
+  })
+);
+
+const scriptSrc = process.env.CSP_ALLOW_UNSAFE_INLINE === 'false'
+  ? ["'self'"]
+  : ["'self'", "'unsafe-inline'"];
+const styleSrc = process.env.CSP_ALLOW_UNSAFE_INLINE === 'false'
+  ? ["'self'"]
+  : ["'self'", "'unsafe-inline'"];
+
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc,
+        styleSrc,
+        imgSrc: ["'self'", 'data:', 'https:'],
+        connectSrc: ["'self'", 'ws:', 'wss:'],
+        fontSrc: ["'self'", 'https:', 'data:'],
+        frameSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+        objectSrc: ["'none'"],
+        baseUri: ["'self'"]
+      }
+    },
+    crossOriginEmbedderPolicy: false
+  })
+);
+
+app.post('/api/billing/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
+  try {
+    await handleWebhookRequest(req);
+    res.json({ received: true });
+  } catch (err) {
+    console.error('Webhook error:', err.message);
+    res.status(400).json({ error: err.message });
+  }
+});
+
 app.use(express.json());
 
 const apiLimiter = rateLimit({
@@ -48,19 +98,24 @@ const licenseLimiter = rateLimit({
   windowMs: 60 * 1000,
   max: 120,
   standardHeaders: true,
-  legacyHeaders: false
+  legacyHeaders: false,
+  keyGenerator: (req) => {
+    const key = req.body?.licenseKey || req.body?.siteId || req.ip;
+    return `${req.ip}:${key}`;
+  }
 });
 
-// ─── Static Files ───────────────────────────────────────────────────────
 app.use(express.static(path.join(__dirname, '..', 'public')));
 app.use('/script', express.static(path.join(__dirname, '..', 'script')));
 
-// ─── API Routes ─────────────────────────────────────────────────────────
 app.use('/api/auth', apiLimiter, authRoutes);
 app.use('/api', apiLimiter, apiRoutes);
 app.use('/api/license', licenseLimiter, licenseRoutes);
+app.use('/api/admin', apiLimiter, adminRoutes);
+app.use('/api/billing', apiLimiter, billingRoutes);
+app.use('/api/noscript', noscriptRoutes);
+app.use('/', discoveryRoutes);
 
-// ─── HTML Routes ────────────────────────────────────────────────────────
 app.get('/dashboard', (req, res) => {
   res.sendFile(path.join(__dirname, '..', 'public', 'dashboard.html'));
 });
@@ -73,13 +128,29 @@ app.get('/login', (req, res) => {
 app.get('/register', (req, res) => {
   res.sendFile(path.join(__dirname, '..', 'public', 'register.html'));
 });
+app.get('/admin/login', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'admin', 'login.html'));
+});
+app.get('/admin', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'admin', 'dashboard.html'));
+});
+app.get('/premium', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'premium.html'));
+});
+app.get('/privacy', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'privacy.html'));
+});
+app.get('/terms', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'terms.html'));
+});
+app.get('/cookies', (req, res) => {
+  res.sendFile(path.join(__dirname, '..', 'public', 'cookies.html'));
+});
 
-// ─── CDN Versioned Script ───────────────────────────────────────────────
 const pkg = require('../package.json');
 app.use(`/v${pkg.version.split('.')[0]}`, express.static(path.join(__dirname, '..', 'script')));
 app.use('/latest', express.static(path.join(__dirname, '..', 'script')));
 
-// ─── SPA Fallback ───────────────────────────────────────────────────────
 app.get('*', (req, res) => {
   if (req.accepts('html')) {
     res.sendFile(path.join(__dirname, '..', 'public', 'index.html'));
@@ -88,8 +159,11 @@ app.get('*', (req, res) => {
   }
 });
 
-// ─── Start ──────────────────────────────────────────────────────────────
 if (process.env.NODE_ENV !== 'test') {
+  console.log('Running database migrations...');
+  runMigrations();
+  maybeBootstrapAdmin();
+
   const server = http.createServer(app);
   setupWebSocket(server);
 

package/server/middleware/adminAuth.js

@@ -0,0 +1,30 @@
+const { signAdminToken, verifyAdminToken } = require('../config/secrets');
+
+function generateAdminToken(admin) {
+  return signAdminToken(
+    { id: admin.id, email: admin.email, name: admin.name, role: admin.role, isAdmin: true },
+    { expiresIn: '12h' }
+  );
+}
+
+function authenticateAdmin(req, res, next) {
+  const authHeader = req.headers['authorization'];
+  const token = authHeader && authHeader.split(' ')[1];
+
+  if (!token) {
+    return res.status(401).json({ error: 'Admin access token required' });
+  }
+
+  try {
+    const decoded = verifyAdminToken(token);
+    if (!decoded.isAdmin) {
+      return res.status(403).json({ error: 'Admin privileges required' });
+    }
+    req.admin = decoded;
+    next();
+  } catch (err) {
+    return res.status(403).json({ error: 'Invalid or expired admin token' });
+  }
+}
+
+module.exports = { generateAdminToken, authenticateAdmin };

package/server/middleware/auth.js

@@ -1,11 +1,8 @@
-const jwt = require('jsonwebtoken');
-
-const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret-change-in-production';
+const { signUserToken, verifyUserToken } = require('../config/secrets');
 
 function generateToken(user) {
-  return jwt.sign(
+  return signUserToken(
     { id: user.id, email: user.email, name: user.name },
-    JWT_SECRET,
     { expiresIn: '7d' }
   );
 }
@@ -19,7 +16,7 @@ function authenticateToken(req, res, next) {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = verifyUserToken(token);
     req.user = decoded;
     next();
   } catch (err) {
@@ -33,7 +30,7 @@ function optionalAuth(req, res, next) {
 
   if (token) {
     try {
-      req.user = jwt.verify(token, JWT_SECRET);
+      req.user = verifyUserToken(token);
     } catch (e) {
       // ignore invalid tokens for optional auth
     }

package/server/middleware/rateLimits.js

@@ -0,0 +1,24 @@
+/**
+ * Stricter rate limits for license token / track endpoints (used inside license router).
+ */
+
+const rateLimit = require('express-rate-limit');
+
+const licenseTokenLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 30,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many token requests, please try again later' }
+});
+
+const licenseTrackLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 300,
+  standardHeaders: true,
+  legacyHeaders: false,
+  keyGenerator: (req) => `${req.ip}:${req.body?.sessionToken || req.body?.siteId || 'anon'}`,
+  message: { error: 'Too many track requests, please try again later' }
+});
+
+module.exports = { licenseTokenLimiter, licenseTrackLimiter };

package/server/migrations/001_add_analytics_indexes.sql

@@ -0,0 +1,7 @@
+-- Migration 001: Add composite indexes for analytics performance
+-- Created: 2024-12-01
+
+CREATE INDEX IF NOT EXISTS idx_analytics_site_action ON analytics(site_id, action_name);
+CREATE INDEX IF NOT EXISTS idx_analytics_site_created ON analytics(site_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_subscriptions_user ON subscriptions(user_id);
+CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);