yusufkhon-guard 1.0.0

package/bin/cli.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * @file bin/cli.js
+ * @description `yusufkhon-guard` CLI kirish nuqtasi (dispatcher). Birinchi
+ *              argumentga qarab kichik buyruqni tanlaydi:
+ *                yusufkhon-guard scan ...   -> xavfsizlik auditi
+ *                yusufkhon-guard ssl  ...   -> Let's Encrypt SSL sertifikati
+ *              Kichik buyruq berilmasa yoki `--...` bilan boshlansa — `scan`
+ *              (orqaga moslik uchun).
+ * @module bin/cli
+ */
+
+const sub = process.argv[2];
+
+if (sub === 'ssl') {
+  require('./ssl').main();
+} else if (sub === 'renew') {
+  require('./renew').main();
+} else if (sub === '--help' || sub === '-h' || sub === 'help') {
+  console.log(`
+🛡️  yusufkhon-guard CLI
+
+Buyruqlar:
+  scan    Serverni xavfsizlik jihatidan tekshiradi (SSL, sarlavhalar, oshkorlik...)
+  ssl     Let's Encrypt orqali SSL sertifikatini avtomat oladi (domenni o'zi aniqlaydi)
+  renew   Sertifikatni tekshiradi/yangilaydi; --install bilan avtomat yangilash
+
+Batafsil:
+  npx yusufkhon-guard scan --help
+  npx yusufkhon-guard ssl --help
+  npx yusufkhon-guard renew --help
+`);
+  process.exit(0);
+} else {
+  // Standart: scan ('scan', undefined yoki `--domain ...` kabi eski chaqiruvlar).
+  require('./scan').run();
+}

package/bin/renew.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * @file bin/renew.js
+ * @description `yusufkhon-guard renew` — mavjud sertifikatni tekshiradi va
+ *              `<N kun` qolgan bo'lsa AVTOMAT yangilaydi. `--install` bilan
+ *              har kunlik avtomat yangilashni (cron/systemd/schtasks) rozilik
+ *              qatlami orqali o'rnatadi.
+ *
+ *              Misollar:
+ *                npx yusufkhon-guard renew                 # kerak bo'lsa yangilaydi
+ *                npx yusufkhon-guard renew --force         # majburan yangilaydi
+ *                sudo npx yusufkhon-guard renew --install  # avtomat yangilashni o'rnatadi
+ * @module bin/renew
+ */
+
+const path = require('path');
+const acme = require('../src/modules/acme');
+const privilege = require('../src/utils/privilege');
+const { createChallengeServer, parseArgs } = require('./ssl');
+
+/**
+ * Avtomat yangilash (auto-renew) buyrug'ini platformaga mos tuzadi.
+ * @param {string} certDir
+ * @param {string} cwd
+ * @returns {{ command: string, args: string[] }}
+ */
+function buildAutoRenewCommand(certDir, cwd) {
+  if (process.platform === 'win32') {
+    const tr = `cmd /c cd /d "${cwd}" && npx yusufkhon-guard renew --cert-dir "${certDir}" --yes`;
+    return { command: 'schtasks', args: ['/create', '/tn', 'yusufkhon-guard-renew', '/tr', tr, '/sc', 'daily', '/st', '03:00', '/f'] };
+  }
+  const line = `0 3 * * * cd ${cwd} && npx yusufkhon-guard renew --cert-dir ${certDir} --yes >> ${certDir}/renew.log 2>&1 # yusufkhon-guard-renew`;
+  const pipeline = `(crontab -l 2>/dev/null | grep -v 'yusufkhon-guard-renew'; echo '${line}') | crontab -`;
+  return { command: 'sh', args: ['-c', pipeline] };
+}
+
+/**
+ * Avtomat yangilashni rozilik qatlami orqali o'rnatadi.
+ * @param {Object} params
+ * @param {string} params.certDir
+ * @param {boolean} [params.autoApprove]
+ * @param {boolean} [params.dryRun]
+ * @returns {Promise<import('../src/utils/privilege').PrivilegedResult>}
+ */
+function installAutoRenew({ certDir, autoApprove, dryRun }) {
+  const cmd = buildAutoRenewCommand(path.resolve(certDir), process.cwd());
+  return privilege.runPrivileged(cmd.command, cmd.args, {
+    description: 'Har kuni 03:00 da sertifikatni avtomat yangilash (auto-renew) o\'rnatish',
+    autoApprove,
+    dryRun,
+  });
+}
+
+/** Yordam matni. @returns {void} */
+function printHelp() {
+  console.log(`
+🔄 yusufkhon-guard renew — sertifikatni tekshiradi va kerak bo'lsa yangilaydi
+
+Foydalanish:
+  npx yusufkhon-guard renew [parametrlar]
+
+Parametrlar:
+  --cert-dir <yo'l>   Sertifikat papkasi (standart: ./certs)
+  --days <n>          Shu kundan kam qolsa yangilanadi (standart: 30)
+  --force             Muddatidan qat'i nazar yangilaydi
+  --domain <d>        Domen(lar)ni qo'lda ko'rsatish (aks holda cert SAN'idan olinadi)
+  --production        Jonli muhit (standart: staging)
+  --port <n>          Challenge porti (standart: 80)
+  --install           Avtomat (har kunlik) yangilashni o'rnatadi (root/admin rozilik)
+  --yes               Rozilikni so'ramasdan tasdiqlash
+  --dry-run           O'rnatish buyrug'ini faqat ko'rsatadi (bajarmaydi)
+  --help              Ushbu yordam
+`);
+}
+
+/**
+ * CLI kirish nuqtasi.
+ * @returns {Promise<void>}
+ */
+async function main() {
+  const raw = process.argv.slice(2).filter((a) => a !== 'renew');
+  const args = parseArgs(raw);
+  if (args.help) { printHelp(); process.exit(0); }
+
+  const certDir = typeof args['cert-dir'] === 'string' ? args['cert-dir'] : './certs';
+
+  // 1) Avtomat yangilashni o'rnatish.
+  if (args.install) {
+    await installAutoRenew({ certDir, autoApprove: Boolean(args.yes), dryRun: Boolean(args['dry-run']) });
+    process.exit(0);
+  }
+
+  // 2) Holatni tekshirish.
+  const days = Number(args.days) || 30;
+  const certPath = path.join(certDir, 'fullchain.pem');
+  const status = acme.checkCert(certPath, days);
+
+  console.log(`📜 Sertifikat: ${certPath}`);
+  console.log(`   Holat: ${status.reason}`);
+
+  if (!status.exists && !args.domain) {
+    console.error('❌ Sertifikat topilmadi. Avval oling: npx yusufkhon-guard ssl');
+    process.exit(1);
+  }
+
+  const domains = args.domain
+    ? String(args.domain).split(',').map((s) => s.trim()).filter(Boolean)
+    : (status.domains || []);
+  if (!domains.length) {
+    console.error('❌ Yangilanadigan domen aniqlanmadi (--domain bering).');
+    process.exit(1);
+  }
+
+  if (!status.needsRenewal && !args.force) {
+    console.log(`✅ Hali yangi — yangilash shart emas (${status.daysLeft} kun qoldi). Majburlash uchun: --force`);
+    process.exit(0);
+  }
+
+  // 3) Yangilash.
+  console.log(`🔄 Yangilanyapti: ${domains.join(', ')}`);
+  const environment = args.production ? 'production' : 'staging';
+  const port = Number(args.port) || 80;
+  const accountKeyPath = typeof args['account-key'] === 'string' ? args['account-key'] : path.join(certDir, 'account.pem');
+
+  const store = new acme.ChallengeStore();
+  const server = createChallengeServer(store);
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, resolve); });
+  } catch (err) {
+    console.error(`❌ ${port}-portni ochib bo'lmadi (${err && err.code}). sudo yoki --port bering.`);
+    process.exit(1);
+  }
+  try {
+    const result = await acme.obtainCertificate({ domains, email: typeof args.email === 'string' ? args.email : undefined, challengeStore: store, environment, certDir, accountKeyPath });
+    console.log(`✅ Sertifikat yangilandi: ${result.paths.fullchain}`);
+    process.exit(0);
+  } catch (err) {
+    console.error(`❌ Yangilash muvaffaqiyatsiz: ${err && err.message}`);
+    process.exit(1);
+  } finally {
+    server.close();
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = { main, buildAutoRenewCommand, installAutoRenew };

package/bin/scan.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * @file bin/scan.js
+ * @description `yusufkhon-guard` ning buyruq qatori (CLI) skaneri.
+ *              Foydalanuvchi kutubxonani o'rnatgach, terminalda quyidagicha
+ *              ishga tushiradi:
+ *
+ *                npx yusufkhon-guard scan --domain example.com --target http://localhost:3000 --fix
+ *
+ *              yoki loyihada:  npm run scan
+ * @module bin/scan
+ */
+
+const { scan, formatReport } = require('../src/scanner');
+
+/**
+ * `--kalit qiymat` va `--bayroq` ko'rinishidagi argumentlarni tahlil qiladi.
+ * @param {string[]} argv - process.argv.slice(2).
+ * @returns {Record<string, string|boolean>}
+ */
+function parseArgs(argv) {
+  /** @type {Record<string, string|boolean>} */
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (token.startsWith('--')) {
+      const key = token.slice(2);
+      const next = argv[i + 1];
+      if (next && !next.startsWith('--')) {
+        args[key] = next;
+        i++;
+      } else {
+        args[key] = true;
+      }
+    }
+  }
+  return args;
+}
+
+/**
+ * Yordam matnini chiqaradi.
+ * @returns {void}
+ */
+function printHelp() {
+  console.log(`
+🛡️  yusufkhon-guard — Xavfsizlik skaneri
+
+Foydalanish:
+  npx yusufkhon-guard scan [parametrlar]
+
+Parametrlar:
+  --domain <domen>     SSL/sertifikat tekshiruvi uchun domen (misol: example.com)
+  --target <url>       Xavfsizlik sarlavhalarini tekshirish uchun server URL'i
+                       (misol: http://localhost:3000)
+  --cwd <yo'l>         Loyiha ildiz papkasi (standart: joriy papka)
+  --fix                Muammolarni tuzatish (xavfsizlari avtomat; root talab
+                       qiladiganlari rozilik so'rab, sudo/UAC bilan)
+  --yes                Privilegiyali tuzatishlarga so'ramasdan rozilik berish
+  --dry-run            Privilegiyali buyruqlarni bajarmasdan faqat ko'rsatish
+  --json               Natijani JSON ko'rinishida chiqarish
+  --help               Ushbu yordamni ko'rsatish
+
+Misollar:
+  npx yusufkhon-guard scan --domain mysite.uz --target http://localhost:3000
+  npx yusufkhon-guard scan --fix
+  sudo npx yusufkhon-guard scan --domain mysite.uz --fix --yes
+  npx yusufkhon-guard scan --domain mysite.uz --fix --dry-run
+`);
+}
+
+/**
+ * CLI kirish nuqtasi.
+ * @returns {Promise<void>}
+ */
+async function main() {
+  // "scan" buyrug'ini (agar berilgan bo'lsa) tashlab yuboramiz.
+  const raw = process.argv.slice(2).filter((a) => a !== 'scan');
+  const args = parseArgs(raw);
+
+  if (args.help) {
+    printHelp();
+    process.exit(0);
+  }
+
+  const result = await scan({
+    domain: typeof args.domain === 'string' ? args.domain : undefined,
+    target: typeof args.target === 'string' ? args.target : undefined,
+    cwd: typeof args.cwd === 'string' ? args.cwd : process.cwd(),
+    autoFix: Boolean(args.fix),
+    autoApprove: Boolean(args.yes),
+    dryRun: Boolean(args['dry-run']),
+  });
+
+  if (args.json) {
+    // Ichki (_fix / _privileged) maydonlarni JSON'ga chiqarmaymiz.
+    const clean = {
+      ...result,
+      findings: result.findings.map(({ _fix, _privileged, ...rest }) => rest),
+    };
+    console.log(JSON.stringify(clean, null, 2));
+  } else {
+    console.log(formatReport(result));
+  }
+
+  // Kritik yoki yuqori darajadagi muammo bo'lsa — nol bo'lmagan chiqish kodi
+  // (CI/CD quvurlarida to'xtatish uchun foydali).
+  const failing = result.summary.critical + result.summary.high;
+  process.exit(failing > 0 ? 1 : 0);
+}
+
+/** Skaner CLI'ni ishga tushiradi (dispatcher yoki to'g'ridan-to'g'ri chaqiradi). */
+function run() {
+  return main().catch((err) => {
+    console.error('Skaner xatosi:', err);
+    process.exit(2);
+  });
+}
+
+// To'g'ridan-to'g'ri (`node bin/scan.js`) chaqirilgandagina avtomat ishga tushadi.
+if (require.main === module) run();
+
+module.exports = { run, main, parseArgs };

package/bin/ssl.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * @file bin/ssl.js
+ * @description `yusufkhon-guard ssl` — Let's Encrypt (ACME) orqali SSL sertifikatini
+ *              KOD YOZMASDAN, bitta buyruq bilan oladi ("standalone" rejim, certbot
+ *              kabi). O'zi vaqtinchalik HTTP server ochib, HTTP-01 challenge'ni
+ *              bajaradi va sertifikatni saqlaydi.
+ *
+ *              Misol:
+ *                npx yusufkhon-guard ssl --domain sayt.uz --email admin@sayt.uz
+ *                npx yusufkhon-guard ssl --domain sayt.uz,www.sayt.uz --production
+ * @module bin/ssl
+ */
+
+const http = require('http');
+const acme = require('../src/modules/acme');
+const privilege = require('../src/utils/privilege');
+
+/**
+ * Sertifikat uchun domenlarni aniqlaydi: agar `--domain` berilgan bo'lsa o'shani,
+ * aks holda VPS konfiguratsiyasidan (nginx/apache/hostname) AVTOMAT topib, admin'dan
+ * tasdiq so'raydi.
+ * @param {Record<string,string|boolean>} args
+ * @param {Object} [deps] - Test uchun: { detect, confirm }.
+ * @returns {Promise<{ domains: string[], detected: Array, source: string, confirmed?: boolean }>}
+ */
+async function resolveDomains(args, deps = {}) {
+  const detectFn = deps.detect || (() => acme.detectDomains());
+  const confirmFn = deps.confirm || ((msg) => privilege.confirm(msg, { autoApprove: Boolean(args.yes), defaultYes: true }));
+
+  // 1) Aniq --domain berilgan bo'lsa — o'shani ishlatamiz.
+  if (args.domain) {
+    const domains = String(args.domain).split(',').map((s) => s.trim()).filter(Boolean);
+    return { domains, detected: [], source: 'flag' };
+  }
+
+  // 2) Avtomat aniqlash (nginx / apache / hostname).
+  const detected = detectFn();
+  if (!detected.length) return { domains: [], detected: [], source: 'none' };
+
+  const list = detected.map((d) => `${d.domain} (${d.source})`).join(', ');
+  const ok = await confirmFn(`  🔎 Aniqlangan domen(lar): ${list}\n  ❓ Shu domen(lar) uchun SSL sertifikati olinsinmi?`);
+  return { domains: ok ? detected.map((d) => d.domain) : [], detected, source: 'detected', confirmed: ok };
+}
+
+/**
+ * `--kalit qiymat` va `--bayroq` argumentlarini tahlil qiladi.
+ * @param {string[]} argv - process.argv.slice(2) ('ssl' tokeni chiqarilgan holda).
+ * @returns {Record<string, string|boolean>}
+ */
+function parseArgs(argv) {
+  /** @type {Record<string, string|boolean>} */
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (token.startsWith('--')) {
+      const key = token.slice(2);
+      const next = argv[i + 1];
+      if (next && !next.startsWith('--')) { args[key] = next; i++; }
+      else args[key] = true;
+    }
+  }
+  return args;
+}
+
+/**
+ * Challenge'ni beruvchi vaqtinchalik HTTP serverni yaratadi (express'siz).
+ * `/.well-known/acme-challenge/<token>` so'roviga keyAuth qaytaradi, qolganiga 404.
+ * @param {acme.ChallengeStore} store
+ * @returns {import('http').Server}
+ */
+function createChallengeServer(store) {
+  const chal = acme.challengeMiddleware(store);
+  return http.createServer((req, res) => {
+    chal(req, res, () => { res.statusCode = 404; res.end('Not found'); });
+  });
+}
+
+/** Yordam matnini chiqaradi. @returns {void} */
+function printHelp() {
+  console.log(`
+🔐 yusufkhon-guard ssl — Let's Encrypt SSL sertifikatini avtomat oladi
+
+Foydalanish:
+  npx yusufkhon-guard ssl                    # domenni AVTOMAT aniqlab, tasdiq so'raydi
+  npx yusufkhon-guard ssl --domain <domen>   # domenni qo'lda ko'rsatib
+
+Parametrlar:
+  --domain <d>        Domen(lar). Berilmasa — nginx/apache/hostname'dan avtomat topiladi
+  --email <e>         Bog'lanish uchun email (tavsiya etiladi)
+  --yes               Aniqlangan domenni so'ramasdan tasdiqlash (non-interactive)
+  --staging           Sinov muhiti (STANDART) — soxta, lekin xavfsiz cert
+  --production        Jonli muhit — HAQIQIY cert (limitlarga e'tibor bering!)
+  --cert-dir <yo'l>   Sertifikat saqlanadigan papka (standart: ./certs)
+  --account-key <f>   ACME hisob kaliti fayli (standart: ./certs/account.pem)
+  --port <n>          Challenge HTTP porti (standart: 80)
+  --help              Ushbu yordam
+
+Shartlar: real ommaviy domen, DNS domenni shu serverga yo'naltirgan, 80-port ochiq.
+
+Misollar:
+  npx yusufkhon-guard ssl --domain sayt.uz --email admin@sayt.uz
+  npx yusufkhon-guard ssl --domain sayt.uz,www.sayt.uz --production
+`);
+}
+
+/**
+ * CLI kirish nuqtasi.
+ * @returns {Promise<void>}
+ */
+async function main() {
+  const raw = process.argv.slice(2).filter((a) => a !== 'ssl');
+  const args = parseArgs(raw);
+
+  if (args.help) { printHelp(); process.exit(0); }
+
+  // Domenni aniqlaymiz (--domain yoki avtomat aniqlash + admin tasdiqi).
+  const resolved = await resolveDomains(args);
+  const domains = resolved.domains;
+  if (!domains.length) {
+    if (resolved.source === 'none') {
+      console.error('❌ Domen avtomat aniqlanmadi (nginx/apache/hostname topilmadi).');
+      console.error('   --domain bilan qo\'lda ko\'rsating: npx yusufkhon-guard ssl --domain sayt.uz');
+    } else if (resolved.source === 'detected' && resolved.confirmed === false) {
+      console.error('🚫 Bekor qilindi (admin tasdiqlamadi).');
+    }
+    process.exit(1);
+  }
+  if (resolved.source === 'detected') console.log(`✔️  Tasdiqlangan domen(lar): ${domains.join(', ')}`);
+
+  const environment = args.production ? 'production' : 'staging';
+  const port = Number(args.port) || 80;
+  const certDir = typeof args['cert-dir'] === 'string' ? args['cert-dir'] : './certs';
+  const accountKeyPath = typeof args['account-key'] === 'string' ? args['account-key'] : './certs/account.pem';
+
+  const store = new acme.ChallengeStore();
+  const server = createChallengeServer(store);
+
+  // Challenge serverni ishga tushiramiz (80-port ruxsat talab qilishi mumkin).
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(port, resolve);
+    });
+  } catch (err) {
+    if (err && err.code === 'EACCES') {
+      console.error(`❌ ${port}-portni ochib bo'lmadi (ruxsat yo'q). Root bilan ishlating (sudo) yoki --port 8080 bering (reverse-proxy orqasida).`);
+    } else if (err && err.code === 'EADDRINUSE') {
+      console.error(`❌ ${port}-port band. Boshqa xizmatni to'xtating yoki --port bilan boshqa port bering.`);
+    } else {
+      console.error(`❌ Server xatosi: ${err && err.message}`);
+    }
+    process.exit(1);
+  }
+
+  console.log(`🌐 Challenge server ${port}-portda. Sertifikat olinyapti [${environment}]: ${domains.join(', ')}`);
+  if (environment === 'staging') console.log('ℹ️  Sinov (staging) rejimi — cert soxta. Jonli cert uchun --production bering.');
+
+  try {
+    const result = await acme.obtainCertificate({ domains, email: typeof args.email === 'string' ? args.email : undefined, challengeStore: store, environment, certDir, accountKeyPath });
+    console.log('\n✅ Sertifikat muvaffaqiyatli olindi!');
+    console.log(`   Zanjir : ${result.paths.fullchain}`);
+    console.log(`   Kalit  : ${result.paths.privkey}`);
+    console.log('\n   HTTPS serverda ishlatish:');
+    console.log(`   https.createServer({ cert: fs.readFileSync('${result.paths.fullchain}'), key: fs.readFileSync('${result.paths.privkey}') }, app)`);
+    process.exit(0);
+  } catch (err) {
+    console.error(`\n❌ Sertifikat olinmadi: ${err && err.message}`);
+    console.error('   Tekshiring: domen DNS shu serverga yo\'naltirilganmi, 80-port internetdan ochiqmi.');
+    process.exit(1);
+  } finally {
+    server.close();
+  }
+}
+
+// To'g'ridan-to'g'ri chaqirilgandagina ishga tushadi (require qilinganda emas).
+if (require.main === module) main();
+
+module.exports = { main, parseArgs, createChallengeServer, resolveDomains };

package/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "yusufkhon-guard",
+  "version": "1.0.0",
+  "description": "Express.js va Node.js uchun yengil, mustaqil (zero-dependency) xavfsizlik middleware: aktiv himoya (blue team firewall), auto IP-ban, security headers, rate-limiting, input sanitization va audit-skaner.",
+  "main": "src/index.js",
+  "types": "src/index.js",
+  "bin": {
+    "yusufkhon-guard": "bin/cli.js"
+  },
+  "scripts": {
+    "start": "node test.js",
+    "demo": "node test.js",
+    "test": "jest --runInBand",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --coverage --runInBand",
+    "scan": "node bin/scan.js",
+    "ssl": "node bin/ssl.js",
+    "renew": "node bin/renew.js",
+    "prepublishOnly": "npm test"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "setupFiles": [
+      "<rootDir>/tests/jest.setup.js"
+    ],
+    "testMatch": [
+      "**/tests/**/*.test.js"
+    ],
+    "testPathIgnorePatterns": [
+      "/node_modules/",
+      "/tests/legacy-manual/"
+    ],
+    "testTimeout": 15000
+  },
+  "keywords": [
+    "express",
+    "security",
+    "middleware",
+    "rate-limit",
+    "rate-limiter",
+    "helmet",
+    "sanitizer",
+    "xss",
+    "sqli",
+    "security-headers",
+    "csp",
+    "hsts",
+    "firewall",
+    "waf",
+    "blue-team",
+    "ip-ban",
+    "auto-block",
+    "intrusion-detection",
+    "ssl-check",
+    "security-scanner",
+    "yusufkhon-guard"
+  ],
+  "author": "Yusufkhon",
+  "license": "MIT",
+  "engines": {
+    "node": ">=14.0.0"
+  },
+  "peerDependencies": {
+    "express": ">=4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "express": {
+      "optional": true
+    }
+  },
+  "files": [
+    "src",
+    "bin",
+    "README.md"
+  ],
+  "devDependencies": {
+    "jest": "^30.4.2",
+    "supertest": "^7.2.2"
+  }
+}