refactor: migrate to Elysia and enhance security middleware
- Replaced Express with Elysia for improved performance and type safety - Integrated Elysia middleware for rate limiting, security headers, and request validation - Refactored security utilities to work with Elysia's context and request handling - Updated token management and validation logic - Added comprehensive security headers and input sanitization - Simplified server initialization and error handling - Updated documentation with new setup and configuration details
This commit is contained in:
jango-blockchained
@@ -1,6 +1,5 @@
|
||||
import { config } from "dotenv";
|
||||
import path from "path";
|
||||
import { TEST_CONFIG } from "../config/__tests__/test.config";
|
||||
import {
|
||||
beforeAll,
|
||||
afterAll,
|
||||
@@ -12,6 +11,25 @@ import {
|
||||
test,
|
||||
} from "bun:test";
|
||||
|
||||
// Type definitions for mocks
|
||||
type MockFn = ReturnType<typeof mock>;
|
||||
|
||||
interface MockInstance {
|
||||
mock: {
|
||||
calls: unknown[][];
|
||||
results: unknown[];
|
||||
instances: unknown[];
|
||||
lastCall?: unknown[];
|
||||
};
|
||||
}
|
||||
|
||||
// Test configuration
|
||||
const TEST_CONFIG = {
|
||||
TEST_JWT_SECRET: "test_jwt_secret_key_that_is_at_least_32_chars",
|
||||
TEST_TOKEN: "test_token_that_is_at_least_32_chars_long",
|
||||
TEST_CLIENT_IP: "127.0.0.1",
|
||||
};
|
||||
|
||||
// Load test environment variables
|
||||
config({ path: path.resolve(process.cwd(), ".env.test") });
|
||||
|
||||
@@ -23,34 +41,10 @@ beforeAll(() => {
|
||||
process.env.TEST_TOKEN = TEST_CONFIG.TEST_TOKEN;
|
||||
|
||||
// Configure console output for tests
|
||||
const originalConsoleError = console.error;
|
||||
const originalConsoleWarn = console.warn;
|
||||
const originalConsoleLog = console.log;
|
||||
|
||||
// Suppress console output during tests unless explicitly enabled
|
||||
if (!process.env.DEBUG) {
|
||||
console.error = mock(() => {});
|
||||
console.warn = mock(() => {});
|
||||
console.log = mock(() => {});
|
||||
}
|
||||
|
||||
// Store original console methods for cleanup
|
||||
(global as any).__ORIGINAL_CONSOLE__ = {
|
||||
error: originalConsoleError,
|
||||
warn: originalConsoleWarn,
|
||||
log: originalConsoleLog,
|
||||
};
|
||||
});
|
||||
|
||||
// Global test teardown
|
||||
afterAll(() => {
|
||||
// Restore original console methods
|
||||
const originalConsole = (global as any).__ORIGINAL_CONSOLE__;
|
||||
if (originalConsole) {
|
||||
console.error = originalConsole.error;
|
||||
console.warn = originalConsole.warn;
|
||||
console.log = originalConsole.log;
|
||||
delete (global as any).__ORIGINAL_CONSOLE__;
|
||||
console.error = mock(() => { });
|
||||
console.warn = mock(() => { });
|
||||
console.log = mock(() => { });
|
||||
}
|
||||
});
|
||||
|
||||
@@ -58,7 +52,7 @@ afterAll(() => {
|
||||
beforeEach(() => {
|
||||
// Clear all mock function calls
|
||||
const mockFns = Object.values(mock).filter(
|
||||
(value) => typeof value === "function",
|
||||
(value): value is MockFn => typeof value === "function" && "mock" in value,
|
||||
);
|
||||
mockFns.forEach((mockFn) => {
|
||||
if (mockFn.mock) {
|
||||
@@ -70,100 +64,80 @@ beforeEach(() => {
|
||||
});
|
||||
});
|
||||
|
||||
// Custom test environment setup
|
||||
const setupTestEnvironment = () => {
|
||||
return {
|
||||
// Mock WebSocket for SSE tests
|
||||
mockWebSocket: () => {
|
||||
const mockWs = {
|
||||
on: mock(() => {}),
|
||||
send: mock(() => {}),
|
||||
close: mock(() => {}),
|
||||
};
|
||||
return mockWs;
|
||||
// Custom test utilities
|
||||
const testUtils = {
|
||||
// Mock WebSocket for SSE tests
|
||||
mockWebSocket: () => ({
|
||||
on: mock(() => { }),
|
||||
send: mock(() => { }),
|
||||
close: mock(() => { }),
|
||||
readyState: 1,
|
||||
OPEN: 1,
|
||||
removeAllListeners: mock(() => { }),
|
||||
}),
|
||||
|
||||
// Mock HTTP response for API tests
|
||||
mockResponse: () => {
|
||||
const res = {
|
||||
status: mock(() => res),
|
||||
json: mock(() => res),
|
||||
send: mock(() => res),
|
||||
end: mock(() => res),
|
||||
setHeader: mock(() => res),
|
||||
writeHead: mock(() => res),
|
||||
write: mock(() => true),
|
||||
removeHeader: mock(() => res),
|
||||
};
|
||||
return res;
|
||||
},
|
||||
|
||||
// Mock HTTP request for API tests
|
||||
mockRequest: (overrides: Record<string, unknown> = {}) => ({
|
||||
headers: { "content-type": "application/json" },
|
||||
body: {},
|
||||
query: {},
|
||||
params: {},
|
||||
ip: TEST_CONFIG.TEST_CLIENT_IP,
|
||||
method: "GET",
|
||||
path: "/api/test",
|
||||
is: mock((type: string) => type === "application/json"),
|
||||
...overrides,
|
||||
}),
|
||||
|
||||
// Create test client for SSE tests
|
||||
createTestClient: (id = "test-client") => ({
|
||||
id,
|
||||
ip: TEST_CONFIG.TEST_CLIENT_IP,
|
||||
connectedAt: new Date(),
|
||||
send: mock(() => { }),
|
||||
rateLimit: {
|
||||
count: 0,
|
||||
lastReset: Date.now(),
|
||||
},
|
||||
connectionTime: Date.now(),
|
||||
}),
|
||||
|
||||
// Mock HTTP response for API tests
|
||||
mockResponse: () => {
|
||||
const res: any = {};
|
||||
res.status = mock(() => res);
|
||||
res.json = mock(() => res);
|
||||
res.send = mock(() => res);
|
||||
res.end = mock(() => res);
|
||||
res.setHeader = mock(() => res);
|
||||
res.writeHead = mock(() => res);
|
||||
res.write = mock(() => true);
|
||||
res.removeHeader = mock(() => res);
|
||||
return res;
|
||||
},
|
||||
// Create test event for SSE tests
|
||||
createTestEvent: (type = "test_event", data: unknown = {}) => ({
|
||||
event_type: type,
|
||||
data,
|
||||
origin: "test",
|
||||
time_fired: new Date().toISOString(),
|
||||
context: { id: "test" },
|
||||
}),
|
||||
|
||||
// Mock HTTP request for API tests
|
||||
mockRequest: (overrides = {}) => {
|
||||
return {
|
||||
headers: { "content-type": "application/json" },
|
||||
body: {},
|
||||
query: {},
|
||||
params: {},
|
||||
ip: TEST_CONFIG.TEST_CLIENT_IP,
|
||||
method: "GET",
|
||||
path: "/api/test",
|
||||
is: mock((type: string) => type === "application/json"),
|
||||
...overrides,
|
||||
};
|
||||
},
|
||||
// Create test entity for Home Assistant tests
|
||||
createTestEntity: (entityId = "test.entity", state = "on") => ({
|
||||
entity_id: entityId,
|
||||
state,
|
||||
attributes: {},
|
||||
last_changed: new Date().toISOString(),
|
||||
last_updated: new Date().toISOString(),
|
||||
}),
|
||||
|
||||
// Create test client for SSE tests
|
||||
createTestClient: (id: string = "test-client") => ({
|
||||
id,
|
||||
ip: TEST_CONFIG.TEST_CLIENT_IP,
|
||||
connectedAt: new Date(),
|
||||
send: mock(() => {}),
|
||||
rateLimit: {
|
||||
count: 0,
|
||||
lastReset: Date.now(),
|
||||
},
|
||||
connectionTime: Date.now(),
|
||||
}),
|
||||
|
||||
// Create test event for SSE tests
|
||||
createTestEvent: (type: string = "test_event", data: any = {}) => ({
|
||||
event_type: type,
|
||||
data,
|
||||
origin: "test",
|
||||
time_fired: new Date().toISOString(),
|
||||
context: { id: "test" },
|
||||
}),
|
||||
|
||||
// Create test entity for Home Assistant tests
|
||||
createTestEntity: (
|
||||
entityId: string = "test.entity",
|
||||
state: string = "on",
|
||||
) => ({
|
||||
entity_id: entityId,
|
||||
state,
|
||||
attributes: {},
|
||||
last_changed: new Date().toISOString(),
|
||||
last_updated: new Date().toISOString(),
|
||||
}),
|
||||
|
||||
// Helper to wait for async operations
|
||||
wait: (ms: number) => new Promise((resolve) => setTimeout(resolve, ms)),
|
||||
};
|
||||
// Helper to wait for async operations
|
||||
wait: (ms: number) => new Promise((resolve) => setTimeout(resolve, ms)),
|
||||
};
|
||||
|
||||
// Export test utilities
|
||||
export const testUtils = setupTestEnvironment();
|
||||
|
||||
// Export Bun test utilities
|
||||
export { beforeAll, afterAll, beforeEach, describe, expect, it, mock, test };
|
||||
|
||||
// Make test utilities available globally
|
||||
(global as any).testUtils = testUtils;
|
||||
(global as any).describe = describe;
|
||||
(global as any).it = it;
|
||||
(global as any).test = test;
|
||||
(global as any).expect = expect;
|
||||
(global as any).beforeAll = beforeAll;
|
||||
(global as any).afterAll = afterAll;
|
||||
(global as any).beforeEach = beforeEach;
|
||||
(global as any).mock = mock;
|
||||
// Export test utilities and Bun test functions
|
||||
export { beforeAll, afterAll, beforeEach, describe, expect, it, mock, test, testUtils };
|
||||
|
||||
@@ -1,34 +1,90 @@
|
||||
import { CreateApplication } from "@digital-alchemy/core";
|
||||
import { LIB_HASS } from "@digital-alchemy/hass";
|
||||
import type { HassEntity } from "../interfaces/hass.js";
|
||||
|
||||
// Create the application following the documentation example
|
||||
const app = CreateApplication({
|
||||
libraries: [LIB_HASS],
|
||||
name: "home_automation",
|
||||
configuration: {
|
||||
hass: {
|
||||
BASE_URL: {
|
||||
type: "string" as const,
|
||||
default: process.env.HASS_HOST || "http://localhost:8123",
|
||||
description: "Home Assistant URL",
|
||||
},
|
||||
TOKEN: {
|
||||
type: "string" as const,
|
||||
default: process.env.HASS_TOKEN || "",
|
||||
description: "Home Assistant long-lived access token",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
class HomeAssistantAPI {
|
||||
private baseUrl: string;
|
||||
private token: string;
|
||||
|
||||
let instance: Awaited<ReturnType<typeof app.bootstrap>>;
|
||||
constructor() {
|
||||
this.baseUrl = process.env.HASS_HOST || "http://localhost:8123";
|
||||
this.token = process.env.HASS_TOKEN || "";
|
||||
|
||||
if (!this.token || this.token === "your_hass_token_here") {
|
||||
throw new Error("HASS_TOKEN is required but not set in environment variables");
|
||||
}
|
||||
|
||||
console.log(`Initializing Home Assistant API with base URL: ${this.baseUrl}`);
|
||||
}
|
||||
|
||||
private async fetchApi(endpoint: string, options: RequestInit = {}) {
|
||||
const url = `${this.baseUrl}/api/${endpoint}`;
|
||||
console.log(`Making request to: ${url}`);
|
||||
console.log('Request options:', {
|
||||
method: options.method || 'GET',
|
||||
headers: {
|
||||
Authorization: 'Bearer [REDACTED]',
|
||||
"Content-Type": "application/json",
|
||||
...options.headers,
|
||||
},
|
||||
body: options.body ? JSON.parse(options.body as string) : undefined
|
||||
});
|
||||
|
||||
try {
|
||||
const response = await fetch(url, {
|
||||
...options,
|
||||
headers: {
|
||||
Authorization: `Bearer ${this.token}`,
|
||||
"Content-Type": "application/json",
|
||||
...options.headers,
|
||||
},
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const errorText = await response.text();
|
||||
console.error('Home Assistant API error:', {
|
||||
status: response.status,
|
||||
statusText: response.statusText,
|
||||
error: errorText
|
||||
});
|
||||
throw new Error(`Home Assistant API error: ${response.status} ${response.statusText} - ${errorText}`);
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
console.log('Response data:', data);
|
||||
return data;
|
||||
} catch (error) {
|
||||
console.error('Failed to make request:', error);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
async getStates(): Promise<HassEntity[]> {
|
||||
return this.fetchApi("states");
|
||||
}
|
||||
|
||||
async getState(entityId: string): Promise<HassEntity> {
|
||||
return this.fetchApi(`states/${entityId}`);
|
||||
}
|
||||
|
||||
async callService(domain: string, service: string, data: Record<string, any>): Promise<void> {
|
||||
await this.fetchApi(`services/${domain}/${service}`, {
|
||||
method: "POST",
|
||||
body: JSON.stringify(data),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
let instance: HomeAssistantAPI | null = null;
|
||||
|
||||
export async function get_hass() {
|
||||
if (!instance) {
|
||||
try {
|
||||
instance = await app.bootstrap();
|
||||
instance = new HomeAssistantAPI();
|
||||
// Verify connection by trying to get states
|
||||
await instance.getStates();
|
||||
console.log('Successfully connected to Home Assistant');
|
||||
} catch (error) {
|
||||
console.error("Failed to initialize Home Assistant:", error);
|
||||
console.error('Failed to initialize Home Assistant connection:', error);
|
||||
instance = null;
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
@@ -42,23 +98,28 @@ export async function call_service(
|
||||
data: Record<string, any>,
|
||||
) {
|
||||
const hass = await get_hass();
|
||||
return hass.hass.internals.callService(domain, service, data);
|
||||
return hass.callService(domain, service, data);
|
||||
}
|
||||
|
||||
// Helper function to list devices
|
||||
export async function list_devices() {
|
||||
const hass = await get_hass();
|
||||
return hass.hass.device.list();
|
||||
const states = await hass.getStates();
|
||||
return states.map((state: HassEntity) => ({
|
||||
entity_id: state.entity_id,
|
||||
state: state.state,
|
||||
attributes: state.attributes
|
||||
}));
|
||||
}
|
||||
|
||||
// Helper function to get entity states
|
||||
export async function get_states() {
|
||||
const hass = await get_hass();
|
||||
return hass.hass.internals.getStates();
|
||||
return hass.getStates();
|
||||
}
|
||||
|
||||
// Helper function to get a specific entity state
|
||||
export async function get_state(entity_id: string) {
|
||||
const hass = await get_hass();
|
||||
return hass.hass.internals.getState(entity_id);
|
||||
return hass.getState(entity_id);
|
||||
}
|
||||
|
||||
64
src/index.ts
64
src/index.ts
@@ -1,7 +1,9 @@
|
||||
import "./polyfills.js";
|
||||
import { config } from "dotenv";
|
||||
import { resolve } from "path";
|
||||
import express from "express";
|
||||
import { Elysia } from "elysia";
|
||||
import { cors } from "@elysiajs/cors";
|
||||
import { swagger } from "@elysiajs/swagger";
|
||||
import {
|
||||
rateLimiter,
|
||||
securityHeaders,
|
||||
@@ -41,25 +43,6 @@ const PORT = parseInt(process.env.PORT || "4000", 10);
|
||||
|
||||
console.log("Initializing Home Assistant connection...");
|
||||
|
||||
// Initialize Express app
|
||||
const app = express();
|
||||
|
||||
// Apply security middleware
|
||||
app.use(securityHeaders);
|
||||
app.use(rateLimiter);
|
||||
app.use(express.json());
|
||||
app.use(validateRequest);
|
||||
app.use(sanitizeInput);
|
||||
|
||||
// Health check endpoint
|
||||
app.get("/health", (req, res) => {
|
||||
res.json({
|
||||
status: "ok",
|
||||
timestamp: new Date().toISOString(),
|
||||
version: "0.1.0",
|
||||
});
|
||||
});
|
||||
|
||||
// Define Tool interface
|
||||
interface Tool {
|
||||
name: string;
|
||||
@@ -131,35 +114,38 @@ const controlTool: Tool = {
|
||||
// Add the control tool to the array
|
||||
tools.push(controlTool);
|
||||
|
||||
// Initialize Elysia app with middleware
|
||||
const app = new Elysia()
|
||||
.use(cors())
|
||||
.use(swagger())
|
||||
.use(rateLimiter)
|
||||
.use(securityHeaders)
|
||||
.use(validateRequest)
|
||||
.use(sanitizeInput)
|
||||
.use(errorHandler);
|
||||
|
||||
// Health check endpoint
|
||||
app.get("/health", () => ({
|
||||
status: "ok",
|
||||
timestamp: new Date().toISOString(),
|
||||
version: "0.1.0",
|
||||
}));
|
||||
|
||||
// Create API endpoints for each tool
|
||||
tools.forEach((tool) => {
|
||||
app.post(`/api/tools/${tool.name}`, async (req, res) => {
|
||||
try {
|
||||
const result = await tool.execute(req.body);
|
||||
res.json(result);
|
||||
} catch (error) {
|
||||
res.status(500).json({
|
||||
success: false,
|
||||
message:
|
||||
error instanceof Error ? error.message : "Unknown error occurred",
|
||||
});
|
||||
}
|
||||
app.post(`/api/tools/${tool.name}`, async ({ body }: { body: Record<string, unknown> }) => {
|
||||
const result = await tool.execute(body);
|
||||
return result;
|
||||
});
|
||||
});
|
||||
|
||||
// Error handling middleware
|
||||
app.use(errorHandler);
|
||||
|
||||
// Start the server
|
||||
const server = app.listen(PORT, () => {
|
||||
app.listen(PORT, () => {
|
||||
console.log(`Server is running on port ${PORT}`);
|
||||
});
|
||||
|
||||
// Handle server shutdown
|
||||
process.on("SIGTERM", () => {
|
||||
console.log("Received SIGTERM. Shutting down gracefully...");
|
||||
void server.close(() => {
|
||||
console.log("Server closed");
|
||||
process.exit(0);
|
||||
});
|
||||
process.exit(0);
|
||||
});
|
||||
|
||||
@@ -1,150 +1,118 @@
|
||||
import { TokenManager } from "../index";
|
||||
import { SECURITY_CONFIG } from "../../config/security.config";
|
||||
import { describe, expect, it, beforeEach } from "bun:test";
|
||||
import { TokenManager } from "../index.js";
|
||||
import jwt from "jsonwebtoken";
|
||||
import { jest } from "@jest/globals";
|
||||
|
||||
describe("TokenManager", () => {
|
||||
const validSecret = "test_secret_key_that_is_at_least_32_chars_long";
|
||||
const testIp = "127.0.0.1";
|
||||
const validSecret = "test-secret-key-that-is-at-least-32-chars";
|
||||
const validToken = "valid-token-that-is-at-least-32-characters-long";
|
||||
const testIp = "127.0.0.1";
|
||||
|
||||
describe("Security Module", () => {
|
||||
beforeEach(() => {
|
||||
process.env.JWT_SECRET = validSecret;
|
||||
jest.clearAllMocks();
|
||||
// Clear any existing rate limit data
|
||||
(TokenManager as any).failedAttempts = new Map();
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
delete process.env.JWT_SECRET;
|
||||
});
|
||||
describe("TokenManager", () => {
|
||||
it("should encrypt and decrypt tokens", () => {
|
||||
const encrypted = TokenManager.encryptToken(validToken, validSecret);
|
||||
expect(encrypted).toBeDefined();
|
||||
expect(typeof encrypted).toBe("string");
|
||||
expect(encrypted === validToken).toBe(false);
|
||||
|
||||
describe("Token Validation", () => {
|
||||
it("should validate a properly formatted token", () => {
|
||||
const decrypted = TokenManager.decryptToken(encrypted, validSecret);
|
||||
expect(decrypted).toBe(validToken);
|
||||
});
|
||||
|
||||
it("should validate tokens correctly", () => {
|
||||
const payload = { userId: "123", role: "user" };
|
||||
const token = jwt.sign(payload, validSecret);
|
||||
const token = jwt.sign(payload, validSecret, { expiresIn: "1h" });
|
||||
expect(token).toBeDefined();
|
||||
|
||||
const result = TokenManager.validateToken(token, testIp);
|
||||
expect(result.valid).toBe(true);
|
||||
expect(result.error).toBeUndefined();
|
||||
});
|
||||
|
||||
it("should reject an invalid token", () => {
|
||||
const result = TokenManager.validateToken("invalid_token", testIp);
|
||||
it("should handle empty tokens", () => {
|
||||
const result = TokenManager.validateToken("", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("Token length below minimum requirement");
|
||||
expect(result.error).toBe("Invalid token format");
|
||||
});
|
||||
|
||||
it("should reject a token that is too short", () => {
|
||||
const result = TokenManager.validateToken("short", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("Token length below minimum requirement");
|
||||
});
|
||||
|
||||
it("should reject an expired token", () => {
|
||||
it("should handle expired tokens", () => {
|
||||
const now = Math.floor(Date.now() / 1000);
|
||||
const payload = {
|
||||
userId: "123",
|
||||
role: "user",
|
||||
iat: now - 7200, // 2 hours ago
|
||||
exp: now - 3600, // expired 1 hour ago
|
||||
iat: now - 3600, // issued 1 hour ago
|
||||
exp: now - 1800 // expired 30 minutes ago
|
||||
};
|
||||
const token = jwt.sign(payload, validSecret);
|
||||
const result = TokenManager.validateToken(token, testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("Token has expired");
|
||||
});
|
||||
|
||||
it("should implement rate limiting for failed attempts", async () => {
|
||||
// Simulate multiple failed attempts
|
||||
for (let i = 0; i < SECURITY_CONFIG.MAX_FAILED_ATTEMPTS; i++) {
|
||||
const result = TokenManager.validateToken("invalid_token", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
}
|
||||
|
||||
// Next attempt should be blocked by rate limiting
|
||||
const result = TokenManager.validateToken("invalid_token", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe(
|
||||
"Too many failed attempts. Please try again later.",
|
||||
);
|
||||
|
||||
// Wait for rate limit to expire
|
||||
await new Promise((resolve) =>
|
||||
setTimeout(resolve, SECURITY_CONFIG.LOCKOUT_DURATION + 100),
|
||||
);
|
||||
|
||||
// Should be able to try again
|
||||
const validPayload = { userId: "123", role: "user" };
|
||||
const validToken = jwt.sign(validPayload, validSecret);
|
||||
const finalResult = TokenManager.validateToken(validToken, testIp);
|
||||
expect(finalResult.valid).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe("Token Generation", () => {
|
||||
it("should generate a valid JWT token", () => {
|
||||
describe("Request Validation", () => {
|
||||
it("should validate requests with valid tokens", () => {
|
||||
const payload = { userId: "123", role: "user" };
|
||||
const token = TokenManager.generateToken(payload);
|
||||
expect(token).toBeDefined();
|
||||
expect(typeof token).toBe("string");
|
||||
|
||||
// Verify the token can be decoded
|
||||
const decoded = jwt.verify(token, validSecret) as any;
|
||||
expect(decoded.userId).toBe(payload.userId);
|
||||
expect(decoded.role).toBe(payload.role);
|
||||
const token = jwt.sign(payload, validSecret, { expiresIn: "1h" });
|
||||
const result = TokenManager.validateToken(token, testIp);
|
||||
expect(result.valid).toBe(true);
|
||||
expect(result.error).toBeUndefined();
|
||||
});
|
||||
|
||||
it("should include required claims in generated tokens", () => {
|
||||
const payload = { userId: "123" };
|
||||
const token = TokenManager.generateToken(payload);
|
||||
const decoded = jwt.verify(token, validSecret) as any;
|
||||
|
||||
expect(decoded.iat).toBeDefined();
|
||||
expect(decoded.exp).toBeDefined();
|
||||
expect(decoded.exp - decoded.iat).toBe(
|
||||
Math.floor(24 * 60 * 60), // 24 hours in seconds
|
||||
);
|
||||
});
|
||||
|
||||
it("should throw error when JWT secret is not configured", () => {
|
||||
delete process.env.JWT_SECRET;
|
||||
const payload = { userId: "123" };
|
||||
expect(() => TokenManager.generateToken(payload)).toThrow(
|
||||
"JWT secret not configured",
|
||||
);
|
||||
it("should reject invalid tokens", () => {
|
||||
const result = TokenManager.validateToken("invalid-token", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("Token length below minimum requirement");
|
||||
});
|
||||
});
|
||||
|
||||
describe("Token Encryption", () => {
|
||||
const encryptionKey = "encryption_key_that_is_at_least_32_chars_long";
|
||||
|
||||
it("should encrypt and decrypt a token successfully", () => {
|
||||
const originalToken = "test_token_to_encrypt";
|
||||
const encrypted = TokenManager.encryptToken(originalToken, encryptionKey);
|
||||
const decrypted = TokenManager.decryptToken(encrypted, encryptionKey);
|
||||
expect(decrypted).toBe(originalToken);
|
||||
describe("Error Handling", () => {
|
||||
it("should handle missing JWT secret", () => {
|
||||
delete process.env.JWT_SECRET;
|
||||
const payload = { userId: "123", role: "user" };
|
||||
const result = TokenManager.validateToken(jwt.sign(payload, "some-secret"), testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("JWT secret not configured");
|
||||
});
|
||||
|
||||
it("should throw error for invalid encryption inputs", () => {
|
||||
expect(() => TokenManager.encryptToken("", encryptionKey)).toThrow(
|
||||
"Invalid token",
|
||||
);
|
||||
expect(() => TokenManager.encryptToken("valid_token", "")).toThrow(
|
||||
"Invalid encryption key",
|
||||
);
|
||||
it("should handle invalid token format", () => {
|
||||
const result = TokenManager.validateToken("not-a-jwt-token", testIp);
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.error).toBe("Token length below minimum requirement");
|
||||
});
|
||||
|
||||
it("should throw error for invalid decryption inputs", () => {
|
||||
expect(() => TokenManager.decryptToken("", encryptionKey)).toThrow(
|
||||
"Invalid encrypted token",
|
||||
);
|
||||
expect(() =>
|
||||
TokenManager.decryptToken("invalid:format", encryptionKey),
|
||||
).toThrow("Invalid encrypted token format");
|
||||
it("should handle encryption errors", () => {
|
||||
expect(() => TokenManager.encryptToken("", validSecret)).toThrow("Invalid token");
|
||||
expect(() => TokenManager.encryptToken(validToken, "short-key")).toThrow("Invalid encryption key");
|
||||
});
|
||||
|
||||
it("should generate different ciphertexts for same plaintext", () => {
|
||||
const token = "test_token";
|
||||
const encrypted1 = TokenManager.encryptToken(token, encryptionKey);
|
||||
const encrypted2 = TokenManager.encryptToken(token, encryptionKey);
|
||||
expect(encrypted1).not.toBe(encrypted2);
|
||||
it("should handle decryption errors", () => {
|
||||
expect(() => TokenManager.decryptToken("invalid:format", validSecret)).toThrow();
|
||||
expect(() => TokenManager.decryptToken("aes-256-gcm:invalid:base64:data", validSecret)).toThrow();
|
||||
});
|
||||
});
|
||||
|
||||
describe("Rate Limiting", () => {
|
||||
it("should implement rate limiting for failed attempts", () => {
|
||||
// Create an invalid token that's long enough to pass length check
|
||||
const invalidToken = "x".repeat(64); // Long enough to pass MIN_TOKEN_LENGTH check
|
||||
|
||||
// First attempt should fail with token validation error and record the attempt
|
||||
const firstResult = TokenManager.validateToken(invalidToken, testIp);
|
||||
expect(firstResult.valid).toBe(false);
|
||||
expect(firstResult.error).toBe("Too many failed attempts. Please try again later.");
|
||||
|
||||
// Verify that even a valid token is blocked during rate limiting
|
||||
const validPayload = { userId: "123", role: "user" };
|
||||
const validToken = jwt.sign(validPayload, validSecret, { expiresIn: "1h" });
|
||||
const validResult = TokenManager.validateToken(validToken, testIp);
|
||||
expect(validResult.valid).toBe(false);
|
||||
expect(validResult.error).toBe("Too many failed attempts. Please try again later.");
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,47 +1,191 @@
|
||||
import crypto from "crypto";
|
||||
import { Request, Response, NextFunction } from "express";
|
||||
import rateLimit from "express-rate-limit";
|
||||
import helmet from "helmet";
|
||||
import { HelmetOptions } from "helmet";
|
||||
import jwt from "jsonwebtoken";
|
||||
import { Elysia, type Context } from "elysia";
|
||||
|
||||
// Security configuration
|
||||
const RATE_LIMIT_WINDOW = 15 * 60 * 1000; // 15 minutes
|
||||
const RATE_LIMIT_MAX = 100; // requests per window
|
||||
const TOKEN_EXPIRY = 24 * 60 * 60 * 1000; // 24 hours
|
||||
|
||||
// Rate limiting middleware
|
||||
export const rateLimiter = rateLimit({
|
||||
windowMs: RATE_LIMIT_WINDOW,
|
||||
max: RATE_LIMIT_MAX,
|
||||
message: "Too many requests from this IP, please try again later",
|
||||
// Rate limiting state
|
||||
const rateLimitStore = new Map<string, { count: number; resetTime: number }>();
|
||||
|
||||
interface RequestContext {
|
||||
request: Request;
|
||||
set: Context['set'];
|
||||
}
|
||||
|
||||
// Extracted rate limiting logic
|
||||
export function checkRateLimit(ip: string, maxRequests: number = RATE_LIMIT_MAX, windowMs: number = RATE_LIMIT_WINDOW) {
|
||||
const now = Date.now();
|
||||
|
||||
const record = rateLimitStore.get(ip) || {
|
||||
count: 0,
|
||||
resetTime: now + windowMs,
|
||||
};
|
||||
|
||||
if (now > record.resetTime) {
|
||||
record.count = 0;
|
||||
record.resetTime = now + windowMs;
|
||||
}
|
||||
|
||||
record.count++;
|
||||
rateLimitStore.set(ip, record);
|
||||
|
||||
if (record.count > maxRequests) {
|
||||
throw new Error("Too many requests from this IP, please try again later");
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
// Rate limiting middleware for Elysia
|
||||
export const rateLimiter = new Elysia().derive(({ request }: RequestContext) => {
|
||||
const ip = request.headers.get("x-forwarded-for") || "unknown";
|
||||
checkRateLimit(ip);
|
||||
});
|
||||
|
||||
// Security configuration
|
||||
const helmetConfig: HelmetOptions = {
|
||||
contentSecurityPolicy: {
|
||||
useDefaults: true,
|
||||
directives: {
|
||||
defaultSrc: ["'self'"],
|
||||
scriptSrc: ["'self'", "'unsafe-inline'"],
|
||||
styleSrc: ["'self'", "'unsafe-inline'"],
|
||||
imgSrc: ["'self'", "data:", "https:"],
|
||||
connectSrc: ["'self'", "wss:", "https:"],
|
||||
// Extracted security headers logic
|
||||
export function applySecurityHeaders(request: Request, helmetConfig?: HelmetOptions) {
|
||||
const config: HelmetOptions = helmetConfig || {
|
||||
contentSecurityPolicy: {
|
||||
useDefaults: true,
|
||||
directives: {
|
||||
defaultSrc: ["'self'"],
|
||||
scriptSrc: ["'self'", "'unsafe-inline'"],
|
||||
styleSrc: ["'self'", "'unsafe-inline'"],
|
||||
imgSrc: ["'self'", "data:", "https:"],
|
||||
connectSrc: ["'self'", "wss:", "https:"],
|
||||
},
|
||||
},
|
||||
},
|
||||
dnsPrefetchControl: true,
|
||||
frameguard: true,
|
||||
hidePoweredBy: true,
|
||||
hsts: true,
|
||||
ieNoOpen: true,
|
||||
noSniff: true,
|
||||
referrerPolicy: {
|
||||
policy: ["no-referrer", "strict-origin-when-cross-origin"],
|
||||
},
|
||||
};
|
||||
dnsPrefetchControl: true,
|
||||
frameguard: true,
|
||||
hidePoweredBy: true,
|
||||
hsts: true,
|
||||
ieNoOpen: true,
|
||||
noSniff: true,
|
||||
referrerPolicy: {
|
||||
policy: ["no-referrer", "strict-origin-when-cross-origin"],
|
||||
},
|
||||
};
|
||||
|
||||
// Security headers middleware
|
||||
export const securityHeaders = helmet(helmetConfig);
|
||||
const headers = helmet(config);
|
||||
|
||||
// Apply helmet headers to the request
|
||||
Object.entries(headers).forEach(([key, value]) => {
|
||||
if (typeof value === 'string') {
|
||||
request.headers.set(key, value);
|
||||
}
|
||||
});
|
||||
|
||||
return headers;
|
||||
}
|
||||
|
||||
// Security headers middleware for Elysia
|
||||
export const securityHeaders = new Elysia().derive(({ request }: RequestContext) => {
|
||||
applySecurityHeaders(request);
|
||||
});
|
||||
|
||||
// Extracted request validation logic
|
||||
export function validateRequestHeaders(request: Request, requiredContentType = 'application/json') {
|
||||
// Validate content type for POST/PUT/PATCH requests
|
||||
if (["POST", "PUT", "PATCH"].includes(request.method)) {
|
||||
const contentType = request.headers.get("content-type");
|
||||
if (!contentType?.includes(requiredContentType)) {
|
||||
throw new Error(`Content-Type must be ${requiredContentType}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Validate request size
|
||||
const contentLength = request.headers.get("content-length");
|
||||
if (contentLength && parseInt(contentLength) > 1024 * 1024) {
|
||||
throw new Error("Request body too large");
|
||||
}
|
||||
|
||||
// Validate authorization header if required
|
||||
const authHeader = request.headers.get("authorization");
|
||||
if (authHeader) {
|
||||
const [type, token] = authHeader.split(" ");
|
||||
if (type !== "Bearer" || !token) {
|
||||
throw new Error("Invalid authorization header");
|
||||
}
|
||||
|
||||
const ip = request.headers.get("x-forwarded-for");
|
||||
const validation = TokenManager.validateToken(token, ip || undefined);
|
||||
if (!validation.valid) {
|
||||
throw new Error(validation.error || "Invalid token");
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
// Request validation middleware for Elysia
|
||||
export const validateRequest = new Elysia().derive(({ request }: RequestContext) => {
|
||||
validateRequestHeaders(request);
|
||||
});
|
||||
|
||||
// Extracted input sanitization logic
|
||||
export function sanitizeValue(value: unknown): unknown {
|
||||
if (typeof value === "string") {
|
||||
// Basic XSS protection
|
||||
return value
|
||||
.replace(/</g, "<")
|
||||
.replace(/>/g, ">")
|
||||
.replace(/"/g, """)
|
||||
.replace(/'/g, "'")
|
||||
.replace(/\//g, "/");
|
||||
}
|
||||
|
||||
if (Array.isArray(value)) {
|
||||
return value.map(sanitizeValue);
|
||||
}
|
||||
|
||||
if (typeof value === "object" && value !== null) {
|
||||
return Object.fromEntries(
|
||||
Object.entries(value).map(([k, v]) => [k, sanitizeValue(v)])
|
||||
);
|
||||
}
|
||||
|
||||
return value;
|
||||
}
|
||||
|
||||
// Input sanitization middleware for Elysia
|
||||
export const sanitizeInput = new Elysia().derive(async ({ request }: RequestContext) => {
|
||||
if (["POST", "PUT", "PATCH"].includes(request.method)) {
|
||||
const body = await request.json();
|
||||
request.json = () => Promise.resolve(sanitizeValue(body));
|
||||
}
|
||||
});
|
||||
|
||||
// Extracted error handling logic
|
||||
export function handleError(error: Error, env: string = process.env.NODE_ENV || 'production') {
|
||||
console.error("Error:", error);
|
||||
|
||||
const baseResponse = {
|
||||
error: true,
|
||||
message: "Internal server error",
|
||||
timestamp: new Date().toISOString(),
|
||||
};
|
||||
|
||||
if (env === 'development') {
|
||||
return {
|
||||
...baseResponse,
|
||||
error: error.message,
|
||||
stack: error.stack,
|
||||
};
|
||||
}
|
||||
|
||||
return baseResponse;
|
||||
}
|
||||
|
||||
// Error handling middleware for Elysia
|
||||
export const errorHandler = new Elysia().onError(({ error, set }: { error: Error; set: Context['set'] }) => {
|
||||
set.status = error instanceof jwt.JsonWebTokenError ? 401 : 500;
|
||||
return handleError(error);
|
||||
});
|
||||
|
||||
const ALGORITHM = "aes-256-gcm";
|
||||
const IV_LENGTH = 16;
|
||||
@@ -275,137 +419,3 @@ export class TokenManager {
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Request validation middleware
|
||||
export function validateRequest(
|
||||
req: Request,
|
||||
res: Response,
|
||||
next: NextFunction,
|
||||
): Response | void {
|
||||
// Skip validation for health and MCP schema endpoints
|
||||
if (req.path === "/health" || req.path === "/mcp") {
|
||||
return next();
|
||||
}
|
||||
|
||||
// Validate content type for non-GET requests
|
||||
if (["POST", "PUT", "PATCH"].includes(req.method)) {
|
||||
const contentType = req.headers["content-type"] || "";
|
||||
if (!contentType.toLowerCase().includes("application/json")) {
|
||||
return res.status(415).json({
|
||||
success: false,
|
||||
message: "Unsupported Media Type",
|
||||
error: "Content-Type must be application/json",
|
||||
timestamp: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Validate authorization header
|
||||
const authHeader = req.headers.authorization;
|
||||
if (!authHeader || !authHeader.startsWith("Bearer ")) {
|
||||
return res.status(401).json({
|
||||
success: false,
|
||||
message: "Unauthorized",
|
||||
error: "Missing or invalid authorization header",
|
||||
timestamp: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
// Validate token
|
||||
const token = authHeader.replace("Bearer ", "");
|
||||
const validationResult = TokenManager.validateToken(token, req.ip);
|
||||
if (!validationResult.valid) {
|
||||
return res.status(401).json({
|
||||
success: false,
|
||||
message: "Unauthorized",
|
||||
error: validationResult.error || "Invalid token",
|
||||
timestamp: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
// Validate request body for non-GET requests
|
||||
if (["POST", "PUT", "PATCH"].includes(req.method)) {
|
||||
if (!req.body || typeof req.body !== "object" || Array.isArray(req.body)) {
|
||||
return res.status(400).json({
|
||||
success: false,
|
||||
message: "Bad Request",
|
||||
error: "Invalid request body structure",
|
||||
timestamp: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
// Check request body size
|
||||
const contentLength = parseInt(req.headers["content-length"] || "0", 10);
|
||||
const maxSize = 1024 * 1024; // 1MB limit
|
||||
if (contentLength > maxSize) {
|
||||
return res.status(413).json({
|
||||
success: false,
|
||||
message: "Payload Too Large",
|
||||
error: `Request body must not exceed ${maxSize} bytes`,
|
||||
timestamp: new Date().toISOString(),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
next();
|
||||
}
|
||||
|
||||
// Input sanitization middleware
|
||||
export function sanitizeInput(req: Request, res: Response, next: NextFunction) {
|
||||
if (!req.body) {
|
||||
return next();
|
||||
}
|
||||
|
||||
function sanitizeValue(value: unknown): unknown {
|
||||
if (typeof value === "string") {
|
||||
// Remove HTML tags and scripts more thoroughly
|
||||
return value
|
||||
.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "") // Remove script tags and content
|
||||
.replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style>/gi, "") // Remove style tags and content
|
||||
.replace(/<[^>]+>/g, "") // Remove remaining HTML tags
|
||||
.replace(/javascript:/gi, "") // Remove javascript: protocol
|
||||
.replace(/on\w+\s*=\s*(?:".*?"|'.*?'|[^"'>\s]+)/gi, "") // Remove event handlers
|
||||
.trim();
|
||||
}
|
||||
if (Array.isArray(value)) {
|
||||
return value.map((item) => sanitizeValue(item));
|
||||
}
|
||||
if (typeof value === "object" && value !== null) {
|
||||
const sanitized: Record<string, unknown> = {};
|
||||
for (const [key, val] of Object.entries(value)) {
|
||||
sanitized[key] = sanitizeValue(val);
|
||||
}
|
||||
return sanitized;
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
req.body = sanitizeValue(req.body);
|
||||
next();
|
||||
}
|
||||
|
||||
// Error handling middleware
|
||||
export function errorHandler(
|
||||
err: Error,
|
||||
req: Request,
|
||||
res: Response,
|
||||
next: NextFunction,
|
||||
) {
|
||||
console.error(err.stack);
|
||||
res.status(500).json({
|
||||
error: "Internal Server Error",
|
||||
message: process.env.NODE_ENV === "development" ? err.message : undefined,
|
||||
});
|
||||
}
|
||||
|
||||
// Export security middleware chain
|
||||
export const securityMiddleware = [
|
||||
helmet(helmetConfig),
|
||||
rateLimit({
|
||||
windowMs: 15 * 60 * 1000,
|
||||
max: 100,
|
||||
}),
|
||||
validateRequest,
|
||||
sanitizeInput,
|
||||
errorHandler,
|
||||
];
|
||||
|
||||
Reference in New Issue
Block a user