@iota-big3/sdk-security/dist/middleware.js

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

"use strict";
/**
 * @iota-big3/sdk-security - Express Middleware
 * Security middleware for Express applications
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.securityMiddleware = securityMiddleware;
function securityMiddleware(securityManager) {
    return async (req, res, next) => {
        try {
            // Check if user is authenticated
            if (!req.user) {
                res.status(401).json({ error: 'Authentication required' });
                return;
            }
            // Map HTTP method to action
            const actionMap = {
                GET: 'read',
                POST: 'write',
                PUT: 'write',
                PATCH: 'write',
                DELETE: 'delete'
            };
            const action = actionMap[req.method] || 'read';
            // Check access
            const decision = await securityManager.checkAccess({
                subject: req.user,
                resource: req.path,
                action,
                context: {
                    ip: req.ip,
                    method: req.method
                }
            });
            if (!decision.allowed) {
                // Record security event
                securityManager.recordEvent('AUTHORIZATION_FAILURE', 'MEDIUM', {
                    user: req.user,
                    resource: req.path,
                    action,
                    reason: decision.reason
                });
                res.status(403).json({
                    error: 'Access denied',
                    reason: decision.reason
                });
                return;
            }
            // Access granted, continue
            next();
        }
        catch (error) {
            // Log error and return 500
            securityManager.recordEvent('POLICY_VIOLATION', 'HIGH', {
                error: error.message,
                user: req.user,
                resource: req.path
            });
            res.status(500).json({
                error: 'Internal security error'
            });
        }
    };
}
//# sourceMappingURL=middleware.js.map