Security in System Design

import jwt from 'jsonwebtoken';
import { Request, Response, NextFunction } from 'express';

const ACCESS_TOKEN_SECRET = process.env.JWT_SECRET!;
const REFRESH_TOKEN_SECRET = process.env.JWT_REFRESH_SECRET!;

// ─────────────────────────────────────────────
// JWT Token Generate করুন
// ─────────────────────────────────────────────
export function generateTokens(userId: string, role: string) {
    // Access token — short-lived (15 minutes)
    const accessToken = jwt.sign(
        { sub: userId, role, type: 'access' },
        ACCESS_TOKEN_SECRET,
        { expiresIn: '15m', algorithm: 'RS256' }
    );

    // Refresh token — long-lived (7 days), stored in DB
    const refreshToken = jwt.sign(
        { sub: userId, type: 'refresh' },
        REFRESH_TOKEN_SECRET,
        { expiresIn: '7d', algorithm: 'RS256' }
    );

    return { accessToken, refreshToken };
}

// ─────────────────────────────────────────────
// JWT Middleware — Request verify করুন
// ─────────────────────────────────────────────
export function authenticate(req: Request, res: Response, next: NextFunction) {
    // Authorization: Bearer <token>
    const authHeader = req.headers.authorization;
    if (!authHeader?.startsWith('Bearer ')) {
        return res.status(401).json({ error: 'No token provided' });
    }

    const token = authHeader.split(' ')[1];

    try {
        const payload = jwt.verify(token, ACCESS_TOKEN_SECRET) as {
            sub: string;
            role: string;
            exp: number;
        };

        // Attach user info to request
        (req as any).user = { id: payload.sub, role: payload.role };
        next();
    } catch (err) {
        if (err instanceof jwt.TokenExpiredError) {
            return res.status(401).json({ error: 'Token expired' });
        }
        return res.status(401).json({ error: 'Invalid token' });
    }
}

// ─────────────────────────────────────────────
// Python equivalent (FastAPI)
// ─────────────────────────────────────────────
/*
from jose import JWTError, jwt
from datetime import datetime, timedelta

SECRET_KEY = os.getenv("JWT_SECRET")
ALGORITHM = "RS256"

def create_access_token(user_id: str, role: str) -> str:
    payload = {
        "sub": user_id,
        "role": role,
        "exp": datetime.utcnow() + timedelta(minutes=15),
        "iat": datetime.utcnow(),
    }
    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

def verify_token(token: str) -> dict:
    try:
        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
    except JWTError:
        raise HTTPException(status_code=401, detail="Invalid token")
*/

import { Request, Response, NextFunction } from 'express';

// ─────────────────────────────────────────────
// RBAC — Role-Based Authorization Middleware
// ─────────────────────────────────────────────
export function requireRole(...roles: string[]) {
    return (req: Request, res: Response, next: NextFunction) => {
        const user = (req as any).user;

        if (!user) {
            return res.status(401).json({ error: 'Unauthenticated' });
        }

        if (!roles.includes(user.role)) {
            return res.status(403).json({
                error: 'Forbidden',
                required: roles,
                current: user.role,
            });
        }

        next();
    };
}

// Usage:
// app.delete('/posts/:id', authenticate, requireRole('admin', 'moderator'), deletePost);
// app.get('/reports', authenticate, requireRole('admin'), getReports);

// ─────────────────────────────────────────────
// ABAC — Attribute-Based Authorization
// ─────────────────────────────────────────────
interface Policy {
    action: string;
    condition: (user: any, resource: any, env: any) => boolean;
}

const policies: Policy[] = [
    {
        action: 'document:read',
        condition: (user, resource, env) =>
            // User নিজের department-এর document read করতে পারবেন
            // অথবা admin সবসময় পারবেন
            user.department === resource.department || user.role === 'admin',
    },
    {
        action: 'document:write',
        condition: (user, resource, env) =>
            // শুধু working hours-এ এবং নিজের document
            user.id === resource.ownerId &&
            env.hour >= 9 &&
            env.hour <= 18,
    },
    {
        action: 'report:export',
        condition: (user, resource, env) =>
            // Finance dept + senior level + weekday only
            user.department === 'finance' &&
            user.level >= 3 &&
            env.dayOfWeek >= 1 && env.dayOfWeek <= 5,
    },
];

export function checkPolicy(action: string, resource: any) {
    return (req: Request, res: Response, next: NextFunction) => {
        const user = (req as any).user;
        const env = {
            hour: new Date().getHours(),
            dayOfWeek: new Date().getDay(),
            ip: req.ip,
        };

        const policy = policies.find(p => p.action === action);
        if (!policy || !policy.condition(user, resource, env)) {
            return res.status(403).json({ error: 'Policy denied' });
        }
        next();
    };
}

import axios from 'axios';
import { Pool } from 'pg';

const VAULT_ADDR = process.env.VAULT_ADDR!;
const VAULT_TOKEN = process.env.VAULT_TOKEN!; // Service token (short-lived)

// ─────────────────────────────────────────────
// HashiCorp Vault — Dynamic Database Credentials
// ─────────────────────────────────────────────
interface VaultDBCreds {
    username: string;
    password: string;
    lease_duration: number; // seconds
    lease_id: string;
}

async function getDynamicDBCredentials(): Promise<VaultDBCreds> {
    // Vault generates temporary DB credentials on demand
    const response = await axios.get(
        `${VAULT_ADDR}/v1/database/creds/my-role`,
        { headers: { 'X-Vault-Token': VAULT_TOKEN } }
    );

    return {
        username: response.data.data.username,   // e.g., "v-service-xYz123"
        password: response.data.data.password,
        lease_duration: response.data.lease_duration, // e.g., 3600 (1 hour)
        lease_id: response.data.lease_id,
    };
}

// ─────────────────────────────────────────────
// Auto-Rotating DB Connection Pool
// ─────────────────────────────────────────────
class ManagedDBPool {
    private pool: Pool | null = null;
    private leaseExpiry: number = 0;
    private leaseId: string = '';

    async getPool(): Promise<Pool> {
        const now = Math.floor(Date.now() / 1000);

        // Renew credentials 5 minutes before expiry
        if (!this.pool || now >= this.leaseExpiry - 300) {
            await this.rotateCredentials();
        }

        return this.pool!;
    }

    private async rotateCredentials() {
        console.log('[Vault] Fetching new DB credentials...');

        // Revoke old lease first
        if (this.leaseId) {
            await axios.put(
                `${VAULT_ADDR}/v1/sys/leases/revoke`,
                { lease_id: this.leaseId },
                { headers: { 'X-Vault-Token': VAULT_TOKEN } }
            );
        }

        const creds = await getDynamicDBCredentials();
        this.leaseId = creds.lease_id;
        this.leaseExpiry = Math.floor(Date.now() / 1000) + creds.lease_duration;

        // Destroy old pool gracefully
        if (this.pool) {
            await this.pool.end();
        }

        this.pool = new Pool({
            host: process.env.DB_HOST,
            database: process.env.DB_NAME,
            user: creds.username,    // Vault-generated temp user
            password: creds.password, // Vault-generated temp password
            port: 5432,
            ssl: { rejectUnauthorized: true },
        });

        console.log(`[Vault] DB creds rotated. Expires in ${creds.lease_duration}s`);
    }
}

// ─────────────────────────────────────────────
// AWS Secrets Manager Alternative
// ─────────────────────────────────────────────
import {
    SecretsManagerClient,
    GetSecretValueCommand,
} from '@aws-sdk/client-secrets-manager';

const secretsClient = new SecretsManagerClient({ region: 'ap-southeast-1' });

async function getSecret(secretName: string): Promise<Record<string, string>> {
    const cmd = new GetSecretValueCommand({ SecretId: secretName });
    const response = await secretsClient.send(cmd);

    if (!response.SecretString) throw new Error('Secret not found');
    return JSON.parse(response.SecretString);
}

// Usage:
// const dbCreds = await getSecret('prod/myapp/db');
// const { username, password, host } = dbCreds;