Middleware

# Global middleware — applied to every request in order
1. securityHeaders()
2. correlationId()
3. cors()
4. express.json({ limit: "1mb" })
5. csrfProtection()
6. requestLogger()

# Agent-scoped middleware — added on agent routes after global middleware
7. jwtAuth()
8. tokenBudget()
9. workspaceResolver()
10. rateLimiter({ window: 60s, max: 30 })
11. userRateLimit()
12. requestTimeout(120_000)

# Error handler — always last
errorHandler()

// gateway/middleware/security-headers.ts
export function securityHeaders() {
  return (req, res, next) => {
    res.removeHeader("X-Powered-By");
    res.setHeader("X-Content-Type-Options", "nosniff");
    res.setHeader("X-Frame-Options", "DENY");
    res.setHeader("Strict-Transport-Security",
      "max-age=63072000; includeSubDomains; preload");
    res.setHeader("Content-Security-Policy",
      "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'");
    res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
    res.setHeader("Permissions-Policy",
      "camera=(), microphone=(), geolocation=()");
    next();
  };
}

// gateway/middleware/correlation-id.ts
import { randomUUID } from "crypto";

export function correlationId() {
  return (req, res, next) => {
    const id = req.headers["x-request-id"] || randomUUID();
    req.requestId = id;
    res.setHeader("X-Request-ID", id);
    next();
  };
}

// gateway/middleware/cors.ts
export function cors() {
  const allowed = process.env.ALLOWED_ORIGINS?.split(",").map(s => s.trim()) || [];
  const isDev = "production" !== "production";

  return (req, res, next) => {
    const origin = req.headers.origin;
    if (isDev || allowed.includes(origin)) {
      res.setHeader("Access-Control-Allow-Origin", origin);
      res.setHeader("Access-Control-Allow-Credentials", "true");
      res.setHeader("Access-Control-Allow-Methods",
        "GET, POST, PUT, PATCH, DELETE, OPTIONS");
      res.setHeader("Access-Control-Allow-Headers",
        "Content-Type, Authorization, X-Request-ID, X-Workspace-Id, X-CSRF-Token");
    }
    if (req.method === "OPTIONS") return res.sendStatus(204);
    next();
  };
}

// Inline in gateway/index.ts
app.use(express.json({
  limit: "1mb",
  verify: (req, _res, buf) => {
    // Capture raw body for HMAC verification by channel webhooks
    req.rawBody = buf;
  }
}));

// gateway/middleware/csrf.ts
export function csrfProtection() {
  return (req, res, next) => {
    // Safe methods are exempt
    if (["GET", "HEAD", "OPTIONS"].includes(req.method)) return next();

    // Bearer token holders are exempt — the token itself is proof of intent
    const auth = req.headers.authorization;
    if (auth?.startsWith("Bearer ")) return next();

    // Double-submit cookie: csrf_token cookie must match x-csrf-token header
    const cookie = req.cookies?.csrf_token;
    const header = req.headers["x-csrf-token"];
    if (!cookie || !header || cookie !== header) {
      return res.status(403).json({
        error: "CSRF validation failed",
        code: "CSRF_INVALID",
        status: 403
      });
    }
    next();
  };
}

// gateway/middleware/request-logger.ts
export function requestLogger() {
  return (req, res, next) => {
    const start = Date.now();
    res.on("finish", () => {
      const duration = Date.now() - start;
      console.log(JSON.stringify({
        method: req.method,
        path: req.originalUrl,
        status: res.statusCode,
        duration,
        uid: req.uid || null,
        requestId: req.requestId
      }));
    });
    next();
  };
}

// gateway/middleware/jwt-auth.ts
import jwt from "jsonwebtoken";

export function jwtAuth() {
  return (req, res, next) => {
    const token = req.headers.authorization?.replace("Bearer ", "");
    if (!token) return res.status(401).json({
      error: "Missing authentication token",
      code: "AUTH_REQUIRED", status: 401
    });

    // Try current secret first, then previous secret for key rotation
    try {
      const payload = jwt.verify(token, process.env.JWT_SECRET, {
        algorithms: ["HS256"]
      });
      req.uid = payload.uid;
      next();
    } catch {
      if (process.env.JWT_SECRET_PREV) {
        try {
          const payload = jwt.verify(token, process.env.JWT_SECRET_PREV, {
            algorithms: ["HS256"]
          });
          req.uid = payload.uid;
          return next();
        } catch { /* fall through */ }
      }
      return res.status(401).json({
        error: "Invalid or expired token",
        code: "AUTH_INVALID", status: 401
      });
    }
  };
}

// gateway/middleware/token-budget.ts
export function tokenBudget() {
  return async (req, res, next) => {
    const usage = await getUserBudgetUsage(req.uid);
    const limits = await getUserBudgetLimits(req.uid);

    // Hard cap — block the request entirely
    if (usage.tokens >= limits.hardCap) {
      return res.status(429).json({
        error: "Token budget exhausted",
        code: "BUDGET_HARD_CAP",
        status: 429,
        details: { used: usage.tokens, limit: limits.hardCap }
      });
    }

    // Soft cap — allow but downgrade model
    if (usage.tokens >= limits.softCap) {
      req.budgetDegraded = true;
      req.overrideModel = limits.fallbackModel; // e.g. "gpt-4o-mini"
    }

    next();
  };
}

// gateway/middleware/workspace-resolver.ts
export function workspaceResolver() {
  return async (req, res, next) => {
    const workspaceId = req.headers["x-workspace-id"];
    if (!workspaceId) return res.status(400).json({
      error: "Missing X-Workspace-Id header",
      code: "WORKSPACE_REQUIRED", status: 400
    });

    const membership = await getWorkspaceMembership(req.uid, workspaceId);
    if (!membership) return res.status(403).json({
      error: "Not a member of this workspace",
      code: "WORKSPACE_FORBIDDEN", status: 403
    });

    req.workspace = {
      id: workspaceId,
      role: membership.role,
      name: membership.workspaceName
    };
    next();
  };
}

// gateway/middleware/rate-limiter.ts
// Postgres-backed sliding window — survives restarts, works across replicas
export function rateLimiter({ window = 60, max = 30 } = {}) {
  return async (req, res, next) => {
    const key = req.uid || req.ip;
    const now = Date.now();
    const windowStart = now - window * 1000;

    try {
      // Atomic: delete expired + count remaining + insert new entry
      const count = await db.query(`
        WITH cleaned AS (
          DELETE FROM rate_limit_entries
          WHERE key = $1 AND timestamp < $2
        ),
        current AS (
          SELECT COUNT(*) AS cnt FROM rate_limit_entries
          WHERE key = $1 AND timestamp >= $2
        ),
        inserted AS (
          INSERT INTO rate_limit_entries (key, timestamp)
          SELECT $1, $3 WHERE (SELECT cnt FROM current) < $4
          RETURNING 1
        )
        SELECT (SELECT cnt FROM current) AS count
      `, [key, windowStart, now, max]);

      const used = parseInt(count.rows[0].count);
      res.setHeader("X-RateLimit-Limit", max);
      res.setHeader("X-RateLimit-Remaining", Math.max(0, max - used - 1));

      if (used >= max) {
        return res.status(429).json({
          error: "Rate limit exceeded",
          code: "RATE_LIMIT", status: 429,
          details: { retryAfter: window, limit: max, window: window + "s" }
        });
      }
      next();
    } catch {
      // Postgres unreachable — fall back to in-memory sliding window
      inMemoryRateLimiter(key, window, max, req, res, next);
    }
  };
}

// gateway/middleware/user-rate-limit.ts
// In-memory per-uid sliding window — fast path for per-user throttling
const windows = new Map<string, number[]>();

export function userRateLimit() {
  const rpm = parseInt(process.env.USER_RATE_LIMIT_RPM || "60");
  const burst = parseInt(process.env.USER_RATE_LIMIT_BURST || "10");
  const maxPerMinute = rpm + burst;

  return (req, res, next) => {
    const uid = req.uid;
    const now = Date.now();
    const cutoff = now - 60_000;

    let timestamps = windows.get(uid) || [];
    timestamps = timestamps.filter(t => t > cutoff);
    timestamps.push(now);
    windows.set(uid, timestamps);

    if (timestamps.length > maxPerMinute) {
      return res.status(429).json({
        error: "Per-user rate limit exceeded",
        code: "USER_RATE_LIMIT", status: 429,
        details: { rpm, burst, used: timestamps.length }
      });
    }
    next();
  };
}

// gateway/middleware/request-timeout.ts
export function requestTimeout(ms = 120_000) {
  return (req, res, next) => {
    const timer = setTimeout(() => {
      if (res.headersSent) {
        // SSE stream already started — close gracefully
        res.end();
      } else {
        res.status(504).json({
          error: "Request timeout",
          code: "TIMEOUT", status: 504,
          details: { timeoutMs: ms }
        });
      }
    }, ms);

    res.on("finish", () => clearTimeout(timer));
    res.on("close", () => clearTimeout(timer));
    next();
  };
}

// gateway/middleware/granular-rate-limiter.ts
// Checks per-second, per-minute, and per-hour windows simultaneously
granularRateLimiter({
  perSecond: 5,   // burst protection
  perMinute: 60,  // sustained rate
  perHour: 1000   // hourly cap
})

// gateway/middleware/require-role.ts
// RBAC hierarchy: owner > editor > tool_runner > viewer
const ROLE_RANK = { owner: 4, editor: 3, tool_runner: 2, viewer: 1 };

export function requireRole(minimum: keyof typeof ROLE_RANK) {
  return (req, res, next) => {
    const userRank = ROLE_RANK[req.workspace?.role];
    if (!userRank || userRank < ROLE_RANK[minimum]) {
      return res.status(403).json({
        error: "Insufficient permissions",
        code: "FORBIDDEN", status: 403,
        details: { required: minimum, current: req.workspace?.role }
      });
    }
    next();
  };
}

// gateway/middleware/etag-cache.ts
// Intercepts res.json(), computes weak ETag, returns 304 on match
export function etagCache() {
  return (req, res, next) => {
    const originalJson = res.json.bind(res);
    res.json = (body) => {
      const serialized = JSON.stringify(body);
      const hash = createHash("md5").update(serialized).digest("hex");
      const etag = `W/"${hash}"`;

      res.setHeader("ETag", etag);
      res.setHeader("Cache-Control", "private, must-revalidate");

      if (req.headers["if-none-match"] === etag) {
        return res.status(304).end();
      }
      return originalJson(body);
    };
    next();
  };
}

// gateway/middleware/hmac-verify.ts
import { timingSafeEqual, createHmac } from "crypto";

export function hmacVerify({
  secret,
  header,              // e.g. "x-hub-signature-256"
  algorithm = "sha256", // sha256 | sha1
  encoding = "hex",     // hex | base64
  prefix = ""           // e.g. "sha256=" for signed webhook signatures
}) {
  return (req, res, next) => {
    const signature = req.headers[header];
    if (!signature) return res.status(401).json({
      error: "Missing webhook signature", code: "HMAC_MISSING", status: 401
    });

    const expected = prefix + createHmac(algorithm, secret)
      .update(req.rawBody)
      .digest(encoding);

    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      return res.status(401).json({
        error: "Invalid webhook signature", code: "HMAC_INVALID", status: 401
      });
    }
    next();
  };
}

// gateway/middleware/error-handler.ts
export function errorHandler() {
  return (err, req, res, _next) => {
    if (err instanceof AppError) {
      return res.status(err.status).json({
        error: err.message,
        code: err.code,
        status: err.status,
        ...(err.details && { details: err.details })
      });
    }

    // Unknown errors become generic 500s — never leak internals
    console.error("Unhandled error:", err);
    return res.status(500).json({
      error: "Internal server error",
      code: "INTERNAL_ERROR",
      status: 500
    });
  };
}

// gateway/index.ts — how the stack is assembled
import { securityHeaders } from "./middleware/security-headers";
import { correlationId } from "./middleware/correlation-id";
import { cors } from "./middleware/cors";
import { csrfProtection } from "./middleware/csrf";
import { requestLogger } from "./middleware/request-logger";
import { jwtAuth } from "./middleware/jwt-auth";
import { tokenBudget } from "./middleware/token-budget";
import { workspaceResolver } from "./middleware/workspace-resolver";
import { rateLimiter } from "./middleware/rate-limiter";
import { userRateLimit } from "./middleware/user-rate-limit";
import { requestTimeout } from "./middleware/request-timeout";
import { errorHandler } from "./middleware/error-handler";

// ── Global middleware (every request) ────────────────────────
app.use(securityHeaders());
app.use(correlationId());
app.use(cors());
app.use(express.json({ limit: "1mb", verify: (req, _, buf) => { req.rawBody = buf; } }));
app.use(csrfProtection());
app.use(requestLogger());

// ── Route groups ─────────────────────────────────────────────
app.use("/auth", authRoutes);                 // public — no JWT
app.use("/health", healthRoutes);             // public — no JWT
app.use("/webhooks/channels", channelRoutes); // HMAC-verified per channel

// ── Agent-scoped middleware ──────────────────────────────────
const agentStack = [
  jwtAuth(),
  tokenBudget(),
  workspaceResolver(),
  rateLimiter({ window: 60, max: 30 }),
  userRateLimit(),
  requestTimeout(120_000)
];

app.use("/agent", agentStack, agentRoutes);
app.use("/agents", [jwtAuth(), workspaceResolver()], agentCrudRoutes);
app.use("/sessions", [jwtAuth()], sessionRoutes);
// ...remaining route groups

// ── Error handler (always last) ──────────────────────────────
app.use(errorHandler());