Module 7: Enterprise Custom Gateway & Capstone Project (MockServer Enterprise Security & Management Portal)

const express = require('express');
const axios = require('axios');
const fs = require('fs');
const app = express();
app.use(express.json());

const MOCKSERVER_URL = process.env.MOCKSERVER_URL || 'http://localhost:1080';

// 1. RBAC Guard Middleware
function checkRBAC(req, res, next) {
    const userRole = req.headers['x-user-role'] || 'READ_ONLY';
    const isWriteMethod = ['POST', 'PUT', 'DELETE'].includes(req.method);

    if (isWriteMethod && userRole === 'READ_ONLY') {
        return res.status(403).json({
            error: 'Forbidden',
            message: 'คุณอยู่ในสิทธิ์ Read-Only ไม่สามารถเพิ่มหรือแก้ไข Mocks ได้'
        });
    }
    next();
}

// 2. Data Masking Function
function maskSensitiveData(data) {
    let jsonStr = JSON.stringify(data);
    // Mask Bearer Tokens
    jsonStr = jsonStr.replace(/Bearer\s+[A-Za-z0-9\-\._~\+\/]+=*/g, 'Bearer ***MASKED***');
    // Mask Credit Card Numbers (16 digits)
    jsonStr = jsonStr.replace(/\b(?:\d[ -]*?){13,16}\b/g, '****-****-****-****');
    return JSON.parse(jsonStr);
}

// 3. Proxy Handler with Audit Trail & Silent Backup
app.put('/mockserver/expectation', checkRBAC, async (req, res) => {
    try {
        const maskedBody = maskSensitiveData(req.body);

        // Forward request to MockServer Engine
        const response = await axios.put(`${MOCKSERVER_URL}/mockserver/expectation`, req.body);

        // Record Audit Log
        const auditLog = {
            timestamp: new Date().toISOString(),
            user: req.headers['x-user-name'] || 'Unknown',
            env: req.headers['x-env'] || 'QA',
            action: 'CREATE_OR_UPDATE_EXPECTATION',
            payload: maskedBody
        };
        fs.appendFileSync('./logs/audit.log', JSON.stringify(auditLog) + '\n');

        // Silent Event-Driven Snapshot (Backend Backup)
        triggerSilentBackup();

        res.status(response.status).send(response.data);
    } catch (err) {
        res.status(err.response?.status || 500).json({ error: err.message });
    }
});

async function triggerSilentBackup() {
    try {
        const activeExpectations = await axios.put(`${MOCKSERVER_URL}/mockserver/retrieve?type=EXPECTATIONS`);
        fs.writeFileSync('./backups/expectations_latest.json', JSON.stringify(activeExpectations.data, null, 2));
    } catch (e) {
        console.error('Silent Backup Failed:', e.message);
    }
}

app.listen(3000, () => console.log('Auth Proxy Gateway running on port 3000'));

[
  {
    "httpRequest": {
      "method": "POST",
      "path": "/api/v1/orders",
      "body": {
        "type": "JSON_SCHEMA",
        "jsonSchema": {
          "type": "object",
          "required": ["orderId"],
          "properties": {
            "orderId": {
              "type": "string",
              "pattern": "^MOCK-.*"
            }
          }
        }
      }
    },
    "httpResponse": {
      "statusCode": 200,
      "headers": { "Content-Type": ["application/json"] },
      "body": {
        "status": "SUCCESS",
        "source": "MOCK_SERVER_ENGINE",
        "message": "Mock response for order matching MOCK-* pattern"
      }
    },
    "priority": 100
  },
  {
    "httpRequest": {
      "method": "POST",
      "path": "/api/v1/orders"
    },
    "httpForward": {
      "host": "httpbin.org",
      "port": 80,
      "scheme": "HTTP"
    },
    "priority": 10
  }
]

function generateCurlCommand(expectation) {
    const activeToken = localStorage.getItem('authToken') || 'eyJhbGciOiJKV1QiLC...';
    const activeSessionId = localStorage.getItem('sessionId') || 'sess_qa_somchai';

    let curl = `curl -i -X ${expectation.httpRequest.method || 'GET'} "http://localhost:3000${expectation.httpRequest.path}" \\\n`;

    // Auto-Inject Active Session Headers
    curl += `  -H "Authorization: Bearer ${activeToken}" \\\n`;
    curl += `  -H "X-Session-ID: ${activeSessionId}" \\\n`;
    curl += `  -H "Content-Type: application/json"`;

    if (expectation.httpRequest.body) {
        const bodyStr = JSON.stringify(expectation.httpRequest.body);
        curl += ` \\\n  -d '${bodyStr}'`;
    }

    return curl;
}