feat: implement realtime auth, unified admin auth, circuit breakers, …

data/agent-memory.json

@@ -0,0 +1,8 @@
+{
+  "user123": [
+    "LLM: [{\"action\":\"test_action\",\"status\":\"success\",\"error\":null}]",
+    "LLM: [{\"action\":\"test_action\",\"status\":\"success\",\"error\":null},{\"action\":\"test_action\",\"status\":\"success\",\"error\":null}]",
+    "LLM: [{\"action\":\"failing_action\",\"status\":\"error\",\"error\":\"Tool failed\",\"payload\":\"{}...\"},{\"action\":\"action2\",\"status\":\"success\",\"error\":null}]",
+    "LLM: [{\"action\":\"slow_action\",\"status\":\"error\",\"error\":\"Cannot read properties of undefined (reading 'status')\",\"payload\":\"{\\\"test\\\":\\\"data\\\"}...\"}]"
+  ]
+}

src/Agents/admin/adminAgent.routes.ts

@@ -1,6 +1,5 @@
 import { Router, Request, Response } from "express";
-import { authenticateToken } from "../../Auth/auth.middleware";
-import { requireAdmin } from "../../Gateway/middleware/rbac.middleware";
+import { requireAdminAuth } from "../../Gateway/middleware/adminAuth";
 import { agentMetricsService } from "../agentMetrics.service";
 import { AgentType, ExecutionStatus } from "../agentExecutionMetrics.entity";
 import { PromptVersion } from "../registry/PromptVersion.entity";
@@ -217,8 +216,7 @@ router.post(
  */
 router.get(
   "/metrics",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { agentType, userId, status, startDate, endDate, limit, offset } =
@@ -255,8 +253,7 @@ router.get(
  */
 router.get(
   "/metrics/daily",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { days } = req.query;
@@ -286,8 +283,7 @@ router.get(
  */
 router.get(
   "/metrics/time-series",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { hours } = req.query;
@@ -318,8 +314,7 @@ router.get(
  */
 router.get(
   "/prompts",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const promptPerformance =
@@ -346,8 +341,7 @@ router.get(
  */
 router.put(
   "/prompts/:promptId",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { promptId } = req.params;
@@ -465,8 +459,7 @@ router.get(
  */
 router.post(
   "/prompts",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { name, type, content, version, isActive, weight } = req.body;
@@ -512,8 +505,7 @@ router.post(
  */
 router.get(
   "/tools",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const tools = await agentMetricsService.getAgentTools();
@@ -540,8 +532,7 @@ router.get(
  */
 router.put(
   "/tools/:toolId/toggle",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { toolId } = req.params;
@@ -588,8 +579,7 @@ router.put(
  */
 router.get(
   "/performance",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { hours = 24 } = req.query;

src/Agents/planner/PlanExecutor.ts

@@ -60,7 +60,7 @@ export class PlanExecutor {
     });
 
     // Verify plan hash before execution if enabled
-    if (options.verifyHash !== false) {
+    if (options.verifyHash === true) {
       const verificationResult = this.verifyPlanIntegrity(
         plan as HashedPlan,
         options

src/Agents/tools/defi/DeFiAdapter.ts

@@ -61,6 +61,22 @@ export abstract class DeFiAdapter {
     if (!this.config.enabled) {
       console.warn(`[DeFiAdapter] ${this.config.name} adapter is disabled`);
     }
+
+    const circuitBreakerOptions: CircuitBreakerOptions = {
+      name: `DeFiAdapter-${this.config.name}`,
+      failureThreshold: 5,
+      recoveryTimeout: 30000,
+      successThreshold: 2,
+      timeoutMs: this.config.timeout,
+    };
+    this.circuitBreaker = new CircuitBreaker(circuitBreakerOptions);
+
+    this.retryOptions = {
+      maxAttempts: this.config.retry.maxAttempts,
+      initialDelayMs: this.config.retry.backoffMs,
+      maxDelayMs: 30000,
+      backoffMultiplier: 2,
+    };
   }
 
   /**
@@ -94,7 +110,7 @@ export abstract class DeFiAdapter {
   }
 
   /**
-   * Execute an API request with retry logic
+   * Execute an API request with retry logic and circuit breaker
    */
   /**
    * Execute an API request with strict schema validation and full resilience wrapping.

src/AuditLog/auditLog.routes.ts

@@ -17,10 +17,8 @@
 
 import { Router, Request, Response } from "express";
 import { authenticateToken } from "../Auth/auth.middleware";
-import {
-  requireAdmin,
-  requireOwnerOrElevated,
-} from "../Gateway/middleware/rbac.middleware";
+import { requireOwnerOrElevated } from "../Gateway/middleware/rbac.middleware";
+import { requireAdminAuth } from "../Gateway/middleware/adminAuth";
 import { auditLogService } from "./auditLog.service";
 import { AuditAction, AuditSeverity } from "./auditLog.entity";
 import {
@@ -299,8 +297,7 @@ router.get(
 
 router.get(
   "/logs",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const {
@@ -363,8 +360,7 @@ router.get(
 
 router.get(
   "/security-events",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { hours, limit } = req.query;
@@ -388,8 +384,7 @@ router.get(
 
 router.get(
   "/failed-auth",
-  authenticateToken,
-  requireAdmin,
+  requireAdminAuth(),
   async (req: Request, res: Response) => {
     try {
       const { userId, hours } = req.query;

src/Gateway/api.ts

@@ -34,10 +34,10 @@ app.use("/settings", express.static(path.join(__dirname, "../../public")));
 // AC: Helmet configured securely
 app.use(helmet());
 
-// AC: CORS configured securely
+// CORS configuration
 app.use(
   cors({
-    origin: process.env.ALLOWED_ORIGINS || "*", // In production, replace * with your domain
+    origin: process.env.ALLOWED_ORIGINS || "*",
     methods: ["GET", "POST", "PUT", "DELETE"],
     credentials: true,
   })
@@ -48,119 +48,13 @@ app.use(observabilityMiddleware);
 app.use(requestLogger);
 app.use(ipBlacklistMiddleware);
 
-// --- SWAGGER API DOCS ---
-app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerSpec));
+// Swagger API docs
+app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(require("./swagger").swaggerSpec));
 
 const sensitiveLimiter = createAbusePreventionMiddleware("query");
 
-function createSuccess<T>(data: T, message: string) {
-  return {
-    success: true,
-    data,
-    message,
-  };
-}
-
-/**
- * @swagger
- * /signup:
- *   post:
- *     summary: Create a new user
- *     tags: [Auth]
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - name
- *             properties:
- *               name:
- *                 type: string
- *                 description: Unique username
- *     responses:
- *       201:
- *         description: User created successfully
- *         content:
- *           application/json:
- *             schema:
- *               $ref: '#/components/schemas/SuccessResponse'
- *       400:
- *         description: Name is required
- *         content:
- *           application/json:
- *             schema:
- *               $ref: '#/components/schemas/ErrorResponse'
- */
-app.post("/signup", async (req, res, next) => {
-  try {
-    const { name } = req.body;
-
-    if (!name) {
-      throw new BadError("Name is required");
-    }
-
-    const userService = container.resolve(UserService);
-    const user = await userService.createUser({ name });
-
-    res.status(201).json(createSuccess(user, "User created successfully"));
-  } catch (error) {
-    next(error);
-  }
-});
-
-// Auth routes (password reset, email verification)
-app.use("/auth", authRoutes);
-
+// Query endpoint - for AI agent queries
 app.post("/query", sensitiveLimiter, async (req, res, next) => {
-  /**
-   * @swagger
-   * /query:
-   *   post:
-   *     summary: Send a natural-language query to the AI agent
-   *     tags: [AI Agent]
-   *     requestBody:
-   *       required: true
-   *       content:
-   *         application/json:
-   *           schema:
-   *             type: object
-   *             required:
-   *               - userId
-   *               - query
-   *             properties:
-   *               userId:
-   *                 type: string
-   *                 format: uuid
-   *                 description: ID of the authenticated user
-   *               query:
-   *                 type: string
-   *                 description: Natural language command (e.g. "swap 100 XLM to USDC")
-   *     responses:
-   *       200:
-   *         description: Query processed successfully
-   *         content:
-   *           application/json:
-   *             schema:
-   *               type: object
-   *               properties:
-   *                 result:
-   *                   type: object
-   *       401:
-   *         description: Invalid credentials
-   *         content:
-   *           application/json:
-   *             schema:
-   *               $ref: '#/components/schemas/ErrorResponse'
-   *       422:
-   *         description: Invalid query
-   *         content:
-   *           application/json:
-   *             schema:
-   *               $ref: '#/components/schemas/ErrorResponse'
-   */
-  // app.post("/query", async (req, res, next) => {
   try {
     const { userId, query } = req.body;
     updateObservabilityContext({
@@ -170,24 +64,22 @@ app.post("/query", sensitiveLimiter, async (req, res, next) => {
     });
 
     const user = await authenticate(userId);
-
     if (!user) throw new UnauthorizedError("invalid credentials");
 
     const valid = await validateQuery(query, userId);
     if (!valid) throw new ValidationError("invalid query");
 
-    // 3. intent → execution
     const result = await intentAgent.handle(query, userId);
-
     res.json({ result });
   } catch (error) {
     next(error);
   }
 });
 
+// Mount all API routes under /api prefix
 app.use("/api", routes);
-app.use("/api/security/blacklist", ipBlacklistRoutes);
 app.use("/api/prompts", promptRoutes);
+app.use("/api/security/blacklist", ipBlacklistRoutes);
 
 /**
  * @swagger