rubydb 0.1.0

data/lib/rubydb/security/credentials.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "openssl"
+
+module RubyDB
+  module Security
+    # Credentials - Manages credential storage
+    class Credentials
+      attr_reader :stats
+
+      def initialize(config = {})
+        @config = config
+        @storage_path = config[:storage_path] || "credentials.json"
+        @encryption_key = config[:encryption_key]
+        @credentials = {}
+        @loaded = false
+        @stats = {
+          loaded: 0,
+          saved: 0,
+          encrypted: 0,
+          decrypted: 0,
+          errors: 0
+        }
+        @lock = Mutex.new
+
+        load_credentials if File.exist?(@storage_path)
+      end
+
+      def add_credential(service, username, password, metadata = {})
+        @lock.synchronize do
+          @credentials[service] ||= {}
+          @credentials[service][username] = {
+            password: password,
+            metadata: metadata,
+            created_at: Time.now.iso8601,
+            updated_at: Time.now.iso8601
+          }
+          save_credentials
+        end
+      end
+
+      def get_credential(service, username)
+        @lock.synchronize do
+          load_credentials unless @loaded
+          return nil unless @credentials[service]
+          @credentials[service][username]
+        end
+      end
+
+      def remove_credential(service, username)
+        @lock.synchronize do
+          return false unless @credentials[service]
+          result = @credentials[service].delete(username)
+          save_credentials if result
+          result
+        end
+      end
+
+      def list_services
+        @lock.synchronize do
+          load_credentials unless @loaded
+          @credentials.keys
+        end
+      end
+
+      def list_usernames(service)
+        @lock.synchronize do
+          load_credentials unless @loaded
+          return [] unless @credentials[service]
+          @credentials[service].keys
+        end
+      end
+
+      def validate_credential(service, username, password)
+        @lock.synchronize do
+          cred = get_credential(service, username)
+          return false unless cred
+          cred[:password] == password
+        end
+      end
+
+      def update_credential(service, username, new_password, metadata = nil)
+        @lock.synchronize do
+          cred = get_credential(service, username)
+          return false unless cred
+          cred[:password] = new_password
+          cred[:updated_at] = Time.now.iso8601
+          cred[:metadata] = metadata if metadata
+          save_credentials
+          true
+        end
+      end
+
+      def encrypt_file
+        @lock.synchronize do
+          return unless @encryption_key
+
+          @stats[:encrypted] += 1
+          encrypted_path = "#{@storage_path}.encrypted"
+
+          # Read file
+          data = File.read(@storage_path)
+
+          # Encrypt
+          cipher = OpenSSL::Cipher.new("aes-256-cbc")
+          cipher.encrypt
+          cipher.key = @encryption_key
+          cipher.iv = cipher.random_iv
+
+          encrypted = cipher.update(data) + cipher.final
+          iv = cipher.iv
+
+          # Write encrypted
+          File.write(encrypted_path, iv + encrypted)
+          File.delete(@storage_path)
+
+          @storage_path = encrypted_path
+        end
+      end
+
+      def decrypt_file
+        @lock.synchronize do
+          return unless @encryption_key && File.exist?(@storage_path)
+
+          @stats[:decrypted] += 1
+          decrypted_path = @storage_path.gsub(/\.encrypted$/, ".json")
+
+          # Read encrypted
+          data = File.read(@storage_path)
+
+          # Decrypt
+          iv = data[0, 16]
+          encrypted = data[16..-1]
+
+          cipher = OpenSSL::Cipher.new("aes-256-cbc")
+          cipher.decrypt
+          cipher.key = @encryption_key
+          cipher.iv = iv
+
+          decrypted = cipher.update(encrypted) + cipher.final
+
+          # Write decrypted
+          File.write(decrypted_path, decrypted)
+          File.delete(@storage_path)
+
+          @storage_path = decrypted_path
+          load_credentials
+        end
+      end
+
+      def stats
+        @lock.synchronize do
+          @stats.merge({
+            credentials_count: @credentials.size,
+            services_count: @credentials.keys.size,
+            loaded: @loaded,
+            storage_path: @storage_path,
+            encrypted: @storage_path.end_with?(".encrypted")
+          })
+        end
+      end
+
+      private
+
+      def load_credentials
+        @lock.synchronize do
+          begin
+            if File.exist?(@storage_path)
+              data = File.read(@storage_path)
+              @credentials = JSON.parse(data, symbolize_names: true)
+              @loaded = true
+              @stats[:loaded] += 1
+            end
+          rescue => e
+            @stats[:errors] += 1
+            @credentials = {}
+          end
+        end
+      end
+
+      def save_credentials
+        @lock.synchronize do
+          begin
+            data = JSON.generate(@credentials)
+            File.write(@storage_path, data)
+            @stats[:saved] += 1
+          rescue => e
+            @stats[:errors] += 1
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubydb/security/password.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "base64"
+require "monitor"
+
+module RubyDB
+  module Security
+    # Password - Handles password hashing and validation
+    class Password
+      # Password algorithms
+      ALGORITHM_SHA256 = :sha256
+      ALGORITHM_SHA512 = :sha512
+      ALGORITHM_BCRYPT = :bcrypt
+      ALGORITHM_PBKDF2 = :pbkdf2
+      ALGORITHM_ARGON2 = :argon2
+
+      def initialize(config = {})
+        @algorithm = config[:algorithm] || ALGORITHM_SHA256
+        @iterations = config[:iterations] || 10000
+        @salt_length = config[:salt_length] || 16
+        @key_length = config[:key_length] || 32
+        @bcrypt_cost = config[:bcrypt_cost] || 10
+        @stats = {
+          hashes: 0,
+          verifications: 0,
+          verifications_successful: 0,
+          verifications_failed: 0,
+          salts_generated: 0
+        }
+        @lock = Monitor.new
+      end
+
+      def hash(password, salt = nil)
+        @lock.synchronize do
+          @stats[:hashes] += 1
+          salt ||= generate_salt
+
+          hash_data = case @algorithm
+          when ALGORITHM_SHA256
+            hash_sha256(password, salt)
+          when ALGORITHM_SHA512
+            hash_sha512(password, salt)
+          when ALGORITHM_BCRYPT
+            hash_bcrypt(password)
+          when ALGORITHM_PBKDF2
+            hash_pbkdf2(password, salt)
+          when ALGORITHM_ARGON2
+            hash_argon2(password, salt)
+          else
+            raise ArgumentError, "Unsupported password algorithm: #{@algorithm}"
+          end
+
+          {
+            algorithm: @algorithm,
+            salt: salt,
+            hash: hash_data,
+            iterations: @iterations,
+            key_length: @key_length
+          }
+        end
+      end
+
+      def verify(password, stored_hash)
+        @lock.synchronize do
+          @stats[:verifications] += 1
+
+          algorithm = stored_hash[:algorithm] || @algorithm
+          salt = stored_hash[:salt]
+          hash_data = stored_hash[:hash]
+
+          result = case algorithm
+          when ALGORITHM_SHA256
+            verify_sha256(password, salt, hash_data)
+          when ALGORITHM_SHA512
+            verify_sha512(password, salt, hash_data)
+          when ALGORITHM_BCRYPT
+            verify_bcrypt(password, hash_data)
+          when ALGORITHM_PBKDF2
+            verify_pbkdf2(password, salt, hash_data, stored_hash[:iterations] || @iterations)
+          when ALGORITHM_ARGON2
+            verify_argon2(password, salt, hash_data)
+          else
+            false
+          end
+
+          if result
+            @stats[:verifications_successful] += 1
+          else
+            @stats[:verifications_failed] += 1
+          end
+
+          result
+        end
+      end
+
+      def generate_salt
+        @lock.synchronize do
+          @stats[:salts_generated] += 1
+          SecureRandom.hex(@salt_length)
+        end
+      end
+
+      def meets_policy?(password)
+        # Check password policy
+        return false if password.length < 8
+        return false unless password.match?(/[a-z]/)
+        return false unless password.match?(/[A-Z]/)
+        return false unless password.match?(/\d/)
+        return false unless password.match?(/[^a-zA-Z0-9]/)
+        true
+      end
+
+      def generate_random_password(length = 16)
+        charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()"
+        (0...length).map { charset[SecureRandom.rand(charset.length)] }.join
+      end
+
+      def stats
+        @lock.synchronize do
+          @stats.merge({
+            algorithm: @algorithm,
+            iterations: @iterations,
+            salt_length: @salt_length,
+            key_length: @key_length
+          })
+        end
+      end
+
+      private
+
+      def hash_sha256(password, salt)
+        Digest::SHA256.hexdigest(salt + password)
+      end
+
+      def verify_sha256(password, salt, stored_hash)
+        hash_sha256(password, salt) == stored_hash
+      end
+
+      def hash_sha512(password, salt)
+        Digest::SHA512.hexdigest(salt + password)
+      end
+
+      def verify_sha512(password, salt, stored_hash)
+        hash_sha512(password, salt) == stored_hash
+      end
+
+      def hash_bcrypt(password)
+        begin
+          require "bcrypt"
+          BCrypt::Password.create(password, cost: @bcrypt_cost)
+        rescue LoadError
+          raise ArgumentError, "bcrypt support requires the bcrypt gem"
+        end
+      end
+
+      def verify_bcrypt(password, stored_hash)
+        begin
+          require "bcrypt"
+          BCrypt::Password.new(stored_hash) == password
+        rescue LoadError
+          false
+        end
+      end
+
+      def hash_pbkdf2(password, salt)
+        begin
+          require "openssl"
+          OpenSSL::PKCS5.pbkdf2_hmac(
+            password,
+            salt,
+            @iterations,
+            @key_length,
+            "sha256"
+          ).unpack1("H*")
+        rescue LoadError
+          hash_sha256(password, salt)
+        end
+      end
+
+      def verify_pbkdf2(password, salt, stored_hash, iterations)
+        require "openssl"
+        computed = OpenSSL::PKCS5.pbkdf2_hmac(
+          password,
+          salt,
+          iterations,
+          @key_length,
+          "sha256"
+        ).unpack1("H*")
+        computed == stored_hash
+      rescue LoadError
+        false
+      end
+
+      def hash_argon2(password, salt)
+        begin
+          require "argon2"
+          Argon2::Password.create(password)
+        rescue LoadError
+          raise ArgumentError, "argon2 support requires the argon2 gem"
+        end
+      end
+
+      def verify_argon2(password, salt, stored_hash)
+        begin
+          require "argon2"
+          Argon2::Password.verify_password(password, stored_hash)
+        rescue LoadError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rubydb/security/permissions.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module RubyDB
+  module Security
+    # Permissions - Permission definitions and management
+    class Permissions
+      # Standard permissions
+      SELECT = "SELECT"
+      INSERT = "INSERT"
+      UPDATE = "UPDATE"
+      DELETE = "DELETE"
+      CREATE = "CREATE"
+      DROP = "DROP"
+      ALTER = "ALTER"
+      INDEX = "INDEX"
+      GRANT = "GRANT"
+      REVOKE = "REVOKE"
+      EXECUTE = "EXECUTE"
+      CONNECT = "CONNECT"
+      USAGE = "USAGE"
+      ALL = "ALL"
+
+      # Permission groups
+      GROUPS = {
+        read: [SELECT],
+        write: [INSERT, UPDATE, DELETE],
+        ddl: [CREATE, DROP, ALTER],
+        admin: [GRANT, REVOKE],
+        all: [SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX, EXECUTE]
+      }
+
+      def initialize
+        @permissions = {}
+        @lock = Mutex.new
+      end
+
+      def define_permission(name, description = nil)
+        @lock.synchronize do
+          @permissions[name] = {
+            description: description || "Permission to #{name}",
+            created_at: Time.now
+          }
+        end
+      end
+
+      def permission_exists?(name)
+        @permissions.key?(name)
+      end
+
+      def list_permissions
+        @permissions.keys
+      end
+
+      def describe_permission(name)
+        @permissions[name]
+      end
+
+      def group_permissions(group)
+        GROUPS[group] || []
+      end
+
+      def permission_names
+        @permissions.keys
+      end
+
+      def to_hash
+        {
+          permissions: @permissions,
+          groups: GROUPS
+        }
+      end
+    end
+  end
+end

data/lib/rubydb/security/role.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "set"
+
+module RubyDB
+  module Security
+    # Role - Role-based access control
+    class Role
+      attr_reader :name, :created_at, :metadata, :members
+      attr_accessor :description, :parent_role
+
+      def initialize(name, options = {})
+        @name = name
+        @description = options[:description]
+        @parent_role = options[:parent_role]
+        @members = Set.new
+        @permissions = []
+        @inherited_permissions = nil
+        @created_at = Time.now
+        @metadata = options[:metadata] || {}
+      end
+
+      def add_member(username)
+        @members.add(username)
+        invalidate_cache
+      end
+
+      def remove_member(username)
+        @members.delete(username)
+        invalidate_cache
+      end
+
+      def member?(username)
+        @members.include?(username)
+      end
+
+      def members
+        @members.to_a
+      end
+
+      def add_permission(permission)
+        @permissions << permission unless @permissions.include?(permission)
+        invalidate_cache
+      end
+
+      def remove_permission(permission)
+        @permissions.delete(permission)
+        invalidate_cache
+      end
+
+      def permissions
+        @permissions.dup
+      end
+
+      def all_permissions(role_map = {})
+        if @inherited_permissions.nil?
+          @inherited_permissions = compute_all_permissions(role_map)
+        end
+        @inherited_permissions
+      end
+
+      def inherit_from(parent_role)
+        @parent_role = parent_role
+        invalidate_cache
+      end
+
+      def to_hash
+        {
+          name: @name,
+          description: @description,
+          parent_role: @parent_role,
+          members: @members.to_a,
+          permissions: @permissions,
+          created_at: @created_at.iso8601,
+          metadata: @metadata
+        }
+      end
+
+      def inspect
+        "#<Role name=#{@name} members=#{@members.size} permissions=#{@permissions.size}>"
+      end
+
+      private
+
+      def invalidate_cache
+        @inherited_permissions = nil
+      end
+
+      def compute_all_permissions(role_map)
+        perms = @permissions.dup
+
+        if @parent_role && role_map[@parent_role]
+          parent = role_map[@parent_role]
+          perms.concat(parent.all_permissions(role_map))
+        end
+
+        perms.uniq
+      end
+    end
+  end
+end

data/lib/rubydb/security/user.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "time"
+
+module RubyDB
+  module Security
+    # User - User account
+    class User
+      attr_reader :username, :created_at, :last_login, :attributes
+      attr_accessor :password_hash, :salt, :email, :full_name, :superuser
+      attr_accessor :active, :locked, :expires_at, :metadata
+
+      def initialize(username, options = {})
+        @username = username
+        @password_hash = options[:password_hash]
+        @salt = options[:salt]
+        @email = options[:email]
+        @full_name = options[:full_name]
+        @superuser = options[:superuser] || false
+        @active = options[:active] != false
+        @locked = options[:locked] || false
+        @created_at = Time.now
+        @last_login = nil
+        @expires_at = options[:expires_at]
+        @metadata = options[:metadata] || {}
+        @attributes = options[:attributes] || {}
+      end
+
+      def authenticate(password, password_hasher)
+        return false unless @active && !@locked
+        return false if expired?
+        password_hasher.verify(password, @password_hash)
+      end
+
+      def login
+        @last_login = Time.now
+        @locked = false
+      end
+
+      def lock
+        @locked = true
+      end
+
+      def unlock
+        @locked = false
+      end
+
+      def activate
+        @active = true
+      end
+
+      def deactivate
+        @active = false
+      end
+
+      def expired?
+        return false unless @expires_at
+        Time.now > @expires_at
+      end
+
+      def to_hash
+        {
+          username: @username,
+          email: @email,
+          full_name: @full_name,
+          superuser: @superuser,
+          active: @active,
+          locked: @locked,
+          created_at: @created_at.iso8601,
+          last_login: @last_login&.iso8601,
+          expires_at: @expires_at&.iso8601,
+          metadata: @metadata,
+          attributes: @attributes
+        }
+      end
+
+      def to_json
+        JSON.generate(to_hash)
+      end
+
+      def inspect
+        "#<User username=#{@username} active=#{@active} superuser=#{@superuser}>"
+      end
+    end
+  end
+end