@aicgen/aicgen 1.0.0-beta.1

package/data/security/headers.md

@@ -0,0 +1,143 @@
+# Security Headers
+
+## Essential Headers with Helmet
+
+```typescript
+import helmet from 'helmet';
+
+// ✅ Apply security headers with sensible defaults
+app.use(helmet());
+
+// ✅ Custom configuration
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "'unsafe-inline'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+      imgSrc: ["'self'", "data:", "https:"],
+    }
+  },
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }
+}));
+```
+
+## Manual Header Configuration
+
+```typescript
+app.use((req, res, next) => {
+  // Prevent MIME sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // Prevent clickjacking
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // XSS protection
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+
+  // Force HTTPS
+  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
+
+  next();
+});
+```
+
+## Content Security Policy (CSP)
+
+```typescript
+// ✅ Strict CSP for maximum protection
+res.setHeader('Content-Security-Policy', [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: https:",
+  "font-src 'self'",
+  "connect-src 'self' https://api.example.com",
+  "frame-ancestors 'none'",
+  "form-action 'self'"
+].join('; '));
+
+// For APIs that don't serve HTML
+res.setHeader('Content-Security-Policy', "default-src 'none'");
+```
+
+## CORS Configuration
+
+```typescript
+import cors from 'cors';
+
+// ✅ Configure CORS properly
+app.use(cors({
+  origin: ['https://example.com', 'https://app.example.com'],
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+  credentials: true,
+  maxAge: 86400 // Cache preflight for 24 hours
+}));
+
+// ❌ Never use in production
+app.use(cors({ origin: '*' })); // Allows any origin
+```
+
+## HTTPS Enforcement
+
+```typescript
+// ✅ Redirect HTTP to HTTPS
+app.use((req, res, next) => {
+  if (!req.secure && req.get('x-forwarded-proto') !== 'https') {
+    return res.redirect(301, `https://${req.hostname}${req.url}`);
+  }
+  next();
+});
+
+// ✅ HSTS header (included in helmet)
+res.setHeader(
+  'Strict-Transport-Security',
+  'max-age=31536000; includeSubDomains; preload'
+);
+```
+
+## Cookie Security
+
+```typescript
+// ✅ Secure cookie settings
+app.use(session({
+  cookie: {
+    secure: true,        // Only send over HTTPS
+    httpOnly: true,      // Not accessible via JavaScript
+    sameSite: 'strict',  // CSRF protection
+    maxAge: 30 * 60 * 1000
+  }
+}));
+
+// ✅ Set secure cookies manually
+res.cookie('token', value, {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'strict',
+  maxAge: 3600000
+});
+```
+
+## Header Checklist
+
+```
+✅ X-Content-Type-Options: nosniff
+✅ X-Frame-Options: DENY
+✅ X-XSS-Protection: 1; mode=block
+✅ Strict-Transport-Security: max-age=31536000
+✅ Content-Security-Policy: (appropriate policy)
+✅ Referrer-Policy: strict-origin-when-cross-origin
+✅ Permissions-Policy: restrict unused features
+✅ Secure, HttpOnly, SameSite cookies
+```

package/data/security/index.md

@@ -0,0 +1,10 @@
+# Security Guidelines
+
+This directory contains security best practices.
+
+## Available Chunks
+
+- **injection.md** - SQL injection, NoSQL injection, command injection prevention
+- **auth-jwt.md** - Password storage, JWT, session management, authorization
+- **secrets.md** - Environment variables, secret generation, CI/CD secrets
+- **headers.md** - Security headers, CORS, HTTPS, CSP

package/data/security/injection.md

@@ -0,0 +1,119 @@
+# Injection Prevention
+
+## SQL Injection Prevention
+
+```typescript
+// ❌ DANGEROUS: String concatenation
+const getUserByEmail = async (email: string) => {
+  const query = `SELECT * FROM users WHERE email = '${email}'`;
+  // Input: ' OR '1'='1
+  // Result: SELECT * FROM users WHERE email = '' OR '1'='1'
+  return db.query(query);
+};
+
+// ✅ SAFE: Parameterized queries
+const getUserByEmail = async (email: string) => {
+  return db.query('SELECT * FROM users WHERE email = ?', [email]);
+};
+
+// ✅ SAFE: Using ORM
+const getUserByEmail = async (email: string) => {
+  return userRepository.findOne({ where: { email } });
+};
+
+// ✅ SAFE: Query builder
+const getUsers = async (minAge: number) => {
+  return db
+    .select('*')
+    .from('users')
+    .where('age', '>', minAge); // Automatically parameterized
+};
+```
+
+## NoSQL Injection Prevention
+
+```typescript
+// ❌ DANGEROUS: Accepting objects from user input
+app.post('/login', (req, res) => {
+  const { username, password } = req.body;
+  // If password = {$gt: ""}, it bypasses password check!
+  db.users.findOne({ username, password });
+});
+
+// ✅ SAFE: Validate input types
+app.post('/login', (req, res) => {
+  const { username, password } = req.body;
+
+  if (typeof username !== 'string' || typeof password !== 'string') {
+    throw new Error('Invalid input types');
+  }
+
+  db.users.findOne({ username, password });
+});
+```
+
+## Command Injection Prevention
+
+```typescript
+// ❌ DANGEROUS: Shell command with user input
+const convertImage = async (filename: string) => {
+  exec(`convert ${filename} output.jpg`);
+  // Input: "file.png; rm -rf /"
+};
+
+// ✅ SAFE: Use arrays, avoid shell
+import { execFile } from 'child_process';
+
+const convertImage = async (filename: string) => {
+  execFile('convert', [filename, 'output.jpg']);
+};
+
+// ✅ SAFE: Validate input against whitelist
+const allowedFilename = /^[a-zA-Z0-9_-]+\.(png|jpg|gif)$/;
+if (!allowedFilename.test(filename)) {
+  throw new Error('Invalid filename');
+}
+```
+
+## Path Traversal Prevention
+
+```typescript
+// ❌ DANGEROUS: Direct path usage
+app.get('/files/:filename', (req, res) => {
+  res.sendFile(`/uploads/${req.params.filename}`);
+  // Input: ../../etc/passwd
+});
+
+// ✅ SAFE: Validate and normalize path
+import path from 'path';
+
+app.get('/files/:filename', (req, res) => {
+  const safeName = path.basename(req.params.filename);
+  const filePath = path.join('/uploads', safeName);
+  const normalizedPath = path.normalize(filePath);
+
+  if (!normalizedPath.startsWith('/uploads/')) {
+    return res.status(400).json({ error: 'Invalid filename' });
+  }
+
+  res.sendFile(normalizedPath);
+});
+```
+
+## Input Validation
+
+```typescript
+// ✅ Whitelist validation
+import { z } from 'zod';
+
+const userSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(12).max(160),
+  age: z.number().int().min(0).max(150),
+  role: z.enum(['user', 'admin'])
+});
+
+const validateUser = (data: unknown) => {
+  return userSchema.parse(data);
+};
+```

package/data/security/secrets.md

@@ -0,0 +1,148 @@
+# Secrets Management
+
+## Environment Variables
+
+```typescript
+// ❌ NEVER hardcode secrets
+const config = {
+  dbPassword: 'super_secret_password',
+  apiKey: 'sk-1234567890abcdef'
+};
+
+// ✅ Use environment variables
+import dotenv from 'dotenv';
+dotenv.config();
+
+const config = {
+  dbPassword: process.env.DB_PASSWORD,
+  apiKey: process.env.API_KEY,
+  sessionSecret: process.env.SESSION_SECRET
+};
+```
+
+## Validate Required Secrets
+
+```typescript
+// ✅ Fail fast if secrets missing
+const requiredEnvVars = [
+  'DB_PASSWORD',
+  'API_KEY',
+  'SESSION_SECRET',
+  'JWT_SECRET'
+];
+
+requiredEnvVars.forEach(varName => {
+  if (!process.env[varName]) {
+    throw new Error(`Missing required environment variable: ${varName}`);
+  }
+});
+
+// ✅ Type-safe config
+interface Config {
+  dbPassword: string;
+  apiKey: string;
+  sessionSecret: string;
+}
+
+function loadConfig(): Config {
+  const dbPassword = process.env.DB_PASSWORD;
+  if (!dbPassword) throw new Error('DB_PASSWORD required');
+
+  // ... validate all required vars
+
+  return { dbPassword, apiKey, sessionSecret };
+}
+```
+
+## Generate Strong Secrets
+
+```bash
+# Generate cryptographically secure secrets
+node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+
+# Or using OpenSSL
+openssl rand -base64 32
+
+# Or using head
+head -c32 /dev/urandom | base64
+```
+
+## .gitignore Configuration
+
+```bash
+# .gitignore - NEVER commit secrets
+.env
+.env.local
+.env.*.local
+*.key
+*.pem
+secrets/
+credentials.json
+```
+
+## Environment Example File
+
+```bash
+# .env.example - commit this to show required variables
+DB_HOST=localhost
+DB_PORT=5432
+DB_NAME=myapp
+DB_USER=
+DB_PASSWORD=
+
+API_KEY=
+SESSION_SECRET=
+JWT_SECRET=
+
+# Copy to .env and fill in actual values
+```
+
+## Secrets in CI/CD
+
+```yaml
+# GitHub Actions
+- name: Deploy
+  env:
+    DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+    API_KEY: ${{ secrets.API_KEY }}
+  run: ./deploy.sh
+
+# ❌ Never echo secrets in logs
+- name: Configure
+  run: |
+    echo "Configuring application..."
+    # echo "DB_PASSWORD=$DB_PASSWORD"  # NEVER do this!
+```
+
+## Secrets Rotation
+
+```typescript
+// ✅ Support for rotating secrets
+class SecretManager {
+  async getSecret(name: string): Promise<string> {
+    // Check for new secret first (during rotation)
+    const newSecret = process.env[`${name}_NEW`];
+    if (newSecret) {
+      return newSecret;
+    }
+
+    const secret = process.env[name];
+    if (!secret) {
+      throw new Error(`Secret ${name} not found`);
+    }
+    return secret;
+  }
+}
+
+// ✅ Accept multiple JWT signing keys during rotation
+function verifyToken(token: string) {
+  const keys = [process.env.JWT_SECRET, process.env.JWT_SECRET_OLD].filter(Boolean);
+
+  for (const key of keys) {
+    try {
+      return jwt.verify(token, key);
+    } catch {}
+  }
+  throw new Error('Invalid token');
+}
+```

package/data/style/index.md

@@ -0,0 +1,8 @@
+# Code Style Guidelines
+
+This directory contains coding style and organization patterns.
+
+## Available Chunks
+
+- **naming.md** - Variables, constants, classes, files, avoiding magic numbers
+- **organization.md** - Function length, nesting depth, file structure, SRP

package/data/style/naming.md

@@ -0,0 +1,136 @@
+# Naming Conventions
+
+## Variables and Functions
+
+```typescript
+// camelCase for variables and functions
+const userName = 'John';
+const isActive = true;
+const itemCount = 42;
+
+function calculateTotal(items: Item[]): number {
+  return items.reduce((sum, item) => sum + item.price, 0);
+}
+
+// Boolean variables: use is/has/can/should prefix
+const isValid = validate(input);
+const hasPermission = checkPermission(user);
+const canEdit = user.role === 'admin';
+const shouldRetry = error.code === 'TIMEOUT';
+
+// Collections: use plural names
+const users = getUsers();
+const activeOrders = orders.filter(o => o.status === 'active');
+```
+
+## Constants
+
+```typescript
+// UPPER_SNAKE_CASE for constants
+const MAX_RETRY_ATTEMPTS = 3;
+const DEFAULT_TIMEOUT_MS = 5000;
+const API_BASE_URL = 'https://api.example.com';
+
+// Enum-like objects
+const ORDER_STATUS = {
+  PENDING: 'pending',
+  PROCESSING: 'processing',
+  SHIPPED: 'shipped',
+  DELIVERED: 'delivered',
+  CANCELLED: 'cancelled'
+} as const;
+
+const HTTP_STATUS = {
+  OK: 200,
+  CREATED: 201,
+  BAD_REQUEST: 400,
+  NOT_FOUND: 404
+} as const;
+```
+
+## Classes and Types
+
+```typescript
+// PascalCase for classes and types
+class UserService {
+  constructor(private userRepository: UserRepository) {}
+}
+
+interface User {
+  id: string;
+  name: string;
+  email: string;
+}
+
+type UserRole = 'admin' | 'editor' | 'viewer';
+
+// Avoid prefixes
+// ❌ IUser, CUser, TUser
+// ✅ User
+```
+
+## Files and Modules
+
+```typescript
+// kebab-case for files
+user-service.ts
+order-repository.ts
+create-user.dto.ts
+
+// Match file name to primary export
+// user-service.ts exports UserService
+// order-repository.ts exports OrderRepository
+```
+
+## Avoid Bad Names
+
+```typescript
+// ❌ Bad - unclear
+const d = Date.now();
+const tmp = user.name;
+const data = fetchData();
+const flag = true;
+
+// ✅ Good - descriptive
+const currentDate = Date.now();
+const originalUserName = user.name;
+const customerOrders = fetchCustomerOrders();
+const isEmailVerified = true;
+```
+
+## Avoid Magic Numbers
+
+```typescript
+// ❌ Magic numbers
+if (user.age >= 18) { ... }
+if (items.length > 100) { ... }
+setTimeout(callback, 5000);
+
+// ✅ Named constants
+const LEGAL_AGE = 18;
+const MAX_BATCH_SIZE = 100;
+const DEFAULT_TIMEOUT_MS = 5000;
+
+if (user.age >= LEGAL_AGE) { ... }
+if (items.length > MAX_BATCH_SIZE) { ... }
+setTimeout(callback, DEFAULT_TIMEOUT_MS);
+```
+
+## Consistency
+
+```typescript
+// Pick ONE style and stick with it across the project
+
+// ✅ Consistent camelCase in APIs
+{
+  "userId": 123,
+  "firstName": "John",
+  "createdAt": "2024-01-01"
+}
+
+// ❌ Mixed styles
+{
+  "user_id": 123,      // snake_case
+  "firstName": "John", // camelCase - inconsistent!
+}
+```