@autonoma-io/a6s 5.1.2

package/dist/modules/auth-access-control.js

@@ -0,0 +1,832 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthAccessControlModule = exports.Permission = exports.AdminRole = void 0;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const speakeasy = __importStar(require("speakeasy"));
+const qrcode = __importStar(require("qrcode"));
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+// Role definitions
+var AdminRole;
+(function (AdminRole) {
+    AdminRole["SUPER_ADMIN"] = "super_admin";
+    AdminRole["PLATFORM_ADMIN"] = "platform_admin";
+    AdminRole["DEVOPS_ADMIN"] = "devops_admin";
+    AdminRole["SECURITY_ADMIN"] = "security_admin";
+    AdminRole["DATA_ADMIN"] = "data_admin";
+    AdminRole["SUPPORT_ADMIN"] = "support_admin";
+    AdminRole["READ_ONLY"] = "read_only"; // View-only access
+})(AdminRole || (exports.AdminRole = AdminRole = {}));
+// Permission definitions
+var Permission;
+(function (Permission) {
+    // System permissions
+    Permission["SYSTEM_CONFIG"] = "system:config";
+    Permission["SYSTEM_DEPLOY"] = "system:deploy";
+    Permission["SYSTEM_MONITOR"] = "system:monitor";
+    Permission["SYSTEM_BACKUP"] = "system:backup";
+    // User management
+    Permission["USER_CREATE"] = "user:create";
+    Permission["USER_UPDATE"] = "user:update";
+    Permission["USER_DELETE"] = "user:delete";
+    Permission["USER_VIEW"] = "user:view";
+    // Data operations
+    Permission["DATA_READ"] = "data:read";
+    Permission["DATA_WRITE"] = "data:write";
+    Permission["DATA_DELETE"] = "data:delete";
+    Permission["DATA_EXPORT"] = "data:export";
+    // AI operations
+    Permission["AI_TRAIN"] = "ai:train";
+    Permission["AI_DEPLOY"] = "ai:deploy";
+    Permission["AI_MONITOR"] = "ai:monitor";
+    Permission["AI_CONFIG"] = "ai:config";
+    // Security operations
+    Permission["SECURITY_AUDIT"] = "security:audit";
+    Permission["SECURITY_CONFIG"] = "security:config";
+    Permission["SECURITY_KEYS"] = "security:keys";
+    Permission["SECURITY_LOGS"] = "security:logs";
+})(Permission || (exports.Permission = Permission = {}));
+// Role-Permission mapping
+const ROLE_PERMISSIONS = {
+    [AdminRole.SUPER_ADMIN]: Object.values(Permission), // All permissions
+    [AdminRole.PLATFORM_ADMIN]: [
+        Permission.SYSTEM_CONFIG,
+        Permission.SYSTEM_DEPLOY,
+        Permission.SYSTEM_MONITOR,
+        Permission.USER_VIEW,
+        Permission.DATA_READ,
+        Permission.DATA_WRITE,
+        Permission.AI_DEPLOY,
+        Permission.AI_MONITOR
+    ],
+    [AdminRole.DEVOPS_ADMIN]: [
+        Permission.SYSTEM_DEPLOY,
+        Permission.SYSTEM_MONITOR,
+        Permission.SYSTEM_BACKUP,
+        Permission.DATA_READ,
+        Permission.AI_DEPLOY,
+        Permission.AI_MONITOR
+    ],
+    [AdminRole.SECURITY_ADMIN]: [
+        Permission.SECURITY_AUDIT,
+        Permission.SECURITY_CONFIG,
+        Permission.SECURITY_KEYS,
+        Permission.SECURITY_LOGS,
+        Permission.USER_VIEW,
+        Permission.SYSTEM_MONITOR
+    ],
+    [AdminRole.DATA_ADMIN]: [
+        Permission.DATA_READ,
+        Permission.DATA_WRITE,
+        Permission.DATA_DELETE,
+        Permission.DATA_EXPORT,
+        Permission.AI_MONITOR
+    ],
+    [AdminRole.SUPPORT_ADMIN]: [
+        Permission.USER_VIEW,
+        Permission.DATA_READ,
+        Permission.SYSTEM_MONITOR,
+        Permission.SECURITY_LOGS
+    ],
+    [AdminRole.READ_ONLY]: [
+        Permission.USER_VIEW,
+        Permission.DATA_READ,
+        Permission.SYSTEM_MONITOR
+    ]
+};
+class AuthAccessControlModule {
+    configPath;
+    config;
+    users = new Map();
+    sessions = new Map();
+    auditLogs = [];
+    ssmClient;
+    secretsClient;
+    cognitoClient;
+    constructor() {
+        this.configPath = (0, path_1.join)((0, os_1.homedir)(), '.autonoma-cli');
+        this.ensureConfigDirectory();
+        this.loadConfig();
+        this.loadUsers();
+        // Initialize AWS clients
+        this.ssmClient = new client_ssm_1.SSMClient({ region: process.env.AWS_REGION || 'us-east-1' });
+        this.secretsClient = new client_secrets_manager_1.SecretsManagerClient({ region: process.env.AWS_REGION || 'us-east-1' });
+        this.cognitoClient = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({ region: process.env.AWS_REGION || 'us-east-1' });
+    }
+    ensureConfigDirectory() {
+        if (!(0, fs_1.existsSync)(this.configPath)) {
+            (0, fs_1.mkdirSync)(this.configPath, { recursive: true });
+        }
+    }
+    loadConfig() {
+        const configFile = (0, path_1.join)(this.configPath, 'auth-config.json');
+        if ((0, fs_1.existsSync)(configFile)) {
+            this.config = JSON.parse((0, fs_1.readFileSync)(configFile, 'utf-8'));
+        }
+        else {
+            // Default configuration
+            this.config = {
+                jwtSecret: (0, crypto_1.randomBytes)(64).toString('hex'),
+                sessionTimeout: 3600000, // 1 hour
+                mfaRequired: true,
+                passwordPolicy: {
+                    minLength: 12,
+                    requireUppercase: true,
+                    requireLowercase: true,
+                    requireNumbers: true,
+                    requireSpecialChars: true,
+                    maxAge: 90
+                },
+                loginAttempts: {
+                    maxAttempts: 5,
+                    lockoutDuration: 30
+                }
+            };
+            this.saveConfig();
+        }
+    }
+    saveConfig() {
+        const configFile = (0, path_1.join)(this.configPath, 'auth-config.json');
+        (0, fs_1.writeFileSync)(configFile, JSON.stringify(this.config, null, 2));
+    }
+    loadUsers() {
+        const usersFile = (0, path_1.join)(this.configPath, 'users.json');
+        if ((0, fs_1.existsSync)(usersFile)) {
+            const usersData = JSON.parse((0, fs_1.readFileSync)(usersFile, 'utf-8'));
+            usersData.forEach((user) => {
+                this.users.set(user.id, user);
+            });
+        }
+    }
+    saveUsers() {
+        const usersFile = (0, path_1.join)(this.configPath, 'users.json');
+        const usersData = Array.from(this.users.values());
+        (0, fs_1.writeFileSync)(usersFile, JSON.stringify(usersData, null, 2));
+    }
+    hashPassword(password, salt) {
+        return (0, crypto_1.pbkdf2Sync)(password, salt, 100000, 64, 'sha512').toString('hex');
+    }
+    validatePassword(password) {
+        const policy = this.config.passwordPolicy;
+        if (password.length < policy.minLength)
+            return false;
+        if (policy.requireUppercase && !/[A-Z]/.test(password))
+            return false;
+        if (policy.requireLowercase && !/[a-z]/.test(password))
+            return false;
+        if (policy.requireNumbers && !/\d/.test(password))
+            return false;
+        if (policy.requireSpecialChars && !/[!@#$%^&*(),.?":{}|<>]/.test(password))
+            return false;
+        return true;
+    }
+    async logAudit(log) {
+        this.auditLogs.push(log);
+        // Also send to CloudWatch or external logging service
+        const auditFile = (0, path_1.join)(this.configPath, 'audit.log');
+        const logEntry = `${log.timestamp.toISOString()} | ${log.userId} | ${log.action} | ${log.resource} | ${log.result} | ${log.ipAddress}\n`;
+        if ((0, fs_1.existsSync)(auditFile)) {
+            (0, fs_1.writeFileSync)(auditFile, logEntry, { flag: 'a' });
+        }
+        else {
+            (0, fs_1.writeFileSync)(auditFile, logEntry);
+        }
+    }
+    // ============= Authentication Methods =============
+    async authenticateWithPassword(email, password, ipAddress = '127.0.0.1') {
+        const spinner = (0, ora_1.default)('Authenticating...').start();
+        try {
+            // Find user by email
+            const user = Array.from(this.users.values()).find(u => u.email === email);
+            if (!user) {
+                spinner.fail('Authentication failed');
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: email,
+                    action: 'LOGIN',
+                    resource: 'CLI',
+                    result: 'failure',
+                    ipAddress,
+                    details: { reason: 'User not found' }
+                });
+                return { success: false };
+            }
+            // Check if account is locked
+            if (user.lockedUntil && new Date() < new Date(user.lockedUntil)) {
+                spinner.fail('Account is locked');
+                return { success: false };
+            }
+            // Verify password
+            const hashedPassword = this.hashPassword(password, user.salt);
+            if (hashedPassword !== user.passwordHash) {
+                user.failedAttempts++;
+                if (user.failedAttempts >= this.config.loginAttempts.maxAttempts) {
+                    user.lockedUntil = new Date(Date.now() + this.config.loginAttempts.lockoutDuration * 60000);
+                    spinner.fail(`Account locked for ${this.config.loginAttempts.lockoutDuration} minutes`);
+                }
+                this.saveUsers();
+                spinner.fail('Invalid credentials');
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: user.id,
+                    action: 'LOGIN',
+                    resource: 'CLI',
+                    result: 'failure',
+                    ipAddress,
+                    details: { reason: 'Invalid password' }
+                });
+                return { success: false };
+            }
+            // Reset failed attempts
+            user.failedAttempts = 0;
+            user.lastLogin = new Date();
+            this.saveUsers();
+            // Check if MFA is required
+            if (this.config.mfaRequired && user.mfaEnabled) {
+                spinner.succeed('Password verified. MFA required');
+                return {
+                    success: true,
+                    token: this.generateTempToken(user.id),
+                    mfaRequired: true
+                };
+            }
+            // Generate session
+            const token = this.generateSessionToken(user, ipAddress);
+            spinner.succeed('Authentication successful');
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: user.id,
+                action: 'LOGIN',
+                resource: 'CLI',
+                result: 'success',
+                ipAddress
+            });
+            return { success: true, token };
+        }
+        catch (error) {
+            spinner.fail('Authentication error');
+            console.error(chalk_1.default.red('Error:'), error.message);
+            return { success: false };
+        }
+    }
+    async authenticateWithMFA(tempToken, mfaCode, ipAddress = '127.0.0.1') {
+        try {
+            // Decode temp token to get user ID
+            const decoded = jsonwebtoken_1.default.verify(tempToken, this.config.jwtSecret);
+            const user = this.users.get(decoded.userId);
+            if (!user || !user.mfaSecret) {
+                return { success: false };
+            }
+            // Verify MFA code
+            const verified = speakeasy.totp.verify({
+                secret: user.mfaSecret,
+                encoding: 'base32',
+                token: mfaCode,
+                window: 2
+            });
+            if (!verified) {
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: user.id,
+                    action: 'MFA_VERIFY',
+                    resource: 'CLI',
+                    result: 'failure',
+                    ipAddress
+                });
+                return { success: false };
+            }
+            // Generate full session
+            const token = this.generateSessionToken(user, ipAddress, true);
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: user.id,
+                action: 'MFA_VERIFY',
+                resource: 'CLI',
+                result: 'success',
+                ipAddress
+            });
+            return { success: true, token };
+        }
+        catch (error) {
+            return { success: false };
+        }
+    }
+    async authenticateWithAPIKey(apiKey, ipAddress = '127.0.0.1') {
+        const user = Array.from(this.users.values()).find(u => u.apiKey === apiKey);
+        if (!user) {
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: 'unknown',
+                action: 'API_KEY_AUTH',
+                resource: 'CLI',
+                result: 'failure',
+                ipAddress,
+                details: { reason: 'Invalid API key' }
+            });
+            return { success: false };
+        }
+        const token = this.generateSessionToken(user, ipAddress);
+        await this.logAudit({
+            timestamp: new Date(),
+            userId: user.id,
+            action: 'API_KEY_AUTH',
+            resource: 'CLI',
+            result: 'success',
+            ipAddress
+        });
+        return { success: true, token };
+    }
+    async authenticateWithSSH(sshKeyPath, email, ipAddress = '127.0.0.1') {
+        try {
+            const sshPublicKey = (0, fs_1.readFileSync)(sshKeyPath, 'utf-8').trim();
+            const user = Array.from(this.users.values()).find(u => u.email === email && u.sshPublicKey === sshPublicKey);
+            if (!user) {
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: email,
+                    action: 'SSH_AUTH',
+                    resource: 'CLI',
+                    result: 'failure',
+                    ipAddress,
+                    details: { reason: 'SSH key not recognized' }
+                });
+                return { success: false };
+            }
+            const token = this.generateSessionToken(user, ipAddress);
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: user.id,
+                action: 'SSH_AUTH',
+                resource: 'CLI',
+                result: 'success',
+                ipAddress
+            });
+            return { success: true, token };
+        }
+        catch (error) {
+            return { success: false };
+        }
+    }
+    async authenticateWithAWSRole(roleArn, ipAddress = '127.0.0.1') {
+        try {
+            // Verify AWS STS assume role
+            // This would typically use AWS STS to verify the caller can assume the role
+            const user = Array.from(this.users.values()).find(u => u.awsRoleArn === roleArn);
+            if (!user) {
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: roleArn,
+                    action: 'AWS_ROLE_AUTH',
+                    resource: 'CLI',
+                    result: 'failure',
+                    ipAddress,
+                    details: { reason: 'Role not authorized' }
+                });
+                return { success: false };
+            }
+            const token = this.generateSessionToken(user, ipAddress);
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: user.id,
+                action: 'AWS_ROLE_AUTH',
+                resource: 'CLI',
+                result: 'success',
+                ipAddress
+            });
+            return { success: true, token };
+        }
+        catch (error) {
+            return { success: false };
+        }
+    }
+    async authenticateWithCognito(username, password, ipAddress = '127.0.0.1') {
+        try {
+            const command = new client_cognito_identity_provider_1.InitiateAuthCommand({
+                AuthFlow: 'USER_PASSWORD_AUTH',
+                ClientId: process.env.COGNITO_CLIENT_ID,
+                AuthParameters: {
+                    USERNAME: username,
+                    PASSWORD: password
+                }
+            });
+            const response = await this.cognitoClient.send(command);
+            if (response.AuthenticationResult?.IdToken) {
+                // Map Cognito user to internal user
+                const user = Array.from(this.users.values()).find(u => u.email === username);
+                if (user) {
+                    const token = this.generateSessionToken(user, ipAddress);
+                    await this.logAudit({
+                        timestamp: new Date(),
+                        userId: user.id,
+                        action: 'COGNITO_AUTH',
+                        resource: 'CLI',
+                        result: 'success',
+                        ipAddress
+                    });
+                    return { success: true, token };
+                }
+            }
+            return { success: false };
+        }
+        catch (error) {
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: username,
+                action: 'COGNITO_AUTH',
+                resource: 'CLI',
+                result: 'failure',
+                ipAddress
+            });
+            return { success: false };
+        }
+    }
+    // ============= User Management =============
+    async createUser(email, password, role, createdBy, metadata) {
+        const spinner = (0, ora_1.default)('Creating user...').start();
+        try {
+            // Check if user already exists
+            if (Array.from(this.users.values()).some(u => u.email === email)) {
+                spinner.fail('User already exists');
+                return { success: false, error: 'User already exists' };
+            }
+            // Validate password
+            if (!this.validatePassword(password)) {
+                spinner.fail('Password does not meet policy requirements');
+                return { success: false, error: 'Invalid password' };
+            }
+            // Create user
+            const salt = (0, crypto_1.randomBytes)(32).toString('hex');
+            const passwordHash = this.hashPassword(password, salt);
+            const userId = (0, crypto_1.randomBytes)(16).toString('hex');
+            const user = {
+                id: userId,
+                email,
+                passwordHash,
+                salt,
+                role,
+                mfaEnabled: false,
+                passwordChangedAt: new Date(),
+                failedAttempts: 0,
+                metadata: {
+                    createdAt: new Date(),
+                    createdBy,
+                    updatedAt: new Date(),
+                    ...metadata
+                }
+            };
+            this.users.set(userId, user);
+            this.saveUsers();
+            spinner.succeed(`User created: ${email} (${role})`);
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: createdBy,
+                action: 'USER_CREATE',
+                resource: userId,
+                result: 'success',
+                ipAddress: '127.0.0.1',
+                details: { email, role }
+            });
+            return { success: true, userId };
+        }
+        catch (error) {
+            spinner.fail('Failed to create user');
+            console.error(chalk_1.default.red('Error:'), error.message);
+            return { success: false, error: error.message };
+        }
+    }
+    async setupMFA(userId) {
+        const user = this.users.get(userId);
+        if (!user) {
+            return { success: false };
+        }
+        const secret = speakeasy.generateSecret({
+            name: `Autonoma CLI (${user.email})`
+        });
+        user.mfaSecret = secret.base32;
+        user.mfaEnabled = true;
+        this.saveUsers();
+        const qrCode = await qrcode.toDataURL(secret.otpauth_url);
+        return {
+            success: true,
+            qrCode,
+            secret: secret.base32
+        };
+    }
+    async generateAPIKey(userId) {
+        const user = this.users.get(userId);
+        if (!user) {
+            return { success: false };
+        }
+        const apiKey = `ak_${(0, crypto_1.randomBytes)(32).toString('hex')}`;
+        user.apiKey = (0, crypto_1.createHash)('sha256').update(apiKey).digest('hex');
+        this.saveUsers();
+        await this.logAudit({
+            timestamp: new Date(),
+            userId,
+            action: 'API_KEY_GENERATE',
+            resource: 'CLI',
+            result: 'success',
+            ipAddress: '127.0.0.1'
+        });
+        return { success: true, apiKey };
+    }
+    // ============= Authorization =============
+    hasPermission(userId, permission) {
+        const user = this.users.get(userId);
+        if (!user)
+            return false;
+        const rolePermissions = ROLE_PERMISSIONS[user.role] || [];
+        return rolePermissions.includes(permission);
+    }
+    checkAccess(token, permission) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, this.config.jwtSecret);
+            const session = this.sessions.get(decoded.sessionId);
+            if (!session || new Date() > new Date(session.expiresAt)) {
+                return false;
+            }
+            return this.hasPermission(session.userId, permission);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    // ============= Session Management =============
+    generateTempToken(userId) {
+        return jsonwebtoken_1.default.sign({ userId, temp: true }, this.config.jwtSecret, { expiresIn: '5m' });
+    }
+    generateSessionToken(user, ipAddress, mfaVerified = false) {
+        const sessionId = (0, crypto_1.randomBytes)(16).toString('hex');
+        const expiresAt = new Date(Date.now() + this.config.sessionTimeout);
+        const session = {
+            userId: user.id,
+            token: sessionId,
+            expiresAt,
+            ipAddress,
+            userAgent: 'Autonoma CLI',
+            mfaVerified
+        };
+        this.sessions.set(sessionId, session);
+        return jsonwebtoken_1.default.sign({
+            sessionId,
+            userId: user.id,
+            email: user.email,
+            role: user.role,
+            permissions: ROLE_PERMISSIONS[user.role]
+        }, this.config.jwtSecret, { expiresIn: this.config.sessionTimeout / 1000 });
+    }
+    async revokeSession(token) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, this.config.jwtSecret);
+            const session = this.sessions.get(decoded.sessionId);
+            if (session) {
+                this.sessions.delete(decoded.sessionId);
+                await this.logAudit({
+                    timestamp: new Date(),
+                    userId: session.userId,
+                    action: 'LOGOUT',
+                    resource: 'CLI',
+                    result: 'success',
+                    ipAddress: session.ipAddress
+                });
+                return true;
+            }
+            return false;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    // ============= Security Features =============
+    async rotateSecrets() {
+        const spinner = (0, ora_1.default)('Rotating security secrets...').start();
+        try {
+            // Rotate JWT secret
+            this.config.jwtSecret = (0, crypto_1.randomBytes)(64).toString('hex');
+            this.saveConfig();
+            // Invalidate all existing sessions
+            this.sessions.clear();
+            // Rotate all API keys
+            for (const user of this.users.values()) {
+                if (user.apiKey) {
+                    user.apiKey = (0, crypto_1.createHash)('sha256')
+                        .update(`ak_${(0, crypto_1.randomBytes)(32).toString('hex')}`)
+                        .digest('hex');
+                }
+            }
+            this.saveUsers();
+            spinner.succeed('Security secrets rotated');
+            await this.logAudit({
+                timestamp: new Date(),
+                userId: 'system',
+                action: 'SECRET_ROTATION',
+                resource: 'CLI',
+                result: 'success',
+                ipAddress: '127.0.0.1'
+            });
+        }
+        catch (error) {
+            spinner.fail('Failed to rotate secrets');
+            console.error(chalk_1.default.red('Error:'), error.message);
+        }
+    }
+    async enforcePasswordRotation() {
+        const maxAge = this.config.passwordPolicy.maxAge * 24 * 60 * 60 * 1000;
+        const now = Date.now();
+        for (const user of this.users.values()) {
+            const passwordAge = now - new Date(user.passwordChangedAt).getTime();
+            if (passwordAge > maxAge) {
+                console.log(chalk_1.default.yellow(`Password expired for user: ${user.email}`));
+                // In production, would force password change on next login
+            }
+        }
+    }
+    // ============= Audit & Compliance =============
+    async getAuditLogs(filters) {
+        let logs = [...this.auditLogs];
+        if (filters) {
+            if (filters.userId) {
+                logs = logs.filter(log => log.userId === filters.userId);
+            }
+            if (filters.action) {
+                logs = logs.filter(log => log.action === filters.action);
+            }
+            if (filters.result) {
+                logs = logs.filter(log => log.result === filters.result);
+            }
+            if (filters.startDate) {
+                const startDate = filters.startDate;
+                logs = logs.filter(log => log.timestamp >= startDate);
+            }
+            if (filters.endDate) {
+                const endDate = filters.endDate;
+                logs = logs.filter(log => log.timestamp <= endDate);
+            }
+        }
+        return logs;
+    }
+    async generateComplianceReport() {
+        const report = {
+            timestamp: new Date(),
+            users: {
+                total: this.users.size,
+                byRole: {},
+                mfaEnabled: 0,
+                passwordCompliant: 0
+            },
+            sessions: {
+                active: this.sessions.size,
+                mfaVerified: 0
+            },
+            security: {
+                failedLogins: 0,
+                lockedAccounts: 0,
+                apiKeysActive: 0,
+                sshKeysConfigured: 0
+            },
+            audit: {
+                totalEvents: this.auditLogs.length,
+                successfulLogins: 0,
+                failedLogins: 0,
+                privilegedActions: 0
+            }
+        };
+        // Calculate statistics
+        for (const user of this.users.values()) {
+            report.users.byRole[user.role] = (report.users.byRole[user.role] || 0) + 1;
+            if (user.mfaEnabled)
+                report.users.mfaEnabled++;
+            if (user.apiKey)
+                report.security.apiKeysActive++;
+            if (user.sshPublicKey)
+                report.security.sshKeysConfigured++;
+            if (user.lockedUntil && new Date() < new Date(user.lockedUntil)) {
+                report.security.lockedAccounts++;
+            }
+        }
+        for (const session of this.sessions.values()) {
+            if (session.mfaVerified)
+                report.sessions.mfaVerified++;
+        }
+        for (const log of this.auditLogs) {
+            if (log.action === 'LOGIN' && log.result === 'success') {
+                report.audit.successfulLogins++;
+            }
+            if (log.action === 'LOGIN' && log.result === 'failure') {
+                report.audit.failedLogins++;
+                report.security.failedLogins++;
+            }
+            if (['USER_CREATE', 'USER_DELETE', 'SECRET_ROTATION'].includes(log.action)) {
+                report.audit.privilegedActions++;
+            }
+        }
+        return report;
+    }
+    // ============= Integration with External Systems =============
+    async fetchSecretsFromAWS(secretName) {
+        try {
+            const command = new client_secrets_manager_1.GetSecretValueCommand({
+                SecretId: secretName
+            });
+            const response = await this.secretsClient.send(command);
+            return JSON.parse(response.SecretString || '{}');
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Failed to fetch AWS secret:'), error);
+            return null;
+        }
+    }
+    async fetchParameterFromSSM(parameterName) {
+        try {
+            const command = new client_ssm_1.GetParameterCommand({
+                Name: parameterName,
+                WithDecryption: true
+            });
+            const response = await this.ssmClient.send(command);
+            return response.Parameter?.Value || null;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Failed to fetch SSM parameter:'), error);
+            return null;
+        }
+    }
+    // ============= CLI Command Interface =============
+    async displayAccessInfo() {
+        console.log(chalk_1.default.cyan('\n📊 Access Control Configuration\n'));
+        console.log(chalk_1.default.blue('Authentication Methods:'));
+        console.log('  • Password + MFA');
+        console.log('  • API Key');
+        console.log('  • SSH Key');
+        console.log('  • AWS IAM Role');
+        console.log('  • AWS Cognito');
+        console.log(chalk_1.default.blue('\nAvailable Roles:'));
+        for (const role of Object.values(AdminRole)) {
+            const permissions = ROLE_PERMISSIONS[role];
+            console.log(`  • ${role} (${permissions.length} permissions)`);
+        }
+        console.log(chalk_1.default.blue('\nPassword Policy:'));
+        console.log(`  • Minimum length: ${this.config.passwordPolicy.minLength}`);
+        console.log(`  • Uppercase required: ${this.config.passwordPolicy.requireUppercase}`);
+        console.log(`  • Lowercase required: ${this.config.passwordPolicy.requireLowercase}`);
+        console.log(`  • Numbers required: ${this.config.passwordPolicy.requireNumbers}`);
+        console.log(`  • Special chars required: ${this.config.passwordPolicy.requireSpecialChars}`);
+        console.log(`  • Maximum age: ${this.config.passwordPolicy.maxAge} days`);
+        console.log(chalk_1.default.blue('\nSecurity Settings:'));
+        console.log(`  • MFA required: ${this.config.mfaRequired}`);
+        console.log(`  • Session timeout: ${this.config.sessionTimeout / 60000} minutes`);
+        console.log(`  • Max login attempts: ${this.config.loginAttempts.maxAttempts}`);
+        console.log(`  • Lockout duration: ${this.config.loginAttempts.lockoutDuration} minutes`);
+        const report = await this.generateComplianceReport();
+        console.log(chalk_1.default.blue('\nCurrent Status:'));
+        console.log(`  • Total users: ${report.users.total}`);
+        console.log(`  • Active sessions: ${report.sessions.active}`);
+        console.log(`  • MFA enabled users: ${report.users.mfaEnabled}`);
+        console.log(`  • Locked accounts: ${report.security.lockedAccounts}`);
+        console.log(`  • Audit events: ${report.audit.totalEvents}`);
+    }
+}
+exports.AuthAccessControlModule = AuthAccessControlModule;
+//# sourceMappingURL=auth-access-control.js.map