@claude-flow/security 3.0.0-alpha.1

package/dist/application/services/security-application-service.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Security Application Service - Application Layer
+ *
+ * Orchestrates security operations and provides simplified interface.
+ *
+ * @module v3/security/application/services
+ */
+import { SecurityContext } from '../../domain/entities/security-context.js';
+import { ValidationResult, ThreatDetectionResult } from '../../domain/services/security-domain-service.js';
+/**
+ * Security audit result
+ */
+export interface SecurityAuditResult {
+    passed: boolean;
+    score: number;
+    checks: Array<{
+        name: string;
+        passed: boolean;
+        severity: 'low' | 'medium' | 'high' | 'critical';
+        message: string;
+    }>;
+    recommendations: string[];
+}
+/**
+ * Security Application Service
+ */
+export declare class SecurityApplicationService {
+    private readonly domainService;
+    private readonly contexts;
+    constructor();
+    /**
+     * Create and register security context for agent
+     */
+    createAgentContext(agentId: string, role: string): SecurityContext;
+    /**
+     * Get security context
+     */
+    getContext(principalId: string): SecurityContext | undefined;
+    /**
+     * Remove security context
+     */
+    removeContext(principalId: string): boolean;
+    /**
+     * Validate path access
+     */
+    validatePath(path: string, principalId: string): ValidationResult;
+    /**
+     * Validate command execution
+     */
+    validateCommand(command: string, principalId: string): ValidationResult;
+    /**
+     * Validate user input
+     */
+    validateInput(input: string): ValidationResult;
+    /**
+     * Detect threats in content
+     */
+    detectThreats(content: string): ThreatDetectionResult;
+    /**
+     * Run security audit on codebase
+     */
+    auditCodebase(files: Array<{
+        path: string;
+        content: string;
+    }>): Promise<SecurityAuditResult>;
+    /**
+     * Check if operation is allowed
+     */
+    isOperationAllowed(principalId: string, operation: 'path' | 'command', target: string): boolean;
+}
+//# sourceMappingURL=security-application-service.d.ts.map

package/dist/application/services/security-application-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-application-service.d.ts","sourceRoot":"","sources":["../../../src/application/services/security-application-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAmB,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAyB,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAElI;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;;IAUpE;;OAEG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe;IAMlE;;OAEG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI5D;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ3C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB;IAajE;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB;IAavE;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB;IAI9C;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAQrD;;OAEG;IACG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAsDlG;;OAEG;IACH,kBAAkB,CAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACb,OAAO;CAUX"}

package/dist/application/services/security-application-service.js

@@ -0,0 +1,153 @@
+/**
+ * Security Application Service - Application Layer
+ *
+ * Orchestrates security operations and provides simplified interface.
+ *
+ * @module v3/security/application/services
+ */
+import { SecurityDomainService } from '../../domain/services/security-domain-service.js';
+/**
+ * Security Application Service
+ */
+export class SecurityApplicationService {
+    domainService;
+    contexts = new Map();
+    constructor() {
+        this.domainService = new SecurityDomainService();
+    }
+    // ============================================================================
+    // Context Management
+    // ============================================================================
+    /**
+     * Create and register security context for agent
+     */
+    createAgentContext(agentId, role) {
+        const context = this.domainService.createAgentContext(agentId, role);
+        this.contexts.set(agentId, context);
+        return context;
+    }
+    /**
+     * Get security context
+     */
+    getContext(principalId) {
+        return this.contexts.get(principalId);
+    }
+    /**
+     * Remove security context
+     */
+    removeContext(principalId) {
+        return this.contexts.delete(principalId);
+    }
+    // ============================================================================
+    // Validation
+    // ============================================================================
+    /**
+     * Validate path access
+     */
+    validatePath(path, principalId) {
+        const context = this.contexts.get(principalId);
+        if (!context) {
+            return {
+                valid: false,
+                errors: ['Security context not found'],
+                warnings: [],
+            };
+        }
+        return this.domainService.validatePath(path, context);
+    }
+    /**
+     * Validate command execution
+     */
+    validateCommand(command, principalId) {
+        const context = this.contexts.get(principalId);
+        if (!context) {
+            return {
+                valid: false,
+                errors: ['Security context not found'],
+                warnings: [],
+            };
+        }
+        return this.domainService.validateCommand(command, context);
+    }
+    /**
+     * Validate user input
+     */
+    validateInput(input) {
+        return this.domainService.validateInput(input);
+    }
+    /**
+     * Detect threats in content
+     */
+    detectThreats(content) {
+        return this.domainService.detectThreats(content);
+    }
+    // ============================================================================
+    // Audit
+    // ============================================================================
+    /**
+     * Run security audit on codebase
+     */
+    async auditCodebase(files) {
+        const checks = [];
+        const recommendations = [];
+        let criticalCount = 0;
+        let highCount = 0;
+        for (const file of files) {
+            const threats = this.domainService.detectThreats(file.content);
+            for (const threat of threats.threats) {
+                checks.push({
+                    name: `${threat.type} in ${file.path}`,
+                    passed: false,
+                    severity: threat.severity,
+                    message: threat.description,
+                });
+                if (threat.severity === 'critical')
+                    criticalCount++;
+                if (threat.severity === 'high')
+                    highCount++;
+            }
+            if (threats.safe) {
+                checks.push({
+                    name: `Security check: ${file.path}`,
+                    passed: true,
+                    severity: 'low',
+                    message: 'No threats detected',
+                });
+            }
+        }
+        // Generate recommendations
+        if (criticalCount > 0) {
+            recommendations.push('Address critical security issues immediately');
+        }
+        if (highCount > 0) {
+            recommendations.push('Review and fix high-severity findings');
+        }
+        recommendations.push('Run regular security scans');
+        recommendations.push('Keep dependencies updated');
+        // Calculate score
+        const totalChecks = checks.length;
+        const passedChecks = checks.filter((c) => c.passed).length;
+        const score = totalChecks > 0 ? Math.round((passedChecks / totalChecks) * 100) : 100;
+        return {
+            passed: criticalCount === 0 && highCount === 0,
+            score,
+            checks,
+            recommendations,
+        };
+    }
+    /**
+     * Check if operation is allowed
+     */
+    isOperationAllowed(principalId, operation, target) {
+        const context = this.contexts.get(principalId);
+        if (!context || context.isExpired())
+            return false;
+        if (operation === 'path') {
+            return context.canAccessPath(target);
+        }
+        else {
+            return context.canExecuteCommand(target);
+        }
+    }
+}
+//# sourceMappingURL=security-application-service.js.map

package/dist/application/services/security-application-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-application-service.js","sourceRoot":"","sources":["../../../src/application/services/security-application-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,qBAAqB,EAA2C,MAAM,kDAAkD,CAAC;AAiBlI;;GAEG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,CAAwB;IACrC,QAAQ,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEpE;QACE,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,qBAAqB;IACrB,+EAA+E;IAE/E;;OAEG;IACH,kBAAkB,CAAC,OAAe,EAAE,IAAY;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,+EAA+E;IAC/E,aAAa;IACb,+EAA+E;IAE/E;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,WAAmB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,CAAC,4BAA4B,CAAC;gBACtC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe,EAAE,WAAmB;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,CAAC,4BAA4B,CAAC;gBACtC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,QAAQ;IACR,+EAA+E;IAE/E;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,KAA+C;QACjE,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/D,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,WAAW;iBAC5B,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU;oBAAE,aAAa,EAAE,CAAC;gBACpD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;oBAAE,SAAS,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,mBAAmB,IAAI,CAAC,IAAI,EAAE;oBACpC,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,qBAAqB;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,eAAe,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,eAAe,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACnD,eAAe,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAElD,kBAAkB;QAClB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC3D,MAAM,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAErF,OAAO;YACL,MAAM,EAAE,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC;YAC9C,KAAK;YACL,MAAM;YACN,eAAe;SAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,WAAmB,EACnB,SAA6B,EAC7B,MAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE;YAAE,OAAO,KAAK,CAAC;QAElD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF"}

package/dist/credential-generator.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Credential Generator - CVE-3 Remediation
+ *
+ * Fixes hardcoded default credentials by providing secure random
+ * credential generation for installation and runtime.
+ *
+ * Security Properties:
+ * - Uses crypto.randomBytes for cryptographically secure randomness
+ * - Configurable entropy levels
+ * - No hardcoded defaults stored in code
+ * - Secure credential storage recommendations
+ *
+ * @module v3/security/credential-generator
+ */
+export interface CredentialConfig {
+    /**
+     * Length of generated passwords.
+     * Default: 32 characters
+     */
+    passwordLength?: number;
+    /**
+     * Length of generated API keys.
+     * Default: 48 characters
+     */
+    apiKeyLength?: number;
+    /**
+     * Length of generated secrets (JWT, session, etc.).
+     * Default: 64 characters
+     */
+    secretLength?: number;
+    /**
+     * Character set for password generation.
+     * Default: alphanumeric + special
+     */
+    passwordCharset?: string;
+    /**
+     * Character set for API key generation.
+     * Default: alphanumeric only (URL-safe)
+     */
+    apiKeyCharset?: string;
+}
+export interface GeneratedCredentials {
+    adminPassword: string;
+    servicePassword: string;
+    jwtSecret: string;
+    sessionSecret: string;
+    encryptionKey: string;
+    generatedAt: Date;
+    expiresAt?: Date;
+}
+export interface ApiKeyCredential {
+    key: string;
+    prefix: string;
+    keyId: string;
+    createdAt: Date;
+}
+export declare class CredentialGeneratorError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Secure credential generator.
+ *
+ * This class provides cryptographically secure credential generation
+ * to replace hardcoded default credentials.
+ *
+ * @example
+ * ```typescript
+ * const generator = new CredentialGenerator();
+ * const credentials = generator.generateInstallationCredentials();
+ * // Store credentials securely (environment variables, secrets manager)
+ * ```
+ */
+export declare class CredentialGenerator {
+    private readonly config;
+    constructor(config?: CredentialConfig);
+    /**
+     * Validates configuration parameters.
+     */
+    private validateConfig;
+    /**
+     * Generates a cryptographically secure random string using rejection sampling
+     * to eliminate modulo bias.
+     *
+     * @param length - Length of the string to generate
+     * @param charset - Character set to use
+     * @returns Random string
+     */
+    private generateSecureString;
+    /**
+     * Generates a secure random password.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Secure random password
+     */
+    generatePassword(length?: number): string;
+    /**
+     * Checks if password has required character types.
+     */
+    private hasRequiredCharacterTypes;
+    /**
+     * Generates a secure API key.
+     *
+     * @param prefix - Optional prefix for the key (e.g., 'cf_')
+     * @returns API key credential with metadata
+     */
+    generateApiKey(prefix?: string): ApiKeyCredential;
+    /**
+     * Generates a secure secret for JWT, sessions, etc.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Hex-encoded secret
+     */
+    generateSecret(length?: number): string;
+    /**
+     * Generates an encryption key suitable for AES-256.
+     *
+     * @returns 32-byte key encoded as hex (64 characters)
+     */
+    generateEncryptionKey(): string;
+    /**
+     * Generates a complete set of installation credentials.
+     *
+     * These should be stored securely (environment variables,
+     * secrets manager, etc.) and NEVER committed to version control.
+     *
+     * @param expirationDays - Optional expiration period in days
+     * @returns Complete credential set
+     */
+    generateInstallationCredentials(expirationDays?: number): GeneratedCredentials;
+    /**
+     * Generates a secure session token.
+     *
+     * @returns URL-safe session token
+     */
+    generateSessionToken(): string;
+    /**
+     * Generates a secure CSRF token.
+     *
+     * @returns CSRF token
+     */
+    generateCsrfToken(): string;
+    /**
+     * Generates a secure nonce for one-time use.
+     *
+     * @returns Unique nonce value
+     */
+    generateNonce(): string;
+    /**
+     * Creates a setup script output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns Environment variable export script
+     */
+    createEnvScript(credentials: GeneratedCredentials): string;
+    /**
+     * Creates a JSON configuration output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns JSON configuration (for secrets manager import)
+     */
+    createJsonConfig(credentials: GeneratedCredentials): string;
+}
+/**
+ * Factory function to create a production credential generator.
+ *
+ * @returns Configured CredentialGenerator instance
+ */
+export declare function createCredentialGenerator(): CredentialGenerator;
+/**
+ * Quick credential generation for CLI usage.
+ *
+ * @returns Generated installation credentials
+ */
+export declare function generateCredentials(): GeneratedCredentials;
+//# sourceMappingURL=credential-generator.d.ts.map

package/dist/credential-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-generator.d.ts","sourceRoot":"","sources":["../src/credential-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aAG/B,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAgBD;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAExC,MAAM,GAAE,gBAAqB;IAazC;;OAEG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IA6B5B;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAezC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;OAKG;IACH,cAAc,CAAC,MAAM,SAAQ,GAAG,gBAAgB;IAiBhD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAMvC;;;;OAIG;IACH,qBAAqB,IAAI,MAAM;IAI/B;;;;;;;;OAQG;IACH,+BAA+B,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,oBAAoB;IAiB9E;;;;OAIG;IACH,oBAAoB,IAAI,MAAM;IAI9B;;;;OAIG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;;;OAIG;IACH,aAAa,IAAI,MAAM;IAIvB;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,oBAAoB,GAAG,MAAM;IAa1D;;;;;OAKG;IACH,gBAAgB,CAAC,WAAW,EAAE,oBAAoB,GAAG,MAAM;CAW5D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CAG1D"}

package/dist/credential-generator.js

@@ -0,0 +1,272 @@
+/**
+ * Credential Generator - CVE-3 Remediation
+ *
+ * Fixes hardcoded default credentials by providing secure random
+ * credential generation for installation and runtime.
+ *
+ * Security Properties:
+ * - Uses crypto.randomBytes for cryptographically secure randomness
+ * - Configurable entropy levels
+ * - No hardcoded defaults stored in code
+ * - Secure credential storage recommendations
+ *
+ * @module v3/security/credential-generator
+ */
+import { randomBytes, randomUUID } from 'crypto';
+export class CredentialGeneratorError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'CredentialGeneratorError';
+    }
+}
+/**
+ * Character sets for credential generation
+ */
+const CHARSETS = {
+    UPPERCASE: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
+    LOWERCASE: 'abcdefghijklmnopqrstuvwxyz',
+    DIGITS: '0123456789',
+    SPECIAL: '!@#$%^&*()_+-=[]{}|;:,.<>?',
+    // URL-safe characters for API keys
+    URL_SAFE: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',
+    // Hex characters for secrets
+    HEX: '0123456789abcdef',
+};
+/**
+ * Secure credential generator.
+ *
+ * This class provides cryptographically secure credential generation
+ * to replace hardcoded default credentials.
+ *
+ * @example
+ * ```typescript
+ * const generator = new CredentialGenerator();
+ * const credentials = generator.generateInstallationCredentials();
+ * // Store credentials securely (environment variables, secrets manager)
+ * ```
+ */
+export class CredentialGenerator {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            passwordLength: config.passwordLength ?? 32,
+            apiKeyLength: config.apiKeyLength ?? 48,
+            secretLength: config.secretLength ?? 64,
+            passwordCharset: config.passwordCharset ??
+                CHARSETS.UPPERCASE + CHARSETS.LOWERCASE + CHARSETS.DIGITS + CHARSETS.SPECIAL,
+            apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,
+        };
+        this.validateConfig();
+    }
+    /**
+     * Validates configuration parameters.
+     */
+    validateConfig() {
+        if (this.config.passwordLength < 16) {
+            throw new CredentialGeneratorError('Password length must be at least 16 characters', 'INVALID_PASSWORD_LENGTH');
+        }
+        if (this.config.apiKeyLength < 32) {
+            throw new CredentialGeneratorError('API key length must be at least 32 characters', 'INVALID_API_KEY_LENGTH');
+        }
+        if (this.config.secretLength < 32) {
+            throw new CredentialGeneratorError('Secret length must be at least 32 characters', 'INVALID_SECRET_LENGTH');
+        }
+    }
+    /**
+     * Generates a cryptographically secure random string using rejection sampling
+     * to eliminate modulo bias.
+     *
+     * @param length - Length of the string to generate
+     * @param charset - Character set to use
+     * @returns Random string
+     */
+    generateSecureString(length, charset) {
+        const charsetLength = charset.length;
+        const result = new Array(length);
+        // Calculate rejection threshold to eliminate modulo bias
+        // For a byte (0-255), we reject values >= (256 - (256 % charsetLength))
+        // This ensures uniform distribution over charset indices
+        const maxValidValue = 256 - (256 % charsetLength);
+        let i = 0;
+        while (i < length) {
+            // Generate more random bytes than needed to reduce iterations
+            const randomBuffer = randomBytes(Math.max(length - i, 16));
+            for (let j = 0; j < randomBuffer.length && i < length; j++) {
+                const randomValue = randomBuffer[j];
+                // Rejection sampling: only accept values below threshold
+                if (randomValue < maxValidValue) {
+                    result[i] = charset[randomValue % charsetLength];
+                    i++;
+                }
+                // Values >= maxValidValue are rejected to avoid bias
+            }
+        }
+        return result.join('');
+    }
+    /**
+     * Generates a secure random password.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Secure random password
+     */
+    generatePassword(length) {
+        const len = length ?? this.config.passwordLength;
+        // Ensure password contains at least one of each required character type
+        const password = this.generateSecureString(len, this.config.passwordCharset);
+        // Validate the generated password meets requirements
+        if (!this.hasRequiredCharacterTypes(password)) {
+            // Regenerate if requirements not met (rare case)
+            return this.generatePassword(length);
+        }
+        return password;
+    }
+    /**
+     * Checks if password has required character types.
+     */
+    hasRequiredCharacterTypes(password) {
+        const hasUppercase = /[A-Z]/.test(password);
+        const hasLowercase = /[a-z]/.test(password);
+        const hasDigit = /\d/.test(password);
+        const hasSpecial = /[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password);
+        return hasUppercase && hasLowercase && hasDigit && hasSpecial;
+    }
+    /**
+     * Generates a secure API key.
+     *
+     * @param prefix - Optional prefix for the key (e.g., 'cf_')
+     * @returns API key credential with metadata
+     */
+    generateApiKey(prefix = 'cf_') {
+        const keyBody = this.generateSecureString(this.config.apiKeyLength - prefix.length, this.config.apiKeyCharset);
+        const key = `${prefix}${keyBody}`;
+        const keyId = randomUUID();
+        return {
+            key,
+            prefix,
+            keyId,
+            createdAt: new Date(),
+        };
+    }
+    /**
+     * Generates a secure secret for JWT, sessions, etc.
+     *
+     * @param length - Optional custom length (default from config)
+     * @returns Hex-encoded secret
+     */
+    generateSecret(length) {
+        const len = length ?? this.config.secretLength;
+        // Generate raw bytes and encode as hex for consistent storage
+        return randomBytes(Math.ceil(len / 2)).toString('hex').slice(0, len);
+    }
+    /**
+     * Generates an encryption key suitable for AES-256.
+     *
+     * @returns 32-byte key encoded as hex (64 characters)
+     */
+    generateEncryptionKey() {
+        return randomBytes(32).toString('hex');
+    }
+    /**
+     * Generates a complete set of installation credentials.
+     *
+     * These should be stored securely (environment variables,
+     * secrets manager, etc.) and NEVER committed to version control.
+     *
+     * @param expirationDays - Optional expiration period in days
+     * @returns Complete credential set
+     */
+    generateInstallationCredentials(expirationDays) {
+        const now = new Date();
+        const expiresAt = expirationDays
+            ? new Date(now.getTime() + expirationDays * 24 * 60 * 60 * 1000)
+            : undefined;
+        return {
+            adminPassword: this.generatePassword(),
+            servicePassword: this.generatePassword(),
+            jwtSecret: this.generateSecret(64),
+            sessionSecret: this.generateSecret(64),
+            encryptionKey: this.generateEncryptionKey(),
+            generatedAt: now,
+            expiresAt,
+        };
+    }
+    /**
+     * Generates a secure session token.
+     *
+     * @returns URL-safe session token
+     */
+    generateSessionToken() {
+        return this.generateSecureString(64, CHARSETS.URL_SAFE);
+    }
+    /**
+     * Generates a secure CSRF token.
+     *
+     * @returns CSRF token
+     */
+    generateCsrfToken() {
+        return randomBytes(32).toString('base64url');
+    }
+    /**
+     * Generates a secure nonce for one-time use.
+     *
+     * @returns Unique nonce value
+     */
+    generateNonce() {
+        return randomBytes(16).toString('hex');
+    }
+    /**
+     * Creates a setup script output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns Environment variable export script
+     */
+    createEnvScript(credentials) {
+        return `# Claude Flow V3 - Generated Credentials
+# Generated: ${credentials.generatedAt.toISOString()}
+# IMPORTANT: Store these securely and delete this file after use
+
+export CLAUDE_FLOW_ADMIN_PASSWORD="${credentials.adminPassword}"
+export CLAUDE_FLOW_SERVICE_PASSWORD="${credentials.servicePassword}"
+export CLAUDE_FLOW_JWT_SECRET="${credentials.jwtSecret}"
+export CLAUDE_FLOW_SESSION_SECRET="${credentials.sessionSecret}"
+export CLAUDE_FLOW_ENCRYPTION_KEY="${credentials.encryptionKey}"
+`;
+    }
+    /**
+     * Creates a JSON configuration output for secure credential deployment.
+     *
+     * @param credentials - Generated credentials
+     * @returns JSON configuration (for secrets manager import)
+     */
+    createJsonConfig(credentials) {
+        return JSON.stringify({
+            'claude-flow/admin-password': credentials.adminPassword,
+            'claude-flow/service-password': credentials.servicePassword,
+            'claude-flow/jwt-secret': credentials.jwtSecret,
+            'claude-flow/session-secret': credentials.sessionSecret,
+            'claude-flow/encryption-key': credentials.encryptionKey,
+            'claude-flow/generated-at': credentials.generatedAt.toISOString(),
+            'claude-flow/expires-at': credentials.expiresAt?.toISOString() ?? null,
+        }, null, 2);
+    }
+}
+/**
+ * Factory function to create a production credential generator.
+ *
+ * @returns Configured CredentialGenerator instance
+ */
+export function createCredentialGenerator() {
+    return new CredentialGenerator();
+}
+/**
+ * Quick credential generation for CLI usage.
+ *
+ * @returns Generated installation credentials
+ */
+export function generateCredentials() {
+    const generator = new CredentialGenerator();
+    return generator.generateInstallationCredentials();
+}
+//# sourceMappingURL=credential-generator.js.map