@claude-flow/security 3.0.0-alpha.9 → 3.0.0

package/src/domain/services/security-domain-service.ts

@@ -1,296 +0,0 @@
-/**
- * Security Domain Service - Domain Layer
- *
- * Contains security logic for validation, policy enforcement, and threat detection.
- *
- * @module v3/security/domain/services
- */
-
-import { SecurityContext, PermissionLevel } from '../entities/security-context.js';
-
-/**
- * Validation result
- */
-export interface ValidationResult {
-  valid: boolean;
-  errors: string[];
-  warnings: string[];
-  sanitized?: string;
-}
-
-/**
- * Threat detection result
- */
-export interface ThreatDetectionResult {
-  safe: boolean;
-  threats: Array<{
-    type: string;
-    severity: 'low' | 'medium' | 'high' | 'critical';
-    description: string;
-    location?: string;
-  }>;
-}
-
-/**
- * Security Domain Service
- */
-export class SecurityDomainService {
-  // Dangerous patterns for path traversal
-  private static readonly PATH_TRAVERSAL_PATTERNS = [
-    /\.\./,
-    /~\//,
-    /^\/etc\//,
-    /^\/tmp\//,
-    /^\/var\/log\//,
-    /^C:\\Windows/i,
-    /^C:\\Users\\[^\\]+\\AppData/i,
-  ];
-
-  // Dangerous command patterns
-  private static readonly DANGEROUS_COMMANDS = [
-    /^rm\s+-rf\s+\//,
-    /^rm\s+-rf\s+\*/,
-    /^dd\s+if=/,
-    /^mkfs\./,
-    /^format\s+/i,
-    /^del\s+\/s\s+\/q/i,
-    />\s*\/dev\/sd[a-z]/,
-    /\|\s*bash$/,
-    /\|\s*sh$/,
-    /eval\s*\(/,
-    /exec\s*\(/,
-  ];
-
-  // SQL injection patterns
-  private static readonly SQL_INJECTION_PATTERNS = [
-    /'\s*OR\s+'1'\s*=\s*'1/i,
-    /'\s*OR\s+1\s*=\s*1/i,
-    /;\s*DROP\s+TABLE/i,
-    /;\s*DELETE\s+FROM/i,
-    /UNION\s+SELECT/i,
-    /--\s*$/,
-  ];
-
-  // XSS patterns
-  private static readonly XSS_PATTERNS = [
-    /<script[\s>]/i,
-    /javascript:/i,
-    /on\w+\s*=/i,
-    /<iframe/i,
-    /<object/i,
-    /<embed/i,
-  ];
-
-  /**
-   * Validate a file path
-   */
-  validatePath(path: string, context: SecurityContext): ValidationResult {
-    const errors: string[] = [];
-    const warnings: string[] = [];
-
-    // Check path traversal
-    for (const pattern of SecurityDomainService.PATH_TRAVERSAL_PATTERNS) {
-      if (pattern.test(path)) {
-        errors.push(`Path traversal detected: ${pattern.source}`);
-      }
-    }
-
-    // Check context permissions
-    if (!context.canAccessPath(path)) {
-      errors.push(`Access denied to path: ${path}`);
-    }
-
-    // Check for suspicious paths
-    if (path.includes('..')) {
-      warnings.push('Path contains parent directory reference');
-    }
-
-    return {
-      valid: errors.length === 0,
-      errors,
-      warnings,
-      sanitized: this.sanitizePath(path),
-    };
-  }
-
-  /**
-   * Validate a command
-   */
-  validateCommand(command: string, context: SecurityContext): ValidationResult {
-    const errors: string[] = [];
-    const warnings: string[] = [];
-
-    // Check dangerous commands
-    for (const pattern of SecurityDomainService.DANGEROUS_COMMANDS) {
-      if (pattern.test(command)) {
-        errors.push(`Dangerous command pattern detected: ${pattern.source}`);
-      }
-    }
-
-    // Check context permissions
-    if (!context.canExecuteCommand(command)) {
-      errors.push(`Command execution denied: ${command}`);
-    }
-
-    if (!context.hasPermission('execute')) {
-      errors.push('Execute permission required');
-    }
-
-    // Check for shell injection
-    if (/[;&|`$(){}]/.test(command)) {
-      warnings.push('Command contains shell metacharacters');
-    }
-
-    return {
-      valid: errors.length === 0,
-      errors,
-      warnings,
-      sanitized: this.sanitizeCommand(command),
-    };
-  }
-
-  /**
-   * Validate user input
-   */
-  validateInput(input: string): ValidationResult {
-    const errors: string[] = [];
-    const warnings: string[] = [];
-
-    // Check for SQL injection
-    for (const pattern of SecurityDomainService.SQL_INJECTION_PATTERNS) {
-      if (pattern.test(input)) {
-        errors.push(`SQL injection pattern detected`);
-        break;
-      }
-    }
-
-    // Check for XSS
-    for (const pattern of SecurityDomainService.XSS_PATTERNS) {
-      if (pattern.test(input)) {
-        errors.push(`XSS pattern detected`);
-        break;
-      }
-    }
-
-    // Check length
-    if (input.length > 10000) {
-      warnings.push('Input exceeds recommended length');
-    }
-
-    return {
-      valid: errors.length === 0,
-      errors,
-      warnings,
-      sanitized: this.sanitizeInput(input),
-    };
-  }
-
-  /**
-   * Detect threats in content
-   */
-  detectThreats(content: string): ThreatDetectionResult {
-    const threats: ThreatDetectionResult['threats'] = [];
-
-    // Check for various threat patterns
-    if (/<script/i.test(content)) {
-      threats.push({
-        type: 'xss',
-        severity: 'high',
-        description: 'Script tag detected',
-      });
-    }
-
-    if (/password\s*[:=]\s*["'][^"']+["']/i.test(content)) {
-      threats.push({
-        type: 'credential-exposure',
-        severity: 'critical',
-        description: 'Hardcoded password detected',
-      });
-    }
-
-    if (/api[_-]?key\s*[:=]\s*["'][^"']+["']/i.test(content)) {
-      threats.push({
-        type: 'credential-exposure',
-        severity: 'critical',
-        description: 'API key detected',
-      });
-    }
-
-    if (/eval\s*\(/.test(content)) {
-      threats.push({
-        type: 'code-injection',
-        severity: 'high',
-        description: 'Eval statement detected',
-      });
-    }
-
-    return {
-      safe: threats.length === 0,
-      threats,
-    };
-  }
-
-  /**
-   * Sanitize path
-   */
-  private sanitizePath(path: string): string {
-    return path
-      .replace(/\.\./g, '')
-      .replace(/\/\//g, '/')
-      .replace(/^~\//, '')
-      .trim();
-  }
-
-  /**
-   * Sanitize command
-   */
-  private sanitizeCommand(command: string): string {
-    return command
-      .replace(/[;&|`$]/g, '')
-      .replace(/\$\([^)]*\)/g, '')
-      .trim();
-  }
-
-  /**
-   * Sanitize user input
-   */
-  private sanitizeInput(input: string): string {
-    return input
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#x27;')
-      .replace(/\//g, '&#x2F;');
-  }
-
-  /**
-   * Create security context for agent
-   */
-  createAgentContext(
-    agentId: string,
-    role: string,
-    customPaths?: string[]
-  ): SecurityContext {
-    // Default permissions based on role
-    const rolePermissions: Record<string, PermissionLevel[]> = {
-      'queen-coordinator': ['read', 'write', 'execute', 'admin'],
-      'security-architect': ['read', 'write', 'execute', 'admin'],
-      'coder': ['read', 'write', 'execute'],
-      'reviewer': ['read'],
-      'tester': ['read', 'execute'],
-      default: ['read'],
-    };
-
-    const permissions = rolePermissions[role] ?? rolePermissions.default;
-
-    return SecurityContext.create({
-      principalId: agentId,
-      principalType: 'agent',
-      permissions,
-      allowedPaths: customPaths ?? ['./src', './tests', './docs'],
-      blockedPaths: ['/etc', '/var', '~/', '../'],
-      allowedCommands: ['npm', 'node', 'git', 'vitest'],
-      blockedCommands: ['rm -rf /', 'dd', 'mkfs', 'format'],
-    });
-  }
-}

package/src/index.ts

@@ -1,314 +0,0 @@
-/**
- * V3 Security Module
- *
- * Comprehensive security module addressing all identified vulnerabilities:
- * - CVE-2: Weak Password Hashing (password-hasher.ts)
- * - CVE-3: Hardcoded Default Credentials (credential-generator.ts)
- * - HIGH-1: Command Injection (safe-executor.ts)
- * - HIGH-2: Path Traversal (path-validator.ts)
- *
- * Also provides:
- * - Input validation with Zod schemas
- * - Secure token generation
- *
- * @module v3/security
- */
-
-// Password Hashing (CVE-2 Fix)
-export {
-  PasswordHasher,
-  PasswordHashError,
-  createPasswordHasher,
-  type PasswordHasherConfig,
-  type PasswordValidationResult,
-} from './password-hasher.js';
-
-// Credential Generation (CVE-3 Fix)
-export {
-  CredentialGenerator,
-  CredentialGeneratorError,
-  createCredentialGenerator,
-  generateCredentials,
-  type CredentialConfig,
-  type GeneratedCredentials,
-  type ApiKeyCredential,
-} from './credential-generator.js';
-
-// Safe Command Execution (HIGH-1 Fix)
-export {
-  SafeExecutor,
-  SafeExecutorError,
-  createDevelopmentExecutor,
-  createReadOnlyExecutor,
-  type ExecutorConfig,
-  type ExecutionResult,
-  type StreamingExecutor,
-} from './safe-executor.js';
-
-// Path Validation (HIGH-2 Fix)
-export {
-  PathValidator,
-  PathValidatorError,
-  createProjectPathValidator,
-  createFullProjectPathValidator,
-  type PathValidatorConfig,
-  type PathValidationResult,
-} from './path-validator.js';
-
-// Input Validation
-export {
-  InputValidator,
-  sanitizeString,
-  sanitizeHtml,
-  sanitizePath,
-  // Base schemas
-  SafeStringSchema,
-  IdentifierSchema,
-  FilenameSchema,
-  EmailSchema,
-  PasswordSchema,
-  UUIDSchema,
-  HttpsUrlSchema,
-  UrlSchema,
-  SemverSchema,
-  PortSchema,
-  IPv4Schema,
-  IPSchema,
-  // Auth schemas
-  UserRoleSchema,
-  PermissionSchema,
-  LoginRequestSchema,
-  CreateUserSchema,
-  CreateApiKeySchema,
-  // Agent & Task schemas
-  AgentTypeSchema,
-  SpawnAgentSchema,
-  TaskInputSchema,
-  // Command & Path schemas
-  CommandArgumentSchema,
-  PathSchema,
-  // Config schemas
-  SecurityConfigSchema,
-  ExecutorConfigSchema,
-  // Utilities
-  PATTERNS,
-  LIMITS,
-  z,
-} from './input-validator.js';
-
-// Token Generation
-export {
-  TokenGenerator,
-  TokenGeneratorError,
-  createTokenGenerator,
-  getDefaultGenerator,
-  quickGenerate,
-  type TokenConfig,
-  type Token,
-  type SignedToken,
-  type VerificationCode,
-} from './token-generator.js';
-
-// Tool-Output Guardrail (ADR-131 — closes OWASP ASI01 gap; ruvnet/ruflo#2149)
-export {
-  ToolOutputGuardrail,
-  createToolOutputGuardrail,
-  isToolOutputSafe,
-  type GuardrailConfig,
-  type GuardrailResult,
-  type GuardrailAction,
-  type InjectionFinding,
-  type InjectionSeverity,
-  type InjectionCategory,
-} from './tool-output-guardrail.js';
-
-// Agent Authorization Propagation (ADR-144 P1 — ruvnet/ruflo#2248)
-// Action-layer: SendMessage envelope + per-action scope check + MCP server
-// identity probe. Wraps the comms layer in P2; wraps the dispatcher in P3.
-export {
-  AgentAuthorizationPropagator,
-  AuthorizationPropagationError,
-  makeLegacyPermissiveScope,
-  type AuthScope,
-  type SendMessageEnvelope,
-  type ToolCallDecision,
-} from './authorization/propagator.js';
-
-// Plugin Integrity Verifier (ADR-145 P1 — ruvnet/ruflo#2254)
-// Install-layer: Ed25519 signature verification + trust-anchor allowlist.
-// Stage-2 semantic-intent scan (SCH defence) lands in P2.
-export {
-  PluginIntegrityVerifier,
-  canonicalize,
-  hashManifest,
-  fingerprint,
-  findAnchor,
-  type PluginManifest,
-  type SignedPluginManifest,
-  type TrustAnchor,
-  type TrustAnchors,
-  type VerificationStatus,
-  type VerificationResult,
-  type VerifierConfig,
-} from './plugins/integrity-verifier.js';
-
-// ============================================================================
-// Convenience Factory Functions
-// ============================================================================
-
-import { PasswordHasher } from './password-hasher.js';
-import { CredentialGenerator } from './credential-generator.js';
-import { SafeExecutor } from './safe-executor.js';
-import { PathValidator } from './path-validator.js';
-import { TokenGenerator } from './token-generator.js';
-
-/**
- * Security module configuration
- */
-export interface SecurityModuleConfig {
-  /**
-   * Project root directory for path validation
-   */
-  projectRoot: string;
-
-  /**
-   * HMAC secret for token signing
-   */
-  hmacSecret: string;
-
-  /**
-   * Bcrypt rounds for password hashing
-   * Default: 12
-   */
-  bcryptRounds?: number;
-
-  /**
-   * Allowed commands for safe executor
-   * Default: ['git', 'npm', 'node']
-   */
-  allowedCommands?: string[];
-}
-
-/**
- * Complete security module instance
- */
-export interface SecurityModule {
-  passwordHasher: PasswordHasher;
-  credentialGenerator: CredentialGenerator;
-  safeExecutor: SafeExecutor;
-  pathValidator: PathValidator;
-  tokenGenerator: TokenGenerator;
-}
-
-/**
- * Creates a complete security module with all components configured.
- *
- * @param config - Module configuration
- * @returns Complete security module
- *
- * @example
- * ```typescript
- * const security = createSecurityModule({
- *   projectRoot: '/workspaces/project',
- *   hmacSecret: process.env.HMAC_SECRET!,
- * });
- *
- * // Hash password
- * const hash = await security.passwordHasher.hash('password');
- *
- * // Validate path
- * const result = await security.pathValidator.validate('/workspaces/project/src/file.ts');
- *
- * // Execute command safely
- * const output = await security.safeExecutor.execute('git', ['status']);
- * ```
- */
-export function createSecurityModule(config: SecurityModuleConfig): SecurityModule {
-  return {
-    passwordHasher: new PasswordHasher({
-      rounds: config.bcryptRounds ?? 12,
-    }),
-    credentialGenerator: new CredentialGenerator(),
-    safeExecutor: new SafeExecutor({
-      allowedCommands: config.allowedCommands ?? ['git', 'npm', 'node'],
-    }),
-    pathValidator: new PathValidator({
-      allowedPrefixes: [config.projectRoot],
-      allowHidden: true,
-    }),
-    tokenGenerator: new TokenGenerator({
-      hmacSecret: config.hmacSecret,
-    }),
-  };
-}
-
-// ============================================================================
-// Security Constants
-// ============================================================================
-
-/**
- * Minimum recommended bcrypt rounds for production
- */
-export const MIN_BCRYPT_ROUNDS = 12;
-
-/**
- * Maximum recommended bcrypt rounds (performance consideration)
- */
-export const MAX_BCRYPT_ROUNDS = 14;
-
-/**
- * Minimum password length
- */
-export const MIN_PASSWORD_LENGTH = 8;
-
-/**
- * Maximum password length (bcrypt limitation)
- */
-export const MAX_PASSWORD_LENGTH = 72;
-
-/**
- * Default token expiration in seconds (1 hour)
- */
-export const DEFAULT_TOKEN_EXPIRATION = 3600;
-
-/**
- * Default session expiration in seconds (24 hours)
- */
-export const DEFAULT_SESSION_EXPIRATION = 86400;
-
-// ============================================================================
-// Security Audit Helper
-// ============================================================================
-
-/**
- * Checks security configuration for common issues.
- *
- * @param config - Configuration to audit
- * @returns Array of security warnings
- */
-export function auditSecurityConfig(config: Partial<SecurityModuleConfig>): string[] {
-  const warnings: string[] = [];
-
-  if (config.bcryptRounds && config.bcryptRounds < MIN_BCRYPT_ROUNDS) {
-    warnings.push(`bcryptRounds (${config.bcryptRounds}) below recommended minimum (${MIN_BCRYPT_ROUNDS})`);
-  }
-
-  if (config.hmacSecret && config.hmacSecret.length < 32) {
-    warnings.push('hmacSecret should be at least 32 characters');
-  }
-
-  if (!config.projectRoot) {
-    warnings.push('projectRoot not configured - path validation may be disabled');
-  }
-
-  if (config.allowedCommands && config.allowedCommands.length === 0) {
-    warnings.push('No commands allowed - executor will reject all commands');
-  }
-
-  return warnings;
-}
-
-/**
- * Security module version
- */
-export const SECURITY_MODULE_VERSION = '3.0.0-alpha.1';