@dataparade/cli 0.0.2 → 0.0.4

package/patterns/non-pii-signals.rules.yaml

@@ -0,0 +1,84 @@
+# Non-PII signal rules consumed by `src/ai-enrichment/non-pii-signal-rules.ts`.
+# Rule schema:
+# - id: unique rule identifier
+# - category: one of [auth_artifacts, usage_metadata, telemetry, content_files, identifiers]
+# - labels: canonical output labels emitted in thirdPartyDataFlow.dataShared
+# - patterns: regex strings (compiled case-insensitive)
+# - capabilities: optional capability tags added to thirdPartyDataFlow.capabilities
+# - directionHint: optional one of [outbound_to_third_party, inbound_from_third_party]
+# Matching notes:
+# - Rules are evaluated per source line with operation-context gating.
+# - content_files signals also require vendor-aware checks in the data-flow pass.
+# - Prefer snake_case labels and lowercase capability names.
+non_pii_signal_rules:
+  - id: auth_token_artifacts
+    category: auth_artifacts
+    labels:
+      - auth_token
+    capabilities:
+      - auth
+    patterns:
+      - "\\b(jwt|oauth2?|access[_-]?token|refresh[_-]?token|id[_-]?token|session|bearer|api[_-]?key|authorization)\\b"
+
+  - id: technical_identifier
+    category: identifiers
+    labels:
+      - technical_identifier
+    patterns:
+      - "\\b(device[_-]?id|installation[_-]?id|cookie[_-]?id|anonymous[_-]?id|ad(vertising)?[_-]?id|ga[_-]?client[_-]?id)\\b"
+
+  - id: telemetry_events
+    category: telemetry
+    labels:
+      - telemetry_event
+    capabilities:
+      - analytics
+    patterns:
+      - "\\b(event[_-]?name|event[_-]?properties|tracking[_-]?payload|analytics[_-]?event|clickstream|screen[_-]?view|funnel[_-]?step)\\b"
+
+  - id: usage_metadata
+    category: usage_metadata
+    labels:
+      - usage_metadata
+    patterns:
+      - "\\b(timestamp|timezone|locale|user[_-]?agent|referrer|request[_-]?id|trace[_-]?id|session[_-]?duration)\\b"
+
+  - id: prompt_content_input
+    category: content_files
+    labels:
+      - prompt_input
+    capabilities:
+      - ai_inference
+    directionHint: outbound_to_third_party
+    patterns:
+      - "\\b(prompt|completion|embedding|chat\\.completions|generateContent|input_text|GoogleGenAI|@google/genai|@google/generative-ai|generativelanguage\\.googleapis\\.com)\\b"
+
+  - id: document_content_input
+    category: content_files
+    labels:
+      - content_input
+    capabilities:
+      - ai_inference
+    directionHint: outbound_to_third_party
+    patterns:
+      - "\\b(attachment|document|file_input|content_block|mime_type|file_name|file_size)\\b"
+
+  - id: storage_metadata
+    category: content_files
+    labels:
+      - file_content
+    capabilities:
+      - storage
+    directionHint: outbound_to_third_party
+    patterns:
+      - "\\b(storage\\.from|bucket|blob|putObject|getObject|uploadBytes|multipart|s3|gcs|object[_-]?key|storage[_-]?path|checksum)\\b"
+
+  - id: webhook_payload
+    category: usage_metadata
+    labels:
+      - webhook_payload
+    capabilities:
+      - webhook
+    directionHint: inbound_from_third_party
+    patterns:
+      - "\\b(webhook|callback|event[_-]?payload)\\b"

package/patterns/pii-signals.rules.yaml

@@ -0,0 +1,115 @@
+# PII signal rules consumed by `src/ai-enrichment/pii-signal-rules.ts`.
+# Rule schema:
+# - id: unique rule identifier
+# - category: one of [identifiers, profile_data, credentials]
+# - labels: canonical output labels emitted in thirdPartyDataFlow.dataShared
+# - patterns: regex strings (compiled case-insensitive)
+# Matching notes:
+# - Rules are evaluated per source line.
+# - A match still requires operation-context gating in the data-flow pass.
+# - Prefer snake_case labels for consistency.
+pii_signal_rules:
+  - id: first_name
+    category: profile_data
+    labels:
+      - first_name
+    patterns:
+      - "\\b(first[_-]?name|firstname|given[_-]?name|forename|f[_-]?name|fname)\\b"
+
+  - id: last_name
+    category: profile_data
+    labels:
+      - last_name
+    patterns:
+      - "\\b(last[_-]?name|lastname|family[_-]?name|surname|l[_-]?name|lname)\\b"
+
+  - id: full_name
+    category: profile_data
+    labels:
+      - full_name
+    patterns:
+      - "\\b(full[_-]?name|fullname|display[_-]?name|legal[_-]?name|person[_-]?name)\\b"
+
+  - id: date_of_birth
+    category: profile_data
+    labels:
+      - date_of_birth
+    patterns:
+      - "\\b(date[_-]?of[_-]?birth|dob|d\\.o\\.b|birth[_-]?date|birthdate|bday)\\b"
+
+  - id: phone_number
+    category: profile_data
+    labels:
+      - phone_number
+    patterns:
+      - "\\b(phone|phone[_-]?number|telephone|tel|mobile|mobile[_-]?number|cell|msisdn)\\b"
+
+  - id: address
+    category: profile_data
+    labels:
+      - address
+    patterns:
+      - "\\b(street[_-]?address|mailing[_-]?address|home[_-]?address|billing[_-]?address|shipping[_-]?address|postal[_-]?address|zip[_-]?code|postal[_-]?code|postcode)\\b"
+
+  - id: ssn
+    category: identifiers
+    labels:
+      - social_security_number
+    patterns:
+      - "\\b(ssn|social[_-]?security[_-]?number|socialsecuritynumber|nin|national[_-]?insurance[_-]?number)\\b"
+
+  - id: passport
+    category: identifiers
+    labels:
+      - passport_number
+    patterns:
+      - "\\b(passport[_-]?number|passport[_-]?no|pp[_-]?number|travel[_-]?document[_-]?number)\\b"
+
+  - id: national_id
+    category: identifiers
+    labels:
+      - national_id
+    patterns:
+      - "\\b(national[_-]?id|national[_-]?identifier|nid|id[_-]?number|government[_-]?id|gov[_-]?id)\\b"
+
+  - id: drivers_license
+    category: identifiers
+    labels:
+      - drivers_license_number
+    patterns:
+      - "\\b(driver['’]?s?[_-]?license|driverslicense|driving[_-]?license|driver[_-]?licence|dl[_-]?number|license[_-]?number|licence[_-]?number)\\b"
+
+  - id: tax_id
+    category: identifiers
+    labels:
+      - tax_identifier
+    patterns:
+      - "\\b(tax[_-]?id|taxid|tin|ein|vat[_-]?number|fiscal[_-]?code)\\b"
+
+  - id: account_number
+    category: identifiers
+    labels:
+      - account_number
+    patterns:
+      - "\\b(account[_-]?number|acct[_-]?number|iban|routing[_-]?number|sort[_-]?code|swift|bic)\\b"
+
+  - id: username
+    category: credentials
+    labels:
+      - username
+    patterns:
+      - "\\b(username|user[_-]?name|login|login[_-]?id|userid|user[_-]?id)\\b"
+
+  - id: email
+    category: credentials
+    labels:
+      - user_email
+    patterns:
+      - "\\b(email|email[_-]?address|mail)\\b"
+
+  - id: password
+    category: credentials
+    labels:
+      - user_password
+    patterns:
+      - "\\b(password|passwd|pass|pwd|passphrase|secret)\\b"

package/patterns/property.patterns.yaml

@@ -0,0 +1,431 @@
+# Shared property-detection config: regexes and rules to set component properties from findings.
+# Aligns with enhance-defaults.ts: only properties listed in DETECTABLE_PROPERTY_KEYS can be set here.
+# Used by all language analyzers (TypeScript, Python, etc.).
+
+regexes:
+  # Auth
+  mfa_strategy: "mfa|totp|webauthn|2fa|two[-_]?factor|authenticator|duo|okta"
+  sso_strategy: "saml|oidc|openid|sso|oauth"
+  # Env: cloud and region
+  env_cloud_aws: "^AWS_|AWS_REGION|AWS_ACCESS_KEY|AWS_SECRET"
+  env_cloud_gcp: "^GCP_|GOOGLE_CLOUD|GCLOUD"
+  env_cloud_azure: "^AZURE_|ARM_"
+  env_region: "^(AWS_REGION|GCP_REGION|AZURE_REGION|REGION|REGION_NAME|LOCATION|DATA_RESIDENCY)"
+  env_vendor_jurisdiction: "^(JURISDICTION|VENDOR_JURISDICTION|COUNTRY|REGION)"
+  # Env: encryption and keys
+  env_encryption: "^(ENCRYPTION_KEY|ENCRYPT_|SSL_KEY|CIPHER_|AES_|SECRET_KEY)"
+  env_connection_ssl: "^(DATABASE_URL|DB_|SSL|TLS|NODE_TLS|REJECT_UNAUTHORIZED)"
+  env_key_rotation: "^(KEY_ROTATION|ROTATION_PERIOD|KMS_ROTATION)"
+  env_backup: "^(BACKUP_|BACKUP_FREQUENCY|SNAPSHOT)"
+  # Env: IP / network
+  env_ip_allowlist: "^(ALLOWED_IPS|IP_WHITELIST|IP_ALLOWLIST|ALLOWED_ORIGINS)"
+  # Config
+  config_audit_logging: "^(audit|logging|log_level|winston|pino)"
+  config_retention: "^(retention|data_retention|retention_period|ttl)"
+  config_request_logging: "^(request_logging|request_log_level|http_log)"
+  config_backup: "^(backup|snapshot|replication)"
+  # Database / file content
+  database_ssl_content: "\\bssl\\s*:\\s*true|rejectUnauthorized|\\.ssl\\s*\\(|tls\\s*:|encrypt\\s*:\\s*true"
+  content_backup: "backup|snapshot|replication|point_in_time"
+  content_https: "https://|ssl:\\s*true|secure:\\s*true"
+  graphql_endpoint: "/graphql|\\bgraphql\\b"
+
+# Env variable → cloud_provider value (order matters: first match wins)
+cloud_provider_env:
+  - regex: env_cloud_aws
+    value: AWS
+  - regex: env_cloud_gcp
+    value: GCP
+  - regex: env_cloud_azure
+    value: Azure
+
+# Known database/data-store names: when a component name matches (case-insensitive),
+# use it for technology_stack (used by classifier/enhance).
+known_database_names:
+  - postgres
+  - postgresql
+  - redis
+  - mysql
+  - mongodb
+  - elasticsearch
+  - supabase
+
+# Enhancer rules (classifier/enhance.ts): subtypes and defaults per asset/third_party.
+enhance:
+  # subTypes that qualify as "main application" (first one gets isMainApplication: true)
+  main_app_subtypes:
+    - application
+    - api
+    - service
+  # Default hosting_type for third_party when not set
+  default_third_party_hosting: saas
+  # Asset subTypes that imply cloud hosting
+  cloud_asset_subtypes:
+    - api
+    - service
+    - database
+    - cache
+    - container
+    - auth_service
+    - function
+  # Asset subTypes that imply on-premise hosting
+  on_prem_asset_subtypes:
+    - config
+  # supported_operations by asset subType (key = subType, value = list of operations)
+  supported_operations:
+    database:
+      - read
+      - write
+      - query
+    cache:
+      - read
+      - write
+      - query
+    api:
+      - read
+      - write
+      - query
+      - execute
+    service:
+      - read
+      - write
+      - query
+      - execute
+    application:
+      - read
+      - write
+      - query
+      - execute
+    auth_service:
+      - read
+      - write
+      - query
+      - execute
+    function:
+      - read
+      - write
+      - query
+      - execute
+    config:
+      - read
+
+# ---------------------------------------------------------------------------
+# Property inference rules
+# ---------------------------------------------------------------------------
+#
+# These rules map RawFinding → component properties by patternId. The engine
+# applies the rules in order and only relies on:
+# - `regexes` defined above (by name)
+# - input values derived from finding.properties and file content
+# - assignments (constants, fromInput, lookup tables) declared here.
+
+external_api_known_documentation_urls:
+  auth0: "https://auth0.com/docs"
+  stripe: "https://stripe.com/docs"
+  sendgrid: "https://docs.sendgrid.com"
+  twilio: "https://www.twilio.com/docs"
+  openai: "https://platform.openai.com/docs"
+  firebase: "https://firebase.google.com/docs"
+  aws: "https://docs.aws.amazon.com"
+  supabase: "https://supabase.com/docs"
+
+external_api_known_package_names:
+  auth0: "@auth0/auth0-react"
+  stripe: "stripe"
+  sendgrid: "@sendgrid/mail"
+  twilio: "twilio"
+  openai: "openai"
+  firebase: "firebase"
+  supabase: "@supabase/supabase-js"
+
+inference_rules:
+  auth_middleware:
+    # MFA/TOTP/WebAuthn strategies
+    - when:
+        anyOf:
+          - regex:
+              input: strategy
+              regex: mfa_strategy
+          - regex:
+              input: content
+              regex: mfa_strategy
+      set:
+        mfa_required: true
+        authentication_method: mfa
+
+    # SSO/OIDC/OAuth discovery
+    - when:
+        regex:
+          input: strategyStr
+          regex: sso_strategy
+      set:
+        sso_integration: true
+
+    # JWT fallback (only if MFA rule did not already set auth method)
+    - when:
+        allOf:
+          - notSet: authentication_method
+          - anyOf:
+              - equals:
+                  input: library
+                  value: jsonwebtoken
+              - equals:
+                  input: strategy
+                  value: jwt
+      set:
+        authentication_method: jwt
+
+    # OAuth2 fallback
+    - when:
+        allOf:
+          - notSet: authentication_method
+          - anyOf:
+              - equals:
+                  input: strategy
+                  value: oauth
+              - equals:
+                  input: strategy
+                  value: oauth2
+      set:
+        authentication_method: oauth_2_0
+
+    # Passport/Nest auth fallback
+    - when:
+        allOf:
+          - notSet: authentication_method
+          - anyOf:
+              - equals:
+                  input: library
+                  value: passport
+              - equals:
+                  input: library
+                  value: nestjs_auth
+      set:
+        authentication_method:
+          preferInputOrConstant:
+            input: strategy
+            fallback: session
+
+    # Audit logging is enabled when we can tie the finding to a library/strategy.
+    - when:
+        anyOf:
+          - exists: library
+          - exists: strategy
+      set:
+        audit_logging_enabled: true
+
+  env_variable:
+    # Cloud provider first-match wins
+    - when:
+        allOf:
+          - notSet: cloud_provider
+          - regex:
+              input: key
+              regex: env_cloud_aws
+      set:
+        cloud_provider: AWS
+    - when:
+        allOf:
+          - notSet: cloud_provider
+          - regex:
+              input: key
+              regex: env_cloud_gcp
+      set:
+        cloud_provider: GCP
+    - when:
+        allOf:
+          - notSet: cloud_provider
+          - regex:
+              input: key
+              regex: env_cloud_azure
+      set:
+        cloud_provider: Azure
+
+    - when:
+        regex:
+          input: key
+          regex: env_region
+      set:
+        region_location: detected
+    - when:
+        regex:
+          input: key
+          regex: env_vendor_jurisdiction
+      set:
+        vendor_jurisdiction: detected
+    - when:
+        regex:
+          input: key
+          regex: env_encryption
+      set:
+        encrypt_at_rest: aes_256
+    - when:
+        regex:
+          input: key
+          regex: env_connection_ssl
+      set:
+        connection_encryption: true
+    - when:
+        regex:
+          input: key
+          regex: env_key_rotation
+      set:
+        key_rotation_period: detected
+    - when:
+        regex:
+          input: key
+          regex: env_backup
+      set:
+        backup_frequency: detected
+        backup_encryption: true
+    - when:
+        regex:
+          input: key
+          regex: env_ip_allowlist
+      set:
+        ip_allowlisting: true
+
+  config_file:
+    - when:
+        regex:
+          input: key
+          regex: config_audit_logging
+      set:
+        audit_logging_enabled: true
+    - when:
+        regex:
+          input: key
+          regex: config_retention
+      set:
+        data_retention_period_days: 0
+    - when:
+        regex:
+          input: key
+          regex: config_request_logging
+      set:
+        request_logging_level: detected
+    - when:
+        regex:
+          input: key
+          regex: config_backup
+      set:
+        backup_frequency: detected
+        backup_encryption: true
+
+  database_connection:
+    - when:
+        regex:
+          input: content
+          regex: database_ssl_content
+      set:
+        connection_encryption: true
+    - when:
+        regex:
+          input: content
+          regex: content_backup
+      set:
+        backup_frequency: detected
+        backup_encryption: true
+    - when:
+        always: true
+      set:
+        audit_logging_enabled: true
+
+  external_api_call:
+    - when:
+        regex:
+          input: url
+          regex: graphql_endpoint
+      set:
+        integration_method: api
+        authentication_method: api_key
+        integration_status: active
+        api_type: graphql
+        sdk_available: true
+
+    - when:
+        allOf:
+          - exists: serviceName
+          - not:
+              regex:
+                input: url
+                regex: graphql_endpoint
+      set:
+        integration_method: api
+        authentication_method: api_key
+        integration_status: active
+        api_type: rest
+        sdk_available: true
+        code_reference_package:
+          lookup:
+            map: external_api_known_package_names
+            keyInput: serviceName
+            transform: lowercase
+            onMissing: skip
+
+    - when:
+        exists: documentationUrl
+      set:
+        documentation_url:
+          fromInput: documentationUrl
+
+    - when:
+        exists: apiVersion
+      set:
+        api_version:
+          fromInput: apiVersion
+
+    - when:
+        exists: url
+      set:
+        service_url_api_endpoint:
+          fromInput: url
+
+    - when:
+        allOf:
+          - notSet: documentation_url
+          - exists: serviceName
+      set:
+        documentation_url:
+          lookup:
+            map: external_api_known_documentation_urls
+            keyInput: serviceName
+            transform: lowercase
+            onMissing: skip
+
+    - when:
+        always: true
+      set:
+        https_enforced: true
+
+  express_route:
+    - when:
+        regex:
+          input: path
+          regex: graphql_endpoint
+      set:
+        request_validation: true
+        connection_encryption: true
+        api_type: graphql
+        https_enforced: true
+
+    - when:
+        allOf:
+          - anyOf:
+              - exists: httpMethods
+              - exists: path
+          - not:
+              regex:
+                input: path
+                regex: graphql_endpoint
+      set:
+        request_validation: true
+        connection_encryption: true
+        api_type: rest
+        https_enforced: true
+    - when:
+        regex:
+          input: content
+          regex: content_https
+      set:
+        https_enforced: true