@ds-sfdc/sfparty 1.7.8 → 3.0.0

package/dist/lib/fileSigning.js

@@ -0,0 +1,140 @@
+/**
+ * Configuration File Signing (SEC-015)
+ * Provides optional signing and verification for critical configuration files
+ * to prevent tampering attacks.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+const SIGNATURE_EXTENSION = '.sig';
+const DEFAULT_ALGORITHM = 'sha256';
+const DEFAULT_KEY_LENGTH = 32; // 256 bits for HMAC
+/**
+ * Generate a signing key from a passphrase or use a default key file
+ * @param keyPath - Optional path to key file
+ * @param passphrase - Optional passphrase to derive key from
+ * @returns Signing key as Buffer
+ */
+export function generateSigningKey(keyPath, passphrase) {
+    if (keyPath) {
+        try {
+            return fs.readFileSync(keyPath);
+        }
+        catch {
+            throw new Error(`Failed to read signing key from ${keyPath}`);
+        }
+    }
+    if (passphrase) {
+        return crypto.pbkdf2Sync(passphrase, 'sfparty-salt', 10000, 32, 'sha256');
+    }
+    // Default: use environment variable or generate from workspace
+    const envKey = process.env.SFPARTY_SIGNING_KEY;
+    if (envKey) {
+        return Buffer.from(envKey, 'hex');
+    }
+    // Fallback: generate deterministic key from workspace (not secure, but better than nothing)
+    // In production, users should provide their own key
+    const workspace = process.cwd();
+    return crypto
+        .createHash('sha256')
+        .update(workspace)
+        .digest()
+        .subarray(0, DEFAULT_KEY_LENGTH);
+}
+/**
+ * Sign a file's content
+ * @param filePath - Path to file to sign
+ * @param content - File content to sign
+ * @param key - Signing key
+ * @returns Signature as hex string
+ */
+export function signContent(content, key) {
+    const hmac = crypto.createHmac(DEFAULT_ALGORITHM, key);
+    hmac.update(content);
+    return hmac.digest('hex');
+}
+/**
+ * Verify a file's signature
+ * @param content - File content to verify
+ * @param signature - Expected signature (hex string)
+ * @param key - Signing key
+ * @returns True if signature is valid
+ */
+export function verifySignature(content, signature, key) {
+    const expected = signContent(content, key);
+    const expectedBuf = Buffer.from(expected, 'hex');
+    const signatureBuf = Buffer.from(signature, 'hex');
+    // timingSafeEqual requires buffers of the same length
+    // If lengths differ, signature is invalid
+    if (expectedBuf.length !== signatureBuf.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(expectedBuf, signatureBuf);
+}
+/**
+ * Save signature to a separate file
+ * @param filePath - Path to original file
+ * @param signature - Signature to save
+ */
+export function saveSignature(filePath, signature) {
+    const sigPath = filePath + SIGNATURE_EXTENSION;
+    fs.writeFileSync(sigPath, signature, 'utf8');
+    // Restrict permissions (owner read/write only)
+    fs.chmodSync(sigPath, 0o600);
+}
+/**
+ * Load signature from file
+ * @param filePath - Path to original file
+ * @returns Signature if file exists, undefined otherwise
+ */
+export function loadSignature(filePath) {
+    const sigPath = filePath + SIGNATURE_EXTENSION;
+    try {
+        return fs.readFileSync(sigPath, 'utf8').trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Sign a configuration file
+ * @param filePath - Path to file to sign
+ * @param key - Signing key (optional, will be generated if not provided)
+ * @returns Signature hex string
+ */
+export function signFile(filePath, key) {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const signingKey = key ?? generateSigningKey();
+    const signature = signContent(content, signingKey);
+    saveSignature(filePath, signature);
+    return signature;
+}
+/**
+ * Verify a configuration file's signature
+ * @param filePath - Path to file to verify
+ * @param key - Signing key (optional, will be generated if not provided)
+ * @returns True if signature is valid, false if signature file doesn't exist
+ * @throws Error if signature is invalid
+ */
+export function verifyFile(filePath, key) {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const signature = loadSignature(filePath);
+    if (!signature) {
+        return false; // No signature file - verification not possible
+    }
+    const signingKey = key ?? generateSigningKey();
+    const isValid = verifySignature(content, signature, signingKey);
+    if (!isValid) {
+        throw new Error(`Signature verification failed for ${filePath}. File may have been tampered with.`);
+    }
+    return true;
+}
+/**
+ * Check if a file has a signature
+ * @param filePath - Path to file
+ * @returns True if signature file exists
+ */
+export function hasSignature(filePath) {
+    const sigPath = filePath + SIGNATURE_EXTENSION;
+    return fs.existsSync(sigPath);
+}
+//# sourceMappingURL=fileSigning.js.map

package/dist/lib/fileSigning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSigning.js","sourceRoot":"","sources":["../../src/lib/fileSigning.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAExB,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAClC,MAAM,kBAAkB,GAAG,EAAE,CAAA,CAAC,oBAAoB;AAElD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAgB,EAChB,UAAmB;IAEnB,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAChC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,UAAU,CACvB,UAAU,EACV,cAAc,EACd,KAAK,EACL,EAAE,EACF,QAAQ,CACR,CAAA;IACF,CAAC;IAED,+DAA+D;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAC9C,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,4FAA4F;IAC5F,oDAAoD;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IAC/B,OAAO,MAAM;SACX,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC9B,OAAe,EACf,SAAiB,EACjB,GAAW;IAEX,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAElD,sDAAsD;IACtD,0CAA0C;IAC1C,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,SAAiB;IAChE,MAAM,OAAO,GAAG,QAAQ,GAAG,mBAAmB,CAAA;IAC9C,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAC5C,+CAA+C;IAC/C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,QAAQ,GAAG,mBAAmB,CAAA;IAC9C,IAAI,CAAC;QACJ,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,GAAY;IACtD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAClD,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAClC,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAY;IACxD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IAEzC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,KAAK,CAAA,CAAC,gDAAgD;IAC9D,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,qCAAqC,QAAQ,qCAAqC,CAClF,CAAA;IACF,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,MAAM,OAAO,GAAG,QAAQ,GAAG,mBAAmB,CAAA;IAC9C,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;AAC9B,CAAC"}

package/dist/lib/fileUtils.d.ts

@@ -0,0 +1,90 @@
+import * as fs from 'fs';
+import type { AppContext } from '../types/context.js';
+import { WriteBatcher } from './writeBatcher.js';
+/**
+ * Initialize the global write batcher
+ */
+export declare function initWriteBatcher(batchSize?: number, batchDelay?: number): void;
+/**
+ * Get the global write batcher
+ */
+export declare function getWriteBatcher(): WriteBatcher | null;
+/**
+ * Get the number of pending writes in the batcher
+ */
+export declare function getWriteBatcherQueueLength(): number;
+/**
+ * Get write batcher queue statistics for visualization
+ */
+export declare function getWriteBatcherQueueStats(): {
+    queueLength: number;
+    batchSize: number;
+    isFlushing: boolean;
+} | null;
+/**
+ * Wait for all batched writes to complete
+ */
+export declare function flushWriteBatcher(): Promise<void>;
+/**
+ * Reset the global write batcher (primarily for testing)
+ */
+export declare function resetWriteBatcher(): void;
+export interface FileInfo {
+    dirname: string;
+    basename: string;
+    filename: string;
+    extname: string;
+    exists: boolean;
+    stats: fs.Stats | undefined;
+}
+export declare function checkDepth(obj: unknown, maxDepth: number, currentDepth?: number): void;
+export declare function estimateObjectSize(obj: unknown): number;
+export declare function safeJSONParse(jsonString: string): unknown;
+export { sanitizeErrorPath } from './errorUtils.js';
+export { clearPathSanitizationCache, replaceSpecialChars } from './pathUtils.js';
+export declare function validatePath(userPath: string, workspaceRoot?: string): string;
+/**
+ * SEC-011: Validate symlink and ensure it doesn't point outside workspace
+ * @param filePath - Path to check
+ * @param workspaceRoot - Workspace root directory
+ * @param fsTmp - File system module (for testing)
+ * @returns Resolved path if symlink is safe, throws error if unsafe
+ */
+export declare function validateSymlink(filePath: string, workspaceRoot: string | undefined, fsTmp?: typeof fs): Promise<string>;
+export declare function directoryExists({ dirPath, fs: fsTmp, workspaceRoot, }: {
+    dirPath: string;
+    fs: typeof fs;
+    workspaceRoot?: string;
+}): Promise<boolean>;
+export declare function fileExists({ filePath, fs: fsTmp, workspaceRoot, }: {
+    filePath: string;
+    fs: typeof fs;
+    workspaceRoot?: string;
+}): Promise<boolean>;
+/**
+ * Clear the verified directories cache (primarily for testing)
+ */
+export declare function clearVerifiedDirectoriesCache(): void;
+export declare function createDirectory(dirPath: string, fsTmp?: typeof fs): Promise<void>;
+export declare function deleteDirectory(dirPath: string, recursive?: boolean, fsTmp?: typeof fs): Promise<boolean | void>;
+export declare function getFiles(dirPath: string, filter?: string, fsTmp?: typeof fs): Promise<string[]>;
+export declare function getDirectories(dirPath: string, fsTmp?: typeof fs): Promise<string[]>;
+export declare function deleteFile(filePath: string, fsTmp?: typeof fs): Promise<boolean | void>;
+export declare function fileInfo(filePath: string, fsTmp?: typeof fs, workspaceRoot?: string): Promise<FileInfo>;
+export declare function saveFile(ctx: AppContext, json: unknown, fileName: string, format?: string, fsTmp?: typeof fs, useBatching?: boolean): Promise<boolean>;
+/**
+ * Read and parse a file (YAML, JSON, or XML)
+ *
+ * @param filePath - Path to the file
+ * @param convert - Whether to parse the file (default: true)
+ * @param fsTmp - File system module (for testing)
+ * @returns Parsed file content or undefined if file doesn't exist
+ *
+ * @security Uses yaml.JSON_SCHEMA to prevent prototype pollution attacks.
+ * This schema only allows JSON-compatible types and rejects dangerous
+ * keys like __proto__ and constructor. See SECURITY.md for details.
+ */
+export declare function readFile(ctx: AppContext, filePath: string, convert?: boolean, fsTmp?: typeof fs): Promise<unknown>;
+export declare function writeFile(ctx: AppContext, fileName: string, data: string, atime?: Date, mtime?: Date, fsTmp?: typeof fs): Promise<void>;
+export declare function find(filename: string, root?: string, fsTmp?: typeof fs): Promise<string | null>;
+//# sourceMappingURL=fileUtils.d.ts.map

package/dist/lib/fileUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileUtils.d.ts","sourceRoot":"","sources":["../../src/lib/fileUtils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAGxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAIrD,OAAO,EAAiB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAK/D;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,SAAK,EAAE,UAAU,SAAK,GAAG,IAAI,CAEtE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAErD;AAED;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,OAAO,CAAA;CACnB,GAAG,IAAI,CAEP;AAED;;GAEG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAIvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,MAAM,WAAW,QAAQ;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,SAAS,CAAA;CAC3B;AAqBD,wBAAgB,UAAU,CACzB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,SAAI,GACd,IAAI,CAwBN;AAGD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CA+BvD;AAGD,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAwDzD;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAGhF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAyB7E;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACpC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,wBAAsB,eAAe,CAAC,EACrC,OAAO,EACP,EAAE,EAAE,KAAK,EACT,aAAa,GACb,EAAE;IACF,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,OAAO,EAAE,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,OAAO,CAAC,CAenB;AAED,wBAAsB,UAAU,CAAC,EAChC,QAAQ,EACR,EAAE,EAAE,KAAK,EACT,aAAa,GACb,EAAE;IACF,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,OAAO,EAAE,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,OAAO,CAAC,CAenB;AAMD;;GAEG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,wBAAsB,eAAe,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,eAAe,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,UAAQ,EACjB,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAwBzB;AAED,wBAAsB,QAAQ,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BnB;AAED,wBAAsB,cAAc,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,wBAAsB,UAAU,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;AAED,wBAAsB,QAAQ,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,OAAO,EAAO,EACrB,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,QAAQ,CAAC,CA2BnB;AAED,wBAAsB,QAAQ,CAC7B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAgD,EACxD,KAAK,GAAE,OAAO,EAAO,EACrB,WAAW,UAAO,GAChB,OAAO,CAAC,OAAO,CAAC,CAkClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAC7B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,UAAO,EACd,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,OAAO,CAAC,CAwIlB;AA8DD,wBAAsB,SAAS,CAC9B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,IAAiB,EACxB,KAAK,GAAE,IAAiB,EACxB,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,IAAI,CACzB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,KAAK,GAAE,OAAO,EAAO,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgDxB"}