@ibgib/core-gib 0.1.59 → 0.1.61

package/src/keystone/policy/keystone-profile-builder.mts

@@ -0,0 +1,131 @@
+import { hash } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { KeystonePoolConfig } from "../keystone-types.mjs";
+import { KeystonePoolTemplate, KeystonePolicyConfigTemplate, KeystoneBehaviorProfileTemplate } from "../keystone-policy-types.mjs";
+import { createPoolConfigFromJson } from "../keystone-config-builder.mjs";
+
+import profileHigh from "./profiles/profile-high.json" assert { type: "json" };
+import profileMedium from "./profiles/profile-medium.json" assert { type: "json" };
+import profileLow from "./profiles/profile-low.json" assert { type: "json" };
+import profileSession from "./profiles/profile-session.json" assert { type: "json" };
+import profileTest from "./profiles/profile-test.json" assert { type: "json" };
+
+export class KeystoneProfileBuilder {
+    private _template: KeystonePolicyConfigTemplate;
+    private _username?: string;
+    private _email?: string;
+    private _description?: string;
+    private _details?: any;
+    private _customizations: { [poolId: string]: { template?: Partial<KeystonePoolTemplate>, behavior?: Partial<KeystoneBehaviorProfileTemplate> } } = {};
+
+    private constructor(template: KeystonePolicyConfigTemplate) {
+        // Deep copy the template to avoid modifying shared imports
+        this._template = JSON.parse(JSON.stringify(template));
+    }
+
+    static buildKeystone(profileName: 'high' | 'medium' | 'low' | 'session' | 'test'): KeystoneProfileBuilder {
+        let selected: KeystonePolicyConfigTemplate;
+        switch (profileName) {
+            case 'high':
+                selected = profileHigh as any;
+                break;
+            case 'medium':
+                selected = profileMedium as any;
+                break;
+            case 'low':
+                selected = profileLow as any;
+                break;
+            case 'session':
+                selected = profileSession as any;
+                break;
+            case 'test':
+                selected = profileTest as any;
+                break;
+            default:
+                throw new Error(`Unknown profile name: ${profileName} (E: fc10a8ad482ef2bda871ac567d268d26)`);
+        }
+        return new KeystoneProfileBuilder(selected);
+    }
+
+    withUsername(username: string): this {
+        this._username = username;
+        return this;
+    }
+
+    withEmail(email: string): this {
+        this._email = email;
+        return this;
+    }
+
+    withDescription(description: string): this {
+        this._description = description;
+        return this;
+    }
+
+    withDetails(details: any): this {
+        this._details = details;
+        return this;
+    }
+
+    customizePool(
+        poolId: string,
+        overrides: Omit<Partial<KeystonePoolTemplate>, 'behavior'> & { behavior?: Partial<KeystoneBehaviorProfileTemplate> }
+    ): this {
+        const { behavior, ...templateOverrides } = overrides;
+        this._customizations[poolId] = {
+            template: templateOverrides as any,
+            behavior
+        };
+        return this;
+    }
+
+    /**
+     * Unifies username, email, description, and details into a frameDetails object for genesis.
+     */
+    getFrameDetails(): any {
+        const details: any = { ...this._details };
+        if (this._username) { details.username = this._username; }
+        if (this._email) { details.email = this._email; }
+        if (this._description) { details.description = this._description; }
+        return details;
+    }
+
+    async compileConfigs(): Promise<KeystonePoolConfig[]> {
+        const poolConfigs: KeystonePoolConfig[] = [];
+        
+        // Derive a unique user-specific base salt if username/email is provided
+        let userSalt = "";
+        if (this._username || this._email) {
+            const seed = `${this._username || ""}:${this._email || ""}`;
+            userSalt = await hash({ s: seed });
+        } else {
+            // Fallback salt to guarantee unique challenge IDs even without user details
+            userSalt = await hash({ s: "default-keystone-salt" });
+        }
+
+        for (const [poolKey, poolTemplate] of Object.entries(this._template.pools)) {
+            // Apply customization overrides
+            const custom = this._customizations[poolTemplate.id];
+            if (custom) {
+                if (custom.template) {
+                    Object.assign(poolTemplate, custom.template);
+                }
+                if (custom.behavior && poolTemplate.behavior) {
+                    Object.assign(poolTemplate.behavior, custom.behavior);
+                }
+            }
+
+            // Derive a unique salt for this specific pool by hashing userSalt + poolId
+            const saltSeed = `${userSalt}-${poolTemplate.id}`;
+            const derivedSalt = await hash({ s: saltSeed });
+
+            const poolConfig = createPoolConfigFromJson({
+                template: poolTemplate,
+                salt: derivedSalt
+            });
+
+            poolConfigs.push(poolConfig);
+        }
+
+        return poolConfigs;
+    }
+}

package/src/keystone/policy/profiles/profile-high.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.high.schema.json",
+  "metadata": {
+    "name": "High Security Profile",
+    "securityLevel": "high"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "replace-all",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-512",
+      "rounds": 20,
+      "behavior": {
+        "size": 2000,
+        "replenish": "delete-all",
+        "selectSequentially": 50,
+        "selectRandomly": 50,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-512",
+      "rounds": 4,
+      "behavior": {
+        "size": 2000,
+        "replenish": "top-up",
+        "selectSequentially": 10,
+        "selectRandomly": 10,
+        "targetBindingCount": 16
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-low.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.low.schema.json",
+  "metadata": {
+    "name": "Low Security Profile",
+    "securityLevel": "low"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "replace-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 5,
+      "behavior": {
+        "size": 100,
+        "replenish": "delete-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 100,
+        "replenish": "top-up",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 8
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-medium.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.medium.schema.json",
+  "metadata": {
+    "name": "Medium Security Profile",
+    "securityLevel": "medium"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 500,
+        "replenish": "top-up",
+        "selectSequentially": 5,
+        "selectRandomly": 5,
+        "targetBindingCount": 10
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 500,
+        "replenish": "replace-all",
+        "selectSequentially": 5,
+        "selectRandomly": 5,
+        "targetBindingCount": 10
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 10,
+      "behavior": {
+        "size": 500,
+        "replenish": "delete-all",
+        "selectSequentially": 20,
+        "selectRandomly": 20,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 500,
+        "replenish": "top-up",
+        "selectSequentially": 5,
+        "selectRandomly": 5,
+        "targetBindingCount": 10
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 500,
+        "replenish": "top-up",
+        "selectSequentially": 5,
+        "selectRandomly": 5,
+        "targetBindingCount": 10
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-session.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.low.schema.json",
+  "metadata": {
+    "name": "Session/Saga Identity Profile",
+    "securityLevel": "low"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 50,
+        "replenish": "top-up",
+        "selectSequentially": 2,
+        "selectRandomly": 2,
+        "targetBindingCount": 6
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 50,
+        "replenish": "replace-all",
+        "selectSequentially": 2,
+        "selectRandomly": 2,
+        "targetBindingCount": 6
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 5,
+      "behavior": {
+        "size": 50,
+        "replenish": "delete-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 50,
+        "replenish": "top-up",
+        "selectSequentially": 2,
+        "selectRandomly": 2,
+        "targetBindingCount": 6
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 50,
+        "replenish": "top-up",
+        "selectSequentially": 2,
+        "selectRandomly": 2,
+        "targetBindingCount": 6
+      }
+    }
+  }
+}

package/src/keystone/policy/profiles/profile-test.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "../schemas/keystone.low.schema.json",
+  "metadata": {
+    "name": "Test Identity Profile",
+    "securityLevel": "low"
+  },
+  "pools": {
+    "sync": {
+      "id": "sync",
+      "allowedVerbs": [
+        "sync"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 12,
+        "replenish": "top-up",
+        "selectSequentially": 1,
+        "selectRandomly": 1,
+        "targetBindingCount": 3
+      }
+    },
+    "manage": {
+      "id": "manage",
+      "allowedVerbs": [
+        "manage"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 12,
+        "replenish": "replace-all",
+        "selectSequentially": 1,
+        "selectRandomly": 2,
+        "targetBindingCount": 3
+      }
+    },
+    "revoke": {
+      "id": "revoke",
+      "allowedVerbs": [
+        "revoke"
+      ],
+      "algo": "SHA-256",
+      "rounds": 5,
+      "behavior": {
+        "size": 12,
+        "replenish": "delete-all",
+        "selectSequentially": 3,
+        "selectRandomly": 3,
+        "targetBindingCount": 0
+      }
+    },
+    "connect": {
+      "id": "connect",
+      "allowedVerbs": [
+        "connect"
+      ],
+      "algo": "SHA-256",
+      "rounds": 1,
+      "behavior": {
+        "size": 12,
+        "replenish": "top-up",
+        "selectSequentially": 1,
+        "selectRandomly": 1,
+        "targetBindingCount": 3
+      }
+    },
+    "sign": {
+      "id": "default",
+      "allowedVerbs": [
+        "sign"
+      ],
+      "algo": "SHA-256",
+      "rounds": 2,
+      "behavior": {
+        "size": 20,
+        "replenish": "top-up",
+        "selectSequentially": 1,
+        "selectRandomly": 1,
+        "targetBindingCount": 3
+      }
+    }
+  }
+}

package/src/keystone/policy/schemas/connect-pool.high.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecurityConnectPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "connect" },
+    "allowedVerbs": { "type": "array", "items": { "const": "connect" } },
+    "algo": { "type": "string", "const": "SHA-512" },
+    "rounds": { "type": "integer", "minimum": 4 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 2000 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 10 },
+        "selectRandomly": { "type": "integer", "minimum": 10 },
+        "targetBindingCount": { "type": "integer", "minimum": 16 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/connect-pool.low.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecurityConnectPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "connect" },
+    "allowedVerbs": { "type": "array", "items": { "const": "connect" } },
+    "algo": { "type": "string", "const": "SHA-256" },
+    "rounds": { "type": "integer", "minimum": 1 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 12 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 1 },
+        "selectRandomly": { "type": "integer", "minimum": 1 },
+        "targetBindingCount": { "type": "integer", "minimum": 3 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/connect-pool.medium.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "MediumSecurityConnectPool",
+  "type": "object",
+  "properties": {
+    "id": { "type": "string", "const": "connect" },
+    "allowedVerbs": { "type": "array", "items": { "const": "connect" } },
+    "algo": { "type": "string", "enum": ["SHA-256", "SHA-512"] },
+    "rounds": { "type": "integer", "minimum": 2 },
+    "behavior": {
+      "type": "object",
+      "properties": {
+        "size": { "type": "integer", "minimum": 500 },
+        "replenish": { "type": "string", "const": "top-up" },
+        "selectSequentially": { "type": "integer", "minimum": 5 },
+        "selectRandomly": { "type": "integer", "minimum": 5 },
+        "targetBindingCount": { "type": "integer", "minimum": 10 }
+      },
+      "required": ["size", "replenish", "selectSequentially", "selectRandomly", "targetBindingCount"]
+    }
+  },
+  "required": ["id", "allowedVerbs", "algo", "rounds", "behavior"]
+}

package/src/keystone/policy/schemas/keystone.high.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "HighSecurityKeystoneProfile",
+  "type": "object",
+  "properties": {
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "securityLevel": { "type": "string", "const": "high" }
+      }
+    },
+    "pools": {
+      "type": "object",
+      "properties": {
+        "sync": { "$ref": "./sync-pool.high.schema.json" },
+        "manage": { "$ref": "./manage-pool.high.schema.json" },
+        "revoke": { "$ref": "./revoke-pool.high.schema.json" },
+        "connect": { "$ref": "./connect-pool.high.schema.json" },
+        "sign": { "$ref": "./sign-pool.high.schema.json" }
+      },
+      "required": ["sync", "manage", "revoke", "connect", "sign"]
+    }
+  },
+  "required": ["pools"]
+}

package/src/keystone/policy/schemas/keystone.low.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "LowSecurityKeystoneProfile",
+  "type": "object",
+  "properties": {
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "name": { "type": "string" },
+        "securityLevel": { "type": "string", "const": "low" }
+      }
+    },
+    "pools": {
+      "type": "object",
+      "properties": {
+        "sync": { "$ref": "./sync-pool.low.schema.json" },
+        "manage": { "$ref": "./manage-pool.low.schema.json" },
+        "revoke": { "$ref": "./revoke-pool.low.schema.json" },
+        "connect": { "$ref": "./connect-pool.low.schema.json" },
+        "sign": { "$ref": "./sign-pool.low.schema.json" }
+      },
+      "required": ["sync", "manage", "revoke", "connect", "sign"]
+    }
+  },
+  "required": ["pools"]
+}