@liuhange/dsh-data-masking 2.0.2 → 3.0.0

package/lib/advancedMaskingExecutor.js

@@ -0,0 +1,94 @@
+import { FpeAlgorithm } from './algorithms/fpeAlgorithm.js';
+import { KAnonymityAlgorithm } from './algorithms/kAnonymityAlgorithm.js';
+import { DifferentialPrivacyAlgorithm } from './algorithms/differentialPrivacyAlgorithm.js';
+import { HashAlgorithm } from './algorithms/hashAlgorithm.js';
+import { BudgetTracker } from './budgetTracker.js';
+export class AdvancedMaskingExecutor {
+    fpeAlgorithm = new FpeAlgorithm();
+    kAnonymityAlgorithm = new KAnonymityAlgorithm();
+    differentialPrivacyAlgorithm = new DifferentialPrivacyAlgorithm();
+    hashAlgorithm = new HashAlgorithm();
+    execute(data, algorithm, fieldName, config) {
+        const fieldConfig = fieldName ? config.fieldAlgorithms[fieldName] : undefined;
+        const resolvedAlgorithm = fieldConfig?.algorithm ?? algorithm;
+        switch (resolvedAlgorithm) {
+            case 'FPE':
+                return this.executeFpe(data, config);
+            case 'k-anonymity':
+                return this.executeKAnonymity(data, config);
+            case 'differential-privacy':
+                return this.executeDifferentialPrivacy(data, config);
+            case 'hash':
+                return this.executeHash(data, config);
+            default:
+                return this.executeHash(data, config);
+        }
+    }
+    executeFpe(data, config) {
+        const key = this.resolveEnvVar(config.fpe.key);
+        const encrypted = this.fpeAlgorithm.encrypt(data, key);
+        const details = {
+            algorithm: 'FPE',
+            reversible: true,
+        };
+        return { maskedData: encrypted, algorithm: 'FPE', details };
+    }
+    executeKAnonymity(data, config) {
+        const kValue = config.kAnonymity.kValue;
+        const quasiIdentifiers = config.kAnonymity.quasiIdentifiers;
+        let records;
+        try {
+            records = JSON.parse(data);
+        }
+        catch {
+            records = [{ value: data }];
+        }
+        const result = this.kAnonymityAlgorithm.anonymize(records, kValue, quasiIdentifiers);
+        const details = {
+            algorithm: 'k-anonymity',
+            kValue,
+            actualMinEquivalenceClass: result.actualMinEquivalenceClass,
+            suppressedCount: result.suppressedCount,
+        };
+        return { maskedData: JSON.stringify(result.anonymizedRecords), algorithm: 'k-anonymity', details };
+    }
+    executeDifferentialPrivacy(data, config) {
+        const epsilon = config.differentialPrivacy.epsilon;
+        const totalBudget = config.differentialPrivacy.totalBudget;
+        const sensitivity = config.differentialPrivacy.sensitivity;
+        const budgetTracker = new BudgetTracker(totalBudget);
+        const trueValue = Number(data);
+        if (isNaN(trueValue)) {
+            throw new Error('差分隐私要求输入为数字');
+        }
+        const noisyValue = this.differentialPrivacyAlgorithm.addNoise(trueValue, epsilon, sensitivity, budgetTracker, totalBudget);
+        const budgetState = budgetTracker.getState();
+        const details = {
+            algorithm: 'differential-privacy',
+            epsilon,
+            budgetConsumed: budgetState.consumed,
+            budgetRemaining: budgetState.remaining,
+        };
+        return { maskedData: String(noisyValue), algorithm: 'differential-privacy', details };
+    }
+    executeHash(data, config) {
+        const hashAlgo = config.hash.algorithm;
+        const salt = this.resolveEnvVar(config.hash.salt);
+        const result = this.hashAlgorithm.hash(data, hashAlgo, salt || undefined);
+        const details = {
+            algorithm: 'hash',
+            hashAlgorithm: hashAlgo,
+            salted: result.salted,
+            digestLength: result.digestLength,
+        };
+        return { maskedData: result.digest, algorithm: 'hash', details };
+    }
+    resolveEnvVar(value) {
+        if (value.startsWith('${') && value.endsWith('}')) {
+            const envVar = value.slice(2, -1);
+            return process.env[envVar] ?? '';
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=advancedMaskingExecutor.js.map

package/lib/algorithms/differentialPrivacyAlgorithm.js

@@ -0,0 +1,24 @@
+import * as crypto from 'crypto';
+export class DifferentialPrivacyAlgorithm {
+    addNoise(trueValue, epsilon, sensitivity, budgetTracker, totalBudget) {
+        if (!budgetTracker.canConsume(epsilon, totalBudget)) {
+            throw new Error('隐私预算已耗尽，拒绝查询');
+        }
+        const scale = sensitivity / epsilon;
+        const noise = this.generateLaplaceNoise(scale);
+        budgetTracker.consume(epsilon);
+        return trueValue + noise;
+    }
+    generateLaplaceNoise(scale) {
+        const u = this.generateSecureUniform();
+        const adjustedU = u - 0.5;
+        return -scale * Math.sign(adjustedU) * Math.log(1 - 2 * Math.abs(adjustedU));
+    }
+    generateSecureUniform() {
+        const bytes = crypto.randomBytes(8);
+        const uint64 = bytes.readBigUInt64BE(0);
+        const maxUint64 = BigInt(2) ** BigInt(64) - BigInt(1);
+        return Number(uint64) / Number(maxUint64);
+    }
+}
+//# sourceMappingURL=differentialPrivacyAlgorithm.js.map

package/lib/algorithms/fpeAlgorithm.js

@@ -0,0 +1,102 @@
+import * as crypto from 'crypto';
+export class FpeAlgorithm {
+    encrypt(plaintext, key) {
+        if (!key) {
+            throw new Error('错误：FPE密钥未配置');
+        }
+        const chars = plaintext.split('');
+        const radix = 10;
+        const isNumeric = chars.every(c => /\d/.test(c));
+        if (!isNumeric) {
+            return this.encryptGeneric(plaintext, key);
+        }
+        const n = plaintext.length;
+        if (n < 2) {
+            return plaintext;
+        }
+        const keyHash = crypto.createHash('sha256').update(key).digest();
+        const rounds = 10;
+        const inputNums = chars.map(c => parseInt(c, 10));
+        for (let round = 0; round < rounds; round++) {
+            const roundKey = crypto.createHash('sha256').update(keyHash).update(Buffer.from([round])).digest();
+            for (let i = 0; i < n - 1; i++) {
+                const mod = radix ** (n - i - 1);
+                const prfInput = Buffer.alloc(4);
+                prfInput.writeUInt32BE(inputNums[i], 0);
+                const prf = crypto.createHmac('sha256', roundKey).update(prfInput).digest();
+                const prfNum = prf.readUInt32BE(0) % mod;
+                inputNums[i + 1] = (inputNums[i + 1] + prfNum) % radix;
+            }
+            for (let i = n - 2; i >= 0; i--) {
+                const mod = radix ** (n - i - 1);
+                const prfInput = Buffer.alloc(4);
+                prfInput.writeUInt32BE(inputNums[i + 1], 0);
+                const prf = crypto.createHmac('sha256', roundKey).update(prfInput).digest();
+                const prfNum = prf.readUInt32BE(0) % mod;
+                inputNums[i] = (inputNums[i] + prfNum) % radix;
+            }
+        }
+        return inputNums.join('');
+    }
+    decrypt(ciphertext, key) {
+        if (!key) {
+            throw new Error('错误：FPE密钥未配置');
+        }
+        const chars = ciphertext.split('');
+        const radix = 10;
+        const isNumeric = chars.every(c => /\d/.test(c));
+        if (!isNumeric) {
+            return this.decryptGeneric(ciphertext, key);
+        }
+        const n = ciphertext.length;
+        if (n < 2) {
+            return ciphertext;
+        }
+        const keyHash = crypto.createHash('sha256').update(key).digest();
+        const rounds = 10;
+        const outputNums = chars.map(c => parseInt(c, 10));
+        for (let round = rounds - 1; round >= 0; round--) {
+            const roundKey = crypto.createHash('sha256').update(keyHash).update(Buffer.from([round])).digest();
+            for (let i = 0; i < n - 1; i++) {
+                const mod = radix ** (n - i - 1);
+                const prfInput = Buffer.alloc(4);
+                prfInput.writeUInt32BE(outputNums[i + 1], 0);
+                const prf = crypto.createHmac('sha256', roundKey).update(prfInput).digest();
+                const prfNum = prf.readUInt32BE(0) % mod;
+                outputNums[i] = ((outputNums[i] - prfNum) % radix + radix) % radix;
+            }
+            for (let i = n - 2; i >= 0; i--) {
+                const mod = radix ** (n - i - 1);
+                const prfInput = Buffer.alloc(4);
+                prfInput.writeUInt32BE(outputNums[i], 0);
+                const prf = crypto.createHmac('sha256', roundKey).update(prfInput).digest();
+                const prfNum = prf.readUInt32BE(0) % mod;
+                outputNums[i + 1] = ((outputNums[i + 1] - prfNum) % radix + radix) % radix;
+            }
+        }
+        return outputNums.join('');
+    }
+    encryptGeneric(plaintext, key) {
+        const keyHash = crypto.createHash('sha256').update(key).digest();
+        const result = [];
+        for (let i = 0; i < plaintext.length; i++) {
+            const charCode = plaintext.charCodeAt(i);
+            const prf = crypto.createHmac('sha256', keyHash).update(Buffer.from([i & 0xff])).digest();
+            const offset = prf[0] % 256;
+            result.push(String.fromCharCode((charCode + offset) % 256));
+        }
+        return result.join('');
+    }
+    decryptGeneric(ciphertext, key) {
+        const keyHash = crypto.createHash('sha256').update(key).digest();
+        const result = [];
+        for (let i = 0; i < ciphertext.length; i++) {
+            const charCode = ciphertext.charCodeAt(i);
+            const prf = crypto.createHmac('sha256', keyHash).update(Buffer.from([i & 0xff])).digest();
+            const offset = prf[0] % 256;
+            result.push(String.fromCharCode((charCode - offset + 256) % 256));
+        }
+        return result.join('');
+    }
+}
+//# sourceMappingURL=fpeAlgorithm.js.map

package/lib/algorithms/hashAlgorithm.js

@@ -0,0 +1,16 @@
+import * as crypto from 'crypto';
+export class HashAlgorithm {
+    hash(plaintext, hashAlgorithm, salt) {
+        const input = salt ? salt + plaintext : plaintext;
+        const algorithm = hashAlgorithm === 'SHA-512' ? 'SHA-512' : 'SHA-256';
+        const hash = crypto.createHash(algorithm);
+        hash.update(input, 'utf-8');
+        const digest = hash.digest('hex');
+        return {
+            digest,
+            salted: salt !== undefined && salt !== '',
+            digestLength: digest.length,
+        };
+    }
+}
+//# sourceMappingURL=hashAlgorithm.js.map

package/lib/algorithms/kAnonymityAlgorithm.js

@@ -0,0 +1,65 @@
+export class KAnonymityAlgorithm {
+    anonymize(records, kValue, quasiIdentifiers) {
+        if (records.length === 0 || quasiIdentifiers.length === 0) {
+            return { anonymizedRecords: records, actualMinEquivalenceClass: 0, suppressedCount: 0 };
+        }
+        let workingRecords = [...records];
+        let generalized = true;
+        let generalizationLevel = 0;
+        while (generalized) {
+            generalized = false;
+            const groups = this.groupByQuasiIdentifiers(workingRecords, quasiIdentifiers);
+            const minGroupSize = Math.min(...groups.map(g => g.length));
+            if (minGroupSize >= kValue) {
+                const minClass = Math.min(...groups.map(g => g.length));
+                return { anonymizedRecords: workingRecords, actualMinEquivalenceClass: minClass, suppressedCount: 0 };
+            }
+            if (generalizationLevel < 3) {
+                workingRecords = this.generalize(workingRecords, quasiIdentifiers, generalizationLevel);
+                generalizationLevel++;
+                generalized = true;
+            }
+        }
+        const groups = this.groupByQuasiIdentifiers(workingRecords, quasiIdentifiers);
+        const validGroups = groups.filter(g => g.length >= kValue);
+        const suppressedRecords = groups.filter(g => g.length < kValue).flat();
+        const anonymizedRecords = validGroups.flat();
+        const allGroups = [...validGroups, ...groups.filter(g => g.length < kValue)];
+        const actualMin = allGroups.length > 0 ? Math.min(...allGroups.map(g => g.length)) : 0;
+        return {
+            anonymizedRecords,
+            actualMinEquivalenceClass: actualMin,
+            suppressedCount: suppressedRecords.length,
+        };
+    }
+    groupByQuasiIdentifiers(records, quasiIdentifiers) {
+        const groups = new Map();
+        for (const record of records) {
+            const key = quasiIdentifiers.map(qi => String(record[qi] ?? '')).join('|');
+            const group = groups.get(key);
+            if (group) {
+                group.push(record);
+            }
+            else {
+                groups.set(key, [record]);
+            }
+        }
+        return Array.from(groups.values());
+    }
+    generalize(records, quasiIdentifiers, level) {
+        return records.map(record => {
+            const generalized = { ...record };
+            for (const qi of quasiIdentifiers) {
+                const value = String(generalized[qi] ?? '');
+                if (value.length > level + 1) {
+                    generalized[qi] = value.substring(0, value.length - level - 1) + '*'.repeat(level + 1);
+                }
+                else {
+                    generalized[qi] = '*'.repeat(value.length);
+                }
+            }
+            return generalized;
+        });
+    }
+}
+//# sourceMappingURL=kAnonymityAlgorithm.js.map

package/lib/algorithms/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/lib/budgetTracker.js

@@ -0,0 +1,24 @@
+export class BudgetTracker {
+    consumed = 0;
+    queryCount = 0;
+    totalBudget;
+    constructor(totalBudget) {
+        this.totalBudget = totalBudget;
+    }
+    consume(epsilon) {
+        this.consumed += epsilon;
+        this.queryCount++;
+    }
+    canConsume(epsilon, totalBudget) {
+        return this.consumed + epsilon <= totalBudget;
+    }
+    getState() {
+        return {
+            totalBudget: this.totalBudget,
+            consumed: this.consumed,
+            remaining: this.totalBudget - this.consumed,
+            queryCount: this.queryCount,
+        };
+    }
+}
+//# sourceMappingURL=budgetTracker.js.map

package/lib/defaultAdvancedMaskingConfig.js

@@ -0,0 +1,22 @@
+export const defaultAdvancedMaskingConfig = {
+    defaultAlgorithm: 'hash',
+    fieldAlgorithms: {},
+    fpe: {
+        key: '',
+        radix: 10,
+    },
+    kAnonymity: {
+        kValue: 2,
+        quasiIdentifiers: ['zipCode', 'age', 'gender'],
+    },
+    differentialPrivacy: {
+        epsilon: 1.0,
+        totalBudget: 5.0,
+        sensitivity: 1.0,
+    },
+    hash: {
+        algorithm: 'SHA-256',
+        salt: '',
+    },
+};
+//# sourceMappingURL=defaultAdvancedMaskingConfig.js.map

package/lib/index.js

@@ -1,7 +1,7 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import * as fs from 'fs';
 import * as path from 'path';
-import { BusinessRulesLoader, FileFormatAdapter, ReportGenerator, PathValidator, AuditLogger, } from '@liuhange/dsh-data-asset-shared';
+import { BusinessRulesLoader, FileFormatAdapter, ReportGenerator, PathValidator, AuditLogger, RegistrationNavigationEnhancer, } from '@liuhange/dsh-data-asset-shared';
 import { SensitiveFieldScanner } from './sensitiveFieldScanner.js';
 import { MaskingStrategyExecutor } from './maskingStrategyExecutor.js';
 import { AdvancedMaskingExecutor } from './advancedMaskingExecutor.js';
@@ -17,6 +17,7 @@ export function apply(ctx) {
     const scanner = new SensitiveFieldScanner();
     const strategyExecutor = new MaskingStrategyExecutor();
     const advancedExecutor = new AdvancedMaskingExecutor();
+    const navEnhancer = new RegistrationNavigationEnhancer();
     ctx.tools.register(defineTool({
         name: 'mask_sensitive_data',
         description: '识别并脱敏数据中的敏感字段（身份证、手机号、银行卡、邮箱），支持高级算法（FPE/k-匿名/差分隐私/哈希）',
@@ -76,7 +77,7 @@ export function apply(ctx) {
                     outputPath,
                     result: 'SUCCESS',
                 });
-                return `高级脱敏完成（算法: ${algorithm}）\n输入: ${fullPath}\n输出: ${outputPath}\n处理行数: ${maskedLines.length}`;
+                return navEnhancer.enhance(`高级脱敏完成（算法: ${algorithm}）\n输入: ${fullPath}\n输出: ${outputPath}\n处理行数: ${maskedLines.length}`, 'data-masking', '');
             }
             const readResult = await formatAdapter.read(fullPath);
             const lines = readResult.lines;
@@ -107,7 +108,7 @@ export function apply(ctx) {
                 outputPath,
                 result: 'SUCCESS',
             });
-            return report;
+            return navEnhancer.enhance(report, 'data-masking', '');
         },
     }));
     console.log('[data-masking] 脱敏插件已加载');

package/lib/maskingStrategyExecutor.js

@@ -0,0 +1,26 @@
+export class MaskingStrategyExecutor {
+    execute(value, _type, strategy) {
+        const resolvedStrategy = this.resolveStrategy(strategy);
+        switch (resolvedStrategy) {
+            case 'FULL':
+                return '***';
+            case 'PARTIAL':
+                return this.applyPartial(value);
+            case 'GENERALIZE':
+                return '<脱敏数据>';
+        }
+    }
+    resolveStrategy(strategy) {
+        if (strategy === 'FULL' || strategy === 'PARTIAL' || strategy === 'GENERALIZE') {
+            return strategy;
+        }
+        return 'PARTIAL';
+    }
+    applyPartial(value, keepPrefix = 3, keepSuffix = 4) {
+        if (value.length <= keepPrefix + keepSuffix) {
+            return '***';
+        }
+        return value.slice(0, keepPrefix) + '***' + value.slice(-keepSuffix);
+    }
+}
+//# sourceMappingURL=maskingStrategyExecutor.js.map

package/lib/sensitiveFieldScanner.js

@@ -0,0 +1,25 @@
+export class SensitiveFieldScanner {
+    scan(lines, sensitivePatterns) {
+        const fields = [];
+        const typeCounts = {};
+        const patternEntries = Object.entries(sensitivePatterns);
+        for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+            const line = lines[lineIndex] ?? '';
+            for (const [type, config] of patternEntries) {
+                const regex = new RegExp(config.pattern, 'g');
+                let match;
+                while ((match = regex.exec(line)) !== null) {
+                    fields.push({
+                        type,
+                        value: match[0],
+                        line: lineIndex + 1,
+                        column: match.index + 1,
+                    });
+                    typeCounts[type] = (typeCounts[type] ?? 0) + 1;
+                }
+            }
+        }
+        return { fields, typeCounts };
+    }
+}
+//# sourceMappingURL=sensitiveFieldScanner.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
     "name":  "@liuhange/dsh-data-masking",
     "description":  "Data masking plugin: sensitive field identification and graded masking (FULL/PARTIAL/GENERALIZE)",
-    "version": "2.0.2",
+    "version": "3.0.0",
     "publishConfig":  {
                           "access":  "public"
                       },
@@ -26,9 +26,7 @@
                     "./package.json":  "./package.json"
                 },
     "files":  [
-                  "lib/index.js",
-                  "lib/invariant.js",
-                  "lib/types/**/*.d.ts"
+                  "lib/**/*.js", "lib/types/**/*.d.ts"
               ],
     "license":  "MIT",
     "scripts": {
@@ -39,6 +37,7 @@
     "peerDependencies":  {
                              "@deepseek-ai/cordis": "^4.0.0",
                              "@deepseek-ai/dsh-tools": "0.0.1-rc.1",
-                             "@liuhange/dsh-data-asset-shared":  "^2.0.0"
-                         }
+                             "@liuhange/dsh-data-asset-shared":  "^3.0.0"
+                         },
+    "dsh":  { "bundle":  { "patch": true } }
 }