@nodatachat/guard 2.2.0 → 2.4.0

package/dist/reporter.js

@@ -67,6 +67,9 @@ function generateReports(input) {
     const proofData = allPII.map(f => `${f.table}.${f.column}:${f.encrypted}`).join("|") + `|${overallScore}|${now}`;
     const proofHash = (0, crypto_1.createHash)("sha256").update(proofData).digest("hex");
     // ── Build metadata report (what we send) ──
+    // PRIVACY DOCTRINE: No structural metadata (table/column/file names) ever leaves the machine.
+    // We send ONLY: counts, scores, severity, generic category labels, SOC control IDs.
+    // The customer keeps the full report locally and can verify the diff.
     const metadata = {
         version: "1.0",
         scan_id: input.scanId,
@@ -77,6 +80,13 @@ function generateReports(input) {
         guard_version: GUARD_VERSION,
         scores: {
             overall: overallScore,
+            code: input.code ? Math.round((encCoverage * 0.5) + (routeProtection * 0.25) + (secretScore * 0.25)) : null,
+            db: input.db ? Math.round(((input.db.piiFields.length > 0
+                ? Math.round((input.db.piiFields.filter(f => f.encrypted).length / input.db.piiFields.length) * 100)
+                : 100) * 0.6) +
+                ((input.db.rls.length > 0
+                    ? Math.round((input.db.rls.filter(r => r.rls_enabled).length / input.db.rls.length) * 100)
+                    : 0) * 0.4)) : null,
             previous: input.previousScore,
             improved,
             delta: input.previousScore !== null ? overallScore - input.previousScore : 0,
@@ -93,13 +103,11 @@ function generateReports(input) {
             route_protection_percent: routeProtection,
             secrets_found: (input.code.secrets.filter(s => !s.is_env_interpolated)).length,
             secrets_critical: criticalSecrets,
-            // Per-field summary — NO VALUES, just table.column + status
+            // Per-field: hashed identifier + type + status — NO real names
             fields: input.code.piiFields.map(f => ({
-                table: f.table,
-                column: f.column,
+                field_hash: (0, crypto_1.createHash)("sha256").update(`${f.table}.${f.column}`).digest("hex").slice(0, 16),
                 pii_type: f.pii_type,
                 encrypted: f.encrypted,
-                pattern: f.encryption_pattern,
             })),
         } : null,
         db_summary: input.db ? {
@@ -123,32 +131,32 @@ function generateReports(input) {
             critical: criticalSecrets,
             high: highSecrets + plaintextPII,
             medium: medSecrets,
-            recommendations_available: plaintextPII, // each plaintext field has a recommendation
+            recommendations_available: plaintextPII,
         },
-        // Fix suggestions — safe to send (just recommendation text, no code/values)
+        // REDACTED findings — generic titles only, no structural metadata
         findings: [
             ...allPII.filter(f => !f.encrypted).map(f => ({
                 severity: "high",
                 category: "pii",
                 rule_id: `PII_${f.pii_type.toUpperCase()}`,
-                title: `${f.table}.${f.column} — ${f.pii_type} stored in plaintext`,
-                fix_suggestion: `Add AES-256-GCM encryption to ${f.table}.${f.column} via Capsule field permissions`,
+                title: `PII field (${f.pii_type}) stored unencrypted`,
+                fix_suggestion: "Add AES-256-GCM column encryption via Capsule Protect",
                 soc_control: "CC6.7",
             })),
             ...(input.code?.secrets.filter(s => !s.is_env_interpolated) || []).map(s => ({
                 severity: s.severity,
                 category: "secrets",
                 rule_id: `SECRET_${s.type.toUpperCase().replace(/-/g, "_")}`,
-                title: `Hardcoded ${s.type} in ${s.file}:${s.line}`,
-                fix_suggestion: `Move to .env and encrypt with @nodatachat/protect`,
+                title: `Hardcoded secret (${s.type}) in source code`,
+                fix_suggestion: "Move to .env and encrypt with @nodatachat/protect",
                 soc_control: "CC6.1",
             })),
-            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(r => ({
+            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(() => ({
                 severity: "high",
                 category: "auth",
                 rule_id: "ROUTE_NO_AUTH",
-                title: `Unprotected route: ${r.path}`,
-                fix_suggestion: `Add authentication middleware (withAuth or API key check)`,
+                title: "API route missing authentication",
+                fix_suggestion: "Add authentication middleware (withAuth or API key check)",
                 soc_control: "CC6.3",
             })),
         ],
@@ -159,6 +167,7 @@ function generateReports(input) {
             contains_credentials: false,
             contains_source_code: false,
             contains_file_contents: false,
+            contains_structural_metadata: false,
             customer_can_verify: true,
         },
     };
@@ -207,6 +216,36 @@ function generateReports(input) {
         },
         proof_hash: proofHash,
         metadata_preview: metadata,
+        // ── HOW TO FIX ──
+        // This section stays in the LOCAL report only. Never sent to NoData.
+        how_to_fix: {
+            summary: `This scan found ${plaintextPII} unencrypted PII fields, ${criticalSecrets} hardcoded secrets, and ${totalRoutes - protectedRoutes} unprotected routes.`,
+            steps: [
+                ...(plaintextPII > 0 ? [{
+                        priority: 1,
+                        action: "Encrypt PII fields",
+                        detail: `${plaintextPII} fields contain personal data without encryption. Each field listed below needs AES-256-GCM column-level encryption.`,
+                        fields: allPII.filter(f => !f.encrypted).map(f => `${f.table}.${f.column} (${f.pii_type})`),
+                        impact: `+${Math.min(Math.round(plaintextPII * 1.5), 30)}% score improvement`,
+                    }] : []),
+                ...(criticalSecrets > 0 ? [{
+                        priority: 2,
+                        action: "Remove hardcoded secrets",
+                        detail: `${criticalSecrets} secrets are hardcoded in source files. Move them to .env and encrypt with: npx @nodatachat/protect init`,
+                        fields: (input.code?.secrets.filter(s => !s.is_env_interpolated && s.severity === "critical") || []).map(s => `${s.file}:${s.line} (${s.type})`),
+                        impact: `+${Math.min(criticalSecrets * 5, 25)}% score improvement`,
+                    }] : []),
+                ...((totalRoutes - protectedRoutes > 0) ? [{
+                        priority: 3,
+                        action: "Add route authentication",
+                        detail: `${totalRoutes - protectedRoutes} API routes have no auth middleware. Add withAuth, API key validation, or rate limiting.`,
+                        fields: (input.code?.routes.filter(r => !r.has_auth) || []).map(r => r.path),
+                        impact: `+${Math.min(Math.round((totalRoutes - protectedRoutes) * 0.5), 15)}% score improvement`,
+                    }] : []),
+            ],
+            workflow: "Give this report to your development team or security engineer. They can review each finding and implement the fix suggestions. After fixing, re-run Guard to verify your score improved.",
+            re_scan: `npx @nodatachat/guard@latest --license-key YOUR_KEY`,
+        },
     };
     return { full, metadata };
 }

package/dist/types.d.ts

@@ -88,6 +88,18 @@ export interface FullReport {
     };
     proof_hash: string;
     metadata_preview: MetadataReport;
+    how_to_fix: {
+        summary: string;
+        steps: Array<{
+            priority: number;
+            action: string;
+            detail: string;
+            fields: string[];
+            impact: string;
+        }>;
+        workflow: string;
+        re_scan: string;
+    };
 }
 export interface MetadataReport {
     version: "1.0";
@@ -99,6 +111,8 @@ export interface MetadataReport {
     guard_version: string;
     scores: {
         overall: number;
+        code: number | null;
+        db: number | null;
         previous: number | null;
         improved: boolean;
         delta: number;
@@ -116,11 +130,9 @@ export interface MetadataReport {
         secrets_found: number;
         secrets_critical: number;
         fields: Array<{
-            table: string;
-            column: string;
+            field_hash: string;
             pii_type: string;
             encrypted: boolean;
-            pattern: string | null;
         }>;
     } | null;
     db_summary: {
@@ -157,6 +169,7 @@ export interface MetadataReport {
         contains_credentials: false;
         contains_source_code: false;
         contains_file_contents: false;
+        contains_structural_metadata: false;
         customer_can_verify: true;
     };
 }

package/dist/vault-crypto.d.ts

@@ -0,0 +1,6 @@
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+export declare function encryptForVault(pin: string, plaintext: string): {
+    ciphertext: string;
+    iv: string;
+    salt: string;
+};

package/dist/vault-crypto.js

@@ -0,0 +1,36 @@
+"use strict";
+// ══════════════════════════════════════════════════════════════
+// vault-crypto.ts — Node.js AES-256-GCM encryption for Guard CLI
+//
+// Mirrors the browser vault-crypto.ts exactly:
+//   PIN → PBKDF2 (100k iterations, SHA-256) → AES-256-GCM key
+//
+// The encrypted blob produced here can be decrypted by the
+// browser VaultReportViewer using the same PIN.
+// ══════════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptForVault = encryptForVault;
+const crypto_1 = require("crypto");
+const ITERATIONS = 100_000;
+const KEY_LENGTH = 32; // 256 bits
+const SALT_LENGTH = 16; // bytes
+const IV_LENGTH = 12; // bytes (standard for AES-GCM)
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+function encryptForVault(pin, plaintext) {
+    const salt = (0, crypto_1.randomBytes)(SALT_LENGTH);
+    const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
+    const key = (0, crypto_1.pbkdf2Sync)(pin, salt, ITERATIONS, KEY_LENGTH, "sha256");
+    const cipher = (0, crypto_1.createCipheriv)("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    // Combine ciphertext + authTag (browser Web Crypto expects them concatenated)
+    const combined = Buffer.concat([encrypted, authTag]);
+    return {
+        ciphertext: combined.toString("base64"),
+        iv: iv.toString("hex"),
+        salt: salt.toString("hex"),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",