@revealui/core 0.3.0 → 0.5.0

package/dist/security/gdpr.js

@@ -1,531 +0,0 @@
-/**
- * GDPR Compliance Utilities
- *
- * Data privacy, consent management, data export, and right to be forgotten
- */
-import { createHash, createHmac } from 'node:crypto';
-import { logger } from '../observability/logger.js';
-import { InMemoryBreachStorage } from './gdpr-storage.js';
-/**
- * Consent management system
- */
-export class ConsentManager {
-    storage;
-    consentVersion = '1.0.0';
-    constructor(storage) {
-        this.storage = storage;
-    }
-    /**
-     * Grant consent
-     */
-    async grantConsent(userId, type, source = 'explicit', expiresIn) {
-        const consent = {
-            id: crypto.randomUUID(),
-            userId,
-            type,
-            granted: true,
-            timestamp: new Date().toISOString(),
-            expiresAt: expiresIn ? new Date(Date.now() + expiresIn).toISOString() : undefined,
-            source,
-            version: this.consentVersion,
-        };
-        await this.storage.setConsent(userId, type, consent);
-        return consent;
-    }
-    /**
-     * Revoke consent
-     */
-    async revokeConsent(userId, type) {
-        const existing = await this.storage.getConsent(userId, type);
-        if (existing) {
-            existing.granted = false;
-            existing.timestamp = new Date().toISOString();
-            await this.storage.setConsent(userId, type, existing);
-        }
-    }
-    /**
-     * Check if consent is granted
-     */
-    async hasConsent(userId, type) {
-        const consent = await this.storage.getConsent(userId, type);
-        if (!consent?.granted) {
-            return false;
-        }
-        // Check if expired
-        if (consent.expiresAt && new Date(consent.expiresAt) < new Date()) {
-            return false;
-        }
-        return true;
-    }
-    /**
-     * Get all consents for user
-     */
-    async getUserConsents(userId) {
-        return this.storage.getConsentsByUser(userId);
-    }
-    /**
-     * Update consent version
-     */
-    setConsentVersion(version) {
-        this.consentVersion = version;
-    }
-    /**
-     * Check if consent needs renewal
-     */
-    async needsRenewal(userId, type, maxAge) {
-        const consent = await this.storage.getConsent(userId, type);
-        if (!consent?.granted) {
-            return true;
-        }
-        const age = Date.now() - new Date(consent.timestamp).getTime();
-        return age >= maxAge;
-    }
-    /**
-     * Get consent statistics
-     */
-    async getStatistics() {
-        const consents = await this.storage.getAllConsents();
-        const now = new Date();
-        const granted = consents.filter((c) => c.granted).length;
-        const revoked = consents.filter((c) => !c.granted).length;
-        const expired = consents.filter((c) => c.expiresAt && new Date(c.expiresAt) < now).length;
-        const byType = consents.reduce((acc, c) => {
-            acc[c.type] = (acc[c.type] || 0) + 1;
-            return acc;
-        }, {});
-        return {
-            total: consents.length,
-            granted,
-            revoked,
-            expired,
-            byType,
-        };
-    }
-}
-/**
- * Escape a value for safe CSV inclusion.
- * Prevents CSV injection by prefixing formula-triggering characters (=, +, -, @, \t, \r)
- * with a single quote, and escapes embedded quotes/commas per RFC 4180.
- */
-function escapeCsvField(value) {
-    // Prefix formula-triggering characters to prevent CSV injection in spreadsheet apps
-    let safe = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
-    // RFC 4180: escape double quotes by doubling them
-    safe = safe.replace(/"/g, '""');
-    // Always quote the field to handle commas, newlines, and quotes
-    return `"${safe}"`;
-}
-/**
- * Data export system
- */
-export class DataExportSystem {
-    /**
-     * Export user data
-     */
-    async exportUserData(userId, getUserData, format = 'json') {
-        const data = await getUserData(userId);
-        const exportData = {
-            userId,
-            exportedAt: new Date().toISOString(),
-            data: {
-                profile: data.profile,
-                activities: data.activities,
-                consents: data.consents,
-                dataProcessing: [],
-            },
-            format,
-        };
-        return exportData;
-    }
-    /**
-     * Format export as JSON
-     */
-    formatAsJSON(exportData) {
-        return JSON.stringify(exportData, null, 2);
-    }
-    /**
-     * Format export as CSV
-     */
-    formatAsCSV(exportData) {
-        const lines = [];
-        // Profile data
-        lines.push('Type,Key,Value');
-        Object.entries(exportData.data.profile).forEach(([key, value]) => {
-            lines.push(`Profile,${escapeCsvField(key)},${escapeCsvField(String(value))}`);
-        });
-        // Activities
-        exportData.data.activities.forEach((activity, index) => {
-            Object.entries(activity).forEach(([key, value]) => {
-                lines.push(`Activity ${index + 1},${escapeCsvField(key)},${escapeCsvField(String(value))}`);
-            });
-        });
-        return lines.join('\n');
-    }
-    /**
-     * Create download link
-     */
-    createDownloadLink(content, _filename, mimeType) {
-        const blob = new Blob([content], { type: mimeType });
-        return URL.createObjectURL(blob);
-    }
-}
-/**
- * Data deletion system (Right to be Forgotten)
- */
-export class DataDeletionSystem {
-    storage;
-    constructor(storage) {
-        this.storage = storage;
-    }
-    /**
-     * Request data deletion
-     */
-    async requestDeletion(userId, dataCategories, reason) {
-        const request = {
-            id: crypto.randomUUID(),
-            userId,
-            requestedAt: new Date().toISOString(),
-            status: 'pending',
-            dataCategories,
-            reason,
-        };
-        await this.storage.setDeletionRequest(request);
-        return request;
-    }
-    /**
-     * Process deletion request
-     */
-    async processDeletion(requestId, deleteData) {
-        const request = await this.storage.getDeletionRequest(requestId);
-        if (!request) {
-            throw new Error('Deletion request not found');
-        }
-        request.status = 'processing';
-        await this.storage.setDeletionRequest(request);
-        try {
-            const result = await deleteData(request.userId, request.dataCategories);
-            request.status = 'completed';
-            request.processedAt = new Date().toISOString();
-            request.deletedData = result.deleted;
-            request.retainedData = result.retained;
-            await this.storage.setDeletionRequest(request);
-        }
-        catch (error) {
-            request.status = 'failed';
-            await this.storage.setDeletionRequest(request);
-            throw error;
-        }
-    }
-    /**
-     * Get deletion request
-     */
-    async getRequest(requestId) {
-        return this.storage.getDeletionRequest(requestId);
-    }
-    /**
-     * Get user deletion requests
-     */
-    async getUserRequests(userId) {
-        return this.storage.getDeletionRequestsByUser(userId);
-    }
-    /**
-     * Check if data can be deleted
-     */
-    canDelete(_dataCategory, legalBasis) {
-        // Data with legal obligation or vital interest cannot be deleted
-        if (legalBasis === 'legal_obligation' || legalBasis === 'vital_interest') {
-            return false;
-        }
-        return true;
-    }
-    /**
-     * Calculate retention period
-     */
-    calculateRetentionEnd(createdAt, retentionPeriod) {
-        return new Date(createdAt.getTime() + retentionPeriod * 24 * 60 * 60 * 1000);
-    }
-    /**
-     * Check if data should be deleted (retention period expired)
-     */
-    shouldDelete(createdAt, retentionPeriod) {
-        const retentionEnd = this.calculateRetentionEnd(createdAt, retentionPeriod);
-        return new Date() > retentionEnd;
-    }
-}
-/**
- * Data anonymization utilities
- */
-/**
- * Hash value (irreversible) using SHA-256
- */
-function hashValue(value) {
-    const digest = createHash('sha256').update(value).digest('hex');
-    return `hash_${digest}`;
-}
-/**
- * Anonymize user data
- */
-function anonymizeUser(user) {
-    return {
-        ...user,
-        email: hashValue(user.email),
-        name: 'Anonymous User',
-        phone: undefined,
-        address: undefined,
-        ip: undefined,
-    };
-}
-/**
- * Pseudonymize data (one-way, key-dependent)
- *
- * Uses HMAC-SHA256 — cryptographically bound to the key, resistant to
- * length-extension attacks and GPU brute-force (unlike plain SHA-256).
- */
-function pseudonymize(value, key) {
-    const hmac = createHmac('sha256', key).update(value).digest('hex');
-    return `pseudo_${hmac.substring(0, 16)}`;
-}
-/**
- * Anonymize dataset
- */
-function anonymizeDataset(data, sensitiveFields) {
-    return data.map((item) => {
-        const anonymized = { ...item };
-        sensitiveFields.forEach((field) => {
-            if (field in anonymized && typeof anonymized[field] === 'string') {
-                anonymized[field] = hashValue(anonymized[field]);
-            }
-        });
-        return anonymized;
-    });
-}
-/**
- * K-anonymity check
- */
-function checkKAnonymity(data, quasiIdentifiers, k) {
-    // Group by quasi-identifiers
-    const groups = new Map();
-    data.forEach((item) => {
-        const key = quasiIdentifiers.map((field) => String(item[field])).join('|');
-        groups.set(key, (groups.get(key) || 0) + 1);
-    });
-    // Check if all groups have at least k members
-    return Array.from(groups.values()).every((count) => count >= k);
-}
-export const DataAnonymization = {
-    anonymizeUser,
-    pseudonymize,
-    hashValue,
-    anonymizeDataset,
-    checkKAnonymity,
-};
-/**
- * Privacy policy manager
- */
-export class PrivacyPolicyManager {
-    policies = new Map();
-    currentVersion = '1.0.0';
-    /**
-     * Add policy version
-     */
-    addPolicy(version, content, effectiveDate) {
-        this.policies.set(version, { version, content, effectiveDate });
-        this.currentVersion = version;
-    }
-    /**
-     * Get current policy
-     */
-    getCurrentPolicy() {
-        return this.policies.get(this.currentVersion);
-    }
-    /**
-     * Get policy by version
-     */
-    getPolicy(version) {
-        return this.policies.get(version);
-    }
-    /**
-     * Check if user accepted current policy
-     */
-    hasAcceptedCurrent(userAcceptedVersion) {
-        return userAcceptedVersion === this.currentVersion;
-    }
-    /**
-     * Get all versions
-     */
-    getAllVersions() {
-        return Array.from(this.policies.keys());
-    }
-}
-export class CookieConsentManager {
-    config = {
-        necessary: true,
-        functional: false,
-        analytics: false,
-        marketing: false,
-    };
-    /**
-     * Set consent configuration
-     */
-    setConsent(config) {
-        this.config = { ...this.config, ...config };
-        this.saveToStorage();
-    }
-    /**
-     * Get consent configuration
-     */
-    getConsent() {
-        return { ...this.config };
-    }
-    /**
-     * Check if specific consent is granted
-     */
-    hasConsent(type) {
-        return this.config[type];
-    }
-    /**
-     * Save to storage
-     */
-    saveToStorage() {
-        if (typeof localStorage !== 'undefined') {
-            localStorage.setItem('cookie-consent', JSON.stringify(this.config));
-        }
-    }
-    /**
-     * Load from storage
-     */
-    loadFromStorage() {
-        if (typeof localStorage !== 'undefined') {
-            const stored = localStorage.getItem('cookie-consent');
-            if (stored) {
-                try {
-                    const parsed = JSON.parse(stored);
-                    // Validate shape before assigning — only accept known boolean fields
-                    // to prevent malicious scripts from injecting arbitrary config.
-                    if (typeof parsed === 'object' && parsed !== null) {
-                        this.config = {
-                            necessary: true, // always required
-                            analytics: typeof parsed.analytics === 'boolean' ? parsed.analytics : false,
-                            marketing: typeof parsed.marketing === 'boolean' ? parsed.marketing : false,
-                            functional: typeof parsed.functional === 'boolean' ? parsed.functional : true,
-                        };
-                    }
-                }
-                catch {
-                    // Ignore parse errors
-                }
-            }
-        }
-    }
-    /**
-     * Clear consent
-     */
-    clearConsent() {
-        this.config = {
-            necessary: true,
-            functional: false,
-            analytics: false,
-            marketing: false,
-        };
-        if (typeof localStorage !== 'undefined') {
-            localStorage.removeItem('cookie-consent');
-        }
-    }
-}
-export class DataBreachManager {
-    storage;
-    constructor(storage) {
-        if (storage) {
-            this.storage = storage;
-        }
-        else {
-            logger.warn('DataBreachManager: using in-memory storage — breach records will be lost on restart. ' +
-                'For production GDPR compliance, pass a database-backed BreachStorage.');
-            this.storage = new InMemoryBreachStorage();
-        }
-    }
-    /**
-     * Report data breach
-     */
-    async reportBreach(breach) {
-        const fullBreach = {
-            ...breach,
-            id: crypto.randomUUID(),
-            detectedAt: new Date().toISOString(),
-            status: 'detected',
-        };
-        await this.storage.setBreach(fullBreach);
-        // Auto-notify if critical
-        if (fullBreach.severity === 'critical') {
-            await this.notifyAuthorities(fullBreach);
-        }
-        return fullBreach;
-    }
-    /**
-     * Notify authorities (required within 72 hours under GDPR)
-     */
-    async notifyAuthorities(breach) {
-        await this.storage.updateBreach(breach.id, {
-            reportedAt: new Date().toISOString(),
-            status: 'notified',
-        });
-        // In production, integrate with data protection authority API
-        logger.info('Breach reported to authorities', { breachId: breach.id });
-    }
-    /**
-     * Notify affected users
-     */
-    async notifyAffectedUsers(breachId, notifyFn) {
-        const breach = await this.storage.getBreach(breachId);
-        if (!breach) {
-            throw new Error('Breach not found');
-        }
-        for (const userId of breach.affectedUsers) {
-            await notifyFn(userId, breach);
-        }
-    }
-    /**
-     * Check if breach notification is required
-     */
-    requiresNotification(breach) {
-        // Notification required for high risk breaches
-        return (breach.severity === 'high' ||
-            breach.severity === 'critical' ||
-            breach.dataCategories.includes('sensitive') ||
-            breach.dataCategories.includes('financial'));
-    }
-    /**
-     * Get breach
-     */
-    async getBreach(id) {
-        return this.storage.getBreach(id);
-    }
-    /**
-     * Get all breaches
-     */
-    async getAllBreaches() {
-        return this.storage.getAllBreaches();
-    }
-}
-/**
- * Factory functions for GDPR subsystems.
- *
- * `ConsentManager` and `DataDeletionSystem` require a `GDPRStorage` implementation.
- * Use `InMemoryGDPRStorage` only in tests — production MUST use a database-backed store.
- *
- * `DataExportSystem`, `PrivacyPolicyManager`, `CookieConsentManager`, and
- * `DataBreachManager` are stateless or client-side only, so singletons are safe.
- */
-export function createConsentManager(storage) {
-    return new ConsentManager(storage);
-}
-export function createDataDeletionSystem(storage) {
-    return new DataDeletionSystem(storage);
-}
-export const dataExportSystem = new DataExportSystem();
-export const privacyPolicyManager = new PrivacyPolicyManager();
-export const cookieConsentManager = new CookieConsentManager();
-export function createDataBreachManager(storage) {
-    return new DataBreachManager(storage);
-}
-export const dataBreachManager = new DataBreachManager();

package/dist/security/headers.d.ts

@@ -1,184 +0,0 @@
-/**
- * Security Headers and CORS Configuration
- *
- * HTTP security headers and CORS policy management
- */
-export interface SecurityHeadersConfig {
-    contentSecurityPolicy?: string | ContentSecurityPolicyConfig;
-    strictTransportSecurity?: boolean | HSTSConfig;
-    xFrameOptions?: 'DENY' | 'SAMEORIGIN' | string;
-    xContentTypeOptions?: boolean;
-    referrerPolicy?: ReferrerPolicyValue;
-    permissionsPolicy?: string | PermissionsPolicyConfig;
-    crossOriginEmbedderPolicy?: 'require-corp' | 'credentialless';
-    crossOriginOpenerPolicy?: 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none';
-    crossOriginResourcePolicy?: 'same-origin' | 'same-site' | 'cross-origin';
-}
-export interface ContentSecurityPolicyConfig {
-    defaultSrc?: string[];
-    scriptSrc?: string[];
-    styleSrc?: string[];
-    imgSrc?: string[];
-    fontSrc?: string[];
-    connectSrc?: string[];
-    frameSrc?: string[];
-    objectSrc?: string[];
-    mediaSrc?: string[];
-    workerSrc?: string[];
-    childSrc?: string[];
-    formAction?: string[];
-    frameAncestors?: string[];
-    baseUri?: string[];
-    manifestSrc?: string[];
-    upgradeInsecureRequests?: boolean;
-    blockAllMixedContent?: boolean;
-    reportUri?: string;
-    reportTo?: string;
-}
-export interface HSTSConfig {
-    maxAge: number;
-    includeSubDomains?: boolean;
-    preload?: boolean;
-}
-export type ReferrerPolicyValue = 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';
-export interface PermissionsPolicyConfig {
-    accelerometer?: string[];
-    ambientLightSensor?: string[];
-    autoplay?: string[];
-    battery?: string[];
-    camera?: string[];
-    displayCapture?: string[];
-    documentDomain?: string[];
-    encryptedMedia?: string[];
-    fullscreen?: string[];
-    geolocation?: string[];
-    gyroscope?: string[];
-    magnetometer?: string[];
-    microphone?: string[];
-    midi?: string[];
-    payment?: string[];
-    pictureInPicture?: string[];
-    publicKeyCredentials?: string[];
-    screenWakeLock?: string[];
-    syncXhr?: string[];
-    usb?: string[];
-    webShare?: string[];
-    xrSpatialTracking?: string[];
-}
-export interface CORSConfig {
-    origin?: string | string[] | ((origin: string) => boolean);
-    methods?: string[];
-    allowedHeaders?: string[];
-    exposedHeaders?: string[];
-    credentials?: boolean;
-    maxAge?: number;
-    preflightContinue?: boolean;
-    optionsSuccessStatus?: number;
-}
-/**
- * Security headers manager
- */
-export declare class SecurityHeaders {
-    private config;
-    constructor(config?: SecurityHeadersConfig);
-    /**
-     * Get all security headers
-     */
-    getHeaders(): Record<string, string>;
-    /**
-     * Build Content Security Policy header
-     */
-    private buildCSP;
-    /**
-     * Build HSTS header
-     */
-    private buildHSTS;
-    /**
-     * Build Permissions-Policy header
-     */
-    private buildPermissionsPolicy;
-    /**
-     * Apply headers to response
-     */
-    applyHeaders(response: Response): Response;
-}
-/**
- * CORS manager
- */
-export declare class CORSManager {
-    private config;
-    constructor(config?: CORSConfig);
-    /**
-     * Check if origin is allowed
-     */
-    isOriginAllowed(origin: string): boolean;
-    /**
-     * Get CORS headers
-     */
-    getCORSHeaders(origin: string): Record<string, string>;
-    /**
-     * Get preflight headers
-     */
-    getPreflightHeaders(origin: string): Record<string, string>;
-    /**
-     * Handle CORS request
-     */
-    handleRequest(request: Request): Response | null;
-    /**
-     * Handle preflight request
-     */
-    handlePreflight(_request: Request, origin: string): Response;
-    /**
-     * Apply CORS headers to response
-     */
-    applyHeaders(response: Response, origin: string): Response;
-}
-/**
- * Common security header presets
- */
-export declare const SecurityPresets: {
-    /**
-     * Strict security (recommended for production)
-     */
-    strict: () => SecurityHeadersConfig;
-    /**
-     * Moderate security (balanced)
-     */
-    moderate: () => SecurityHeadersConfig;
-    /**
-     * Development (permissive)
-     */
-    development: () => SecurityHeadersConfig;
-};
-/**
- * Common CORS presets
- */
-export declare const CORSPresets: {
-    /**
-     * Strict CORS (same origin only)
-     */
-    strict: () => CORSConfig;
-    /**
-     * Moderate CORS (specific origins)
-     */
-    moderate: (allowedOrigins: string[]) => CORSConfig;
-    /**
-     * Permissive CORS (all origins) — development only.
-     * Logs a warning if used when NODE_ENV === 'production'.
-     */
-    permissive: () => CORSConfig;
-    /**
-     * API CORS (public read-only APIs) — credentials disabled.
-     * Logs a warning if used when NODE_ENV === 'production'.
-     */
-    api: () => CORSConfig;
-};
-/**
- * Security middleware creator
- */
-export declare function createSecurityMiddleware(securityConfig?: SecurityHeadersConfig, corsConfig?: CORSConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
-/**
- * Rate limiting headers
- */
-export declare function setRateLimitHeaders(response: Response, limit: number, remaining: number, reset: number): void;
-//# sourceMappingURL=headers.d.ts.map