@riocrypto/common-server 1.0.2935 → 1.0.2936

package/build/models/security-bot-audit-event.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityBotAuditEvent = exports.SecurityBotAuditType = void 0;
+// Every model call and every admin action on security-bot, with token
+// counts, so the daily and monthly budgets are computed from the same rows
+// that would be reviewed after an incident.
+var SecurityBotAuditType;
+(function (SecurityBotAuditType) {
+    SecurityBotAuditType["SweepStarted"] = "sweepStarted";
+    SecurityBotAuditType["SweepToolCall"] = "sweepToolCall";
+    SecurityBotAuditType["SweepCompleted"] = "sweepCompleted";
+    SecurityBotAuditType["SweepFailed"] = "sweepFailed";
+    SecurityBotAuditType["Triage"] = "triage";
+    SecurityBotAuditType["FindingStatusChanged"] = "findingStatusChanged";
+    SecurityBotAuditType["RuleMuted"] = "ruleMuted";
+    SecurityBotAuditType["RuleUnmuted"] = "ruleUnmuted";
+    SecurityBotAuditType["ControlsChanged"] = "controlsChanged";
+    SecurityBotAuditType["BudgetPaused"] = "budgetPaused";
+    SecurityBotAuditType["InjectionRejected"] = "injectionRejected";
+})(SecurityBotAuditType = exports.SecurityBotAuditType || (exports.SecurityBotAuditType = {}));
+const buildSecurityBotAuditEvent = (mongoose) => {
+    if (mongoose.models.SecurityBotAuditEvent) {
+        return mongoose.model("SecurityBotAuditEvent");
+    }
+    const schema = new mongoose.Schema({
+        type: { type: String, enum: Object.values(SecurityBotAuditType), required: true },
+        sweepRunId: { type: String },
+        findingId: { type: String },
+        adminAuthId: { type: String },
+        adminAuthEmail: { type: String },
+        toolName: { type: String },
+        toolInput: { type: mongoose.Schema.Types.Mixed },
+        ok: { type: Boolean },
+        durationMs: { type: Number },
+        error: { type: String },
+        detail: { type: String },
+        redactionCounts: { type: mongoose.Schema.Types.Mixed },
+        modelId: { type: String },
+        inputTokens: { type: Number },
+        outputTokens: { type: Number },
+        estimatedUsd: { type: Number },
+    }, {
+        timestamps: { createdAt: true, updatedAt: false },
+        collection: "securityBotAuditEvents",
+    });
+    schema.index({ type: 1, createdAt: -1 });
+    schema.index({ sweepRunId: 1, createdAt: 1 });
+    schema.index({ findingId: 1, createdAt: 1 });
+    return mongoose.model("SecurityBotAuditEvent", schema);
+};
+exports.buildSecurityBotAuditEvent = buildSecurityBotAuditEvent;

package/build/models/security-bot-controls.d.ts

@@ -0,0 +1,23 @@
+import mongoose from "mongoose";
+export declare const SECURITY_BOT_CONTROLS_KEY = "global";
+export interface SecurityBotMutedRule {
+    ruleId: string;
+    until: Date;
+    mutedBy: string;
+    reason?: string;
+}
+export interface SecurityBotControlsDoc extends mongoose.Document {
+    key: string;
+    disabled: boolean;
+    disabledAt?: Date;
+    disabledBy?: string;
+    reason?: string;
+    sweepsPaused: boolean;
+    sweepsPausedAt?: Date;
+    sweepsPausedBy?: string;
+    sweepsPausedReason?: string;
+    mutedRules: SecurityBotMutedRule[];
+}
+export type SecurityBotControlsModel = mongoose.Model<SecurityBotControlsDoc>;
+declare const buildSecurityBotControls: (mongoose: typeof mongoose) => SecurityBotControlsModel;
+export { buildSecurityBotControls };

package/build/models/security-bot-controls.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityBotControls = exports.SECURITY_BOT_CONTROLS_KEY = void 0;
+// Singleton (key "global"). Read before every sweep and every rule
+// evaluation so the switch and the mutes work without a redeploy. Flipped by
+// a super admin from the dashboard or by the bot itself when a budget cap
+// is hit.
+exports.SECURITY_BOT_CONTROLS_KEY = "global";
+const buildSecurityBotControls = (mongoose) => {
+    if (mongoose.models.SecurityBotControls) {
+        return mongoose.model("SecurityBotControls");
+    }
+    const mutedRuleSchema = new mongoose.Schema({
+        ruleId: { type: String, required: true },
+        until: { type: Date, required: true },
+        mutedBy: { type: String, required: true },
+        reason: { type: String },
+    }, { _id: false });
+    const schema = new mongoose.Schema({
+        key: { type: String, required: true, unique: true },
+        disabled: { type: Boolean, default: false },
+        disabledAt: { type: Date },
+        disabledBy: { type: String },
+        reason: { type: String },
+        sweepsPaused: { type: Boolean, default: false },
+        sweepsPausedAt: { type: Date },
+        sweepsPausedBy: { type: String },
+        sweepsPausedReason: { type: String },
+        mutedRules: { type: [mutedRuleSchema], default: [] },
+    }, {
+        collection: "securityBotControls",
+        toJSON: {
+            transform(_doc, ret) {
+                delete ret._id;
+                delete ret.__v;
+                delete ret.key;
+            },
+        },
+    });
+    return mongoose.model("SecurityBotControls", schema);
+};
+exports.buildSecurityBotControls = buildSecurityBotControls;

package/build/models/security-finding.d.ts

@@ -0,0 +1,38 @@
+import mongoose from "mongoose";
+import { SecurityFindingSeverity, SecurityFindingSource, SecurityFindingStatus } from "@riocrypto/common";
+export interface SecurityFindingEvidence {
+    kind: string;
+    ref: string;
+    note?: string;
+}
+export interface SecurityFindingEntity {
+    kind: string;
+    id: string;
+}
+export interface SecurityFindingDoc extends mongoose.Document {
+    fingerprint: string;
+    ruleId: string;
+    source: SecurityFindingSource;
+    severity: SecurityFindingSeverity;
+    status: SecurityFindingStatus;
+    title: string;
+    summary: string;
+    evidence: SecurityFindingEvidence[];
+    entity?: SecurityFindingEntity;
+    lens?: string;
+    sweepRunId?: string;
+    confidence?: number;
+    firstSeenAt: Date;
+    lastSeenAt: Date;
+    count: number;
+    resolvedAt?: Date;
+    resolvedBy?: string;
+    resolutionNote?: string;
+    triageNote?: string;
+    triagedAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export type SecurityFindingModel = mongoose.Model<SecurityFindingDoc>;
+declare const buildSecurityFinding: (mongoose: typeof mongoose) => SecurityFindingModel;
+export { buildSecurityFinding };

package/build/models/security-finding.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityFinding = void 0;
+const common_1 = require("@riocrypto/common");
+const buildSecurityFinding = (mongoose) => {
+    if (mongoose.models.SecurityFinding) {
+        return mongoose.model("SecurityFinding");
+    }
+    const evidenceSchema = new mongoose.Schema({
+        kind: { type: String, required: true },
+        ref: { type: String, required: true },
+        note: { type: String },
+    }, { _id: false });
+    const schema = new mongoose.Schema({
+        fingerprint: { type: String, required: true, unique: true },
+        ruleId: { type: String, required: true },
+        source: { type: String, enum: Object.values(common_1.SecurityFindingSource), required: true },
+        severity: { type: String, enum: Object.values(common_1.SecurityFindingSeverity), required: true },
+        status: {
+            type: String,
+            enum: Object.values(common_1.SecurityFindingStatus),
+            required: true,
+            default: common_1.SecurityFindingStatus.Open,
+        },
+        title: { type: String, required: true },
+        summary: { type: String, default: "" },
+        evidence: { type: [evidenceSchema], default: [] },
+        entity: {
+            type: new mongoose.Schema({ kind: { type: String, required: true }, id: { type: String, required: true } }, { _id: false }),
+        },
+        lens: { type: String },
+        sweepRunId: { type: String },
+        confidence: { type: Number },
+        firstSeenAt: { type: Date, required: true },
+        lastSeenAt: { type: Date, required: true },
+        count: { type: Number, default: 1 },
+        resolvedAt: { type: Date },
+        resolvedBy: { type: String },
+        resolutionNote: { type: String },
+        triageNote: { type: String },
+        triagedAt: { type: Date },
+    }, {
+        timestamps: true,
+        collection: "securityFindings",
+        toJSON: {
+            transform(_doc, ret) {
+                ret.id = ret._id;
+                delete ret._id;
+                delete ret.__v;
+            },
+        },
+    });
+    schema.index({ status: 1, severity: 1, lastSeenAt: -1 });
+    schema.index({ ruleId: 1, lastSeenAt: -1 });
+    schema.index({ "entity.kind": 1, "entity.id": 1, lastSeenAt: -1 });
+    schema.index({ source: 1, lastSeenAt: -1 });
+    return mongoose.model("SecurityFinding", schema);
+};
+exports.buildSecurityFinding = buildSecurityFinding;

package/build/models/security-known-pattern.d.ts

@@ -0,0 +1,12 @@
+import mongoose from "mongoose";
+export interface SecurityKnownPatternDoc extends mongoose.Document {
+    lens: string;
+    ruleId?: string;
+    text: string;
+    createdBy: string;
+    findingId?: string;
+    createdAt: Date;
+}
+export type SecurityKnownPatternModel = mongoose.Model<SecurityKnownPatternDoc>;
+declare const buildSecurityKnownPattern: (mongoose: typeof mongoose) => SecurityKnownPatternModel;
+export { buildSecurityKnownPattern };

package/build/models/security-known-pattern.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecurityKnownPattern = void 0;
+const buildSecurityKnownPattern = (mongoose) => {
+    if (mongoose.models.SecurityKnownPattern) {
+        return mongoose.model("SecurityKnownPattern");
+    }
+    const schema = new mongoose.Schema({
+        lens: { type: String, required: true },
+        ruleId: { type: String },
+        text: { type: String, required: true },
+        createdBy: { type: String, required: true },
+        findingId: { type: String },
+    }, {
+        timestamps: { createdAt: true, updatedAt: false },
+        collection: "securityKnownPatterns",
+        toJSON: {
+            transform(_doc, ret) {
+                ret.id = ret._id;
+                delete ret._id;
+                delete ret.__v;
+            },
+        },
+    });
+    schema.index({ lens: 1, createdAt: -1 });
+    return mongoose.model("SecurityKnownPattern", schema);
+};
+exports.buildSecurityKnownPattern = buildSecurityKnownPattern;

package/build/models/security-sweep-run.d.ts

@@ -0,0 +1,41 @@
+import mongoose from "mongoose";
+export declare enum SecuritySweepRunStatus {
+    Running = "running",
+    Completed = "completed",
+    Failed = "failed",
+    Skipped = "skipped"
+}
+export declare enum SecuritySweepTrigger {
+    Schedule = "schedule",
+    Signal = "signal",
+    Manual = "manual"
+}
+export interface SecuritySweepRunDoc extends mongoose.Document {
+    lens: string;
+    trigger: SecuritySweepTrigger;
+    triggerDetail?: string;
+    windowStart: Date;
+    windowEnd: Date;
+    status: SecuritySweepRunStatus;
+    modelId: string;
+    escalated: boolean;
+    inputSnapshot?: string;
+    output?: string;
+    findingIds: string[];
+    toolCalls: number;
+    toolErrors: number;
+    toolsAvailable: string[];
+    sourcesUnavailable: string[];
+    inputTokens: number;
+    outputTokens: number;
+    estimatedUsd: number;
+    error?: string;
+    requestedBy?: string;
+    leaseUntil?: Date;
+    startedAt: Date;
+    finishedAt?: Date;
+    createdAt: Date;
+}
+export type SecuritySweepRunModel = mongoose.Model<SecuritySweepRunDoc>;
+declare const buildSecuritySweepRun: (mongoose: typeof mongoose) => SecuritySweepRunModel;
+export { buildSecuritySweepRun };

package/build/models/security-sweep-run.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSecuritySweepRun = exports.SecuritySweepTrigger = exports.SecuritySweepRunStatus = void 0;
+// One row per AI sweep. The redacted input snapshot is kept next to the
+// output so a false positive can be diagnosed by looking at exactly what the
+// model saw, and so a prompt change can be replayed against stored inputs.
+// Both are stripped from toJSON; the super admin trace route exposes them.
+var SecuritySweepRunStatus;
+(function (SecuritySweepRunStatus) {
+    SecuritySweepRunStatus["Running"] = "running";
+    SecuritySweepRunStatus["Completed"] = "completed";
+    SecuritySweepRunStatus["Failed"] = "failed";
+    SecuritySweepRunStatus["Skipped"] = "skipped";
+})(SecuritySweepRunStatus = exports.SecuritySweepRunStatus || (exports.SecuritySweepRunStatus = {}));
+var SecuritySweepTrigger;
+(function (SecuritySweepTrigger) {
+    SecuritySweepTrigger["Schedule"] = "schedule";
+    SecuritySweepTrigger["Signal"] = "signal";
+    SecuritySweepTrigger["Manual"] = "manual";
+})(SecuritySweepTrigger = exports.SecuritySweepTrigger || (exports.SecuritySweepTrigger = {}));
+const buildSecuritySweepRun = (mongoose) => {
+    if (mongoose.models.SecuritySweepRun) {
+        return mongoose.model("SecuritySweepRun");
+    }
+    const schema = new mongoose.Schema({
+        lens: { type: String, required: true },
+        trigger: { type: String, enum: Object.values(SecuritySweepTrigger), required: true },
+        triggerDetail: { type: String },
+        windowStart: { type: Date, required: true },
+        windowEnd: { type: Date, required: true },
+        status: { type: String, enum: Object.values(SecuritySweepRunStatus), required: true },
+        modelId: { type: String, default: "" },
+        escalated: { type: Boolean, default: false },
+        inputSnapshot: { type: String },
+        output: { type: String },
+        findingIds: { type: [String], default: [] },
+        toolCalls: { type: Number, default: 0 },
+        toolErrors: { type: Number, default: 0 },
+        toolsAvailable: { type: [String], default: [] },
+        sourcesUnavailable: { type: [String], default: [] },
+        inputTokens: { type: Number, default: 0 },
+        outputTokens: { type: Number, default: 0 },
+        estimatedUsd: { type: Number, default: 0 },
+        error: { type: String },
+        requestedBy: { type: String },
+        leaseUntil: { type: Date },
+        startedAt: { type: Date, required: true },
+        finishedAt: { type: Date },
+    }, {
+        timestamps: { createdAt: true, updatedAt: false },
+        collection: "securitySweepRuns",
+        toJSON: {
+            transform(_doc, ret) {
+                ret.id = ret._id;
+                delete ret._id;
+                delete ret.__v;
+                delete ret.inputSnapshot;
+                delete ret.output;
+            },
+        },
+    });
+    schema.index({ startedAt: -1 });
+    schema.index({ lens: 1, startedAt: -1 });
+    schema.index({ trigger: 1, startedAt: -1 });
+    return mongoose.model("SecuritySweepRun", schema);
+};
+exports.buildSecuritySweepRun = buildSecuritySweepRun;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2935",
+  "version": "1.0.2936",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -28,7 +28,7 @@
     "@google-cloud/secret-manager": "^5.6.0",
     "@google-cloud/storage": "^7.19.0",
     "@hyperdx/node-opentelemetry": "^0.10.3",
-    "@riocrypto/common": "1.0.2729",
+    "@riocrypto/common": "1.0.2732",
     "@slack/web-api": "^7.15.0",
     "@types/express": "^4.17.25",
     "axios": "1.18.1",
@@ -37,6 +37,7 @@
     "express-rate-limit": "^7.5.1",
     "express-validator": "^6.15.0",
     "fireblocks-sdk": "^5.38.0",
+    "google-auth-library": "9.15.1",
     "googleapis": "^135.1.0",
     "he": "^1.2.0",
     "jose": "^6.2.2",