@secfn/core 0.0.1 → 0.0.2

package/src/rate-limiting/rate-limiter.ts

@@ -1,181 +0,0 @@
-import type { RateLimitRule, RateLimitEntry, RateLimitResult, RateLimitViolation } from '../types/index.js';
-import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
-import { generateId } from '../utils/helpers.js';
-
-export interface RateLimiterConfig {
-  storage: IndexedDBStorage;
-  rules: {
-    global?: RateLimitRule;
-    perUser?: RateLimitRule;
-    perIP?: RateLimitRule;
-    perEndpoint?: Record<string, RateLimitRule>;
-  };
-  onLimitExceeded?: (violation: RateLimitViolation) => void | Promise<void>;
-}
-
-export interface RateLimitCheckRequest {
-  userId?: string;
-  ip: string;
-  endpoint?: string;
-}
-
-export class RateLimiter {
-  private storage: IndexedDBStorage;
-  private rules: RateLimiterConfig['rules'];
-  private onLimitExceeded?: (violation: RateLimitViolation) => void | Promise<void>;
-
-  constructor(config: RateLimiterConfig) {
-    this.storage = config.storage;
-    this.rules = config.rules;
-    this.onLimitExceeded = config.onLimitExceeded;
-  }
-
-  async check(request: RateLimitCheckRequest): Promise<RateLimitResult> {
-    const checks: Array<{ key: string; rule: RateLimitRule }> = [];
-
-    if (this.rules.global) {
-      checks.push({
-        key: 'global',
-        rule: this.rules.global,
-      });
-    }
-
-    if (this.rules.perUser && request.userId) {
-      checks.push({
-        key: `user:${request.userId}`,
-        rule: this.rules.perUser,
-      });
-    }
-
-    if (this.rules.perIP) {
-      checks.push({
-        key: `ip:${request.ip}`,
-        rule: this.rules.perIP,
-      });
-    }
-
-    if (this.rules.perEndpoint && request.endpoint) {
-      const endpointRule = this.rules.perEndpoint[request.endpoint];
-      if (endpointRule) {
-        checks.push({
-          key: `endpoint:${request.endpoint}:${request.ip}`,
-          rule: endpointRule,
-        });
-      }
-    }
-
-    for (const check of checks) {
-      const result = await this.checkLimit(check.key, check.rule);
-      
-      if (!result.allowed) {
-        await this.handleViolation({
-          id: generateId('violation'),
-          timestamp: Date.now(),
-          key: check.key,
-          ip: request.ip,
-          userId: request.userId,
-          endpoint: request.endpoint || 'unknown',
-          requestCount: result.limit || 0,
-          limit: check.rule.requests,
-          window: check.rule.window,
-          blocked: true,
-        });
-
-        return result;
-      }
-    }
-
-    return {
-      allowed: true,
-      remaining: checks.length > 0 ? checks[0].rule.requests : 0,
-      resetAt: Date.now() + (checks.length > 0 ? checks[0].rule.window : 0),
-    };
-  }
-
-  private async checkLimit(key: string, rule: RateLimitRule): Promise<RateLimitResult> {
-    const now = Date.now();
-    const entry = await this.storage.getRateLimitEntry(key);
-
-    if (!entry || now >= entry.resetAt) {
-      const newEntry: RateLimitEntry = {
-        key,
-        count: 1,
-        resetAt: now + rule.window,
-        blocked: false,
-      };
-      await this.storage.setRateLimitEntry(newEntry);
-
-      return {
-        allowed: true,
-        remaining: rule.requests - 1,
-        resetAt: newEntry.resetAt,
-        limit: rule.requests,
-      };
-    }
-
-    if (entry.blocked && entry.blockedUntil && now < entry.blockedUntil) {
-      return {
-        allowed: false,
-        remaining: 0,
-        resetAt: entry.resetAt,
-        retryAfter: entry.blockedUntil - now,
-        limit: rule.requests,
-      };
-    }
-
-    if (entry.count >= rule.requests) {
-      entry.blocked = true;
-      entry.blockedUntil = now + (rule.blockDuration || rule.window);
-      await this.storage.setRateLimitEntry(entry);
-
-      return {
-        allowed: false,
-        remaining: 0,
-        resetAt: entry.resetAt,
-        retryAfter: entry.blockedUntil - now,
-        limit: rule.requests,
-      };
-    }
-
-    entry.count++;
-    await this.storage.setRateLimitEntry(entry);
-
-    return {
-      allowed: true,
-      remaining: rule.requests - entry.count,
-      resetAt: entry.resetAt,
-      limit: rule.requests,
-    };
-  }
-
-  private async handleViolation(violation: RateLimitViolation): Promise<void> {
-    if (this.onLimitExceeded) {
-      try {
-        await this.onLimitExceeded(violation);
-      } catch (error) {
-        console.error('[SecFn] Error in rate limit violation handler:', error);
-      }
-    }
-  }
-
-  async reset(key: string): Promise<void> {
-    await this.storage.deleteRateLimitEntry(key);
-  }
-
-  async resetUser(userId: string): Promise<void> {
-    await this.reset(`user:${userId}`);
-  }
-
-  async resetIP(ip: string): Promise<void> {
-    await this.reset(`ip:${ip}`);
-  }
-
-  async unblock(key: string): Promise<void> {
-    const entry = await this.storage.getRateLimitEntry(key);
-    if (entry) {
-      entry.blocked = false;
-      entry.blockedUntil = undefined;
-      await this.storage.setRateLimitEntry(entry);
-    }
-  }
-}

package/src/scanning/patterns.ts

@@ -1,140 +0,0 @@
-import type { SecretPattern } from '../types/index.js';
-
-export const DEFAULT_PATTERNS: SecretPattern[] = [
-  {
-    name: 'AWS Access Key',
-    pattern: /AKIA[0-9A-Z]{16}/g,
-    entropy: 4.5,
-    description: 'AWS Access Key ID',
-    severity: 'critical',
-  },
-  {
-    name: 'AWS Secret Key',
-    pattern: /aws[_-]?secret[_-]?access[_-]?key[=:\s]+['"]?([a-zA-Z0-9/+=]{40})['"]?/gi,
-    entropy: 5.0,
-    description: 'AWS Secret Access Key',
-    severity: 'critical',
-  },
-  {
-    name: 'Generic API Key',
-    pattern: /api[_-]?key[_-]?[=:]\s*['"]?([a-zA-Z0-9]{32,})['"]?/gi,
-    entropy: 4.0,
-    description: 'Generic API key pattern',
-    severity: 'high',
-  },
-  {
-    name: 'Private Key',
-    pattern: /-----BEGIN (RSA|OPENSSH|DSA|EC|PGP) PRIVATE KEY-----/g,
-    description: 'Private cryptographic key',
-    severity: 'critical',
-  },
-  {
-    name: 'JWT Token',
-    pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,
-    description: 'JSON Web Token',
-    severity: 'high',
-  },
-  {
-    name: 'GitHub Token',
-    pattern: /ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/g,
-    entropy: 4.5,
-    description: 'GitHub Personal Access Token',
-    severity: 'critical',
-  },
-  {
-    name: 'Stripe API Key',
-    pattern: /sk_live_[a-zA-Z0-9]{24,}|rk_live_[a-zA-Z0-9]{24,}/g,
-    entropy: 4.5,
-    description: 'Stripe API Key',
-    severity: 'critical',
-  },
-  {
-    name: 'Google API Key',
-    pattern: /AIza[0-9A-Za-z_-]{35}/g,
-    entropy: 4.5,
-    description: 'Google API Key',
-    severity: 'high',
-  },
-  {
-    name: 'Slack Token',
-    pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}/g,
-    entropy: 4.5,
-    description: 'Slack API Token',
-    severity: 'high',
-  },
-  {
-    name: 'OpenAI API Key',
-    pattern: /sk-[a-zA-Z0-9]{48}/g,
-    entropy: 4.5,
-    description: 'OpenAI API Key',
-    severity: 'critical',
-  },
-  {
-    name: 'Anthropic API Key',
-    pattern: /sk-ant-[a-zA-Z0-9_-]{95,}/g,
-    entropy: 4.5,
-    description: 'Anthropic API Key',
-    severity: 'critical',
-  },
-  {
-    name: 'Database Connection String',
-    pattern: /(postgres|mysql|mongodb):\/\/[^\s'"<>]+:[^\s'"<>]+@[^\s'"<>]+/gi,
-    description: 'Database connection string with credentials',
-    severity: 'critical',
-  },
-  {
-    name: 'Password in Code',
-    pattern: /(password|passwd|pwd)[=:\s]+['"]([^'"]{8,})['"]/gi,
-    entropy: 3.5,
-    description: 'Hardcoded password',
-    severity: 'high',
-  },
-  {
-    name: 'Bearer Token',
-    pattern: /Bearer\s+[a-zA-Z0-9_\-\.]{20,}/gi,
-    entropy: 4.0,
-    description: 'Bearer authentication token',
-    severity: 'high',
-  },
-  {
-    name: 'NPM Token',
-    pattern: /npm_[a-zA-Z0-9]{36}/g,
-    entropy: 4.5,
-    description: 'NPM Access Token',
-    severity: 'high',
-  },
-  {
-    name: 'Twilio API Key',
-    pattern: /SK[a-f0-9]{32}/g,
-    entropy: 4.5,
-    description: 'Twilio API Key',
-    severity: 'high',
-  },
-  {
-    name: 'SendGrid API Key',
-    pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
-    entropy: 4.5,
-    description: 'SendGrid API Key',
-    severity: 'high',
-  },
-  {
-    name: 'Mailgun API Key',
-    pattern: /key-[a-f0-9]{32}/g,
-    entropy: 4.0,
-    description: 'Mailgun API Key',
-    severity: 'high',
-  },
-  {
-    name: 'Azure Storage Key',
-    pattern: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[^;]+/gi,
-    description: 'Azure Storage Connection String',
-    severity: 'critical',
-  },
-  {
-    name: 'Generic Secret',
-    pattern: /(secret|token|api[_-]?key|auth[_-]?token)[=:\s]+['"]([a-zA-Z0-9_\-\/.+=]{20,})['"]/gi,
-    entropy: 3.5,
-    description: 'Generic secret pattern',
-    severity: 'medium',
-  },
-];

package/src/scanning/scanner.ts

@@ -1,199 +0,0 @@
-import { readFile } from 'fs/promises';
-import { glob } from 'glob';
-import simpleGit, { type SimpleGit } from 'simple-git';
-import type { SecretPattern, SecretScanResult } from '../types/index.js';
-import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
-import { DEFAULT_PATTERNS } from './patterns.js';
-import { generateId, calculateEntropy, redactSecret } from '../utils/helpers.js';
-
-export interface SecretScannerConfig {
-  patterns?: SecretPattern[];
-  excludePaths?: string[];
-  minEntropy?: number;
-  maxFileSize?: number;
-  storage?: IndexedDBStorage;
-}
-
-export interface ScanOptions {
-  saveResults?: boolean;
-}
-
-export interface GitScanOptions {
-  branch?: string;
-  commits?: number;
-}
-
-export class SecretScanner {
-  private patterns: SecretPattern[];
-  private excludePaths: string[];
-  private minEntropy: number;
-  private maxFileSize: number;
-  private storage?: IndexedDBStorage;
-  private git: SimpleGit;
-
-  constructor(config: SecretScannerConfig = {}) {
-    this.patterns = config.patterns || DEFAULT_PATTERNS;
-    this.excludePaths = config.excludePaths || ['node_modules/**', 'dist/**', 'build/**', '.git/**'];
-    this.minEntropy = config.minEntropy || 3.0;
-    this.maxFileSize = config.maxFileSize || 1024 * 1024;
-    this.storage = config.storage;
-    this.git = simpleGit();
-  }
-
-  async scanDirectory(dir: string, options: ScanOptions = {}): Promise<SecretScanResult[]> {
-    const files = await glob('**/*', {
-      cwd: dir,
-      absolute: true,
-      nodir: true,
-      ignore: this.excludePaths,
-    });
-
-    const results: SecretScanResult[] = [];
-
-    for (const file of files) {
-      try {
-        const fileResults = await this.scanFile(file);
-        results.push(...fileResults);
-      } catch (error) {
-        console.error(`[SecFn] Error scanning file ${file}:`, error);
-      }
-    }
-
-    if (options.saveResults && this.storage) {
-      for (const result of results) {
-        await this.storage.saveScanResult(result);
-      }
-    }
-
-    return results;
-  }
-
-  async scanFile(filePath: string): Promise<SecretScanResult[]> {
-    try {
-      const content = await readFile(filePath, 'utf-8');
-      
-      if (content.length > this.maxFileSize) {
-        console.warn(`[SecFn] Skipping large file: ${filePath}`);
-        return [];
-      }
-
-      return this.scanContent(content, filePath);
-    } catch (error) {
-      console.error(`[SecFn] Error reading file ${filePath}:`, error);
-      return [];
-    }
-  }
-
-  scanContent(content: string, filePath: string): SecretScanResult[] {
-    const results: SecretScanResult[] = [];
-    const lines = content.split('\n');
-
-    for (const pattern of this.patterns) {
-      const matches = content.matchAll(pattern.pattern);
-
-      for (const match of matches) {
-        if (!match[0] || !match.index) continue;
-
-        const matchedSecret = match[1] || match[0];
-        const entropy = calculateEntropy(matchedSecret);
-
-        if (pattern.entropy && entropy < Math.min(pattern.entropy, this.minEntropy)) {
-          continue;
-        }
-
-        const { line, column } = this.getLineAndColumn(content, match.index);
-        const context = this.getContext(lines, line);
-
-        const result: SecretScanResult = {
-          id: generateId('scan'),
-          timestamp: Date.now(),
-          file: filePath,
-          line,
-          column,
-          pattern: pattern.name,
-          match: matchedSecret,
-          redactedMatch: redactSecret(matchedSecret),
-          severity: pattern.severity,
-          entropy,
-          context,
-          resolved: false,
-          falsePositive: false,
-        };
-
-        results.push(result);
-      }
-    }
-
-    return results;
-  }
-
-  async scanGitHistory(options: GitScanOptions = {}): Promise<SecretScanResult[]> {
-    const branch = options.branch || 'HEAD';
-    const commitCount = options.commits || 100;
-
-    const log = await this.git.log([branch, `-n`, `${commitCount}`]);
-    const results: SecretScanResult[] = [];
-
-    for (const commit of log.all) {
-      try {
-        const diff = await this.git.show([commit.hash]);
-        const commitResults = this.scanContent(diff, `commit:${commit.hash.substring(0, 7)}`);
-        
-        for (const result of commitResults) {
-          result.metadata = {
-            commit: commit.hash,
-            author: commit.author_name,
-            date: commit.date,
-            message: commit.message,
-          };
-        }
-
-        results.push(...commitResults);
-      } catch (error) {
-        console.error(`[SecFn] Error scanning commit ${commit.hash}:`, error);
-      }
-    }
-
-    if (this.storage) {
-      for (const result of results) {
-        await this.storage.saveScanResult(result);
-      }
-    }
-
-    return results;
-  }
-
-  addPattern(pattern: SecretPattern): void {
-    this.patterns.push(pattern);
-  }
-
-  removePattern(name: string): void {
-    this.patterns = this.patterns.filter(p => p.name !== name);
-  }
-
-  getPatterns(): SecretPattern[] {
-    return [...this.patterns];
-  }
-
-  private getLineAndColumn(content: string, index: number): { line: number; column: number } {
-    const beforeMatch = content.substring(0, index);
-    const lines = beforeMatch.split('\n');
-    const line = lines.length;
-    const column = lines[lines.length - 1].length + 1;
-    
-    return { line, column };
-  }
-
-  private getContext(lines: string[], lineNumber: number, contextLines = 2): string {
-    const start = Math.max(0, lineNumber - contextLines - 1);
-    const end = Math.min(lines.length, lineNumber + contextLines);
-    return lines.slice(start, end).join('\n');
-  }
-
-  async getScanHistory(limit = 100): Promise<SecretScanResult[]> {
-    if (!this.storage) {
-      throw new Error('Storage not configured');
-    }
-    return await this.storage.getScanHistory(limit);
-  }
-}

package/src/secrets/encryption.ts

@@ -1,74 +0,0 @@
-import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'crypto';
-
-export interface EncryptedData {
-  iv: string;
-  encrypted: string;
-  authTag: string;
-}
-
-export class SecretEncryption {
-  private algorithm = 'aes-256-gcm';
-  private keyLength = 32;
-  private ivLength = 16;
-  private salt = 'secfn-salt-v1';
-  private iterations = 100000;
-
-  async encrypt(plaintext: string, masterKey: string): Promise<string> {
-    const key = this.deriveKey(masterKey);
-    const iv = randomBytes(this.ivLength);
-    const cipher = createCipheriv(this.algorithm, key, iv) as any;
-
-    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
-    encrypted += cipher.final('hex');
-    const authTag = cipher.getAuthTag();
-
-    const data: EncryptedData = {
-      iv: iv.toString('hex'),
-      encrypted,
-      authTag: authTag.toString('hex'),
-    };
-
-    return JSON.stringify(data);
-  }
-
-  async decrypt(ciphertext: string, masterKey: string): Promise<string> {
-    const key = this.deriveKey(masterKey);
-    const data: EncryptedData = JSON.parse(ciphertext);
-
-    const decipher = createDecipheriv(
-      this.algorithm,
-      key,
-      Buffer.from(data.iv, 'hex')
-    ) as any;
-    decipher.setAuthTag(Buffer.from(data.authTag, 'hex'));
-
-    let decrypted = decipher.update(data.encrypted, 'hex', 'utf8');
-    decrypted += decipher.final('utf8');
-
-    return decrypted;
-  }
-
-  private deriveKey(masterKey: string): Buffer {
-    return pbkdf2Sync(
-      masterKey,
-      this.salt,
-      this.iterations,
-      this.keyLength,
-      'sha256'
-    );
-  }
-
-  isEncrypted(value: string): boolean {
-    try {
-      const parsed = JSON.parse(value);
-      return (
-        typeof parsed === 'object' &&
-        'iv' in parsed &&
-        'encrypted' in parsed &&
-        'authTag' in parsed
-      );
-    } catch {
-      return false;
-    }
-  }
-}