@secfn/core 0.0.1

package/examples/basic-usage.ts

@@ -0,0 +1,143 @@
+import { createSecFn } from '../src/index.js';
+
+async function main() {
+  const secFn = createSecFn({
+    namespace: 'my-app-security',
+    masterKey: process.env.MASTER_KEY || 'dev-master-key-change-in-production',
+  });
+
+  await secFn.initialize();
+  console.log('✅ SecFn initialized');
+
+  const vault = secFn.createSecretsVault();
+  const scanner = secFn.createSecretScanner();
+  const access = secFn.createAccessControl();
+  const limiter = secFn.createRateLimiter({
+    rules: {
+      global: { requests: 1000, window: 60000 },
+      perUser: { requests: 100, window: 60000 },
+      perIP: { requests: 50, window: 60000 },
+      perEndpoint: {
+        '/api/login': { requests: 5, window: 300000 },
+      },
+    },
+  });
+  const monitoring = secFn.createMonitoring({
+    anomalyDetection: {
+      enabled: true,
+      sensitivity: 0.7,
+    },
+  });
+
+  console.log('\n📦 Testing Secrets Vault...');
+  await vault.set('database_url', 'postgres://user:pass@localhost:5432/db', {
+    tags: ['database', 'production'],
+    environment: 'production',
+    createdBy: 'admin',
+  });
+  console.log('✓ Secret stored');
+
+  const dbUrl = await vault.get('database_url');
+  console.log('✓ Secret retrieved:', dbUrl?.substring(0, 20) + '...');
+
+  const secrets = await vault.list({ environment: 'production' });
+  console.log(`✓ Found ${secrets.length} production secrets`);
+
+  console.log('\n🔍 Testing Secret Scanner...');
+  const scanResults = scanner.scanContent(
+    `
+    const apiKey = 'sk-ant-1234567890abcdef';
+    const awsKey = 'AKIAIOSFODNN7EXAMPLE';
+    const password = 'super-secret-password';
+  `,
+    'test.ts'
+  );
+  console.log(`✓ Found ${scanResults.length} secrets in code:`);
+  scanResults.forEach(r => {
+    console.log(`  - ${r.pattern} at line ${r.line}: ${r.redactedMatch}`);
+  });
+
+  console.log('\n🔐 Testing Access Control...');
+  const adminRole = await access.createRole({
+    name: 'admin',
+    description: 'Full system access',
+    permissions: ['*:*'],
+  });
+  console.log('✓ Admin role created');
+
+  const editorRole = await access.createRole({
+    name: 'editor',
+    description: 'Can edit projects',
+    permissions: ['project:read', 'project:write', 'file:read', 'file:write'],
+  });
+  console.log('✓ Editor role created');
+
+  await access.assignRole('user_123', editorRole);
+  console.log('✓ Role assigned to user');
+
+  const canEdit = await access.check({
+    userId: 'user_123',
+    action: 'project:write',
+  });
+  console.log(`✓ User can edit projects: ${canEdit}`);
+
+  const canDelete = await access.check({
+    userId: 'user_123',
+    action: 'project:delete',
+  });
+  console.log(`✓ User can delete projects: ${canDelete}`);
+
+  console.log('\n⏱️  Testing Rate Limiting...');
+  for (let i = 0; i < 3; i++) {
+    const result = await limiter.check({
+      userId: 'user_456',
+      ip: '192.168.1.1',
+      endpoint: '/api/search',
+    });
+    console.log(`  Request ${i + 1}: ${result.allowed ? '✓ Allowed' : '✗ Blocked'} (remaining: ${result.remaining})`);
+  }
+
+  console.log('\n📊 Testing Security Monitoring...');
+  await monitoring.logEvent({
+    type: 'auth_failure',
+    severity: 'medium',
+    userId: 'user_789',
+    ip: '192.168.1.100',
+    resource: '/api/login',
+    action: 'login',
+    metadata: {
+      reason: 'invalid_password',
+      attemptCount: 3,
+    },
+  });
+  console.log('✓ Security event logged');
+
+  await monitoring.logEvent({
+    type: 'permission_denied',
+    severity: 'low',
+    userId: 'user_789',
+    ip: '192.168.1.100',
+    resource: '/api/admin',
+    action: 'access',
+  });
+  console.log('✓ Another security event logged');
+
+  const recentEvents = await monitoring.getRecentEvents(10);
+  console.log(`✓ Retrieved ${recentEvents.length} recent events`);
+
+  const metrics = await monitoring.getMetrics({
+    start: Date.now() - 24 * 60 * 60 * 1000,
+    end: Date.now(),
+  });
+  console.log('✓ Metrics calculated:');
+  console.log(`  - Total events: ${metrics.totalEvents}`);
+  console.log(`  - Events by type:`, metrics.eventsByType);
+  console.log(`  - Events by severity:`, metrics.eventsBySeverity);
+
+  console.log('\n✨ All tests completed successfully!');
+
+  await secFn.destroy();
+  console.log('🧹 Cleanup complete');
+}
+
+main().catch(console.error);

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@secfn/core",
+  "version": "0.0.1",
+  "description": "Comprehensive self-hosted security platform for developers",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "build:watch": "tsc --watch",
+    "test": "vitest",
+    "test:watch": "vitest --watch",
+    "test:coverage": "vitest --coverage",
+    "lint": "eslint src/**/*.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "security",
+    "secrets",
+    "scanning",
+    "rbac",
+    "rate-limiting",
+    "access-control",
+    "vault",
+    "monitoring",
+    "self-hosted"
+  ],
+  "author": "21n",
+  "license": "MIT",
+  "dependencies": {
+    "glob": "^11.0.0",
+    "simple-git": "^3.27.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.6.0",
+    "vitest": "^3.2.4",
+    "fake-indexeddb": "^6.0.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "eslint": "^9.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0"
+  },
+  "peerDependencies": {
+    "@superfunctions/db": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@superfunctions/db": {
+      "optional": true
+    }
+  },
+  "bugs": {
+    "url": "https://github.com/21nCo/super-functions/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/21nCo/super-functions.git",
+    "directory": "secfn/typescript"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "superfunctions": {
+    "initFunction": "secFn",
+    "schemaVersion": 1,
+    "namespace": "secfn"
+  }
+}

package/src/access-control/rbac.ts

@@ -0,0 +1,271 @@
+import type { Role, UserRole, AccessRequest } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { generateId } from '../utils/helpers.js';
+
+export interface AccessControlConfig {
+  storage: IndexedDBStorage;
+  cache?: {
+    ttl: number;
+    maxSize: number;
+  };
+}
+
+export interface CreateRoleOptions {
+  name: string;
+  description: string;
+  permissions: string[];
+  inherits?: string[];
+  metadata?: Record<string, unknown>;
+}
+
+export interface AssignRoleOptions {
+  resourceIds?: string[];
+  expiresAt?: number;
+}
+
+interface CacheEntry {
+  allowed: boolean;
+  timestamp: number;
+}
+
+export class AccessControl {
+  private storage: IndexedDBStorage;
+  private cache: Map<string, CacheEntry>;
+  private cacheTTL: number;
+  private maxCacheSize: number;
+
+  constructor(config: AccessControlConfig) {
+    this.storage = config.storage;
+    this.cache = new Map();
+    this.cacheTTL = config.cache?.ttl || 300000;
+    this.maxCacheSize = config.cache?.maxSize || 1000;
+  }
+
+  async createRole(options: CreateRoleOptions): Promise<string> {
+    const role: Role = {
+      id: generateId('role'),
+      name: options.name,
+      description: options.description,
+      permissions: options.permissions,
+      inherits: options.inherits,
+      metadata: options.metadata,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    };
+
+    await this.storage.saveRole(role);
+    return role.id;
+  }
+
+  async getRole(id: string): Promise<Role | null> {
+    return await this.storage.getRole(id);
+  }
+
+  async getRoleByName(name: string): Promise<Role | null> {
+    const roles = await this.storage.listRoles();
+    return roles.find(r => r.name === name) || null;
+  }
+
+  async listRoles(): Promise<Role[]> {
+    return await this.storage.listRoles();
+  }
+
+  async updateRole(id: string, updates: Partial<CreateRoleOptions>): Promise<void> {
+    const role = await this.storage.getRole(id);
+    if (!role) {
+      throw new Error(`Role ${id} not found`);
+    }
+
+    if (updates.name) role.name = updates.name;
+    if (updates.description) role.description = updates.description;
+    if (updates.permissions) role.permissions = updates.permissions;
+    if (updates.inherits) role.inherits = updates.inherits;
+    if (updates.metadata) role.metadata = updates.metadata;
+    role.updatedAt = Date.now();
+
+    await this.storage.saveRole(role);
+    this.invalidateCache();
+  }
+
+  async deleteRole(id: string): Promise<void> {
+    await this.storage.deleteRole(id);
+    this.invalidateCache();
+  }
+
+  async assignRole(userId: string, roleId: string, options: AssignRoleOptions = {}): Promise<void> {
+    const role = await this.storage.getRole(roleId);
+    if (!role) {
+      throw new Error(`Role ${roleId} not found`);
+    }
+
+    const userRole: UserRole = {
+      userId,
+      roleId,
+      resourceIds: options.resourceIds,
+      expiresAt: options.expiresAt,
+      assignedAt: Date.now(),
+    };
+
+    await this.storage.assignUserRole(userRole);
+    this.invalidateCacheForUser(userId);
+  }
+
+  async removeRole(userId: string, roleId: string): Promise<void> {
+    await this.storage.removeUserRole(userId, roleId);
+    this.invalidateCacheForUser(userId);
+  }
+
+  async getUserRoles(userId: string): Promise<Role[]> {
+    const userRoles = await this.storage.getUserRoles(userId);
+    const roles: Role[] = [];
+
+    for (const userRole of userRoles) {
+      if (userRole.expiresAt && Date.now() > userRole.expiresAt) {
+        continue;
+      }
+
+      const role = await this.storage.getRole(userRole.roleId);
+      if (role) {
+        roles.push(role);
+      }
+    }
+
+    return roles;
+  }
+
+  async getUserPermissions(userId: string): Promise<string[]> {
+    const roles = await this.getUserRoles(userId);
+    const permissions = new Set<string>();
+
+    for (const role of roles) {
+      await this.collectPermissions(role, permissions);
+    }
+
+    return Array.from(permissions);
+  }
+
+  async check(request: AccessRequest): Promise<boolean> {
+    const cacheKey = this.getCacheKey(request);
+    const cached = this.getCached(cacheKey);
+
+    if (cached !== null) {
+      return cached;
+    }
+
+    const allowed = await this.evaluateAccess(request);
+    this.setCached(cacheKey, allowed);
+
+    return allowed;
+  }
+
+  private async evaluateAccess(request: AccessRequest): Promise<boolean> {
+    const userRoles = await this.storage.getUserRoles(request.userId);
+
+    for (const userRole of userRoles) {
+      if (userRole.expiresAt && Date.now() > userRole.expiresAt) {
+        continue;
+      }
+
+      if (userRole.resourceIds && request.resourceId) {
+        if (!userRole.resourceIds.includes(request.resourceId)) {
+          continue;
+        }
+      }
+
+      const role = await this.storage.getRole(userRole.roleId);
+      if (!role) continue;
+
+      const hasPermission = await this.checkRolePermission(role, request);
+      if (hasPermission) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  private async checkRolePermission(role: Role, request: AccessRequest): Promise<boolean> {
+    const allPermissions = new Set<string>();
+    await this.collectPermissions(role, allPermissions);
+
+    for (const permission of allPermissions) {
+      if (this.matchesPermission(permission, request.action)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  private async collectPermissions(role: Role, collected: Set<string>): Promise<void> {
+    for (const permission of role.permissions) {
+      collected.add(permission);
+    }
+
+    if (role.inherits) {
+      for (const inheritedRoleId of role.inherits) {
+        const inheritedRole = await this.storage.getRole(inheritedRoleId);
+        if (inheritedRole) {
+          await this.collectPermissions(inheritedRole, collected);
+        }
+      }
+    }
+  }
+
+  private matchesPermission(permission: string, action: string): boolean {
+    if (permission === '*:*') return true;
+
+    const [permResource, permAction] = permission.split(':');
+    const [reqResource, reqAction] = action.split(':');
+
+    if (!permResource || !permAction || !reqResource || !reqAction) {
+      return false;
+    }
+
+    const resourceMatch = permResource === '*' || permResource === reqResource;
+    const actionMatch = permAction === '*' || permAction === reqAction;
+
+    return resourceMatch && actionMatch;
+  }
+
+  private getCacheKey(request: AccessRequest): string {
+    return `${request.userId}:${request.action}:${request.resourceId || '*'}`;
+  }
+
+  private getCached(key: string): boolean | null {
+    const entry = this.cache.get(key);
+    if (!entry) return null;
+
+    const age = Date.now() - entry.timestamp;
+    if (age > this.cacheTTL) {
+      this.cache.delete(key);
+      return null;
+    }
+
+    return entry.allowed;
+  }
+
+  private setCached(key: string, allowed: boolean): void {
+    if (this.cache.size >= this.maxCacheSize) {
+      const firstKey = this.cache.keys().next().value;
+      if (firstKey) this.cache.delete(firstKey);
+    }
+
+    this.cache.set(key, {
+      allowed,
+      timestamp: Date.now(),
+    });
+  }
+
+  private invalidateCache(): void {
+    this.cache.clear();
+  }
+
+  private invalidateCacheForUser(userId: string): void {
+    for (const [key] of this.cache) {
+      if (key.startsWith(`${userId}:`)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+}

package/src/core/secfn.ts

@@ -0,0 +1,90 @@
+import { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { SecretsVault, type SecretsVaultConfig } from '../secrets/vault.js';
+import { SecretScanner, type SecretScannerConfig } from '../scanning/scanner.js';
+import { AccessControl, type AccessControlConfig } from '../access-control/rbac.js';
+import { RateLimiter, type RateLimiterConfig } from '../rate-limiting/rate-limiter.js';
+import { SecurityMonitor, type MonitoringConfig } from '../monitoring/security-monitor.js';
+import type { StorageConfig } from '../types/index.js';
+
+export interface SecFnConfig {
+  storage?: StorageConfig;
+  masterKey?: string;
+  namespace?: string;
+}
+
+export class SecFn {
+  private storage: IndexedDBStorage;
+  private masterKey?: string;
+  private initialized: boolean = false;
+
+  constructor(config: SecFnConfig = {}) {
+    const dbName = config.storage?.dbName || config.namespace || 'secfn';
+    this.storage = new IndexedDBStorage(dbName);
+    this.masterKey = config.masterKey;
+  }
+
+  async initialize(): Promise<void> {
+    if (this.initialized) return;
+    await this.storage.initialize();
+    this.initialized = true;
+  }
+
+  createSecretsVault(config?: Partial<Omit<SecretsVaultConfig, 'storage'>>): SecretsVault {
+    if (!this.masterKey && !config?.encryption?.masterKey) {
+      throw new Error('Master key is required for secrets vault');
+    }
+
+    return new SecretsVault({
+      storage: this.storage,
+      encryption: {
+        algorithm: 'AES-256-GCM',
+        masterKey: config?.encryption?.masterKey || this.masterKey!,
+        ...config?.encryption,
+      },
+      rotation: config?.rotation,
+    });
+  }
+
+  createSecretScanner(config?: Partial<Omit<SecretScannerConfig, 'storage'>>): SecretScanner {
+    return new SecretScanner({
+      ...config,
+      storage: this.storage,
+    });
+  }
+
+  createAccessControl(config?: Partial<Omit<AccessControlConfig, 'storage'>>): AccessControl {
+    return new AccessControl({
+      storage: this.storage,
+      cache: config?.cache,
+    });
+  }
+
+  createRateLimiter(config: Omit<RateLimiterConfig, 'storage'>): RateLimiter {
+    return new RateLimiter({
+      storage: this.storage,
+      rules: config.rules,
+      onLimitExceeded: config.onLimitExceeded,
+    });
+  }
+
+  createMonitoring(config?: Partial<Omit<MonitoringConfig, 'storage'>>): SecurityMonitor {
+    return new SecurityMonitor({
+      storage: this.storage,
+      retention: config?.retention,
+      anomalyDetection: config?.anomalyDetection,
+    });
+  }
+
+  async destroy(): Promise<void> {
+    await this.storage.destroy();
+    this.initialized = false;
+  }
+
+  getStorage(): IndexedDBStorage {
+    return this.storage;
+  }
+}
+
+export function createSecFn(config?: SecFnConfig): SecFn {
+  return new SecFn(config);
+}

package/src/index.ts

@@ -0,0 +1,27 @@
+export { SecFn, createSecFn, type SecFnConfig } from './core/secfn.js';
+
+export { SecretsVault, type SecretsVaultConfig, type SetSecretOptions } from './secrets/vault.js';
+export { SecretEncryption } from './secrets/encryption.js';
+
+export { SecretScanner, type SecretScannerConfig, type ScanOptions, type GitScanOptions } from './scanning/scanner.js';
+export { DEFAULT_PATTERNS } from './scanning/patterns.js';
+
+export { AccessControl, type AccessControlConfig, type CreateRoleOptions, type AssignRoleOptions } from './access-control/rbac.js';
+
+export { RateLimiter, type RateLimiterConfig, type RateLimitCheckRequest } from './rate-limiting/rate-limiter.js';
+
+export { SecurityMonitor, type MonitoringConfig, type LogEventOptions, type ResolveEventOptions } from './monitoring/security-monitor.js';
+
+export { IndexedDBStorage } from './storage/indexeddb-storage.js';
+
+export * from './types/index.js';
+
+export {
+  generateId,
+  calculateEntropy,
+  redactSecret,
+  isExpired,
+  delay,
+  sanitizeForLog,
+  parseTimeWindow,
+} from './utils/helpers.js';