@secfn/core 0.0.1

package/src/monitoring/security-monitor.ts

@@ -0,0 +1,245 @@
+import type { SecurityEvent, EventQuery, SecurityMetrics, TimeRange, SecurityEventType, Severity, SecurityAnomaly } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { generateId } from '../utils/helpers.js';
+
+export interface MonitoringConfig {
+  storage: IndexedDBStorage;
+  retention?: number;
+  anomalyDetection?: {
+    enabled: boolean;
+    sensitivity: number;
+  };
+}
+
+export interface LogEventOptions {
+  type: SecurityEventType;
+  severity: Severity;
+  userId?: string;
+  ip: string;
+  userAgent?: string;
+  resource?: string;
+  action?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface ResolveEventOptions {
+  resolvedBy: string;
+  notes?: string;
+}
+
+export class SecurityMonitor {
+  private storage: IndexedDBStorage;
+  private retention: number;
+  private anomalyDetection: { enabled: boolean; sensitivity: number };
+
+  constructor(config: MonitoringConfig) {
+    this.storage = config.storage;
+    this.retention = config.retention || 90 * 24 * 60 * 60 * 1000;
+    this.anomalyDetection = config.anomalyDetection || {
+      enabled: false,
+      sensitivity: 0.8,
+    };
+  }
+
+  async logEvent(options: LogEventOptions): Promise<string> {
+    const event: SecurityEvent = {
+      id: generateId('event'),
+      timestamp: Date.now(),
+      type: options.type,
+      severity: options.severity,
+      userId: options.userId,
+      ip: options.ip,
+      userAgent: options.userAgent,
+      resource: options.resource,
+      action: options.action,
+      metadata: options.metadata || {},
+      resolved: false,
+    };
+
+    await this.storage.logSecurityEvent(event);
+
+    return event.id;
+  }
+
+  async queryEvents(query: EventQuery): Promise<SecurityEvent[]> {
+    return await this.storage.queryEvents(query);
+  }
+
+  async getEvent(id: string): Promise<SecurityEvent | null> {
+    const events = await this.storage.queryEvents({ limit: 1 });
+    return events.find(e => e.id === id) || null;
+  }
+
+  async resolveEvent(id: string, options: ResolveEventOptions): Promise<void> {
+    const events = await this.storage.queryEvents({});
+    const event = events.find(e => e.id === id);
+
+    if (!event) {
+      throw new Error(`Event ${id} not found`);
+    }
+
+    event.resolved = true;
+    event.resolvedAt = Date.now();
+    event.resolvedBy = options.resolvedBy;
+    event.notes = options.notes;
+
+    await this.storage.logSecurityEvent(event);
+  }
+
+  async getMetrics(range: TimeRange): Promise<SecurityMetrics> {
+    const metrics = await this.storage.getMetrics(range);
+
+    if (this.anomalyDetection.enabled) {
+      const events = await this.storage.queryEvents({
+        startDate: range.start,
+        endDate: range.end,
+      });
+
+      const anomalies = await this.detectAnomalies(events);
+      metrics.anomalies = anomalies;
+    }
+
+    return metrics;
+  }
+
+  async getRecentEvents(limit = 100): Promise<SecurityEvent[]> {
+    return await this.storage.queryEvents({ limit });
+  }
+
+  async getUnresolvedEvents(): Promise<SecurityEvent[]> {
+    return await this.storage.queryEvents({ resolved: false });
+  }
+
+  async getCriticalEvents(hours = 24): Promise<SecurityEvent[]> {
+    const startDate = Date.now() - hours * 60 * 60 * 1000;
+    return await this.storage.queryEvents({
+      severity: 'critical',
+      startDate,
+    });
+  }
+
+  async getEventsByUser(userId: string, limit = 100): Promise<SecurityEvent[]> {
+    return await this.storage.queryEvents({
+      userId,
+      limit,
+    });
+  }
+
+  async getEventsByIP(ip: string, limit = 100): Promise<SecurityEvent[]> {
+    return await this.storage.queryEvents({
+      ip,
+      limit,
+    });
+  }
+
+  async cleanup(): Promise<void> {
+    await this.storage.cleanup(this.retention);
+  }
+
+  private async detectAnomalies(events: SecurityEvent[]): Promise<SecurityAnomaly[]> {
+    const anomalies: SecurityAnomaly[] = [];
+
+    const authFailures = events.filter(e => e.type === 'auth_failure');
+    if (authFailures.length > 0) {
+      const failureRate = this.calculateFailureRate(events, authFailures);
+      if (failureRate > this.anomalyDetection.sensitivity) {
+        anomalies.push({
+          id: generateId('anomaly'),
+          timestamp: Date.now(),
+          type: 'spike_in_failures',
+          score: failureRate,
+          description: `Unusual spike in authentication failures: ${(failureRate * 100).toFixed(1)}%`,
+          relatedEvents: authFailures.slice(0, 10).map(e => e.id),
+        });
+      }
+    }
+
+    const userActivityPatterns = this.analyzeUserActivity(events);
+    for (const pattern of userActivityPatterns) {
+      if (pattern.score > this.anomalyDetection.sensitivity) {
+        anomalies.push({
+          id: generateId('anomaly'),
+          timestamp: Date.now(),
+          type: 'unusual_access_pattern',
+          score: pattern.score,
+          description: pattern.description,
+          relatedEvents: pattern.eventIds,
+        });
+      }
+    }
+
+    return anomalies;
+  }
+
+  private calculateFailureRate(totalEvents: SecurityEvent[], failures: SecurityEvent[]): number {
+    if (totalEvents.length === 0) return 0;
+    
+    const authRelatedEvents = totalEvents.filter(e => 
+      e.type === 'auth_failure' || 
+      e.action?.includes('auth') || 
+      e.action?.includes('login')
+    );
+
+    if (authRelatedEvents.length === 0) return 0;
+    
+    return failures.length / authRelatedEvents.length;
+  }
+
+  private analyzeUserActivity(events: SecurityEvent[]): Array<{
+    score: number;
+    description: string;
+    eventIds: string[];
+  }> {
+    const patterns: Array<{
+      score: number;
+      description: string;
+      eventIds: string[];
+    }> = [];
+
+    const userGroups = new Map<string, SecurityEvent[]>();
+    for (const event of events) {
+      if (!event.userId) continue;
+      
+      const userEvents = userGroups.get(event.userId) || [];
+      userEvents.push(event);
+      userGroups.set(event.userId, userEvents);
+    }
+
+    for (const [userId, userEvents] of userGroups) {
+      const uniqueIPs = new Set(userEvents.map(e => e.ip));
+      
+      if (uniqueIPs.size > 5) {
+        patterns.push({
+          score: Math.min(uniqueIPs.size / 10, 1.0),
+          description: `User ${userId} accessed from ${uniqueIPs.size} different IP addresses`,
+          eventIds: userEvents.slice(0, 10).map(e => e.id),
+        });
+      }
+
+      const timeGaps = this.detectTimeAnomalies(userEvents);
+      if (timeGaps.length > 0) {
+        patterns.push({
+          score: 0.7,
+          description: `Unusual access times detected for user ${userId}`,
+          eventIds: timeGaps.map(e => e.id),
+        });
+      }
+    }
+
+    return patterns;
+  }
+
+  private detectTimeAnomalies(events: SecurityEvent[]): SecurityEvent[] {
+    const anomalous: SecurityEvent[] = [];
+    
+    for (const event of events) {
+      const hour = new Date(event.timestamp).getHours();
+      
+      if (hour >= 2 && hour <= 5) {
+        anomalous.push(event);
+      }
+    }
+
+    return anomalous;
+  }
+}

package/src/rate-limiting/rate-limiter.ts

@@ -0,0 +1,181 @@
+import type { RateLimitRule, RateLimitEntry, RateLimitResult, RateLimitViolation } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { generateId } from '../utils/helpers.js';
+
+export interface RateLimiterConfig {
+  storage: IndexedDBStorage;
+  rules: {
+    global?: RateLimitRule;
+    perUser?: RateLimitRule;
+    perIP?: RateLimitRule;
+    perEndpoint?: Record<string, RateLimitRule>;
+  };
+  onLimitExceeded?: (violation: RateLimitViolation) => void | Promise<void>;
+}
+
+export interface RateLimitCheckRequest {
+  userId?: string;
+  ip: string;
+  endpoint?: string;
+}
+
+export class RateLimiter {
+  private storage: IndexedDBStorage;
+  private rules: RateLimiterConfig['rules'];
+  private onLimitExceeded?: (violation: RateLimitViolation) => void | Promise<void>;
+
+  constructor(config: RateLimiterConfig) {
+    this.storage = config.storage;
+    this.rules = config.rules;
+    this.onLimitExceeded = config.onLimitExceeded;
+  }
+
+  async check(request: RateLimitCheckRequest): Promise<RateLimitResult> {
+    const checks: Array<{ key: string; rule: RateLimitRule }> = [];
+
+    if (this.rules.global) {
+      checks.push({
+        key: 'global',
+        rule: this.rules.global,
+      });
+    }
+
+    if (this.rules.perUser && request.userId) {
+      checks.push({
+        key: `user:${request.userId}`,
+        rule: this.rules.perUser,
+      });
+    }
+
+    if (this.rules.perIP) {
+      checks.push({
+        key: `ip:${request.ip}`,
+        rule: this.rules.perIP,
+      });
+    }
+
+    if (this.rules.perEndpoint && request.endpoint) {
+      const endpointRule = this.rules.perEndpoint[request.endpoint];
+      if (endpointRule) {
+        checks.push({
+          key: `endpoint:${request.endpoint}:${request.ip}`,
+          rule: endpointRule,
+        });
+      }
+    }
+
+    for (const check of checks) {
+      const result = await this.checkLimit(check.key, check.rule);
+      
+      if (!result.allowed) {
+        await this.handleViolation({
+          id: generateId('violation'),
+          timestamp: Date.now(),
+          key: check.key,
+          ip: request.ip,
+          userId: request.userId,
+          endpoint: request.endpoint || 'unknown',
+          requestCount: result.limit || 0,
+          limit: check.rule.requests,
+          window: check.rule.window,
+          blocked: true,
+        });
+
+        return result;
+      }
+    }
+
+    return {
+      allowed: true,
+      remaining: checks.length > 0 ? checks[0].rule.requests : 0,
+      resetAt: Date.now() + (checks.length > 0 ? checks[0].rule.window : 0),
+    };
+  }
+
+  private async checkLimit(key: string, rule: RateLimitRule): Promise<RateLimitResult> {
+    const now = Date.now();
+    const entry = await this.storage.getRateLimitEntry(key);
+
+    if (!entry || now >= entry.resetAt) {
+      const newEntry: RateLimitEntry = {
+        key,
+        count: 1,
+        resetAt: now + rule.window,
+        blocked: false,
+      };
+      await this.storage.setRateLimitEntry(newEntry);
+
+      return {
+        allowed: true,
+        remaining: rule.requests - 1,
+        resetAt: newEntry.resetAt,
+        limit: rule.requests,
+      };
+    }
+
+    if (entry.blocked && entry.blockedUntil && now < entry.blockedUntil) {
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAt: entry.resetAt,
+        retryAfter: entry.blockedUntil - now,
+        limit: rule.requests,
+      };
+    }
+
+    if (entry.count >= rule.requests) {
+      entry.blocked = true;
+      entry.blockedUntil = now + (rule.blockDuration || rule.window);
+      await this.storage.setRateLimitEntry(entry);
+
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAt: entry.resetAt,
+        retryAfter: entry.blockedUntil - now,
+        limit: rule.requests,
+      };
+    }
+
+    entry.count++;
+    await this.storage.setRateLimitEntry(entry);
+
+    return {
+      allowed: true,
+      remaining: rule.requests - entry.count,
+      resetAt: entry.resetAt,
+      limit: rule.requests,
+    };
+  }
+
+  private async handleViolation(violation: RateLimitViolation): Promise<void> {
+    if (this.onLimitExceeded) {
+      try {
+        await this.onLimitExceeded(violation);
+      } catch (error) {
+        console.error('[SecFn] Error in rate limit violation handler:', error);
+      }
+    }
+  }
+
+  async reset(key: string): Promise<void> {
+    await this.storage.deleteRateLimitEntry(key);
+  }
+
+  async resetUser(userId: string): Promise<void> {
+    await this.reset(`user:${userId}`);
+  }
+
+  async resetIP(ip: string): Promise<void> {
+    await this.reset(`ip:${ip}`);
+  }
+
+  async unblock(key: string): Promise<void> {
+    const entry = await this.storage.getRateLimitEntry(key);
+    if (entry) {
+      entry.blocked = false;
+      entry.blockedUntil = undefined;
+      await this.storage.setRateLimitEntry(entry);
+    }
+  }
+}

package/src/scanning/patterns.ts

@@ -0,0 +1,140 @@
+import type { SecretPattern } from '../types/index.js';
+
+export const DEFAULT_PATTERNS: SecretPattern[] = [
+  {
+    name: 'AWS Access Key',
+    pattern: /AKIA[0-9A-Z]{16}/g,
+    entropy: 4.5,
+    description: 'AWS Access Key ID',
+    severity: 'critical',
+  },
+  {
+    name: 'AWS Secret Key',
+    pattern: /aws[_-]?secret[_-]?access[_-]?key[=:\s]+['"]?([a-zA-Z0-9/+=]{40})['"]?/gi,
+    entropy: 5.0,
+    description: 'AWS Secret Access Key',
+    severity: 'critical',
+  },
+  {
+    name: 'Generic API Key',
+    pattern: /api[_-]?key[_-]?[=:]\s*['"]?([a-zA-Z0-9]{32,})['"]?/gi,
+    entropy: 4.0,
+    description: 'Generic API key pattern',
+    severity: 'high',
+  },
+  {
+    name: 'Private Key',
+    pattern: /-----BEGIN (RSA|OPENSSH|DSA|EC|PGP) PRIVATE KEY-----/g,
+    description: 'Private cryptographic key',
+    severity: 'critical',
+  },
+  {
+    name: 'JWT Token',
+    pattern: /eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,
+    description: 'JSON Web Token',
+    severity: 'high',
+  },
+  {
+    name: 'GitHub Token',
+    pattern: /ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/g,
+    entropy: 4.5,
+    description: 'GitHub Personal Access Token',
+    severity: 'critical',
+  },
+  {
+    name: 'Stripe API Key',
+    pattern: /sk_live_[a-zA-Z0-9]{24,}|rk_live_[a-zA-Z0-9]{24,}/g,
+    entropy: 4.5,
+    description: 'Stripe API Key',
+    severity: 'critical',
+  },
+  {
+    name: 'Google API Key',
+    pattern: /AIza[0-9A-Za-z_-]{35}/g,
+    entropy: 4.5,
+    description: 'Google API Key',
+    severity: 'high',
+  },
+  {
+    name: 'Slack Token',
+    pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}/g,
+    entropy: 4.5,
+    description: 'Slack API Token',
+    severity: 'high',
+  },
+  {
+    name: 'OpenAI API Key',
+    pattern: /sk-[a-zA-Z0-9]{48}/g,
+    entropy: 4.5,
+    description: 'OpenAI API Key',
+    severity: 'critical',
+  },
+  {
+    name: 'Anthropic API Key',
+    pattern: /sk-ant-[a-zA-Z0-9_-]{95,}/g,
+    entropy: 4.5,
+    description: 'Anthropic API Key',
+    severity: 'critical',
+  },
+  {
+    name: 'Database Connection String',
+    pattern: /(postgres|mysql|mongodb):\/\/[^\s'"<>]+:[^\s'"<>]+@[^\s'"<>]+/gi,
+    description: 'Database connection string with credentials',
+    severity: 'critical',
+  },
+  {
+    name: 'Password in Code',
+    pattern: /(password|passwd|pwd)[=:\s]+['"]([^'"]{8,})['"]/gi,
+    entropy: 3.5,
+    description: 'Hardcoded password',
+    severity: 'high',
+  },
+  {
+    name: 'Bearer Token',
+    pattern: /Bearer\s+[a-zA-Z0-9_\-\.]{20,}/gi,
+    entropy: 4.0,
+    description: 'Bearer authentication token',
+    severity: 'high',
+  },
+  {
+    name: 'NPM Token',
+    pattern: /npm_[a-zA-Z0-9]{36}/g,
+    entropy: 4.5,
+    description: 'NPM Access Token',
+    severity: 'high',
+  },
+  {
+    name: 'Twilio API Key',
+    pattern: /SK[a-f0-9]{32}/g,
+    entropy: 4.5,
+    description: 'Twilio API Key',
+    severity: 'high',
+  },
+  {
+    name: 'SendGrid API Key',
+    pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+    entropy: 4.5,
+    description: 'SendGrid API Key',
+    severity: 'high',
+  },
+  {
+    name: 'Mailgun API Key',
+    pattern: /key-[a-f0-9]{32}/g,
+    entropy: 4.0,
+    description: 'Mailgun API Key',
+    severity: 'high',
+  },
+  {
+    name: 'Azure Storage Key',
+    pattern: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[^;]+/gi,
+    description: 'Azure Storage Connection String',
+    severity: 'critical',
+  },
+  {
+    name: 'Generic Secret',
+    pattern: /(secret|token|api[_-]?key|auth[_-]?token)[=:\s]+['"]([a-zA-Z0-9_\-\/.+=]{20,})['"]/gi,
+    entropy: 3.5,
+    description: 'Generic secret pattern',
+    severity: 'medium',
+  },
+];