@secfn/core 0.0.1

package/src/scanning/scanner.ts

@@ -0,0 +1,199 @@
+import { readFile } from 'fs/promises';
+import { glob } from 'glob';
+import simpleGit, { type SimpleGit } from 'simple-git';
+import type { SecretPattern, SecretScanResult } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { DEFAULT_PATTERNS } from './patterns.js';
+import { generateId, calculateEntropy, redactSecret } from '../utils/helpers.js';
+
+export interface SecretScannerConfig {
+  patterns?: SecretPattern[];
+  excludePaths?: string[];
+  minEntropy?: number;
+  maxFileSize?: number;
+  storage?: IndexedDBStorage;
+}
+
+export interface ScanOptions {
+  saveResults?: boolean;
+}
+
+export interface GitScanOptions {
+  branch?: string;
+  commits?: number;
+}
+
+export class SecretScanner {
+  private patterns: SecretPattern[];
+  private excludePaths: string[];
+  private minEntropy: number;
+  private maxFileSize: number;
+  private storage?: IndexedDBStorage;
+  private git: SimpleGit;
+
+  constructor(config: SecretScannerConfig = {}) {
+    this.patterns = config.patterns || DEFAULT_PATTERNS;
+    this.excludePaths = config.excludePaths || ['node_modules/**', 'dist/**', 'build/**', '.git/**'];
+    this.minEntropy = config.minEntropy || 3.0;
+    this.maxFileSize = config.maxFileSize || 1024 * 1024;
+    this.storage = config.storage;
+    this.git = simpleGit();
+  }
+
+  async scanDirectory(dir: string, options: ScanOptions = {}): Promise<SecretScanResult[]> {
+    const files = await glob('**/*', {
+      cwd: dir,
+      absolute: true,
+      nodir: true,
+      ignore: this.excludePaths,
+    });
+
+    const results: SecretScanResult[] = [];
+
+    for (const file of files) {
+      try {
+        const fileResults = await this.scanFile(file);
+        results.push(...fileResults);
+      } catch (error) {
+        console.error(`[SecFn] Error scanning file ${file}:`, error);
+      }
+    }
+
+    if (options.saveResults && this.storage) {
+      for (const result of results) {
+        await this.storage.saveScanResult(result);
+      }
+    }
+
+    return results;
+  }
+
+  async scanFile(filePath: string): Promise<SecretScanResult[]> {
+    try {
+      const content = await readFile(filePath, 'utf-8');
+      
+      if (content.length > this.maxFileSize) {
+        console.warn(`[SecFn] Skipping large file: ${filePath}`);
+        return [];
+      }
+
+      return this.scanContent(content, filePath);
+    } catch (error) {
+      console.error(`[SecFn] Error reading file ${filePath}:`, error);
+      return [];
+    }
+  }
+
+  scanContent(content: string, filePath: string): SecretScanResult[] {
+    const results: SecretScanResult[] = [];
+    const lines = content.split('\n');
+
+    for (const pattern of this.patterns) {
+      const matches = content.matchAll(pattern.pattern);
+
+      for (const match of matches) {
+        if (!match[0] || !match.index) continue;
+
+        const matchedSecret = match[1] || match[0];
+        const entropy = calculateEntropy(matchedSecret);
+
+        if (pattern.entropy && entropy < Math.min(pattern.entropy, this.minEntropy)) {
+          continue;
+        }
+
+        const { line, column } = this.getLineAndColumn(content, match.index);
+        const context = this.getContext(lines, line);
+
+        const result: SecretScanResult = {
+          id: generateId('scan'),
+          timestamp: Date.now(),
+          file: filePath,
+          line,
+          column,
+          pattern: pattern.name,
+          match: matchedSecret,
+          redactedMatch: redactSecret(matchedSecret),
+          severity: pattern.severity,
+          entropy,
+          context,
+          resolved: false,
+          falsePositive: false,
+        };
+
+        results.push(result);
+      }
+    }
+
+    return results;
+  }
+
+  async scanGitHistory(options: GitScanOptions = {}): Promise<SecretScanResult[]> {
+    const branch = options.branch || 'HEAD';
+    const commitCount = options.commits || 100;
+
+    const log = await this.git.log([branch, `-n`, `${commitCount}`]);
+    const results: SecretScanResult[] = [];
+
+    for (const commit of log.all) {
+      try {
+        const diff = await this.git.show([commit.hash]);
+        const commitResults = this.scanContent(diff, `commit:${commit.hash.substring(0, 7)}`);
+        
+        for (const result of commitResults) {
+          result.metadata = {
+            commit: commit.hash,
+            author: commit.author_name,
+            date: commit.date,
+            message: commit.message,
+          };
+        }
+
+        results.push(...commitResults);
+      } catch (error) {
+        console.error(`[SecFn] Error scanning commit ${commit.hash}:`, error);
+      }
+    }
+
+    if (this.storage) {
+      for (const result of results) {
+        await this.storage.saveScanResult(result);
+      }
+    }
+
+    return results;
+  }
+
+  addPattern(pattern: SecretPattern): void {
+    this.patterns.push(pattern);
+  }
+
+  removePattern(name: string): void {
+    this.patterns = this.patterns.filter(p => p.name !== name);
+  }
+
+  getPatterns(): SecretPattern[] {
+    return [...this.patterns];
+  }
+
+  private getLineAndColumn(content: string, index: number): { line: number; column: number } {
+    const beforeMatch = content.substring(0, index);
+    const lines = beforeMatch.split('\n');
+    const line = lines.length;
+    const column = lines[lines.length - 1].length + 1;
+    
+    return { line, column };
+  }
+
+  private getContext(lines: string[], lineNumber: number, contextLines = 2): string {
+    const start = Math.max(0, lineNumber - contextLines - 1);
+    const end = Math.min(lines.length, lineNumber + contextLines);
+    return lines.slice(start, end).join('\n');
+  }
+
+  async getScanHistory(limit = 100): Promise<SecretScanResult[]> {
+    if (!this.storage) {
+      throw new Error('Storage not configured');
+    }
+    return await this.storage.getScanHistory(limit);
+  }
+}

package/src/secrets/encryption.ts

@@ -0,0 +1,74 @@
+import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'crypto';
+
+export interface EncryptedData {
+  iv: string;
+  encrypted: string;
+  authTag: string;
+}
+
+export class SecretEncryption {
+  private algorithm = 'aes-256-gcm';
+  private keyLength = 32;
+  private ivLength = 16;
+  private salt = 'secfn-salt-v1';
+  private iterations = 100000;
+
+  async encrypt(plaintext: string, masterKey: string): Promise<string> {
+    const key = this.deriveKey(masterKey);
+    const iv = randomBytes(this.ivLength);
+    const cipher = createCipheriv(this.algorithm, key, iv) as any;
+
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag();
+
+    const data: EncryptedData = {
+      iv: iv.toString('hex'),
+      encrypted,
+      authTag: authTag.toString('hex'),
+    };
+
+    return JSON.stringify(data);
+  }
+
+  async decrypt(ciphertext: string, masterKey: string): Promise<string> {
+    const key = this.deriveKey(masterKey);
+    const data: EncryptedData = JSON.parse(ciphertext);
+
+    const decipher = createDecipheriv(
+      this.algorithm,
+      key,
+      Buffer.from(data.iv, 'hex')
+    ) as any;
+    decipher.setAuthTag(Buffer.from(data.authTag, 'hex'));
+
+    let decrypted = decipher.update(data.encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+
+    return decrypted;
+  }
+
+  private deriveKey(masterKey: string): Buffer {
+    return pbkdf2Sync(
+      masterKey,
+      this.salt,
+      this.iterations,
+      this.keyLength,
+      'sha256'
+    );
+  }
+
+  isEncrypted(value: string): boolean {
+    try {
+      const parsed = JSON.parse(value);
+      return (
+        typeof parsed === 'object' &&
+        'iv' in parsed &&
+        'encrypted' in parsed &&
+        'authTag' in parsed
+      );
+    } catch {
+      return false;
+    }
+  }
+}

package/src/secrets/vault.ts

@@ -0,0 +1,187 @@
+import type { Secret, SecretAccess, Environment } from '../types/index.js';
+import type { IndexedDBStorage } from '../storage/indexeddb-storage.js';
+import { SecretEncryption } from './encryption.js';
+import { generateId, isExpired } from '../utils/helpers.js';
+
+export interface SecretsVaultConfig {
+  storage: IndexedDBStorage;
+  encryption: {
+    algorithm: 'AES-256-GCM';
+    masterKey: string;
+    keyDerivation?: 'PBKDF2' | 'scrypt';
+  };
+  rotation?: {
+    checkInterval: number;
+    notifyBefore: number;
+  };
+}
+
+export interface SetSecretOptions {
+  tags?: string[];
+  environment?: Environment;
+  expiresAt?: number;
+  rotateEvery?: number;
+  createdBy?: string;
+}
+
+export class SecretsVault {
+  private storage: IndexedDBStorage;
+  private encryption: SecretEncryption;
+  private masterKey: string;
+  private rotationInterval?: NodeJS.Timeout;
+
+  constructor(config: SecretsVaultConfig) {
+    this.storage = config.storage;
+    this.encryption = new SecretEncryption();
+    this.masterKey = config.encryption.masterKey;
+
+    if (config.rotation) {
+      this.startRotationCheck(config.rotation.checkInterval, config.rotation.notifyBefore);
+    }
+  }
+
+  async set(key: string, value: string, options: SetSecretOptions = {}): Promise<string> {
+    const existing = await this.storage.getSecretByKey(key);
+    const now = Date.now();
+
+    const encryptedValue = await this.encryption.encrypt(value, this.masterKey);
+
+    const secret: Secret = {
+      id: existing?.id || generateId('secret'),
+      key,
+      value: encryptedValue,
+      encrypted: true,
+      version: existing ? existing.version + 1 : 1,
+      tags: options.tags || [],
+      environment: options.environment,
+      expiresAt: options.expiresAt,
+      rotateEvery: options.rotateEvery,
+      lastRotated: now,
+      lastAccessed: undefined,
+      accessCount: 0,
+      createdBy: options.createdBy || 'system',
+      createdAt: existing?.createdAt || now,
+      updatedAt: now,
+    };
+
+    await this.storage.saveSecret(secret);
+
+    await this.logAccess(secret.id, options.createdBy || 'system', 'write');
+
+    return secret.id;
+  }
+
+  async get(key: string, userId = 'system'): Promise<string | null> {
+    const secret = await this.storage.getSecretByKey(key);
+    
+    if (!secret) return null;
+
+    if (isExpired(secret.expiresAt)) {
+      throw new Error(`Secret '${key}' has expired`);
+    }
+
+    const decryptedValue = await this.encryption.decrypt(secret.value, this.masterKey);
+
+    secret.lastAccessed = Date.now();
+    secret.accessCount += 1;
+    await this.storage.saveSecret(secret);
+
+    await this.logAccess(secret.id, userId, 'read');
+
+    return decryptedValue;
+  }
+
+  async list(filter?: { environment?: Environment; tags?: string[] }): Promise<Array<Omit<Secret, 'value'>>> {
+    const secrets = await this.storage.listSecrets(filter);
+    
+    return secrets.map(({ value, ...rest }) => rest);
+  }
+
+  async rotate(key: string, newValue: string, userId = 'system'): Promise<void> {
+    const secret = await this.storage.getSecretByKey(key);
+    
+    if (!secret) {
+      throw new Error(`Secret '${key}' not found`);
+    }
+
+    const encryptedValue = await this.encryption.encrypt(newValue, this.masterKey);
+
+    secret.value = encryptedValue;
+    secret.version += 1;
+    secret.lastRotated = Date.now();
+    secret.updatedAt = Date.now();
+
+    await this.storage.saveSecret(secret);
+
+    await this.logAccess(secret.id, userId, 'rotate');
+  }
+
+  async delete(key: string, userId = 'system'): Promise<void> {
+    const secret = await this.storage.getSecretByKey(key);
+    
+    if (!secret) {
+      throw new Error(`Secret '${key}' not found`);
+    }
+
+    await this.storage.deleteSecret(secret.id);
+
+    await this.logAccess(secret.id, userId, 'delete');
+  }
+
+  async getAccessLog(key: string, limit = 100): Promise<SecretAccess[]> {
+    const secret = await this.storage.getSecretByKey(key);
+    
+    if (!secret) {
+      throw new Error(`Secret '${key}' not found`);
+    }
+
+    return await this.storage.getSecretAccessLog(secret.id, limit);
+  }
+
+  async getSecretsNeedingRotation(beforeMs: number = 7 * 24 * 60 * 60 * 1000): Promise<Secret[]> {
+    const allSecrets = await this.storage.listSecrets();
+    const now = Date.now();
+    const threshold = now + beforeMs;
+
+    return allSecrets.filter(secret => {
+      if (!secret.rotateEvery || !secret.lastRotated) return false;
+      
+      const nextRotation = secret.lastRotated + secret.rotateEvery;
+      return nextRotation <= threshold;
+    });
+  }
+
+  async getExpiredSecrets(): Promise<Secret[]> {
+    const allSecrets = await this.storage.listSecrets();
+    return allSecrets.filter(secret => isExpired(secret.expiresAt));
+  }
+
+  private async logAccess(secretId: string, userId: string, action: 'read' | 'write' | 'delete' | 'rotate'): Promise<void> {
+    const accessLog: SecretAccess = {
+      id: generateId('access'),
+      secretId,
+      userId,
+      action,
+      timestamp: Date.now(),
+    };
+
+    await this.storage.logSecretAccess(accessLog);
+  }
+
+  private startRotationCheck(interval: number, notifyBefore: number): void {
+    this.rotationInterval = setInterval(async () => {
+      const needsRotation = await this.getSecretsNeedingRotation(notifyBefore);
+      
+      if (needsRotation.length > 0) {
+        console.warn(`[SecFn] ${needsRotation.length} secret(s) need rotation:`, 
+          needsRotation.map(s => s.key));
+      }
+    }, interval);
+  }
+
+  stop(): void {
+    if (this.rotationInterval) {
+      clearInterval(this.rotationInterval);
+    }
+  }
+}