@secfn/core 0.0.1

package/src/storage/indexeddb-storage.ts

@@ -0,0 +1,355 @@
+import type {
+  Secret,
+  SecretAccess,
+  Role,
+  UserRole,
+  SecurityEvent,
+  RateLimitEntry,
+  SecretScanResult,
+  EventQuery,
+  SecurityMetrics,
+  TimeRange,
+} from '../types/index.js';
+
+const DB_VERSION = 1;
+
+const STORES = {
+  secrets: 'secfn_secrets',
+  secretAccess: 'secfn_secret_access',
+  roles: 'secfn_roles',
+  userRoles: 'secfn_user_roles',
+  securityEvents: 'secfn_security_events',
+  rateLimits: 'secfn_rate_limits',
+  scanResults: 'secfn_scan_results',
+  config: 'secfn_config',
+} as const;
+
+export class IndexedDBStorage {
+  private db: IDBDatabase | null = null;
+  private dbName: string;
+
+  constructor(dbName = 'secfn') {
+    this.dbName = dbName;
+  }
+
+  async initialize(): Promise<void> {
+    if (this.db) return;
+
+    return new Promise((resolve, reject) => {
+      const request = indexedDB.open(this.dbName, DB_VERSION);
+
+      request.onerror = () => reject(request.error);
+      request.onsuccess = () => {
+        this.db = request.result;
+        resolve();
+      };
+
+      request.onupgradeneeded = (event) => {
+        const db = (event.target as IDBOpenDBRequest).result;
+
+        if (!db.objectStoreNames.contains(STORES.secrets)) {
+          const secretsStore = db.createObjectStore(STORES.secrets, { keyPath: 'id' });
+          secretsStore.createIndex('key', 'key', { unique: true });
+          secretsStore.createIndex('environment', 'environment');
+          secretsStore.createIndex('expiresAt', 'expiresAt');
+          secretsStore.createIndex('tags', 'tags', { multiEntry: true });
+        }
+
+        if (!db.objectStoreNames.contains(STORES.secretAccess)) {
+          const accessStore = db.createObjectStore(STORES.secretAccess, { keyPath: 'id' });
+          accessStore.createIndex('secretId', 'secretId');
+          accessStore.createIndex('userId', 'userId');
+          accessStore.createIndex('timestamp', 'timestamp');
+        }
+
+        if (!db.objectStoreNames.contains(STORES.roles)) {
+          db.createObjectStore(STORES.roles, { keyPath: 'id' });
+        }
+
+        if (!db.objectStoreNames.contains(STORES.userRoles)) {
+          const userRolesStore = db.createObjectStore(STORES.userRoles, { keyPath: ['userId', 'roleId'] });
+          userRolesStore.createIndex('userId', 'userId');
+          userRolesStore.createIndex('roleId', 'roleId');
+        }
+
+        if (!db.objectStoreNames.contains(STORES.securityEvents)) {
+          const eventsStore = db.createObjectStore(STORES.securityEvents, { keyPath: 'id' });
+          eventsStore.createIndex('timestamp', 'timestamp');
+          eventsStore.createIndex('type', 'type');
+          eventsStore.createIndex('severity', 'severity');
+          eventsStore.createIndex('userId', 'userId');
+          eventsStore.createIndex('ip', 'ip');
+        }
+
+        if (!db.objectStoreNames.contains(STORES.rateLimits)) {
+          db.createObjectStore(STORES.rateLimits, { keyPath: 'key' });
+        }
+
+        if (!db.objectStoreNames.contains(STORES.scanResults)) {
+          const scanStore = db.createObjectStore(STORES.scanResults, { keyPath: 'id' });
+          scanStore.createIndex('timestamp', 'timestamp');
+          scanStore.createIndex('severity', 'severity');
+          scanStore.createIndex('file', 'file');
+        }
+
+        if (!db.objectStoreNames.contains(STORES.config)) {
+          db.createObjectStore(STORES.config, { keyPath: 'key' });
+        }
+      };
+    });
+  }
+
+  private getStore(storeName: string, mode: IDBTransactionMode = 'readonly'): IDBObjectStore {
+    if (!this.db) throw new Error('Database not initialized');
+    const tx = this.db.transaction(storeName, mode);
+    return tx.objectStore(storeName);
+  }
+
+  async saveSecret(secret: Secret): Promise<void> {
+    const store = this.getStore(STORES.secrets, 'readwrite');
+    await this.promisifyRequest(store.put(secret));
+  }
+
+  async getSecret(id: string): Promise<Secret | null> {
+    const store = this.getStore(STORES.secrets);
+    const result = await this.promisifyRequest<Secret>(store.get(id));
+    return result || null;
+  }
+
+  async getSecretByKey(key: string): Promise<Secret | null> {
+    const store = this.getStore(STORES.secrets);
+    const index = store.index('key');
+    const result = await this.promisifyRequest<Secret>(index.get(key));
+    return result || null;
+  }
+
+  async listSecrets(filter?: { environment?: string; tags?: string[] }): Promise<Secret[]> {
+    const store = this.getStore(STORES.secrets);
+    const secrets = await this.promisifyRequest<Secret[]>(store.getAll());
+    
+    if (!filter) return secrets;
+    
+    return secrets.filter(secret => {
+      if (filter.environment && secret.environment !== filter.environment) {
+        return false;
+      }
+      if (filter.tags && !filter.tags.some(tag => secret.tags.includes(tag))) {
+        return false;
+      }
+      return true;
+    });
+  }
+
+  async deleteSecret(id: string): Promise<void> {
+    const store = this.getStore(STORES.secrets, 'readwrite');
+    await this.promisifyRequest(store.delete(id));
+  }
+
+  async logSecretAccess(access: SecretAccess): Promise<void> {
+    const store = this.getStore(STORES.secretAccess, 'readwrite');
+    await this.promisifyRequest(store.put(access));
+  }
+
+  async getSecretAccessLog(secretId: string, limit = 100): Promise<SecretAccess[]> {
+    const store = this.getStore(STORES.secretAccess);
+    const index = store.index('secretId');
+    const allAccess = await this.promisifyRequest<SecretAccess[]>(index.getAll(secretId));
+    return allAccess.slice(-limit);
+  }
+
+  async saveRole(role: Role): Promise<void> {
+    const store = this.getStore(STORES.roles, 'readwrite');
+    await this.promisifyRequest(store.put(role));
+  }
+
+  async getRole(id: string): Promise<Role | null> {
+    const store = this.getStore(STORES.roles);
+    const result = await this.promisifyRequest<Role>(store.get(id));
+    return result || null;
+  }
+
+  async listRoles(): Promise<Role[]> {
+    const store = this.getStore(STORES.roles);
+    return await this.promisifyRequest<Role[]>(store.getAll());
+  }
+
+  async deleteRole(id: string): Promise<void> {
+    const store = this.getStore(STORES.roles, 'readwrite');
+    await this.promisifyRequest(store.delete(id));
+  }
+
+  async assignUserRole(userRole: UserRole): Promise<void> {
+    const store = this.getStore(STORES.userRoles, 'readwrite');
+    await this.promisifyRequest(store.put(userRole));
+  }
+
+  async getUserRoles(userId: string): Promise<UserRole[]> {
+    const store = this.getStore(STORES.userRoles);
+    const index = store.index('userId');
+    return await this.promisifyRequest<UserRole[]>(index.getAll(userId));
+  }
+
+  async removeUserRole(userId: string, roleId: string): Promise<void> {
+    const store = this.getStore(STORES.userRoles, 'readwrite');
+    await this.promisifyRequest(store.delete([userId, roleId]));
+  }
+
+  async logSecurityEvent(event: SecurityEvent): Promise<void> {
+    const store = this.getStore(STORES.securityEvents, 'readwrite');
+    await this.promisifyRequest(store.put(event));
+  }
+
+  async queryEvents(query: EventQuery): Promise<SecurityEvent[]> {
+    const store = this.getStore(STORES.securityEvents);
+    let events = await this.promisifyRequest<SecurityEvent[]>(store.getAll());
+
+    if (query.type) {
+      const types = Array.isArray(query.type) ? query.type : [query.type];
+      events = events.filter(e => types.includes(e.type));
+    }
+
+    if (query.severity) {
+      const severities = Array.isArray(query.severity) ? query.severity : [query.severity];
+      events = events.filter(e => severities.includes(e.severity));
+    }
+
+    if (query.userId) {
+      events = events.filter(e => e.userId === query.userId);
+    }
+
+    if (query.ip) {
+      events = events.filter(e => e.ip === query.ip);
+    }
+
+    if (query.startDate) {
+      events = events.filter(e => e.timestamp >= query.startDate!);
+    }
+
+    if (query.endDate) {
+      events = events.filter(e => e.timestamp <= query.endDate!);
+    }
+
+    if (query.resolved !== undefined) {
+      events = events.filter(e => e.resolved === query.resolved);
+    }
+
+    events.sort((a, b) => b.timestamp - a.timestamp);
+
+    if (query.offset) {
+      events = events.slice(query.offset);
+    }
+
+    if (query.limit) {
+      events = events.slice(0, query.limit);
+    }
+
+    return events;
+  }
+
+  async getMetrics(range: TimeRange): Promise<SecurityMetrics> {
+    const events = await this.queryEvents({
+      startDate: range.start,
+      endDate: range.end,
+    });
+
+    const eventsByType: Record<string, number> = {};
+    const eventsBySeverity: Record<string, number> = {};
+    const ipCounts: Record<string, number> = {};
+    const userCounts: Record<string, number> = {};
+
+    for (const event of events) {
+      eventsByType[event.type] = (eventsByType[event.type] || 0) + 1;
+      eventsBySeverity[event.severity] = (eventsBySeverity[event.severity] || 0) + 1;
+      ipCounts[event.ip] = (ipCounts[event.ip] || 0) + 1;
+      if (event.userId) {
+        userCounts[event.userId] = (userCounts[event.userId] || 0) + 1;
+      }
+    }
+
+    const topIPs = Object.entries(ipCounts)
+      .map(([ip, count]) => ({ ip, count }))
+      .sort((a, b) => b.count - a.count)
+      .slice(0, 10);
+
+    const topUsers = Object.entries(userCounts)
+      .map(([userId, count]) => ({ userId, count }))
+      .sort((a, b) => b.count - a.count)
+      .slice(0, 10);
+
+    return {
+      timeRange: range,
+      totalEvents: events.length,
+      eventsByType,
+      eventsBySeverity,
+      topIPs,
+      topUsers,
+    };
+  }
+
+  async getRateLimitEntry(key: string): Promise<RateLimitEntry | null> {
+    const store = this.getStore(STORES.rateLimits);
+    const result = await this.promisifyRequest<RateLimitEntry>(store.get(key));
+    return result || null;
+  }
+
+  async setRateLimitEntry(entry: RateLimitEntry): Promise<void> {
+    const store = this.getStore(STORES.rateLimits, 'readwrite');
+    await this.promisifyRequest(store.put(entry));
+  }
+
+  async deleteRateLimitEntry(key: string): Promise<void> {
+    const store = this.getStore(STORES.rateLimits, 'readwrite');
+    await this.promisifyRequest(store.delete(key));
+  }
+
+  async saveScanResult(result: SecretScanResult): Promise<void> {
+    const store = this.getStore(STORES.scanResults, 'readwrite');
+    await this.promisifyRequest(store.put(result));
+  }
+
+  async getScanHistory(limit = 100): Promise<SecretScanResult[]> {
+    const store = this.getStore(STORES.scanResults);
+    const results = await this.promisifyRequest<SecretScanResult[]>(store.getAll());
+    return results.slice(-limit);
+  }
+
+  async cleanup(retentionMs: number): Promise<void> {
+    const cutoffTime = Date.now() - retentionMs;
+
+    const eventsStore = this.getStore(STORES.securityEvents, 'readwrite');
+    const events = await this.promisifyRequest<SecurityEvent[]>(eventsStore.getAll());
+    for (const event of events) {
+      if (event.timestamp < cutoffTime) {
+        await this.promisifyRequest(eventsStore.delete(event.id));
+      }
+    }
+
+    const scanStore = this.getStore(STORES.scanResults, 'readwrite');
+    const scans = await this.promisifyRequest<SecretScanResult[]>(scanStore.getAll());
+    for (const scan of scans) {
+      if (scan.timestamp < cutoffTime) {
+        await this.promisifyRequest(scanStore.delete(scan.id));
+      }
+    }
+  }
+
+  async destroy(): Promise<void> {
+    if (this.db) {
+      this.db.close();
+      this.db = null;
+    }
+    
+    return new Promise((resolve, reject) => {
+      const request = indexedDB.deleteDatabase(this.dbName);
+      request.onsuccess = () => resolve();
+      request.onerror = () => reject(request.error);
+    });
+  }
+
+  private promisifyRequest<T>(request: IDBRequest<T>): Promise<T> {
+    return new Promise((resolve, reject) => {
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  }
+}

package/src/types/index.ts

@@ -0,0 +1,213 @@
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type Environment = 'development' | 'staging' | 'production';
+
+export interface StorageConfig {
+  type: 'indexeddb' | 'file' | 'db';
+  dbName?: string;
+  path?: string;
+  adapter?: any;
+  retentionDays?: number;
+}
+
+export interface SecretPattern {
+  name: string;
+  pattern: RegExp;
+  entropy?: number;
+  description: string;
+  severity: Severity;
+}
+
+export interface SecretScanResult {
+  id: string;
+  timestamp: number;
+  file: string;
+  line: number;
+  column: number;
+  pattern: string;
+  match: string;
+  redactedMatch: string;
+  severity: Severity;
+  entropy: number;
+  context: string;
+  resolved: boolean;
+  falsePositive: boolean;
+  metadata?: Record<string, unknown>;
+}
+
+export interface Secret {
+  id: string;
+  key: string;
+  value: string;
+  encrypted: boolean;
+  version: number;
+  tags: string[];
+  environment?: Environment;
+  expiresAt?: number;
+  rotateEvery?: number;
+  lastRotated?: number;
+  lastAccessed?: number;
+  accessCount: number;
+  createdBy: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface SecretAccess {
+  id: string;
+  secretId: string;
+  userId: string;
+  action: 'read' | 'write' | 'delete' | 'rotate';
+  timestamp: number;
+  ip?: string;
+  userAgent?: string;
+}
+
+export interface Role {
+  id: string;
+  name: string;
+  description: string;
+  permissions: string[];
+  inherits?: string[];
+  metadata?: Record<string, unknown>;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface Permission {
+  id: string;
+  resource: string;
+  action: string;
+  conditions?: PolicyCondition[];
+}
+
+export interface UserRole {
+  userId: string;
+  roleId: string;
+  resourceIds?: string[];
+  expiresAt?: number;
+  assignedAt: number;
+}
+
+export interface PolicyCondition {
+  field: string;
+  operator: 'eq' | 'ne' | 'in' | 'nin' | 'gt' | 'lt' | 'contains';
+  value: unknown;
+}
+
+export interface AccessRequest {
+  userId: string;
+  action: string;
+  resourceId?: string;
+  context?: Record<string, unknown>;
+}
+
+export interface RateLimitRule {
+  id?: string;
+  name?: string;
+  type?: 'global' | 'perUser' | 'perIP' | 'perEndpoint';
+  requests: number;
+  window: number;
+  blockDuration?: number;
+  endpoints?: string[];
+}
+
+export interface RateLimitEntry {
+  key: string;
+  count: number;
+  resetAt: number;
+  blocked: boolean;
+  blockedUntil?: number;
+}
+
+export interface RateLimitResult {
+  allowed: boolean;
+  remaining: number;
+  resetAt: number;
+  retryAfter?: number;
+  limit?: number;
+}
+
+export interface RateLimitViolation {
+  id: string;
+  timestamp: number;
+  key: string;
+  ip: string;
+  userId?: string;
+  endpoint: string;
+  requestCount: number;
+  limit: number;
+  window: number;
+  blocked: boolean;
+}
+
+export type SecurityEventType =
+  | 'auth_failure'
+  | 'rate_limit_exceeded'
+  | 'unauthorized_access'
+  | 'secret_accessed'
+  | 'permission_denied'
+  | 'suspicious_activity'
+  | 'secret_exposed'
+  | 'policy_violation';
+
+export interface SecurityEvent {
+  id: string;
+  timestamp: number;
+  type: SecurityEventType;
+  severity: Severity;
+  userId?: string;
+  ip: string;
+  userAgent?: string;
+  resource?: string;
+  action?: string;
+  metadata: Record<string, unknown>;
+  resolved: boolean;
+  resolvedAt?: number;
+  resolvedBy?: string;
+  notes?: string;
+}
+
+export interface SecurityMetrics {
+  timeRange: { start: number; end: number };
+  totalEvents: number;
+  eventsByType: Record<string, number>;
+  eventsBySeverity: Record<string, number>;
+  topIPs: Array<{ ip: string; count: number }>;
+  topUsers: Array<{ userId: string; count: number }>;
+  anomalies?: SecurityAnomaly[];
+}
+
+export type AnomalyType =
+  | 'unusual_access_pattern'
+  | 'geographic_anomaly'
+  | 'spike_in_failures'
+  | 'new_endpoint_access'
+  | 'unusual_time';
+
+export interface SecurityAnomaly {
+  id: string;
+  timestamp: number;
+  type: AnomalyType;
+  score: number;
+  description: string;
+  relatedEvents: string[];
+  userId?: string;
+  ip?: string;
+}
+
+export interface EventQuery {
+  type?: SecurityEventType | SecurityEventType[];
+  severity?: Severity | Severity[];
+  userId?: string;
+  ip?: string;
+  startDate?: number;
+  endDate?: number;
+  resolved?: boolean;
+  limit?: number;
+  offset?: number;
+}
+
+export interface TimeRange {
+  start: number;
+  end: number;
+}

package/src/utils/helpers.ts

@@ -0,0 +1,84 @@
+import { randomBytes } from 'crypto';
+
+export function generateId(prefix?: string): string {
+  const random = randomBytes(16).toString('hex');
+  return prefix ? `${prefix}_${random}` : random;
+}
+
+export function calculateEntropy(str: string): number {
+  if (!str) return 0;
+  
+  const len = str.length;
+  const frequencies: Record<string, number> = {};
+  
+  for (let i = 0; i < len; i++) {
+    const char = str[i];
+    frequencies[char] = (frequencies[char] || 0) + 1;
+  }
+  
+  let entropy = 0;
+  for (const char in frequencies) {
+    const probability = frequencies[char] / len;
+    entropy -= probability * Math.log2(probability);
+  }
+  
+  return entropy;
+}
+
+export function redactSecret(secret: string, visibleChars = 4): string {
+  if (secret.length <= visibleChars) {
+    return '*'.repeat(secret.length);
+  }
+  
+  const start = secret.slice(0, visibleChars);
+  const rest = '*'.repeat(secret.length - visibleChars);
+  return start + rest;
+}
+
+export function isExpired(timestamp?: number): boolean {
+  if (!timestamp) return false;
+  return Date.now() > timestamp;
+}
+
+export function delay(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+export function sanitizeForLog(obj: Record<string, unknown>): Record<string, unknown> {
+  const sanitized: Record<string, unknown> = {};
+  const sensitiveKeys = ['password', 'secret', 'token', 'key', 'apiKey', 'api_key'];
+  
+  for (const [key, value] of Object.entries(obj)) {
+    const lowerKey = key.toLowerCase();
+    if (sensitiveKeys.some(sk => lowerKey.includes(sk))) {
+      sanitized[key] = '[REDACTED]';
+    } else if (typeof value === 'object' && value !== null) {
+      sanitized[key] = sanitizeForLog(value as Record<string, unknown>);
+    } else {
+      sanitized[key] = value;
+    }
+  }
+  
+  return sanitized;
+}
+
+export function parseTimeWindow(window: string | number): number {
+  if (typeof window === 'number') return window;
+  
+  const match = window.match(/^(\d+)(ms|s|m|h|d)$/);
+  if (!match) {
+    throw new Error(`Invalid time window format: ${window}`);
+  }
+  
+  const [, value, unit] = match;
+  const num = parseInt(value, 10);
+  
+  switch (unit) {
+    case 'ms': return num;
+    case 's': return num * 1000;
+    case 'm': return num * 60 * 1000;
+    case 'h': return num * 60 * 60 * 1000;
+    case 'd': return num * 24 * 60 * 60 * 1000;
+    default: throw new Error(`Unknown time unit: ${unit}`);
+  }
+}

package/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "lib": ["ES2022", "DOM"],
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "allowJs": false,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+}