@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/gdpr-gate/references/layers/api-layer.md

@@ -0,0 +1,355 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: API Layer
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- Any REST route handler or controller action
+- Any GraphQL resolver, query, or mutation
+- Any serializer, DTO, or response shaping code
+- Any endpoint that fetches, updates, or returns user data
+- Any bulk data endpoint or admin panel query
+- Any error response handler
+
+Also loads during full repo scan.
+
+---
+
+## AP-01: Full Object Returned in API Response
+
+What to grep:
+```
+res.json(user)
+res.json(req.user)
+render json: @user
+jsonify(user)
+return user
+JSON.stringify(user)
+res.send(user)
+serialize(user)        (check what fields are included)
+```
+
+Flag when:
+- Full model object returned without field selection
+- `password_hash`, `ssn`, `api_key`, or sensitive fields in response
+- `SELECT *` used in query that feeds into response
+- Serializer includes all fields by default
+
+Fix pattern:
+```javascript
+// Wrong
+app.get('/api/profile', auth, async (req, res) => {
+  const user = await User.findById(req.user.id)
+  res.json(user)  // returns password_hash, ssn, internal_score, everything
+})
+
+// Right — explicit field selection at query AND response level
+app.get('/api/profile', auth, async (req, res) => {
+  const user = await User.findById(req.user.id)
+    .select('id name email createdAt')  // only what client needs
+  res.json({
+    id: user.id,
+    name: user.name,
+    email: user.email
+    // explicit — nothing slips through accidentally
+  })
+})
+```
+
+Regulation: CCPA, HIPAA (minimum necessary), GLBA
+
+---
+
+## AP-02: Missing Ownership Check (IDOR)
+
+What to grep:
+```
+req.params.id
+req.params.userId
+params[:id]
+request.GET['id']
+findById(req.params.id)
+findOne({ id: req.params.id })
+User.find(params[:id])
+```
+
+Flag when:
+- Record fetched by ID from URL param without verifying requester owns it
+- No check that `req.user.id === record.userId`
+- Admin check missing — non-admins can access any record by guessing ID
+
+Why it matters: IDOR (Insecure Direct Object Reference) lets any authenticated
+user access any other user's PII by changing the ID in the URL.
+`/api/users/123/profile` → change to `/api/users/124/profile` → other user's data.
+
+Fix pattern:
+```javascript
+// Wrong
+app.get('/api/users/:id', auth, async (req, res) => {
+  const user = await User.findById(req.params.id)  // no ownership check
+  res.json(user)
+})
+
+// Right
+app.get('/api/users/:id', auth, async (req, res) => {
+  // Verify ownership — requester can only access their own record
+  if (req.params.id !== req.user.id && !req.user.isAdmin) {
+    return res.status(403).json({ error: 'Forbidden' })
+  }
+  const user = await User.findById(req.params.id).select('id name email')
+  res.json(user)
+})
+```
+
+Regulation: CCPA, HIPAA, FTC Act
+
+---
+
+## AP-03: GraphQL Introspection Enabled in Production
+
+What to grep:
+```
+introspection:
+introspection: true
+NODE_ENV !== 'production'   (check if introspection gated on this)
+ApolloServer({
+buildSchema(
+makeExecutableSchema(
+```
+
+Flag when:
+- `introspection: true` set unconditionally
+- No environment check before enabling introspection
+- No query depth limiting (allows deeply nested queries to extract data)
+
+Why it matters: Introspection exposes your full data model — every type,
+field name, and relationship — to anyone who can reach the endpoint.
+This reveals your PII field names and data structure to attackers.
+
+Fix pattern:
+```javascript
+// Wrong
+const server = new ApolloServer({
+  schema,
+  introspection: true  // always on
+})
+
+// Right
+const server = new ApolloServer({
+  schema,
+  introspection: process.env.NODE_ENV !== 'production',
+  plugins: [
+    ApolloServerPluginLandingPageDisabledPlugin()  // disable playground in prod
+  ]
+})
+
+// Also add query depth limiting
+import depthLimit from 'graphql-depth-limit'
+const server = new ApolloServer({
+  schema,
+  validationRules: [depthLimit(5)]
+})
+```
+
+Regulation: FTC Act, CCPA (data exposure risk)
+
+---
+
+## AP-04: Bulk Endpoint Returns All Records Without Scoping
+
+What to grep:
+```
+User.findAll()
+User.all
+User.find({})
+db.users.find({})
+SELECT * FROM users
+.findMany()           (without where clause)
+Model.objects.all()
+```
+
+Flag when:
+- Endpoint returns all users/records without auth scoping
+- No `WHERE user_id = ?` limiting results to requester's own data
+- Admin list endpoints accessible without admin role check
+- No pagination (allows full data extraction in one call)
+
+Fix pattern:
+```javascript
+// Wrong
+app.get('/api/users', auth, async (req, res) => {
+  const users = await User.findAll()  // returns everyone's data
+  res.json(users)
+})
+
+// Right
+app.get('/api/users', auth, requireAdmin, async (req, res) => {
+  const users = await User.findAll({
+    attributes: ['id', 'name', 'email', 'createdAt'],  // no sensitive fields
+    limit: req.query.limit || 50,    // always paginate
+    offset: req.query.offset || 0,
+    order: [['createdAt', 'DESC']]
+  })
+  res.json({ users, total: await User.count() })
+})
+
+// For non-admin endpoints — scope to requester only
+app.get('/api/my/data', auth, async (req, res) => {
+  const records = await Record.findAll({
+    where: { userId: req.user.id }  // always scope to current user
+  })
+  res.json(records)
+})
+```
+
+Regulation: CCPA, HIPAA, FTC Act
+
+---
+
+## AP-05: PII Returned in Error Messages
+
+What to grep:
+```
+`User ${email} not found`
+`Email ${req.body.email} already exists`
+`Invalid password for ${username}`
+`Account ${ssn} not found`
+res.json({ error: `${email}
+res.status(404).json({ message: `User ${
+```
+
+Flag when:
+- Email or username confirmed in error response (account enumeration)
+- PII reflected back in error messages
+- Database error messages forwarded to client (may contain field values)
+
+Fix pattern:
+```javascript
+// Wrong
+if (!user) {
+  return res.status(404).json({ error: `User ${email} not found` })
+}
+if (existingUser) {
+  return res.status(409).json({ error: `Email ${email} already registered` })
+}
+
+// Right — generic messages that don't confirm PII or account existence
+if (!user || !validPassword) {
+  return res.status(401).json({ error: 'Invalid credentials' })
+  // Same message whether user doesn't exist or password is wrong
+}
+if (existingUser) {
+  return res.status(409).json({ error: 'An account with this email already exists' })
+  // OK to confirm email taken at registration — but not at login
+}
+```
+
+Regulation: CCPA, FTC Act, HIPAA
+
+---
+
+## AP-06: Rate Limiting Missing on Auth / PII Endpoints
+
+What to grep:
+```
+app.post('/login'
+app.post('/forgot-password'
+app.post('/reset-password'
+app.get('/api/users/:id'
+app.post('/api/verify'
+```
+
+Flag when:
+- Login endpoint has no rate limiting (brute force risk)
+- Password reset endpoint has no rate limiting (enumeration risk)
+- PII lookup endpoints have no rate limiting (scraping risk)
+- No `express-rate-limit`, `rack-attack`, `django-ratelimit`, or equivalent
+
+Fix pattern:
+```javascript
+// Add to auth-sensitive routes
+import rateLimit from 'express-rate-limit'
+
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,  // 15 minutes
+  max: 10,                     // 10 attempts per window
+  message: { error: 'Too many attempts, please try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+})
+
+app.post('/login', authLimiter, loginHandler)
+app.post('/forgot-password', authLimiter, forgotPasswordHandler)
+app.post('/api/verify', authLimiter, verifyHandler)
+```
+
+Regulation: FTC Act, PCI-DSS, HIPAA
+
+---
+
+## AP-07: CORS Misconfiguration
+
+What to grep:
+```
+origin: '*'
+origin: true
+cors({ origin: '*'
+corsOptions = { origin: '*'
+allow_all_origins = True      (Django)
+CORS_ALLOW_ALL_ORIGINS = True (Django)
+config.allow_origins = ["*"]  (FastAPI)
+```
+
+Flag when:
+- `origin: '*'` on any API that handles authenticated requests
+- `origin: true` (reflects any origin) on credentialed endpoints
+- No `credentials: true` check alongside wildcard origin
+- Different CORS policy for dev vs prod not enforced
+
+Why it matters: A wildcard CORS origin on an authenticated API allows any
+website to make credentialed requests on behalf of your users — reading
+their data, performing actions. One of the most common misconfigurations
+that leads to data exposure.
+
+Fix pattern:
+```javascript
+// Wrong
+app.use(cors({ origin: '*' }))  // allows any domain
+
+// Wrong — reflects any origin
+app.use(cors({ origin: true, credentials: true }))
+
+// Right
+const allowedOrigins = [
+  'https://app.yourcompany.com',
+  'https://www.yourcompany.com',
+  ...(process.env.NODE_ENV === 'development' ? ['http://localhost:3000'] : [])
+]
+
+app.use(cors({
+  origin: (origin, callback) => {
+    if (!origin || allowedOrigins.includes(origin)) {
+      callback(null, true)
+    } else {
+      callback(new Error(`CORS blocked: ${origin}`))
+    }
+  },
+  credentials: true
+}))
+```
+
+```python
+# Wrong (FastAPI)
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True)
+
+# Right
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["https://app.yourcompany.com"],
+    allow_credentials=True,
+    allow_methods=["GET", "POST", "PUT", "DELETE"],
+    allow_headers=["*"],
+)
+```
+
+Regulation: FTC Act, CCPA (data exposure via cross-origin request)

package/skills/gdpr-gate/references/layers/auth-sessions.md

@@ -0,0 +1,290 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: Auth & Sessions
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- A login, logout, signup, or registration flow
+- Any JWT creation, signing, or verification code
+- Any token (access, refresh, reset, API key) generation or storage
+- Any session creation, validation, or invalidation
+- OAuth / SSO integration code
+- Password reset or MFA / OTP flows
+- Any `auth`, `session`, `token`, or `credential` handling
+
+Also loads during full repo scan.
+
+---
+
+## A-01: PII in JWT Payload
+
+What to grep:
+```
+jwt.sign(
+jsonwebtoken.sign(
+JWT.encode(
+jose.SignJWT(
+sign(payload
+new SignJWT({
+```
+
+Flag when:
+- PII fields in JWT payload: `{ email, name, ssn, dob, role, phone }`
+- Health or financial data in token
+- Full user object signed into JWT
+
+Why it matters: JWT payloads are base64-encoded, not encrypted. Anyone who
+intercepts or decodes the token can read every field in the payload.
+`atob(token.split('.')[1])` in any browser reveals it all.
+
+Fix pattern:
+```javascript
+// Wrong
+const token = jwt.sign({
+  userId: user.id,
+  email: user.email,      // PII — readable by anyone
+  role: user.role,
+  ssn: user.ssn,          // critical — never in JWT
+  plan: user.plan
+}, secret)
+
+// Right — opaque ID only, look up everything else server-side
+const token = jwt.sign({
+  sub: user.id,           // subject — opaque ID only
+  iat: Date.now(),
+  exp: Date.now() + 3600  // always set expiry
+}, secret)
+// Fetch user.email, user.role from DB on each request using sub
+```
+
+Regulation: CCPA, HIPAA (if health data in token), FTC Act
+
+---
+
+## A-02: Token Stored in localStorage
+
+What to grep:
+```
+localStorage.setItem('token'
+localStorage.setItem('jwt'
+localStorage.setItem('access_token'
+localStorage.setItem('auth'
+sessionStorage.setItem('token'
+```
+
+Flag when:
+- Any auth token stored in localStorage or sessionStorage
+- JWT, access token, refresh token, or API key in client-side storage
+
+Why it matters: localStorage is accessible to any JavaScript on the page.
+An XSS vulnerability anywhere on the domain exposes all tokens.
+
+Fix pattern:
+```javascript
+// Wrong
+localStorage.setItem('token', accessToken)
+
+// Right — server sets HttpOnly cookie, JS never touches the token
+// Server-side:
+res.cookie('access_token', token, {
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict',
+  maxAge: 3600000
+})
+// Client-side: token is sent automatically with requests, JS can't read it
+```
+
+Regulation: CCPA, FTC Act, PCI-DSS
+
+---
+
+## A-03: No Token Expiry
+
+What to grep:
+```
+jwt.sign({           (check for missing exp/expiresIn)
+expiresIn:           (check value — flag if > 24h for access tokens)
+jwt.sign(payload, secret)   (no options = no expiry)
+createToken(         (check implementation)
+```
+
+Flag when:
+- JWT signed with no `exp` or `expiresIn`
+- `expiresIn` set to days/weeks for access tokens (> 24h)
+- Refresh tokens with no expiry at all
+- Session tokens with no `maxAge` or `expires`
+
+Fix pattern:
+```javascript
+// Wrong
+const token = jwt.sign({ sub: user.id }, secret)  // no expiry — lives forever
+
+// Right
+const accessToken = jwt.sign({ sub: user.id }, secret, { expiresIn: '15m' })
+const refreshToken = jwt.sign({ sub: user.id }, refreshSecret, { expiresIn: '7d' })
+// Refresh tokens stored in DB so they can be revoked
+```
+
+Regulation: FTC Act, PCI-DSS (session timeout requirements)
+
+---
+
+## A-04: Password Reset Tokens — Single-Use Not Enforced
+
+What to grep:
+```
+reset_token
+password_reset_token
+forgot_password
+resetToken
+verifyToken(
+findOne({ reset_token:
+```
+
+Flag when:
+- Reset token stored but no `used_at` or `expires_at` field
+- Token not invalidated after use (can be reused)
+- Token expiry too long (> 1 hour is too long for password reset)
+- Token stored as plaintext (should be hashed like a password)
+
+Fix pattern:
+```javascript
+// Wrong
+await User.update({ reset_token: token }, { where: { id: userId } })
+// Token never expires, never marked used
+
+// Right
+await User.update({
+  reset_token_hash: await bcrypt.hash(token, 12),  // hash it
+  reset_token_expires_at: new Date(Date.now() + 3600000), // 1 hour
+  reset_token_used_at: null
+}, { where: { id: userId } })
+
+// On use:
+await User.update({
+  reset_token_hash: null,
+  reset_token_expires_at: null,
+  reset_token_used_at: new Date()
+}, { where: { id: userId } })
+```
+
+Regulation: FTC Act, HIPAA (for health platforms)
+
+---
+
+## A-05: OAuth Scope Over-Request
+
+What to grep:
+```
+scope:
+scopes:
+'https://www.googleapis.com/auth/
+offline_access
+openid profile email
+passport.use(
+```
+
+Flag when:
+- Requesting `offline_access` when refresh tokens aren't needed
+- Requesting full profile scope when only email is used
+- Google: requesting drive, calendar, or contacts when only email needed
+- GitHub: requesting `repo` (full repo access) when only user info needed
+
+Fix pattern:
+```javascript
+// Wrong
+const scopes = ['openid', 'profile', 'email', 'offline_access',
+                'https://www.googleapis.com/auth/drive']
+
+// Right — request only what you actually use
+const scopes = ['openid', 'email']
+```
+
+Regulation: FTC Act (data minimization principle), CCPA
+
+---
+
+## A-06: Session Not Invalidated on Logout
+
+What to grep:
+```
+app.post('/logout'
+router.post('/logout'
+def logout(
+async logout(
+signOut(
+```
+
+Flag when:
+- Logout only deletes client-side cookie/token without server-side invalidation
+- No session store deletion on logout
+- JWT-based auth with no token blocklist or short enough expiry
+
+Fix pattern:
+```javascript
+// Wrong — client-side only logout
+app.post('/logout', (req, res) => {
+  res.clearCookie('session')  // cookie gone but server doesn't know
+  res.json({ success: true })
+})
+
+// Right — invalidate server-side too
+app.post('/logout', async (req, res) => {
+  const token = req.cookies.session
+  await SessionStore.delete(token)     // invalidate in DB/Redis
+  await TokenBlocklist.add(token)      // blocklist if JWT
+  res.clearCookie('session', { httpOnly: true, secure: true })
+  res.json({ success: true })
+})
+```
+
+Regulation: FTC Act, PCI-DSS, HIPAA
+
+---
+
+## A-07: MFA / OTP Codes Stored Plaintext or Without Expiry
+
+What to grep:
+```
+otp_code
+mfa_code
+verification_code
+two_factor_code
+totp_secret
+backup_codes
+```
+
+Flag when:
+- OTP stored as plaintext integer/string without expiry
+- TOTP secret stored without encryption
+- Backup codes stored plaintext (should be hashed like passwords)
+- No `expires_at` on OTP codes
+
+Fix pattern:
+```javascript
+// Wrong
+await User.update({ otp_code: 123456 }, { where: { id: userId } })
+
+// Right
+await User.update({
+  otp_code_hash: await bcrypt.hash('123456', 12),  // hash it
+  otp_expires_at: new Date(Date.now() + 600000),   // 10 min max
+  otp_attempts: 0                                   // rate limit attempts
+}, { where: { id: userId } })
+```
+
+Regulation: FTC Act, HIPAA, PCI-DSS
+
+---
+
+## EU extension — Art. 32(1)(b) confidentiality
+
+A-01..A-07 are Soleur-extended for the EU regime under GDPR Art. 32(1)(b)
+("the ability to ensure the ongoing confidentiality, integrity, availability
+and resilience of processing systems and services"). Storing PII in JWT
+payloads, leaking session tokens to logs, or persisting OTP secrets in plain
+text are confidentiality failures under Art. 32 even when no other GDPR
+article fires. Treat A-01..A-07 findings as Art. 32 candidates regardless of
+whether a separate Art. 6 / Art. 9 / Art. 32 finding has already been raised
+on the same diff.