@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/gdpr-gate/references/layers/frontend.md

@@ -0,0 +1,249 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: Frontend / Client-Side Privacy
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- A React / Vue / Svelte / Angular component, page, or form
+- Any `localStorage`, `sessionStorage`, or `document.cookie` code
+- Any third-party script or analytics SDK initialization (GA, Mixpanel, Sentry, Hotjar, LogRocket)
+- Client-side routing that puts user data in path or query params
+- Cookie-setting code (client or server-side `Set-Cookie`)
+
+Also loads during full repo scan.
+
+---
+
+## F-01: PII in localStorage / sessionStorage
+
+What to grep:
+```
+localStorage.setItem(
+sessionStorage.setItem(
+localStorage.setItem('user'
+window.localStorage
+```
+
+Flag when:
+- Full user objects stored: `localStorage.setItem('user', JSON.stringify(user))`
+- PII fields stored directly: email, name, phone, dob, token, ssn
+- Auth tokens stored in localStorage (XSS-accessible)
+
+Why it matters: localStorage is readable by any JavaScript on the page —
+including third-party scripts, browser extensions, and XSS payloads.
+
+Fix pattern:
+```javascript
+// Wrong
+localStorage.setItem('user', JSON.stringify({ email, name, phone, token }))
+
+// Right — store only non-sensitive session state
+localStorage.setItem('ui_preferences', JSON.stringify({ theme, language }))
+// Auth tokens → HttpOnly cookies (set server-side, not accessible to JS)
+```
+
+Regulation: CCPA (PII exposure), FTC Act
+
+---
+
+## F-02: Cookie Flags Missing
+
+What to grep:
+```
+res.cookie(
+document.cookie
+Set-Cookie:
+cookies.set(
+cookie.serialize(
+```
+
+Flag when:
+- `HttpOnly` flag missing on auth/session cookies
+- `Secure` flag missing (cookie sent over HTTP)
+- `SameSite` not set (CSRF risk + cross-site tracking)
+- PII stored directly in cookie value
+
+Fix pattern:
+```javascript
+// Wrong
+res.cookie('session', token)
+res.cookie('user_data', JSON.stringify({ email, name }))
+
+// Right
+res.cookie('session', token, {
+  httpOnly: true,       // not accessible to JavaScript
+  secure: true,         // HTTPS only
+  sameSite: 'strict',   // no cross-site sending
+  maxAge: 3600000       // 1 hour — always set expiry
+})
+// Never store PII in cookie value — store only opaque session ID
+```
+
+Regulation: CCPA, FTC Act, PCI-DSS (session management)
+
+---
+
+## F-03: Third-Party Scripts Loading Without Consent Gate
+
+What to grep:
+```
+<script src="https://www.googletagmanager.com
+<script src="https://connect.facebook.net
+<script src="https://static.hotjar.com
+<script src="https://cdn.segment.com
+gtag(        fbq(        _hsq.push(
+mixpanel.init(    amplitude.init(    analytics.load(
+```
+
+Flag when:
+- Analytics/tracking scripts load unconditionally on page load
+- No consent check before initializing tracking
+- Pixel fires on page load without checking consent state
+
+Why it matters: Loading tracking scripts before consent is a CCPA/GDPR violation.
+The script starts collecting IP, device data, and behavior immediately on load.
+
+Fix pattern:
+```javascript
+// Wrong — fires immediately
+<script src="https://www.googletagmanager.com/gtm.js"></script>
+
+// Right — load only after consent
+function initAnalytics() {
+  if (!userHasConsented()) return
+  const script = document.createElement('script')
+  script.src = 'https://www.googletagmanager.com/gtm.js'
+  document.head.appendChild(script)
+}
+```
+
+Regulation: CCPA, FTC Act
+
+---
+
+## F-04: PII in console.log (Frontend)
+
+What to grep:
+```
+console.log(user
+console.log(response.data
+console.log(formData
+console.error(user
+console.debug(
+```
+
+Flag when:
+- User objects logged: `console.log('User:', user)`
+- Form data logged: `console.log(formData)` (may contain email, password, PII)
+- API responses logged: `console.log(response.data)` (may contain PII)
+
+Why it matters: Browser console logs are visible to anyone with DevTools open,
+and some monitoring tools forward console output.
+
+Fix pattern:
+```javascript
+// Wrong
+console.log('Login response:', response.data)  // may contain user PII
+console.log('Form submitted:', formData)        // may contain password
+
+// Right
+console.log('Login successful, userId:', response.data.id)
+if (process.env.NODE_ENV === 'development') {
+  console.log('Form submitted')  // no payload in any environment
+}
+```
+
+Regulation: FTC Act, CCPA
+
+---
+
+## F-05: Session Replay / Error Tools Capturing PII
+
+What to grep:
+```
+LogRocket.init(
+Hotjar.init(
+FullStory.init(
+Sentry.init(
+replay:         (in Sentry config)
+```
+
+Flag when:
+- LogRocket/Hotjar/FullStory initialized without input masking config
+- Sentry Session Replay enabled without privacy config
+- No `inputMask` or `blockClass` configuration to suppress PII fields
+
+Fix pattern:
+```javascript
+// Wrong
+LogRocket.init('app/id')
+
+// Right
+LogRocket.init('app/id', {
+  dom: {
+    inputSanitizer: true,     // masks all input fields
+    textSanitizer: true,      // masks text nodes
+  }
+})
+
+// Sentry with replay
+Sentry.init({
+  replaysSessionSampleRate: 0.1,
+  integrations: [
+    new Sentry.Replay({
+      maskAllText: true,       // mask all text
+      blockAllMedia: true,     // block images
+      maskAllInputs: true,     // mask all form inputs
+    })
+  ]
+})
+```
+
+Regulation: HIPAA (if health data visible), CCPA, FTC Act
+
+---
+
+## F-06: PII in URL Parameters
+
+What to grep:
+```
+?email=
+?phone=
+?ssn=
+?token=
+router.push(`/users/${email}
+window.location = `/verify?email=
+<Link to={`/profile?name=
+history.push(`?dob=
+```
+
+Flag when:
+- PII passed as query parameters: `/reset?email=john@doe.com`
+- PII in route path: `/users/john@doe.com/settings`
+- Tokens in URLs: `/verify?token=abc123` (shows in browser history + server logs)
+
+Fix pattern:
+```javascript
+// Wrong
+router.push(`/reset-password?email=${email}&token=${token}`)
+
+// Right — POST body or short-lived opaque reference
+// Server generates a one-time code, URL contains only that
+router.push(`/reset-password?code=${opaqueOneTimeCode}`)
+// email resolved server-side from the code — never in URL
+```
+
+Regulation: CCPA, HIPAA (if health data), PCI-DSS
+
+---
+
+## EU extension — ePrivacy / TTDSG strict opt-in
+
+F-01..F-06 are Soleur-extended for ePrivacy Directive 2002/58/EC (Art. 5(3))
+and the German TTDSG §25, both of which require **strict opt-in consent**
+before any non-essential storage or transmission to the user terminal —
+including localStorage / sessionStorage writes, third-party SDK loads, and
+analytics beacons. Implicit consent ("by using this site you agree…"),
+pre-checked boxes, and cookie walls do not satisfy ePrivacy. Findings on
+this layer cross-reference LC-01 in `legal-consent.md`; the LC layer carries
+the consent-UX contract, this layer carries the frontend code-level traps.

package/skills/gdpr-gate/references/layers/testing-seeding.md

@@ -0,0 +1,256 @@
+<!-- Adapted from gosprinto/compliance-skills (MIT) — see NOTICE -->
+# Layer: Testing & Seeding
+
+## When This Layer Loads
+
+Auto-trigger inline when Claude is about to generate:
+- A seed file or database seeder
+- A test factory or fixture file
+- A test helper that creates user records
+- Any test that instantiates a user, customer, or patient object
+- Example or sample data in documentation or README
+
+Also loads during full repo scan.
+
+---
+
+## TS-01: Real PII in Seed Files
+
+What to grep:
+```
+seeds/
+db/seeds/
+seed.js, seed.ts, seed.rb, seed.py, seeds.sql
+seeders/
+prisma/seed.ts
+faker          (check if it's actually used — or real data hardcoded)
+```
+
+Flag when:
+- Real email addresses: anything that isn't `@example.com` or `@test.com`
+- Real phone numbers: anything matching `\d{3}[-.\s]\d{3}[-.\s]\d{4}` that isn't `555-0100`–`555-0199`
+- Real SSNs: anything matching `\d{3}-\d{2}-\d{4}` that isn't `000-00-0000`
+- Real names that appear to be actual people (not clearly fake)
+- Real addresses (not "123 Main St, Anytown")
+- Real credit card numbers
+
+Why it matters: Seed files are committed to git. Real PII in seeds means
+real user data in your repo history — accessible to every developer,
+contractor, and anyone who clones the repo.
+
+Fix pattern:
+```javascript
+// Wrong
+await User.create({
+  email: 'john.smith@gmail.com',    // real email
+  phone: '415-555-8923',            // real-looking phone
+  ssn: '123-45-6789'               // real-format SSN
+})
+
+// Right — use faker or obviously fake data
+import { faker } from '@faker-js/faker'
+
+await User.create({
+  email: faker.internet.email(),           // fake@example.com
+  phone: faker.phone.number('555-01##'),   // 555-01xx range = fake
+  ssn: '000-00-0000'                       // invalid SSN format = safe
+})
+
+// Or hardcode clearly fake data
+await User.create({
+  email: 'test.user@example.com',
+  phone: '555-0100',
+  ssn: '000-00-0000'
+})
+```
+
+Regulation: CCPA (any real user data), HIPAA (health seed data)
+
+---
+
+## TS-02: Real PII in Test Fixtures / Factories
+
+What to grep:
+```
+fixtures/
+spec/fixtures/
+test/fixtures/
+factories/
+spec/factories/
+FactoryBot.define
+factory(
+Factory.create(
+create(:user,
+```
+
+Flag when:
+- Factory default values use real-format PII (real-looking SSNs, emails, phones)
+- Fixture YAML files contain real email addresses
+- `create(:user, email: 'real@gmail.com')` in test files
+
+Fix pattern:
+```ruby
+# Wrong (FactoryBot)
+FactoryBot.define do
+  factory :user do
+    email { 'john.smith@gmail.com' }
+    phone { '415-555-8923' }
+    ssn   { '123-45-6789' }
+  end
+end
+
+# Right
+FactoryBot.define do
+  factory :user do
+    sequence(:email) { |n| "user#{n}@example.com" }
+    phone { '555-0100' }
+    ssn   { '000-00-0000' }
+    name  { Faker::Name.name }
+  end
+end
+```
+
+```javascript
+// Wrong (Jest + factory)
+const userFactory = {
+  email: 'john@gmail.com',
+  ssn: '123-45-6789'
+}
+
+// Right
+import { faker } from '@faker-js/faker'
+const userFactory = () => ({
+  email: faker.internet.email({ provider: 'example.com' }),
+  ssn: '000-00-0000'
+})
+```
+
+Regulation: CCPA, HIPAA
+
+---
+
+## TS-03: PII in Test Output / Snapshot Files
+
+What to grep:
+```
+__snapshots__/
+*.snap
+.snap files
+test/cassettes/    (VCR cassettes)
+spec/cassettes/
+fixtures/vcr/
+```
+
+Flag when:
+- Snapshot files contain email, phone, name, SSN, or health data
+- VCR/cassette recordings contain real API responses with PII
+- Test output logs contain PII from real or realistic test data
+
+Why it matters: Snapshot files are committed to git and updated automatically.
+If tests run against realistic data, PII ends up in `.snap` files silently.
+
+Fix pattern:
+```javascript
+// In snapshot — flag if you see:
+// "email": "john@gmail.com"  ← real-looking email in snapshot
+
+// Fix: ensure test data uses example.com domains
+// Use serializers to mask PII in snapshots
+expect(response.body).toMatchSnapshot({
+  email: expect.stringMatching(/@example\.com$/),  // only match pattern
+  id: expect.any(String)
+})
+
+// For VCR cassettes — scrub before committing
+// Use cassette filtering to replace real values:
+VCR.configure do |c|
+  c.filter_sensitive_data('<EMAIL>') { real_user.email }
+  c.filter_sensitive_data('<PHONE>') { real_user.phone }
+end
+```
+
+Regulation: CCPA, HIPAA
+
+---
+
+## TS-04: Tests Running Against Production Data
+
+What to grep:
+```
+DATABASE_URL=postgres://prod
+process.env.DATABASE_URL    (check what it points to in test env)
+RAILS_ENV=production        (in test files)
+NODE_ENV=production         (in test config)
+```
+
+Flag when:
+- Test configuration points to production database URL
+- No separate test database configured
+- Environment variable fallback could resolve to production in CI
+
+Fix pattern:
+```javascript
+// Wrong — in test config or .env.test
+DATABASE_URL=postgres://user:pass@prod-db.company.com/mydb
+
+// Right
+DATABASE_URL=postgres://localhost:5432/myapp_test
+// Or in CI:
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/test_db
+
+// Add guard in code:
+if (process.env.DATABASE_URL?.includes('prod') && process.env.NODE_ENV === 'test') {
+  throw new Error('Tests must not run against production database')
+}
+```
+
+Regulation: CCPA, HIPAA (PHI exposure to dev/test environments)
+
+---
+
+## TS-05: PII Logged During Test Runs
+
+What to grep:
+```
+console.log(         (in test files themselves)
+puts                 (in Ruby test files)
+print(               (in Python test files)
+logger.             (if test env logging is verbose)
+```
+
+Flag when:
+- Test files log user objects, API responses, or PII field values
+- Test helpers print sensitive data for debugging
+- CI log output captures PII (check if logs are stored/accessible)
+
+Fix pattern:
+```javascript
+// Wrong
+it('creates a user', async () => {
+  const user = await User.create({ email: 'test@example.com', ssn: '000-00-0000' })
+  console.log('Created user:', user)  // logs all fields including sensitive ones
+})
+
+// Right
+it('creates a user', async () => {
+  const user = await User.create({ email: 'test@example.com', ssn: '000-00-0000' })
+  // No logging in tests — assertions are enough
+  expect(user.id).toBeDefined()
+  expect(user.email).toBe('test@example.com')
+})
+```
+
+Regulation: CCPA, HIPAA
+
+---
+
+## EU extension — Art. 32 pseudonymization in non-prod
+
+TS-01..TS-05 are Soleur-extended under GDPR Art. 32(1)(a) ("pseudonymisation
+and encryption of personal data"). Test seeds, dev fixtures, and CI snapshots
+are non-prod environments but they still process personal data the moment a
+real-shape email, name, or identifier lands in `__synthesized__/`,
+`__goldens__/`, or `test/fixtures/`. Pseudonymization is not optional in non-
+prod — it is the Art. 32 floor for every environment that touches user-shape
+data. Findings on this layer cross-reference TS-01 (the canonical
+synthesized-data contract) and AGENTS.md `cq-test-fixtures-synthesized-only`.