@stacksjs/ts-cloud-core 0.1.1

package/src/security/certificate-manager.ts

@@ -0,0 +1,492 @@
+/**
+ * Certificate Lifecycle Management
+ * Automated certificate provisioning, renewal, and monitoring
+ */
+
+export interface Certificate {
+  id: string
+  arn: string
+  domainName: string
+  subjectAlternativeNames?: string[]
+  validationMethod: 'DNS' | 'EMAIL'
+  status: CertificateStatus
+  issuer?: string
+  issuedAt?: Date
+  expiresAt?: Date
+  renewalEligibility?: boolean
+  inUseBy?: string[] // Resource ARNs
+}
+
+export type CertificateStatus =
+  | 'PENDING_VALIDATION'
+  | 'ISSUED'
+  | 'INACTIVE'
+  | 'EXPIRED'
+  | 'VALIDATION_TIMED_OUT'
+  | 'REVOKED'
+  | 'FAILED'
+
+export interface CertificateRenewal {
+  id: string
+  certificateArn: string
+  autoRenew: boolean
+  renewBeforeDays: number // Renew X days before expiration
+  lastRenewal?: Date
+  nextRenewal?: Date
+  renewalStatus?: 'success' | 'pending' | 'failed'
+}
+
+export interface CertificateValidation {
+  domainName: string
+  validationMethod: 'DNS' | 'EMAIL'
+  validationStatus: 'PENDING' | 'SUCCESS' | 'FAILED'
+  resourceRecords?: DnsRecord[]
+  validationEmails?: string[]
+}
+
+export interface DnsRecord {
+  name: string
+  type: 'CNAME' | 'A' | 'AAAA' | 'TXT'
+  value: string
+}
+
+export interface CertificateMonitor {
+  id: string
+  name: string
+  certificates: string[] // Certificate ARNs
+  expirationThreshold: number // days
+  alertEnabled: boolean
+  snsTopicArn?: string
+}
+
+export interface CertificateAlert {
+  id: string
+  certificateArn: string
+  alertType: 'expiring_soon' | 'expired' | 'renewal_failed' | 'validation_failed'
+  severity: 'critical' | 'warning' | 'info'
+  message: string
+  timestamp: Date
+  acknowledged?: boolean
+}
+
+/**
+ * Certificate manager
+ */
+export class CertificateManager {
+  private certificates: Map<string, Certificate> = new Map()
+  private renewals: Map<string, CertificateRenewal> = new Map()
+  private validations: Map<string, CertificateValidation> = new Map()
+  private monitors: Map<string, CertificateMonitor> = new Map()
+  private alerts: Map<string, CertificateAlert> = new Map()
+  private certificateCounter = 0
+  private renewalCounter = 0
+  private validationCounter = 0
+  private monitorCounter = 0
+  private alertCounter = 0
+
+  /**
+   * Request certificate
+   */
+  requestCertificate(options: {
+    domainName: string
+    subjectAlternativeNames?: string[]
+    validationMethod?: 'DNS' | 'EMAIL'
+  }): Certificate {
+    const id = `cert-${Date.now()}-${this.certificateCounter++}`
+    const arn = `arn:aws:acm:us-east-1:123456789012:certificate/${id}`
+
+    const certificate: Certificate = {
+      id,
+      arn,
+      domainName: options.domainName,
+      subjectAlternativeNames: options.subjectAlternativeNames,
+      validationMethod: options.validationMethod || 'DNS',
+      status: 'PENDING_VALIDATION',
+    }
+
+    this.certificates.set(id, certificate)
+
+    // Create validation record
+    this.createValidation(certificate)
+
+    return certificate
+  }
+
+  /**
+   * Request wildcard certificate
+   */
+  requestWildcardCertificate(options: {
+    domainName: string
+    includeApex?: boolean
+  }): Certificate {
+    const sans: string[] = []
+
+    if (options.includeApex) {
+      sans.push(options.domainName.replace('*.', ''))
+    }
+
+    return this.requestCertificate({
+      domainName: options.domainName,
+      subjectAlternativeNames: sans.length > 0 ? sans : undefined,
+      validationMethod: 'DNS',
+    })
+  }
+
+  /**
+   * Request multi-domain certificate
+   */
+  requestMultiDomainCertificate(options: {
+    primaryDomain: string
+    additionalDomains: string[]
+    validationMethod?: 'DNS' | 'EMAIL'
+  }): Certificate {
+    return this.requestCertificate({
+      domainName: options.primaryDomain,
+      subjectAlternativeNames: options.additionalDomains,
+      validationMethod: options.validationMethod || 'DNS',
+    })
+  }
+
+  /**
+   * Create certificate validation
+   */
+  private createValidation(certificate: Certificate): CertificateValidation {
+    const validation: CertificateValidation = {
+      domainName: certificate.domainName,
+      validationMethod: certificate.validationMethod,
+      validationStatus: 'PENDING',
+    }
+
+    if (certificate.validationMethod === 'DNS') {
+      validation.resourceRecords = [
+        {
+          name: `_${Math.random().toString(36).slice(2)}.${certificate.domainName}`,
+          type: 'CNAME',
+          value: `_${Math.random().toString(36).slice(2)}.acm-validations.aws.`,
+        },
+      ]
+    } else {
+      validation.validationEmails = [
+        `admin@${certificate.domainName}`,
+        `administrator@${certificate.domainName}`,
+        `hostmaster@${certificate.domainName}`,
+      ]
+    }
+
+    this.validations.set(certificate.id, validation)
+
+    return validation
+  }
+
+  /**
+   * Validate certificate
+   */
+  validateCertificate(certificateId: string): { success: boolean; message: string } {
+    const certificate = this.certificates.get(certificateId)
+    const validation = this.validations.get(certificateId)
+
+    if (!certificate || !validation) {
+      return { success: false, message: 'Certificate or validation not found' }
+    }
+
+    // Simulate validation
+    validation.validationStatus = 'SUCCESS'
+    certificate.status = 'ISSUED'
+    certificate.issuedAt = new Date()
+    certificate.expiresAt = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000) // 1 year
+    certificate.renewalEligibility = true
+    certificate.issuer = 'Amazon'
+
+    return { success: true, message: 'Certificate validated and issued successfully' }
+  }
+
+  /**
+   * Enable auto-renewal
+   */
+  enableAutoRenewal(options: {
+    certificateArn: string
+    renewBeforeDays?: number
+  }): CertificateRenewal {
+    const id = `renewal-${Date.now()}-${this.renewalCounter++}`
+
+    const renewal: CertificateRenewal = {
+      id,
+      certificateArn: options.certificateArn,
+      autoRenew: true,
+      renewBeforeDays: options.renewBeforeDays || 30,
+    }
+
+    this.renewals.set(id, renewal)
+
+    return renewal
+  }
+
+  /**
+   * Renew certificate
+   */
+  async renewCertificate(renewalId: string): Promise<{ success: boolean; message: string }> {
+    const renewal = this.renewals.get(renewalId)
+
+    if (!renewal) {
+      return { success: false, message: 'Renewal configuration not found' }
+    }
+
+    const certificate = Array.from(this.certificates.values()).find(
+      c => c.arn === renewal.certificateArn
+    )
+
+    if (!certificate) {
+      return { success: false, message: 'Certificate not found' }
+    }
+
+    console.log(`\nRenewing certificate: ${certificate.domainName}`)
+    console.log(`Certificate ARN: ${certificate.arn}`)
+
+    try {
+      console.log('\n1. Requesting new certificate...')
+      console.log('2. Validating domain ownership...')
+      console.log('3. Issuing renewed certificate...')
+      console.log('4. Updating resource associations...')
+
+      // Update certificate
+      certificate.issuedAt = new Date()
+      certificate.expiresAt = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000)
+
+      // Update renewal record
+      renewal.lastRenewal = new Date()
+      renewal.renewalStatus = 'success'
+      renewal.nextRenewal = new Date(
+        certificate.expiresAt.getTime() - renewal.renewBeforeDays * 24 * 60 * 60 * 1000
+      )
+
+      console.log('\n✓ Certificate renewed successfully')
+      console.log(`  New expiration: ${certificate.expiresAt.toISOString()}`)
+      console.log(`  Next renewal: ${renewal.nextRenewal.toISOString()}`)
+
+      return { success: true, message: 'Certificate renewed successfully' }
+    } catch (error) {
+      renewal.renewalStatus = 'failed'
+      this.createAlert({
+        certificateArn: certificate.arn,
+        alertType: 'renewal_failed',
+        severity: 'critical',
+        message: `Certificate renewal failed: ${error}`,
+      })
+
+      return {
+        success: false,
+        message: error instanceof Error ? error.message : String(error),
+      }
+    }
+  }
+
+  /**
+   * Create certificate monitor
+   */
+  createMonitor(monitor: Omit<CertificateMonitor, 'id'>): CertificateMonitor {
+    const id = `monitor-${Date.now()}-${this.monitorCounter++}`
+
+    const certificateMonitor: CertificateMonitor = {
+      id,
+      ...monitor,
+    }
+
+    this.monitors.set(id, certificateMonitor)
+
+    return certificateMonitor
+  }
+
+  /**
+   * Check certificate expiration
+   */
+  checkExpiration(): CertificateAlert[] {
+    const alerts: CertificateAlert[] = []
+    const now = Date.now()
+
+    for (const certificate of this.certificates.values()) {
+      if (!certificate.expiresAt) continue
+
+      const daysUntilExpiration =
+        (certificate.expiresAt.getTime() - now) / (1000 * 60 * 60 * 24)
+
+      // Check if expired
+      if (daysUntilExpiration < 0) {
+        alerts.push(
+          this.createAlert({
+            certificateArn: certificate.arn,
+            alertType: 'expired',
+            severity: 'critical',
+            message: `Certificate has expired for ${certificate.domainName}`,
+          })
+        )
+      }
+      // Check if expiring soon (within 30 days)
+      else if (daysUntilExpiration < 30) {
+        alerts.push(
+          this.createAlert({
+            certificateArn: certificate.arn,
+            alertType: 'expiring_soon',
+            severity: daysUntilExpiration < 7 ? 'critical' : 'warning',
+            message: `Certificate expiring in ${Math.floor(daysUntilExpiration)} days for ${certificate.domainName}`,
+          })
+        )
+      }
+    }
+
+    return alerts
+  }
+
+  /**
+   * Create alert
+   */
+  createAlert(alert: Omit<CertificateAlert, 'id' | 'timestamp' | 'acknowledged'>): CertificateAlert {
+    const id = `alert-${Date.now()}-${this.alertCounter++}`
+
+    const certificateAlert: CertificateAlert = {
+      id,
+      timestamp: new Date(),
+      acknowledged: false,
+      ...alert,
+    }
+
+    this.alerts.set(id, certificateAlert)
+
+    return certificateAlert
+  }
+
+  /**
+   * Acknowledge alert
+   */
+  acknowledgeAlert(alertId: string): void {
+    const alert = this.alerts.get(alertId)
+    if (alert) {
+      alert.acknowledged = true
+    }
+  }
+
+  /**
+   * Get certificate
+   */
+  getCertificate(id: string): Certificate | undefined {
+    return this.certificates.get(id)
+  }
+
+  /**
+   * List certificates
+   */
+  listCertificates(): Certificate[] {
+    return Array.from(this.certificates.values())
+  }
+
+  /**
+   * Get expiring certificates
+   */
+  getExpiringCertificates(days: number = 30): Certificate[] {
+    const cutoffTime = Date.now() + days * 24 * 60 * 60 * 1000
+
+    return Array.from(this.certificates.values()).filter(
+      cert => cert.expiresAt && cert.expiresAt.getTime() < cutoffTime
+    )
+  }
+
+  /**
+   * Get validation
+   */
+  getValidation(certificateId: string): CertificateValidation | undefined {
+    return this.validations.get(certificateId)
+  }
+
+  /**
+   * Get renewal
+   */
+  getRenewal(id: string): CertificateRenewal | undefined {
+    return this.renewals.get(id)
+  }
+
+  /**
+   * List renewals
+   */
+  listRenewals(): CertificateRenewal[] {
+    return Array.from(this.renewals.values())
+  }
+
+  /**
+   * List alerts
+   */
+  listAlerts(acknowledged: boolean = false): CertificateAlert[] {
+    return Array.from(this.alerts.values()).filter(
+      alert => alert.acknowledged === acknowledged
+    )
+  }
+
+  /**
+   * Generate CloudFormation for certificate
+   */
+  generateCertificateCF(certificate: Certificate): any {
+    return {
+      Type: 'AWS::CertificateManager::Certificate',
+      Properties: {
+        DomainName: certificate.domainName,
+        ...(certificate.subjectAlternativeNames && {
+          SubjectAlternativeNames: certificate.subjectAlternativeNames,
+        }),
+        ValidationMethod: certificate.validationMethod,
+      },
+    }
+  }
+
+  /**
+   * Generate CloudWatch alarm for expiration
+   */
+  generateExpirationAlarmCF(options: {
+    alarmName: string
+    certificateArn: string
+    daysBeforeExpiration: number
+    snsTopicArn?: string
+  }): any {
+    return {
+      Type: 'AWS::CloudWatch::Alarm',
+      Properties: {
+        AlarmName: options.alarmName,
+        AlarmDescription: `Certificate expiring in ${options.daysBeforeExpiration} days`,
+        MetricName: 'DaysToExpiry',
+        Namespace: 'AWS/CertificateManager',
+        Statistic: 'Minimum',
+        Period: 86400, // 1 day
+        EvaluationPeriods: 1,
+        Threshold: options.daysBeforeExpiration,
+        ComparisonOperator: 'LessThanThreshold',
+        Dimensions: [
+          {
+            Name: 'CertificateArn',
+            Value: options.certificateArn,
+          },
+        ],
+        ...(options.snsTopicArn && {
+          AlarmActions: [options.snsTopicArn],
+        }),
+      },
+    }
+  }
+
+  /**
+   * Clear all data
+   */
+  clear(): void {
+    this.certificates.clear()
+    this.renewals.clear()
+    this.validations.clear()
+    this.monitors.clear()
+    this.alerts.clear()
+    this.certificateCounter = 0
+    this.renewalCounter = 0
+    this.validationCounter = 0
+    this.monitorCounter = 0
+    this.alertCounter = 0
+  }
+}
+
+/**
+ * Global certificate manager instance
+ */
+export const certificateManager: CertificateManager = new CertificateManager()

package/src/security/index.ts

@@ -0,0 +1,9 @@
+/**
+ * Security Module
+ * Secrets management, certificate lifecycle, and security scanning
+ */
+
+export * from './secrets-rotation'
+export * from './secrets-manager'
+export * from './certificate-manager'
+export * from './scanning'