@stacksjs/ts-cloud-core 0.1.2 → 0.1.6

package/src/security/certificate-manager.ts

@@ -1,492 +0,0 @@
-/**
- * Certificate Lifecycle Management
- * Automated certificate provisioning, renewal, and monitoring
- */
-
-export interface Certificate {
-  id: string
-  arn: string
-  domainName: string
-  subjectAlternativeNames?: string[]
-  validationMethod: 'DNS' | 'EMAIL'
-  status: CertificateStatus
-  issuer?: string
-  issuedAt?: Date
-  expiresAt?: Date
-  renewalEligibility?: boolean
-  inUseBy?: string[] // Resource ARNs
-}
-
-export type CertificateStatus =
-  | 'PENDING_VALIDATION'
-  | 'ISSUED'
-  | 'INACTIVE'
-  | 'EXPIRED'
-  | 'VALIDATION_TIMED_OUT'
-  | 'REVOKED'
-  | 'FAILED'
-
-export interface CertificateRenewal {
-  id: string
-  certificateArn: string
-  autoRenew: boolean
-  renewBeforeDays: number // Renew X days before expiration
-  lastRenewal?: Date
-  nextRenewal?: Date
-  renewalStatus?: 'success' | 'pending' | 'failed'
-}
-
-export interface CertificateValidation {
-  domainName: string
-  validationMethod: 'DNS' | 'EMAIL'
-  validationStatus: 'PENDING' | 'SUCCESS' | 'FAILED'
-  resourceRecords?: DnsRecord[]
-  validationEmails?: string[]
-}
-
-export interface DnsRecord {
-  name: string
-  type: 'CNAME' | 'A' | 'AAAA' | 'TXT'
-  value: string
-}
-
-export interface CertificateMonitor {
-  id: string
-  name: string
-  certificates: string[] // Certificate ARNs
-  expirationThreshold: number // days
-  alertEnabled: boolean
-  snsTopicArn?: string
-}
-
-export interface CertificateAlert {
-  id: string
-  certificateArn: string
-  alertType: 'expiring_soon' | 'expired' | 'renewal_failed' | 'validation_failed'
-  severity: 'critical' | 'warning' | 'info'
-  message: string
-  timestamp: Date
-  acknowledged?: boolean
-}
-
-/**
- * Certificate manager
- */
-export class CertificateManager {
-  private certificates: Map<string, Certificate> = new Map()
-  private renewals: Map<string, CertificateRenewal> = new Map()
-  private validations: Map<string, CertificateValidation> = new Map()
-  private monitors: Map<string, CertificateMonitor> = new Map()
-  private alerts: Map<string, CertificateAlert> = new Map()
-  private certificateCounter = 0
-  private renewalCounter = 0
-  private validationCounter = 0
-  private monitorCounter = 0
-  private alertCounter = 0
-
-  /**
-   * Request certificate
-   */
-  requestCertificate(options: {
-    domainName: string
-    subjectAlternativeNames?: string[]
-    validationMethod?: 'DNS' | 'EMAIL'
-  }): Certificate {
-    const id = `cert-${Date.now()}-${this.certificateCounter++}`
-    const arn = `arn:aws:acm:us-east-1:123456789012:certificate/${id}`
-
-    const certificate: Certificate = {
-      id,
-      arn,
-      domainName: options.domainName,
-      subjectAlternativeNames: options.subjectAlternativeNames,
-      validationMethod: options.validationMethod || 'DNS',
-      status: 'PENDING_VALIDATION',
-    }
-
-    this.certificates.set(id, certificate)
-
-    // Create validation record
-    this.createValidation(certificate)
-
-    return certificate
-  }
-
-  /**
-   * Request wildcard certificate
-   */
-  requestWildcardCertificate(options: {
-    domainName: string
-    includeApex?: boolean
-  }): Certificate {
-    const sans: string[] = []
-
-    if (options.includeApex) {
-      sans.push(options.domainName.replace('*.', ''))
-    }
-
-    return this.requestCertificate({
-      domainName: options.domainName,
-      subjectAlternativeNames: sans.length > 0 ? sans : undefined,
-      validationMethod: 'DNS',
-    })
-  }
-
-  /**
-   * Request multi-domain certificate
-   */
-  requestMultiDomainCertificate(options: {
-    primaryDomain: string
-    additionalDomains: string[]
-    validationMethod?: 'DNS' | 'EMAIL'
-  }): Certificate {
-    return this.requestCertificate({
-      domainName: options.primaryDomain,
-      subjectAlternativeNames: options.additionalDomains,
-      validationMethod: options.validationMethod || 'DNS',
-    })
-  }
-
-  /**
-   * Create certificate validation
-   */
-  private createValidation(certificate: Certificate): CertificateValidation {
-    const validation: CertificateValidation = {
-      domainName: certificate.domainName,
-      validationMethod: certificate.validationMethod,
-      validationStatus: 'PENDING',
-    }
-
-    if (certificate.validationMethod === 'DNS') {
-      validation.resourceRecords = [
-        {
-          name: `_${Math.random().toString(36).slice(2)}.${certificate.domainName}`,
-          type: 'CNAME',
-          value: `_${Math.random().toString(36).slice(2)}.acm-validations.aws.`,
-        },
-      ]
-    } else {
-      validation.validationEmails = [
-        `admin@${certificate.domainName}`,
-        `administrator@${certificate.domainName}`,
-        `hostmaster@${certificate.domainName}`,
-      ]
-    }
-
-    this.validations.set(certificate.id, validation)
-
-    return validation
-  }
-
-  /**
-   * Validate certificate
-   */
-  validateCertificate(certificateId: string): { success: boolean; message: string } {
-    const certificate = this.certificates.get(certificateId)
-    const validation = this.validations.get(certificateId)
-
-    if (!certificate || !validation) {
-      return { success: false, message: 'Certificate or validation not found' }
-    }
-
-    // Simulate validation
-    validation.validationStatus = 'SUCCESS'
-    certificate.status = 'ISSUED'
-    certificate.issuedAt = new Date()
-    certificate.expiresAt = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000) // 1 year
-    certificate.renewalEligibility = true
-    certificate.issuer = 'Amazon'
-
-    return { success: true, message: 'Certificate validated and issued successfully' }
-  }
-
-  /**
-   * Enable auto-renewal
-   */
-  enableAutoRenewal(options: {
-    certificateArn: string
-    renewBeforeDays?: number
-  }): CertificateRenewal {
-    const id = `renewal-${Date.now()}-${this.renewalCounter++}`
-
-    const renewal: CertificateRenewal = {
-      id,
-      certificateArn: options.certificateArn,
-      autoRenew: true,
-      renewBeforeDays: options.renewBeforeDays || 30,
-    }
-
-    this.renewals.set(id, renewal)
-
-    return renewal
-  }
-
-  /**
-   * Renew certificate
-   */
-  async renewCertificate(renewalId: string): Promise<{ success: boolean; message: string }> {
-    const renewal = this.renewals.get(renewalId)
-
-    if (!renewal) {
-      return { success: false, message: 'Renewal configuration not found' }
-    }
-
-    const certificate = Array.from(this.certificates.values()).find(
-      c => c.arn === renewal.certificateArn
-    )
-
-    if (!certificate) {
-      return { success: false, message: 'Certificate not found' }
-    }
-
-    console.log(`\nRenewing certificate: ${certificate.domainName}`)
-    console.log(`Certificate ARN: ${certificate.arn}`)
-
-    try {
-      console.log('\n1. Requesting new certificate...')
-      console.log('2. Validating domain ownership...')
-      console.log('3. Issuing renewed certificate...')
-      console.log('4. Updating resource associations...')
-
-      // Update certificate
-      certificate.issuedAt = new Date()
-      certificate.expiresAt = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000)
-
-      // Update renewal record
-      renewal.lastRenewal = new Date()
-      renewal.renewalStatus = 'success'
-      renewal.nextRenewal = new Date(
-        certificate.expiresAt.getTime() - renewal.renewBeforeDays * 24 * 60 * 60 * 1000
-      )
-
-      console.log('\n✓ Certificate renewed successfully')
-      console.log(`  New expiration: ${certificate.expiresAt.toISOString()}`)
-      console.log(`  Next renewal: ${renewal.nextRenewal.toISOString()}`)
-
-      return { success: true, message: 'Certificate renewed successfully' }
-    } catch (error) {
-      renewal.renewalStatus = 'failed'
-      this.createAlert({
-        certificateArn: certificate.arn,
-        alertType: 'renewal_failed',
-        severity: 'critical',
-        message: `Certificate renewal failed: ${error}`,
-      })
-
-      return {
-        success: false,
-        message: error instanceof Error ? error.message : String(error),
-      }
-    }
-  }
-
-  /**
-   * Create certificate monitor
-   */
-  createMonitor(monitor: Omit<CertificateMonitor, 'id'>): CertificateMonitor {
-    const id = `monitor-${Date.now()}-${this.monitorCounter++}`
-
-    const certificateMonitor: CertificateMonitor = {
-      id,
-      ...monitor,
-    }
-
-    this.monitors.set(id, certificateMonitor)
-
-    return certificateMonitor
-  }
-
-  /**
-   * Check certificate expiration
-   */
-  checkExpiration(): CertificateAlert[] {
-    const alerts: CertificateAlert[] = []
-    const now = Date.now()
-
-    for (const certificate of this.certificates.values()) {
-      if (!certificate.expiresAt) continue
-
-      const daysUntilExpiration =
-        (certificate.expiresAt.getTime() - now) / (1000 * 60 * 60 * 24)
-
-      // Check if expired
-      if (daysUntilExpiration < 0) {
-        alerts.push(
-          this.createAlert({
-            certificateArn: certificate.arn,
-            alertType: 'expired',
-            severity: 'critical',
-            message: `Certificate has expired for ${certificate.domainName}`,
-          })
-        )
-      }
-      // Check if expiring soon (within 30 days)
-      else if (daysUntilExpiration < 30) {
-        alerts.push(
-          this.createAlert({
-            certificateArn: certificate.arn,
-            alertType: 'expiring_soon',
-            severity: daysUntilExpiration < 7 ? 'critical' : 'warning',
-            message: `Certificate expiring in ${Math.floor(daysUntilExpiration)} days for ${certificate.domainName}`,
-          })
-        )
-      }
-    }
-
-    return alerts
-  }
-
-  /**
-   * Create alert
-   */
-  createAlert(alert: Omit<CertificateAlert, 'id' | 'timestamp' | 'acknowledged'>): CertificateAlert {
-    const id = `alert-${Date.now()}-${this.alertCounter++}`
-
-    const certificateAlert: CertificateAlert = {
-      id,
-      timestamp: new Date(),
-      acknowledged: false,
-      ...alert,
-    }
-
-    this.alerts.set(id, certificateAlert)
-
-    return certificateAlert
-  }
-
-  /**
-   * Acknowledge alert
-   */
-  acknowledgeAlert(alertId: string): void {
-    const alert = this.alerts.get(alertId)
-    if (alert) {
-      alert.acknowledged = true
-    }
-  }
-
-  /**
-   * Get certificate
-   */
-  getCertificate(id: string): Certificate | undefined {
-    return this.certificates.get(id)
-  }
-
-  /**
-   * List certificates
-   */
-  listCertificates(): Certificate[] {
-    return Array.from(this.certificates.values())
-  }
-
-  /**
-   * Get expiring certificates
-   */
-  getExpiringCertificates(days: number = 30): Certificate[] {
-    const cutoffTime = Date.now() + days * 24 * 60 * 60 * 1000
-
-    return Array.from(this.certificates.values()).filter(
-      cert => cert.expiresAt && cert.expiresAt.getTime() < cutoffTime
-    )
-  }
-
-  /**
-   * Get validation
-   */
-  getValidation(certificateId: string): CertificateValidation | undefined {
-    return this.validations.get(certificateId)
-  }
-
-  /**
-   * Get renewal
-   */
-  getRenewal(id: string): CertificateRenewal | undefined {
-    return this.renewals.get(id)
-  }
-
-  /**
-   * List renewals
-   */
-  listRenewals(): CertificateRenewal[] {
-    return Array.from(this.renewals.values())
-  }
-
-  /**
-   * List alerts
-   */
-  listAlerts(acknowledged: boolean = false): CertificateAlert[] {
-    return Array.from(this.alerts.values()).filter(
-      alert => alert.acknowledged === acknowledged
-    )
-  }
-
-  /**
-   * Generate CloudFormation for certificate
-   */
-  generateCertificateCF(certificate: Certificate): any {
-    return {
-      Type: 'AWS::CertificateManager::Certificate',
-      Properties: {
-        DomainName: certificate.domainName,
-        ...(certificate.subjectAlternativeNames && {
-          SubjectAlternativeNames: certificate.subjectAlternativeNames,
-        }),
-        ValidationMethod: certificate.validationMethod,
-      },
-    }
-  }
-
-  /**
-   * Generate CloudWatch alarm for expiration
-   */
-  generateExpirationAlarmCF(options: {
-    alarmName: string
-    certificateArn: string
-    daysBeforeExpiration: number
-    snsTopicArn?: string
-  }): any {
-    return {
-      Type: 'AWS::CloudWatch::Alarm',
-      Properties: {
-        AlarmName: options.alarmName,
-        AlarmDescription: `Certificate expiring in ${options.daysBeforeExpiration} days`,
-        MetricName: 'DaysToExpiry',
-        Namespace: 'AWS/CertificateManager',
-        Statistic: 'Minimum',
-        Period: 86400, // 1 day
-        EvaluationPeriods: 1,
-        Threshold: options.daysBeforeExpiration,
-        ComparisonOperator: 'LessThanThreshold',
-        Dimensions: [
-          {
-            Name: 'CertificateArn',
-            Value: options.certificateArn,
-          },
-        ],
-        ...(options.snsTopicArn && {
-          AlarmActions: [options.snsTopicArn],
-        }),
-      },
-    }
-  }
-
-  /**
-   * Clear all data
-   */
-  clear(): void {
-    this.certificates.clear()
-    this.renewals.clear()
-    this.validations.clear()
-    this.monitors.clear()
-    this.alerts.clear()
-    this.certificateCounter = 0
-    this.renewalCounter = 0
-    this.validationCounter = 0
-    this.monitorCounter = 0
-    this.alertCounter = 0
-  }
-}
-
-/**
- * Global certificate manager instance
- */
-export const certificateManager: CertificateManager = new CertificateManager()

package/src/security/index.ts

@@ -1,9 +0,0 @@
-/**
- * Security Module
- * Secrets management, certificate lifecycle, and security scanning
- */
-
-export * from './secrets-rotation'
-export * from './secrets-manager'
-export * from './certificate-manager'
-export * from './scanning'