@stacksjs/ts-cloud-core 0.1.3 → 0.1.7

package/src/database/users.ts

@@ -1,494 +0,0 @@
-/**
- * Database User Management
- * User creation, permissions, and access control
- */
-
-export interface DatabaseUser {
-  id: string
-  username: string
-  database: string
-  privileges: DatabasePrivilege[]
-  passwordSecretArn?: string
-  createdAt: Date
-  lastRotated?: Date
-  rotationEnabled?: boolean
-  rotationDays?: number
-}
-
-export interface DatabasePrivilege {
-  database?: string
-  table?: string
-  privileges: PrivilegeType[]
-}
-
-export type PrivilegeType =
-  | 'SELECT'
-  | 'INSERT'
-  | 'UPDATE'
-  | 'DELETE'
-  | 'CREATE'
-  | 'DROP'
-  | 'ALTER'
-  | 'INDEX'
-  | 'EXECUTE'
-  | 'ALL'
-
-export interface UserRole {
-  id: string
-  name: string
-  description?: string
-  privileges: DatabasePrivilege[]
-  users: string[] // user IDs
-}
-
-export interface AccessAudit {
-  id: string
-  username: string
-  action: 'LOGIN' | 'QUERY' | 'MODIFY' | 'GRANT' | 'REVOKE'
-  database?: string
-  table?: string
-  query?: string
-  timestamp: Date
-  success: boolean
-  ipAddress?: string
-}
-
-/**
- * Database user manager
- */
-export class DatabaseUserManager {
-  private users: Map<string, DatabaseUser> = new Map()
-  private roles: Map<string, UserRole> = new Map()
-  private audits: Map<string, AccessAudit> = new Map()
-  private userCounter = 0
-  private roleCounter = 0
-  private auditCounter = 0
-
-  /**
-   * Create database user
-   */
-  createUser(user: Omit<DatabaseUser, 'id' | 'createdAt'>): DatabaseUser {
-    const id = `db-user-${Date.now()}-${this.userCounter++}`
-
-    const dbUser: DatabaseUser = {
-      id,
-      createdAt: new Date(),
-      ...user,
-    }
-
-    this.users.set(id, dbUser)
-
-    return dbUser
-  }
-
-  /**
-   * Create read-only user
-   */
-  createReadOnlyUser(options: {
-    username: string
-    database: string
-    passwordSecretArn?: string
-    tables?: string[]
-  }): DatabaseUser {
-    const privileges: DatabasePrivilege[] = options.tables
-      ? options.tables.map(table => ({
-          database: options.database,
-          table,
-          privileges: ['SELECT' as PrivilegeType],
-        }))
-      : [
-          {
-            database: options.database,
-            privileges: ['SELECT' as PrivilegeType],
-          },
-        ]
-
-    return this.createUser({
-      username: options.username,
-      database: options.database,
-      privileges,
-      passwordSecretArn: options.passwordSecretArn,
-      rotationEnabled: true,
-      rotationDays: 90,
-    })
-  }
-
-  /**
-   * Create read-write user
-   */
-  createReadWriteUser(options: {
-    username: string
-    database: string
-    passwordSecretArn?: string
-    tables?: string[]
-  }): DatabaseUser {
-    const privileges: DatabasePrivilege[] = options.tables
-      ? options.tables.map(table => ({
-          database: options.database,
-          table,
-          privileges: ['SELECT', 'INSERT', 'UPDATE', 'DELETE'] as PrivilegeType[],
-        }))
-      : [
-          {
-            database: options.database,
-            privileges: ['SELECT', 'INSERT', 'UPDATE', 'DELETE'] as PrivilegeType[],
-          },
-        ]
-
-    return this.createUser({
-      username: options.username,
-      database: options.database,
-      privileges,
-      passwordSecretArn: options.passwordSecretArn,
-      rotationEnabled: true,
-      rotationDays: 60,
-    })
-  }
-
-  /**
-   * Create admin user
-   */
-  createAdminUser(options: {
-    username: string
-    database: string
-    passwordSecretArn?: string
-  }): DatabaseUser {
-    return this.createUser({
-      username: options.username,
-      database: options.database,
-      privileges: [
-        {
-          database: options.database,
-          privileges: ['ALL' as PrivilegeType],
-        },
-      ],
-      passwordSecretArn: options.passwordSecretArn,
-      rotationEnabled: true,
-      rotationDays: 30,
-    })
-  }
-
-  /**
-   * Create application user with specific table access
-   */
-  createApplicationUser(options: {
-    username: string
-    database: string
-    tables: { name: string; privileges: PrivilegeType[] }[]
-    passwordSecretArn?: string
-  }): DatabaseUser {
-    const privileges: DatabasePrivilege[] = options.tables.map(table => ({
-      database: options.database,
-      table: table.name,
-      privileges: table.privileges,
-    }))
-
-    return this.createUser({
-      username: options.username,
-      database: options.database,
-      privileges,
-      passwordSecretArn: options.passwordSecretArn,
-      rotationEnabled: true,
-      rotationDays: 90,
-    })
-  }
-
-  /**
-   * Create user role
-   */
-  createRole(role: Omit<UserRole, 'id' | 'users'>): UserRole {
-    const id = `role-${Date.now()}-${this.roleCounter++}`
-
-    const userRole: UserRole = {
-      id,
-      users: [],
-      ...role,
-    }
-
-    this.roles.set(id, userRole)
-
-    return userRole
-  }
-
-  /**
-   * Assign user to role
-   */
-  assignUserToRole(userId: string, roleId: string): void {
-    const user = this.users.get(userId)
-    const role = this.roles.get(roleId)
-
-    if (!user) {
-      throw new Error(`User not found: ${userId}`)
-    }
-
-    if (!role) {
-      throw new Error(`Role not found: ${roleId}`)
-    }
-
-    role.users.push(userId)
-
-    // Merge role privileges with user privileges
-    for (const privilege of role.privileges) {
-      const existingPrivilege = user.privileges.find(
-        p => p.database === privilege.database && p.table === privilege.table
-      )
-
-      if (existingPrivilege) {
-        // Merge privileges
-        existingPrivilege.privileges = Array.from(
-          new Set([...existingPrivilege.privileges, ...privilege.privileges])
-        )
-      } else {
-        user.privileges.push({ ...privilege })
-      }
-    }
-  }
-
-  /**
-   * Grant privileges to user
-   */
-  grantPrivileges(
-    userId: string,
-    privileges: DatabasePrivilege[]
-  ): { success: boolean; message: string } {
-    const user = this.users.get(userId)
-
-    if (!user) {
-      return { success: false, message: 'User not found' }
-    }
-
-    for (const privilege of privileges) {
-      const existing = user.privileges.find(
-        p => p.database === privilege.database && p.table === privilege.table
-      )
-
-      if (existing) {
-        existing.privileges = Array.from(new Set([...existing.privileges, ...privilege.privileges]))
-      } else {
-        user.privileges.push(privilege)
-      }
-    }
-
-    this.auditAccess({
-      username: user.username,
-      action: 'GRANT',
-      database: privileges[0]?.database,
-      table: privileges[0]?.table,
-      success: true,
-    })
-
-    return { success: true, message: 'Privileges granted successfully' }
-  }
-
-  /**
-   * Revoke privileges from user
-   */
-  revokePrivileges(
-    userId: string,
-    privileges: DatabasePrivilege[]
-  ): { success: boolean; message: string } {
-    const user = this.users.get(userId)
-
-    if (!user) {
-      return { success: false, message: 'User not found' }
-    }
-
-    for (const privilege of privileges) {
-      const existingIndex = user.privileges.findIndex(
-        p => p.database === privilege.database && p.table === privilege.table
-      )
-
-      if (existingIndex !== -1) {
-        const existing = user.privileges[existingIndex]
-        existing.privileges = existing.privileges.filter(
-          p => !privilege.privileges.includes(p)
-        )
-
-        // Remove privilege entry if no privileges left
-        if (existing.privileges.length === 0) {
-          user.privileges.splice(existingIndex, 1)
-        }
-      }
-    }
-
-    this.auditAccess({
-      username: user.username,
-      action: 'REVOKE',
-      database: privileges[0]?.database,
-      table: privileges[0]?.table,
-      success: true,
-    })
-
-    return { success: true, message: 'Privileges revoked successfully' }
-  }
-
-  /**
-   * Rotate user password
-   */
-  rotatePassword(userId: string): { success: boolean; newSecretArn?: string } {
-    const user = this.users.get(userId)
-
-    if (!user) {
-      return { success: false }
-    }
-
-    // In production, this would trigger Secrets Manager rotation
-    const newSecretArn = `arn:aws:secretsmanager:us-east-1:123456789012:secret:db-${user.username}-${Date.now()}`
-
-    user.passwordSecretArn = newSecretArn
-    user.lastRotated = new Date()
-
-    console.log(`Password rotated for user: ${user.username}`)
-
-    return { success: true, newSecretArn }
-  }
-
-  /**
-   * Check if password rotation needed
-   */
-  needsPasswordRotation(userId: string): boolean {
-    const user = this.users.get(userId)
-
-    if (!user || !user.rotationEnabled || !user.lastRotated || !user.rotationDays) {
-      return false
-    }
-
-    const daysSinceRotation =
-      (Date.now() - user.lastRotated.getTime()) / (1000 * 60 * 60 * 24)
-
-    return daysSinceRotation >= user.rotationDays
-  }
-
-  /**
-   * Audit access
-   */
-  auditAccess(audit: Omit<AccessAudit, 'id' | 'timestamp'>): AccessAudit {
-    const id = `audit-${Date.now()}-${this.auditCounter++}`
-
-    const accessAudit: AccessAudit = {
-      id,
-      timestamp: new Date(),
-      ...audit,
-    }
-
-    this.audits.set(id, accessAudit)
-
-    return accessAudit
-  }
-
-  /**
-   * Get user access history
-   */
-  getUserAccessHistory(username: string, limit: number = 100): AccessAudit[] {
-    return Array.from(this.audits.values())
-      .filter(audit => audit.username === username)
-      .sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime())
-      .slice(0, limit)
-  }
-
-  /**
-   * Get failed login attempts
-   */
-  getFailedLoginAttempts(username: string, hours: number = 24): AccessAudit[] {
-    const cutoffTime = Date.now() - hours * 60 * 60 * 1000
-
-    return Array.from(this.audits.values()).filter(
-      audit =>
-        audit.username === username &&
-        audit.action === 'LOGIN' &&
-        !audit.success &&
-        audit.timestamp.getTime() > cutoffTime
-    )
-  }
-
-  /**
-   * Generate SQL for user creation
-   */
-  generateCreateUserSQL(user: DatabaseUser, engine: 'postgres' | 'mysql' = 'postgres'): string {
-    const statements: string[] = []
-
-    if (engine === 'postgres') {
-      statements.push(`CREATE USER ${user.username} WITH PASSWORD '${user.passwordSecretArn}';`)
-
-      for (const privilege of user.privileges) {
-        if (privilege.privileges.includes('ALL')) {
-          statements.push(`GRANT ALL PRIVILEGES ON DATABASE ${privilege.database} TO ${user.username};`)
-        } else {
-          const privs = privilege.privileges.join(', ')
-          if (privilege.table) {
-            statements.push(
-              `GRANT ${privs} ON ${privilege.database}.${privilege.table} TO ${user.username};`
-            )
-          } else {
-            statements.push(`GRANT ${privs} ON DATABASE ${privilege.database} TO ${user.username};`)
-          }
-        }
-      }
-    } else {
-      // MySQL
-      statements.push(
-        `CREATE USER '${user.username}'@'%' IDENTIFIED BY '${user.passwordSecretArn}';`
-      )
-
-      for (const privilege of user.privileges) {
-        const privs = privilege.privileges.includes('ALL')
-          ? 'ALL PRIVILEGES'
-          : privilege.privileges.join(', ')
-        const target = privilege.table
-          ? `${privilege.database}.${privilege.table}`
-          : `${privilege.database}.*`
-
-        statements.push(`GRANT ${privs} ON ${target} TO '${user.username}'@'%';`)
-      }
-
-      statements.push('FLUSH PRIVILEGES;')
-    }
-
-    return statements.join('\n')
-  }
-
-  /**
-   * Get user
-   */
-  getUser(id: string): DatabaseUser | undefined {
-    return this.users.get(id)
-  }
-
-  /**
-   * List users
-   */
-  listUsers(): DatabaseUser[] {
-    return Array.from(this.users.values())
-  }
-
-  /**
-   * Get role
-   */
-  getRole(id: string): UserRole | undefined {
-    return this.roles.get(id)
-  }
-
-  /**
-   * List roles
-   */
-  listRoles(): UserRole[] {
-    return Array.from(this.roles.values())
-  }
-
-  /**
-   * Clear all data
-   */
-  clear(): void {
-    this.users.clear()
-    this.roles.clear()
-    this.audits.clear()
-    this.userCounter = 0
-    this.roleCounter = 0
-    this.auditCounter = 0
-  }
-}
-
-/**
- * Global database user manager instance
- */
-export const databaseUserManager: DatabaseUserManager = new DatabaseUserManager()

package/src/dependency-graph.ts

@@ -1,143 +0,0 @@
-import type { CloudFormationResource } from '@stacksjs/ts-cloud-aws-types'
-
-export interface ResourceNode {
-  logicalId: string
-  resource: CloudFormationResource
-  dependencies: Set<string>
-}
-
-/**
- * Dependency Graph for CloudFormation resources
- * Ensures resources are created in the correct order
- */
-export class DependencyGraph {
-  private nodes: Map<string, ResourceNode> = new Map()
-
-  /**
-   * Add a resource to the dependency graph
-   */
-  addResource(logicalId: string, resource: CloudFormationResource): void {
-    const dependencies = this.extractDependencies(resource)
-
-    this.nodes.set(logicalId, {
-      logicalId,
-      resource,
-      dependencies,
-    })
-  }
-
-  /**
-   * Extract dependencies from a resource
-   */
-  private extractDependencies(resource: CloudFormationResource): Set<string> {
-    const dependencies = new Set<string>()
-
-    // Add explicit DependsOn
-    if (resource.DependsOn) {
-      if (Array.isArray(resource.DependsOn)) {
-        resource.DependsOn.forEach(dep => dependencies.add(dep))
-      }
-      else {
-        dependencies.add(resource.DependsOn)
-      }
-    }
-
-    // Extract Ref dependencies
-    this.findReferences(resource.Properties || {}, dependencies)
-
-    return dependencies
-  }
-
-  /**
-   * Find all Ref references in an object
-   */
-  private findReferences(obj: any, dependencies: Set<string>): void {
-    if (!obj || typeof obj !== 'object')
-      return
-
-    if ('Ref' in obj && typeof obj.Ref === 'string') {
-      // Ignore pseudo parameters
-      if (!obj.Ref.startsWith('AWS::')) {
-        dependencies.add(obj.Ref)
-      }
-    }
-
-    if ('Fn::GetAtt' in obj && Array.isArray(obj['Fn::GetAtt'])) {
-      dependencies.add(obj['Fn::GetAtt'][0])
-    }
-
-    // Recursively search
-    for (const value of Object.values(obj)) {
-      if (typeof value === 'object') {
-        this.findReferences(value, dependencies)
-      }
-    }
-  }
-
-  /**
-   * Perform topological sort to determine resource creation order
-   */
-  topologicalSort(): string[] {
-    const sorted: string[] = []
-    const visited = new Set<string>()
-    const visiting = new Set<string>()
-
-    const visit = (nodeId: string): void => {
-      if (visited.has(nodeId))
-        return
-
-      if (visiting.has(nodeId)) {
-        throw new Error(`Circular dependency detected: ${nodeId}`)
-      }
-
-      visiting.add(nodeId)
-
-      const node = this.nodes.get(nodeId)
-      if (node) {
-        for (const dep of node.dependencies) {
-          visit(dep)
-        }
-      }
-
-      visiting.delete(nodeId)
-      visited.add(nodeId)
-      sorted.push(nodeId)
-    }
-
-    for (const nodeId of this.nodes.keys()) {
-      visit(nodeId)
-    }
-
-    return sorted
-  }
-
-  /**
-   * Validate that all dependencies exist
-   */
-  validate(): void {
-    for (const [nodeId, node] of this.nodes.entries()) {
-      for (const dep of node.dependencies) {
-        if (!this.nodes.has(dep)) {
-          throw new Error(
-            `Resource "${nodeId}" depends on "${dep}" which does not exist`,
-          )
-        }
-      }
-    }
-  }
-
-  /**
-   * Get resources that depend on a given resource
-   */
-  getDependents(logicalId: string): string[] {
-    const dependents: string[] = []
-
-    for (const [nodeId, node] of this.nodes.entries()) {
-      if (node.dependencies.has(logicalId)) {
-        dependents.push(nodeId)
-      }
-    }
-
-    return dependents
-  }
-}