@striae-org/striae 3.0.4

package/app/utils/batch-operations.ts

@@ -0,0 +1,135 @@
+/**
+ * Utility functions for batched operations with rate limiting protection
+ */
+
+interface BatchOperationOptions {
+  batchSize: number;
+  baseDelay: number;
+  maxRetries: number;
+  retryMultiplier: number;
+}
+
+interface BatchResult<T> {
+  successful: Array<{ item: T; result: any }>;
+  failed: Array<{ item: T; error: string; retryCount: number }>;
+  totalProcessed: number;
+}
+
+/**
+ * Execute operations in batches with exponential backoff on failures
+ */
+export const executeBatchOperations = async <T>(
+  items: T[],
+  operation: (item: T) => Promise<any>,
+  options: Partial<BatchOperationOptions> = {}
+): Promise<BatchResult<T>> => {
+  const config = {
+    batchSize: 3,
+    baseDelay: 300,
+    maxRetries: 2,
+    retryMultiplier: 2,
+    ...options
+  };
+
+  const successful: Array<{ item: T; result: any }> = [];
+  const failed: Array<{ item: T; error: string; retryCount: number }> = [];
+  let totalProcessed = 0;
+
+  // Process items in batches
+  for (let i = 0; i < items.length; i += config.batchSize) {
+    const batch = items.slice(i, i + config.batchSize);
+    const batchNumber = Math.floor(i / config.batchSize) + 1;
+    const totalBatches = Math.ceil(items.length / config.batchSize);
+
+    console.log(`📦 Processing batch ${batchNumber}/${totalBatches} (${batch.length} items)...`);
+
+    // Process batch with retry logic
+    const batchResults = await Promise.allSettled(
+      batch.map(async item => {
+        let lastError: Error | null = null;
+        
+        for (let retryCount = 0; retryCount <= config.maxRetries; retryCount++) {
+          try {
+            const result = await operation(item);
+            return { item, result };
+          } catch (error) {
+            lastError = error instanceof Error ? error : new Error('Unknown error');
+            
+            if (retryCount < config.maxRetries) {
+              // Wait before retry with exponential backoff
+              const retryDelay = config.baseDelay * Math.pow(config.retryMultiplier, retryCount);
+              console.warn(`⚠️  Operation failed, retrying in ${retryDelay}ms (attempt ${retryCount + 2}/${config.maxRetries + 1})`);
+              await new Promise(resolve => setTimeout(resolve, retryDelay));
+            }
+          }
+        }
+        
+        // All retries exhausted
+        throw lastError;
+      })
+    );
+
+    // Process batch results
+    batchResults.forEach((result, index) => {
+      totalProcessed++;
+      if (result.status === 'fulfilled') {
+        successful.push(result.value);
+      } else {
+        failed.push({
+          item: batch[index],
+          error: result.reason?.message || 'Unknown error',
+          retryCount: config.maxRetries
+        });
+      }
+    });
+
+    // Add delay between batches if not the last batch
+    if (i + config.batchSize < items.length) {
+      const delay = config.baseDelay + (failed.length > 0 ? config.baseDelay : 0); // Extra delay if failures occurred
+      console.log(`⏱️  Waiting ${delay}ms before next batch...`);
+      await new Promise(resolve => setTimeout(resolve, delay));
+    }
+  }
+
+  return {
+    successful,
+    failed,
+    totalProcessed
+  };
+};
+
+/**
+ * Rate-limited audit logging to prevent overwhelming the audit service
+ */
+export const batchedAuditLog = async (
+  auditEntries: Array<() => Promise<void>>,
+  options: { batchSize?: number; delay?: number } = {}
+): Promise<{ successful: number; failed: number }> => {
+  const { batchSize = 2, delay = 500 } = options;
+  let successful = 0;
+  let failed = 0;
+
+  for (let i = 0; i < auditEntries.length; i += batchSize) {
+    const batch = auditEntries.slice(i, i + batchSize);
+    
+    const results = await Promise.allSettled(
+      batch.map(auditFn => auditFn())
+    );
+
+    results.forEach(result => {
+      if (result.status === 'fulfilled') {
+        successful++;
+      } else {
+        failed++;
+        console.error('Audit logging failed:', result.reason);
+      }
+    });
+
+    // Add delay between audit batches
+    if (i + batchSize < auditEntries.length) {
+      await new Promise(resolve => setTimeout(resolve, delay));
+    }
+  }
+
+  return { successful, failed };
+};

package/app/utils/confirmation-signature.ts

@@ -0,0 +1,193 @@
+import { ConfirmationImportData } from '~/types';
+import {
+  ForensicManifestSignature,
+  FORENSIC_MANIFEST_SIGNATURE_ALGORITHM,
+  ManifestSignatureVerificationResult
+} from './SHA256';
+import { verifySignaturePayload } from './signature-utils';
+
+export const CONFIRMATION_SIGNATURE_VERSION = '2.0';
+
+const SHA256_HEX_REGEX = /^[a-f0-9]{64}$/i;
+
+type ConfirmationEntry = {
+  fullName: string;
+  badgeId: string;
+  timestamp: string;
+  confirmationId: string;
+  confirmedBy: string;
+  confirmedByEmail: string;
+  confirmedByCompany: string;
+  confirmedAt: string;
+};
+
+type ConfirmationMap = Record<string, ConfirmationEntry[]>;
+
+function hasValidConfirmationEntry(entry: Partial<ConfirmationEntry>): entry is ConfirmationEntry {
+  return (
+    typeof entry.fullName === 'string' &&
+    typeof entry.badgeId === 'string' &&
+    typeof entry.timestamp === 'string' &&
+    typeof entry.confirmationId === 'string' &&
+    typeof entry.confirmedBy === 'string' &&
+    typeof entry.confirmedByEmail === 'string' &&
+    typeof entry.confirmedByCompany === 'string' &&
+    typeof entry.confirmedAt === 'string' &&
+    !Number.isNaN(Date.parse(entry.confirmedAt))
+  );
+}
+
+function isValidConfirmationData(candidate: Partial<ConfirmationImportData>): candidate is ConfirmationImportData {
+  if (!candidate || !candidate.metadata || !candidate.confirmations) {
+    return false;
+  }
+
+  const { metadata } = candidate;
+
+  if (
+    typeof metadata.caseNumber !== 'string' ||
+    typeof metadata.exportDate !== 'string' ||
+    typeof metadata.exportedBy !== 'string' ||
+    typeof metadata.exportedByUid !== 'string' ||
+    typeof metadata.exportedByName !== 'string' ||
+    typeof metadata.exportedByCompany !== 'string' ||
+    typeof metadata.totalConfirmations !== 'number' ||
+    metadata.totalConfirmations < 0 ||
+    typeof metadata.version !== 'string' ||
+    typeof metadata.hash !== 'string' ||
+    !SHA256_HEX_REGEX.test(metadata.hash)
+  ) {
+    return false;
+  }
+
+  if (Number.isNaN(Date.parse(metadata.exportDate))) {
+    return false;
+  }
+
+  if (
+    typeof metadata.originalExportCreatedAt === 'string' &&
+    Number.isNaN(Date.parse(metadata.originalExportCreatedAt))
+  ) {
+    return false;
+  }
+
+  const confirmations = candidate.confirmations as Record<string, unknown>;
+  for (const [imageId, confirmationList] of Object.entries(confirmations)) {
+    if (!imageId || !Array.isArray(confirmationList)) {
+      return false;
+    }
+
+    for (const confirmationEntry of confirmationList) {
+      if (
+        typeof confirmationEntry !== 'object' ||
+        confirmationEntry === null ||
+        !hasValidConfirmationEntry(confirmationEntry as Partial<ConfirmationEntry>)
+      ) {
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+
+function normalizeConfirmationEntries(entries: ConfirmationEntry[]): ConfirmationEntry[] {
+  return [...entries]
+    .map((entry) => ({
+      fullName: entry.fullName,
+      badgeId: entry.badgeId,
+      timestamp: entry.timestamp,
+      confirmationId: entry.confirmationId,
+      confirmedBy: entry.confirmedBy,
+      confirmedByEmail: entry.confirmedByEmail,
+      confirmedByCompany: entry.confirmedByCompany,
+      confirmedAt: entry.confirmedAt
+    }))
+    .sort((left, right) => {
+      const leftKey = `${left.confirmationId}|${left.confirmedAt}|${left.confirmedBy}`;
+      const rightKey = `${right.confirmationId}|${right.confirmedAt}|${right.confirmedBy}`;
+      return leftKey.localeCompare(rightKey);
+    });
+}
+
+function normalizeConfirmations(confirmations: ConfirmationMap): ConfirmationMap {
+  const normalized: ConfirmationMap = {};
+  const sortedImageIds = Object.keys(confirmations).sort();
+
+  for (const imageId of sortedImageIds) {
+    normalized[imageId] = normalizeConfirmationEntries(confirmations[imageId] || []);
+  }
+
+  return normalized;
+}
+
+export function createConfirmationSigningPayload(
+  confirmationData: ConfirmationImportData,
+  signatureVersion: string = CONFIRMATION_SIGNATURE_VERSION
+): string {
+  const canonicalPayload = {
+    signatureVersion,
+    metadata: {
+      caseNumber: confirmationData.metadata.caseNumber,
+      exportDate: confirmationData.metadata.exportDate,
+      exportedBy: confirmationData.metadata.exportedBy,
+      exportedByUid: confirmationData.metadata.exportedByUid,
+      exportedByName: confirmationData.metadata.exportedByName,
+      exportedByCompany: confirmationData.metadata.exportedByCompany,
+      totalConfirmations: confirmationData.metadata.totalConfirmations,
+      version: confirmationData.metadata.version,
+      hash: confirmationData.metadata.hash.toUpperCase(),
+      ...(confirmationData.metadata.originalExportCreatedAt
+        ? { originalExportCreatedAt: confirmationData.metadata.originalExportCreatedAt }
+        : {})
+    },
+    confirmations: normalizeConfirmations(confirmationData.confirmations)
+  };
+
+  return JSON.stringify(canonicalPayload);
+}
+
+export async function verifyConfirmationSignature(
+  confirmationData: Partial<ConfirmationImportData>
+): Promise<ManifestSignatureVerificationResult> {
+  const signature = confirmationData.metadata?.signature as ForensicManifestSignature | undefined;
+  const signatureVersion = confirmationData.metadata?.signatureVersion;
+
+  if (!signature) {
+    return {
+      isValid: false,
+      error: 'Missing confirmation signature'
+    };
+  }
+
+  if (signatureVersion !== CONFIRMATION_SIGNATURE_VERSION) {
+    return {
+      isValid: false,
+      keyId: signature.keyId,
+      error: `Unsupported confirmation signature version: ${signatureVersion || 'unknown'}`
+    };
+  }
+
+  if (!isValidConfirmationData(confirmationData)) {
+    return {
+      isValid: false,
+      keyId: signature.keyId,
+      error: 'Confirmation content is malformed'
+    };
+  }
+
+  const payload = createConfirmationSigningPayload(confirmationData, signatureVersion);
+
+  return verifySignaturePayload(
+    payload,
+    signature,
+    FORENSIC_MANIFEST_SIGNATURE_ALGORITHM,
+    {
+      unsupportedAlgorithmPrefix: 'Unsupported confirmation signature algorithm',
+      missingKeyOrValueError: 'Missing confirmation signature key ID or value',
+      noVerificationKeyPrefix: 'No verification key configured for key ID',
+      invalidPublicKeyError: 'Confirmation signature verification failed: invalid public key',
+      verificationFailedError: 'Confirmation signature verification failed'
+    }
+  );
+}