@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/ee/src/compliance/masking.ts

@@ -0,0 +1,477 @@
+/**
+ * Column masking for PII-tagged query results.
+ *
+ * Applies masking to query result rows based on:
+ * 1. PII classifications stored in the internal DB (per-org)
+ * 2. User role (admin sees raw, analyst sees partial, viewer sees full mask)
+ * 3. Per-column masking strategy (configurable via admin UI)
+ *
+ * Integration: called from `packages/api/src/lib/tools/sql.ts` after query
+ * execution, before results are returned to the agent/user.
+ *
+ * All mutating operations (saving classifications) call `requireEnterprise`.
+ * The masking check itself (`applyMasking`) fails open when enterprise is
+ * disabled — non-enterprise deployments get unmasked results.
+ */
+
+import { isEnterpriseEnabled, requireEnterprise } from "../index";
+import {
+  hasInternalDB,
+  internalQuery,
+} from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+import type {
+  PIICategory,
+  PIIConfidence,
+  PIIColumnClassification,
+  MaskingStrategy,
+  MaskingRole,
+  UpdatePIIClassificationRequest,
+} from "@useatlas/types";
+import { PII_CATEGORIES, MASKING_STRATEGIES } from "@useatlas/types";
+import { createHash } from "crypto";
+
+const log = createLogger("ee:compliance");
+
+// ── Typed errors ────────────────────────────────────────────────
+
+export type ComplianceErrorCode = "validation" | "not_found" | "conflict";
+
+export class ComplianceError extends Error {
+  constructor(message: string, public readonly code: ComplianceErrorCode) {
+    super(message);
+    this.name = "ComplianceError";
+  }
+}
+
+// ── Table management ────────────────────────────────────────────
+
+const TABLE_NAME = "pii_column_classifications";
+
+async function ensureTable(): Promise<void> {
+  if (!hasInternalDB()) return;
+  await internalQuery(`
+    CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (
+      id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+      org_id TEXT NOT NULL,
+      table_name TEXT NOT NULL,
+      column_name TEXT NOT NULL,
+      connection_id TEXT NOT NULL DEFAULT 'default',
+      category TEXT NOT NULL,
+      confidence TEXT NOT NULL DEFAULT 'medium',
+      masking_strategy TEXT NOT NULL DEFAULT 'partial',
+      reviewed BOOLEAN NOT NULL DEFAULT false,
+      dismissed BOOLEAN NOT NULL DEFAULT false,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      UNIQUE(org_id, table_name, column_name, connection_id)
+    )
+  `);
+}
+
+let _tableReady = false;
+async function ready(): Promise<boolean> {
+  if (!hasInternalDB()) return false;
+  if (_tableReady) return true;
+  try {
+    await ensureTable();
+    _tableReady = true;
+    return true;
+  } catch (err) {
+    log.warn(
+      { err: err instanceof Error ? err.message : String(err) },
+      "Failed to ensure PII classifications table",
+    );
+    return false;
+  }
+}
+
+// ── Internal row shape ──────────────────────────────────────────
+
+interface PIIClassificationRow {
+  id: string;
+  org_id: string;
+  table_name: string;
+  column_name: string;
+  connection_id: string;
+  category: string;
+  confidence: string;
+  masking_strategy: string;
+  reviewed: boolean;
+  dismissed: boolean;
+  created_at: string;
+  updated_at: string;
+  [key: string]: unknown;
+}
+
+function rowToClassification(row: PIIClassificationRow): PIIColumnClassification {
+  return {
+    id: row.id,
+    orgId: row.org_id,
+    tableName: row.table_name,
+    columnName: row.column_name,
+    connectionId: row.connection_id,
+    category: row.category as PIICategory,
+    confidence: row.confidence as PIIConfidence,
+    maskingStrategy: row.masking_strategy as MaskingStrategy,
+    reviewed: row.reviewed,
+    dismissed: row.dismissed,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+// ── CRUD operations (enterprise-gated) ──────────────────────────
+
+export async function listPIIClassifications(
+  orgId: string | undefined,
+  connectionId?: string,
+): Promise<PIIColumnClassification[]> {
+  requireEnterprise("pii-detection");
+  if (!(await ready())) return [];
+
+  let sql = `SELECT * FROM ${TABLE_NAME} WHERE dismissed = false`;
+  const params: unknown[] = [];
+
+  if (orgId) {
+    params.push(orgId);
+    sql += ` AND org_id = $${params.length}`;
+  }
+  if (connectionId) {
+    params.push(connectionId);
+    sql += ` AND connection_id = $${params.length}`;
+  }
+  sql += " ORDER BY table_name, column_name";
+
+  const rows = await internalQuery<PIIClassificationRow>(sql, params);
+  return rows.map(rowToClassification);
+}
+
+export async function savePIIClassification(
+  orgId: string,
+  tableName: string,
+  columnName: string,
+  connectionId: string,
+  category: PIICategory,
+  confidence: PIIConfidence,
+  maskingStrategy: MaskingStrategy = "partial",
+): Promise<PIIColumnClassification> {
+  requireEnterprise("pii-detection");
+  if (!(await ready())) {
+    throw new ComplianceError("Internal database not available", "validation");
+  }
+
+  validateCategory(category);
+  validateStrategy(maskingStrategy);
+
+  const rows = await internalQuery<PIIClassificationRow>(
+    `INSERT INTO ${TABLE_NAME} (org_id, table_name, column_name, connection_id, category, confidence, masking_strategy)
+     VALUES ($1, $2, $3, $4, $5, $6, $7)
+     ON CONFLICT (org_id, table_name, column_name, connection_id)
+     DO UPDATE SET category = $5, confidence = $6, masking_strategy = $7, updated_at = now(), dismissed = false
+     RETURNING *`,
+    [orgId, tableName, columnName, connectionId, category, confidence, maskingStrategy],
+  );
+  return rowToClassification(rows[0]);
+}
+
+export async function updatePIIClassification(
+  orgId: string,
+  id: string,
+  updates: UpdatePIIClassificationRequest,
+): Promise<PIIColumnClassification> {
+  requireEnterprise("pii-detection");
+  if (!(await ready())) {
+    throw new ComplianceError("Internal database not available", "validation");
+  }
+
+  if (updates.category) validateCategory(updates.category);
+  if (updates.maskingStrategy) validateStrategy(updates.maskingStrategy);
+
+  const setClauses: string[] = ["updated_at = now()"];
+  const params: unknown[] = [orgId, id];
+
+  if (updates.category !== undefined) {
+    params.push(updates.category);
+    setClauses.push(`category = $${params.length}`);
+  }
+  if (updates.maskingStrategy !== undefined) {
+    params.push(updates.maskingStrategy);
+    setClauses.push(`masking_strategy = $${params.length}`);
+  }
+  if (updates.dismissed !== undefined) {
+    params.push(updates.dismissed);
+    setClauses.push(`dismissed = $${params.length}`);
+  }
+  if (updates.reviewed !== undefined) {
+    params.push(updates.reviewed);
+    setClauses.push(`reviewed = $${params.length}`);
+  }
+
+  const rows = await internalQuery<PIIClassificationRow>(
+    `UPDATE ${TABLE_NAME} SET ${setClauses.join(", ")} WHERE org_id = $1 AND id = $2 RETURNING *`,
+    params,
+  );
+
+  if (rows.length === 0) {
+    throw new ComplianceError("PII classification not found", "not_found");
+  }
+  return rowToClassification(rows[0]);
+}
+
+export async function deletePIIClassification(
+  orgId: string,
+  id: string,
+): Promise<void> {
+  requireEnterprise("pii-detection");
+  if (!(await ready())) {
+    throw new ComplianceError("Internal database not available", "validation");
+  }
+
+  const rows = await internalQuery<{ id: string }>(
+    `DELETE FROM ${TABLE_NAME} WHERE org_id = $1 AND id = $2 RETURNING id`,
+    [orgId, id],
+  );
+  if (rows.length === 0) {
+    throw new ComplianceError("PII classification not found", "not_found");
+  }
+}
+
+// ── Masking application (query result path) ─────────────────────
+
+/**
+ * In-memory cache for PII classifications per org.
+ * TTL: 60 seconds — balances freshness with performance.
+ */
+const _classificationCache = new Map<string, { data: PIIClassificationRow[]; expiresAt: number }>();
+const CACHE_TTL_MS = 60_000;
+
+async function getClassificationsForOrg(
+  orgId: string,
+): Promise<PIIClassificationRow[]> {
+  const cached = _classificationCache.get(orgId);
+  if (cached && cached.expiresAt > Date.now()) return cached.data;
+
+  if (!(await ready())) return [];
+
+  const data = await internalQuery<PIIClassificationRow>(
+    `SELECT * FROM ${TABLE_NAME} WHERE org_id = $1 AND dismissed = false`,
+    [orgId],
+  );
+  _classificationCache.set(orgId, { data, expiresAt: Date.now() + CACHE_TTL_MS });
+  return data;
+}
+
+/** Invalidate the classification cache for an org (call after CRUD). */
+export function invalidateClassificationCache(orgId: string): void {
+  _classificationCache.delete(orgId);
+}
+
+export interface MaskingContext {
+  /** The query result columns. */
+  columns: string[];
+  /** The query result rows. */
+  rows: Record<string, unknown>[];
+  /** Tables accessed by the query (from SQL classification). */
+  tablesAccessed: string[];
+  /** Organization ID. */
+  orgId: string;
+  /** User role — determines masking level. */
+  userRole: MaskingRole | string | undefined;
+}
+
+/**
+ * Apply PII masking to query results based on column classifications and user role.
+ *
+ * - Fails open when enterprise is disabled (returns unmodified results).
+ * - Admins/owners always see raw data.
+ * - Analysts see partial masks.
+ * - Viewers/members see full masks.
+ *
+ * Returns a new rows array with masked values (does not mutate input).
+ */
+export async function applyMasking(
+  ctx: MaskingContext,
+): Promise<Record<string, unknown>[]> {
+  // Fail open when enterprise is disabled — no masking for non-enterprise deployments
+  if (!isEnterpriseEnabled()) return ctx.rows;
+  if (!hasInternalDB()) return ctx.rows;
+  if (ctx.rows.length === 0) return ctx.rows;
+
+  // Admins and owners always see raw data
+  const role = ctx.userRole ?? "viewer";
+  if (role === "admin" || role === "owner") return ctx.rows;
+
+  let classifications: PIIClassificationRow[];
+  try {
+    classifications = await getClassificationsForOrg(ctx.orgId);
+  } catch (err) {
+    log.warn(
+      { err: err instanceof Error ? err.message : String(err), orgId: ctx.orgId },
+      "Failed to load PII classifications — returning unmasked results",
+    );
+    return ctx.rows;
+  }
+
+  if (classifications.length === 0) return ctx.rows;
+
+  // Build a lookup: columnName → masking strategy (filtered to tables accessed by this query)
+  const maskLookup = new Map<string, MaskingStrategy>();
+  for (const cls of classifications) {
+    const tableNameLower = cls.table_name.toLowerCase();
+    const colNameLower = cls.column_name.toLowerCase();
+    // Match against tables accessed by this query
+    for (const table of ctx.tablesAccessed) {
+      if (table.toLowerCase() === tableNameLower) {
+        maskLookup.set(colNameLower, cls.masking_strategy as MaskingStrategy);
+      }
+    }
+  }
+
+  if (maskLookup.size === 0) return ctx.rows;
+
+  // Determine effective strategy based on role
+  const strategyForRole = resolveStrategyForRole(role);
+
+  // Apply masking to each row
+  return ctx.rows.map((row) => {
+    const masked = { ...row };
+    for (const [colName, strategy] of maskLookup) {
+      // Match column names case-insensitively
+      const matchingKey = ctx.columns.find((c) => c.toLowerCase() === colName);
+      if (matchingKey && matchingKey in masked) {
+        masked[matchingKey] = maskValue(masked[matchingKey], strategy, strategyForRole);
+      }
+    }
+    return masked;
+  });
+}
+
+// ── Masking functions ───────────────────────────────────────────
+
+/**
+ * Resolve the effective masking level for a given role.
+ * Admins/owners are filtered upstream (applyMasking exits early),
+ * so this handles analyst (partial) and all other roles (full).
+ */
+function resolveStrategyForRole(role: string): "full" | "partial" {
+  switch (role) {
+    case "admin":
+    case "owner":
+      return "partial"; // unreachable — admins exit early, but type-safe
+    case "analyst":
+      return "partial";
+    default:
+      return "full";
+  }
+}
+
+/**
+ * Mask a single value according to the column's strategy and the role's override.
+ *
+ * Role determines the effective masking level:
+ * - **viewer/member** (roleStrategy = "full"): always fully masked, regardless of column strategy
+ * - **analyst** (roleStrategy = "partial"): uses column strategy, but "full" is downgraded to "partial"
+ */
+export function maskValue(
+  value: unknown,
+  columnStrategy: MaskingStrategy,
+  roleStrategy: "full" | "partial",
+): unknown {
+  // Preserve null/undefined — no data to mask
+  if (value == null) return value;
+
+  // For non-string types, convert to string for masking
+  const str = String(value);
+  if (str === "") return str;
+
+  // Viewers/members always see full mask
+  if (roleStrategy === "full") {
+    return "***";
+  }
+
+  // Analysts: use column strategy but downgrade "full" to "partial"
+  const effectiveStrategy = columnStrategy === "full" ? "partial" : columnStrategy;
+
+  switch (effectiveStrategy) {
+    case "partial":
+      return partialMask(str);
+    case "hash":
+      return hashValue(str);
+    case "redact":
+      return "[REDACTED]";
+    default:
+      return partialMask(str);
+  }
+}
+
+/**
+ * Apply partial masking that preserves structure while hiding content.
+ *
+ * Examples:
+ * - email: alice@example.com → a***@example.com
+ * - phone: 555-123-4567 → 555-***-4567
+ * - SSN: 123-45-6789 → ***-**-6789
+ * - generic: abcdefgh → ab***gh
+ */
+export function partialMask(value: string): string {
+  // Email: show first char + domain
+  if (EMAIL_RE.test(value)) {
+    const [local, domain] = value.split("@");
+    return `${local[0]}***@${domain}`;
+  }
+
+  // SSN: mask first 5 digits
+  if (SSN_RE.test(value)) {
+    return `***-**-${value.slice(-4)}`;
+  }
+
+  // Credit card: show last 4 digits
+  if (CREDIT_CARD_RE.test(value)) {
+    return `****-****-****-${value.replace(/[\s-]/g, "").slice(-4)}`;
+  }
+
+  // Phone: show area code + last 4
+  if (PHONE_RE.test(value)) {
+    const digits = value.replace(/\D/g, "");
+    if (digits.length >= 10) {
+      return `${digits.slice(0, 3)}-***-${digits.slice(-4)}`;
+    }
+  }
+
+  // Generic: show first 2 + last 2 characters
+  if (value.length <= 4) return "***";
+  return `${value.slice(0, 2)}***${value.slice(-2)}`;
+}
+
+function hashValue(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+import { EMAIL_RE, SSN_RE, CREDIT_CARD_RE, PHONE_RE } from "./patterns";
+
+// ── Validation helpers ──────────────────────────────────────────
+
+function validateCategory(category: string): asserts category is PIICategory {
+  if (!(PII_CATEGORIES as readonly string[]).includes(category)) {
+    throw new ComplianceError(
+      `Invalid PII category "${category}". Must be one of: ${PII_CATEGORIES.join(", ")}`,
+      "validation",
+    );
+  }
+}
+
+function validateStrategy(strategy: string): asserts strategy is MaskingStrategy {
+  if (!(MASKING_STRATEGIES as readonly string[]).includes(strategy)) {
+    throw new ComplianceError(
+      `Invalid masking strategy "${strategy}". Must be one of: ${MASKING_STRATEGIES.join(", ")}`,
+      "validation",
+    );
+  }
+}
+
+/** Reset internal state. For testing only. */
+export function _resetComplianceState(): void {
+  _classificationCache.clear();
+  _tableReady = false;
+}

package/templates/nextjs-standalone/ee/src/compliance/patterns.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared regex patterns for PII detection and partial masking.
+ *
+ * Single source of truth — used by both pii-detection.ts (for sample value
+ * matching) and masking.ts (for format-aware partial masking).
+ */
+
+export const EMAIL_RE = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+export const PHONE_RE = /^[\s]*(?:\+?1[\s.-]?)?(?:\(?\d{3}\)?[\s.-]?)?\d{3}[\s.-]?\d{4}[\s]*$/;
+export const SSN_RE = /^\d{3}-\d{2}-\d{4}$/;
+export const CREDIT_CARD_RE = /^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$/;
+export const IPV4_RE = /^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/;
+export const IPV6_RE = /^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
+export const DOB_RE = /^(?:19|20)\d{2}[-/](?:0[1-9]|1[0-2])[-/](?:0[1-9]|[12]\d|3[01])$/;
+export const PASSPORT_RE = /^[A-Z]{1,2}\d{6,9}$/;
+export const DRIVER_LICENSE_RE = /^[A-Z]\d{3,}-\d{3,}-\d{3,}$/;

package/templates/nextjs-standalone/ee/src/compliance/pii-detection.ts

@@ -0,0 +1,217 @@
+/**
+ * PII detection engine for Atlas Enterprise.
+ *
+ * Pure-function detector that analyzes column metadata (name, type, sample
+ * values) to identify likely PII columns. Three detection methods:
+ *
+ * - **regex**: Pattern match against sample values (highest confidence)
+ * - **column_name**: Heuristic match on column name conventions
+ * - **type_heuristic**: Type-based guess (lowest confidence)
+ *
+ * All functions are stateless and have no DB dependency — easy to test
+ * and safe to call during profiling without side effects.
+ */
+
+import type { PIICategory, PIIDetection } from "@useatlas/types";
+import {
+  EMAIL_RE,
+  PHONE_RE,
+  SSN_RE,
+  CREDIT_CARD_RE,
+  IPV4_RE,
+  IPV6_RE,
+  DOB_RE,
+  PASSPORT_RE,
+  DRIVER_LICENSE_RE,
+} from "./patterns";
+
+interface ValuePattern {
+  category: PIICategory;
+  regex: RegExp;
+  minMatchRatio: number;
+}
+
+const VALUE_PATTERNS: ValuePattern[] = [
+  { category: "email", regex: EMAIL_RE, minMatchRatio: 0.5 },
+  { category: "ssn", regex: SSN_RE, minMatchRatio: 0.5 },
+  { category: "credit_card", regex: CREDIT_CARD_RE, minMatchRatio: 0.5 },
+  { category: "phone", regex: PHONE_RE, minMatchRatio: 0.4 },
+  { category: "ip_address", regex: IPV4_RE, minMatchRatio: 0.5 },
+  { category: "ip_address", regex: IPV6_RE, minMatchRatio: 0.5 },
+  { category: "date_of_birth", regex: DOB_RE, minMatchRatio: 0.3 },
+  { category: "passport", regex: PASSPORT_RE, minMatchRatio: 0.5 },
+  { category: "driver_license", regex: DRIVER_LICENSE_RE, minMatchRatio: 0.5 },
+];
+
+// ── Column name heuristics ──────────────────────────────────────
+
+interface NamePattern {
+  category: PIICategory;
+  patterns: RegExp[];
+}
+
+const NAME_PATTERNS: NamePattern[] = [
+  {
+    category: "email",
+    patterns: [/email/i, /e_?mail/i, /email_?addr/i],
+  },
+  {
+    category: "phone",
+    patterns: [/phone/i, /phone_?num/i, /tel(?:ephone)?/i, /mobile/i, /cell/i, /fax/i],
+  },
+  {
+    category: "ssn",
+    patterns: [/\bssn\b/i, /social_?security/i, /sin\b/i, /national_?id/i, /tax_?id/i],
+  },
+  {
+    category: "credit_card",
+    patterns: [/credit_?card/i, /card_?num/i, /cc_?num/i, /pan\b/i],
+  },
+  {
+    category: "name",
+    patterns: [
+      /^first_?name$/i, /^last_?name$/i, /^full_?name$/i,
+      /^given_?name$/i, /^family_?name$/i, /^surname$/i,
+      /^middle_?name$/i, /^display_?name$/i,
+    ],
+  },
+  {
+    category: "ip_address",
+    patterns: [/\bip_?addr/i, /\bclient_?ip\b/i, /\bremote_?ip\b/i, /\bsource_?ip\b/i, /\bip_?address/i],
+  },
+  {
+    category: "date_of_birth",
+    patterns: [/\bdob\b/i, /\bdate_?of_?birth\b/i, /\bbirth_?date\b/i, /\bbirthday\b/i],
+  },
+  {
+    category: "address",
+    patterns: [
+      /^street_?addr/i, /^mailing_?addr/i, /^home_?addr/i,
+      /^postal_?code$/i, /^zip_?code$/i, /^zip$/i,
+    ],
+  },
+  {
+    category: "passport",
+    patterns: [/passport/i],
+  },
+  {
+    category: "driver_license",
+    patterns: [/driver_?lic/i, /driving_?lic/i, /\bdl_?num/i],
+  },
+];
+
+// ── Public API ──────────────────────────────────────────────────
+
+export interface DetectPIIInput {
+  name: string;
+  type: string;
+  sampleValues: unknown[];
+}
+
+/**
+ * Detect PII in a single column based on its name, type, and sample values.
+ *
+ * Returns the highest-confidence detection, or null if no PII is detected.
+ * Detection priority: regex match on values > column name heuristic > type guess.
+ */
+export function detectPII(column: DetectPIIInput): PIIDetection | null {
+  // 1. Regex match on sample values (highest confidence)
+  const valueDetection = detectFromValues(column.sampleValues);
+  if (valueDetection) return valueDetection;
+
+  // 2. Column name heuristic (medium confidence)
+  const nameDetection = detectFromName(column.name);
+  if (nameDetection) return nameDetection;
+
+  // 3. Type-based guess (lowest confidence)
+  const typeDetection = detectFromType(column.name, column.type);
+  if (typeDetection) return typeDetection;
+
+  return null;
+}
+
+/**
+ * Batch-detect PII across multiple columns.
+ *
+ * Returns a map of column name → detection result (only columns with detections).
+ */
+export function detectPIIBatch(
+  columns: DetectPIIInput[],
+): Map<string, PIIDetection> {
+  const results = new Map<string, PIIDetection>();
+  for (const col of columns) {
+    const detection = detectPII(col);
+    if (detection) {
+      results.set(col.name, detection);
+    }
+  }
+  return results;
+}
+
+// ── Internal detection methods ──────────────────────────────────
+
+function detectFromValues(sampleValues: unknown[]): PIIDetection | null {
+  const stringValues = sampleValues
+    .filter((v): v is string | number => v != null && v !== "")
+    .map(String);
+
+  if (stringValues.length === 0) return null;
+
+  for (const pattern of VALUE_PATTERNS) {
+    const matches = stringValues.filter((v) => pattern.regex.test(v));
+    const ratio = matches.length / stringValues.length;
+    if (ratio >= pattern.minMatchRatio) {
+      return {
+        category: pattern.category,
+        confidence: "high",
+        method: "regex",
+        reason: `${matches.length}/${stringValues.length} sample values match ${pattern.category} pattern`,
+      };
+    }
+  }
+
+  return null;
+}
+
+function detectFromName(columnName: string): PIIDetection | null {
+  for (const namePattern of NAME_PATTERNS) {
+    for (const regex of namePattern.patterns) {
+      if (regex.test(columnName)) {
+        return {
+          category: namePattern.category,
+          confidence: "medium",
+          method: "column_name",
+          reason: `Column name "${columnName}" matches ${namePattern.category} naming pattern`,
+        };
+      }
+    }
+  }
+  return null;
+}
+
+function detectFromType(columnName: string, columnType: string): PIIDetection | null {
+  const lowerName = columnName.toLowerCase();
+  const lowerType = columnType.toLowerCase();
+
+  // Date columns named with birth-related terms
+  if ((lowerType === "date" || lowerType === "timestamp") && /birth|dob/i.test(lowerName)) {
+    return {
+      category: "date_of_birth",
+      confidence: "low",
+      method: "type_heuristic",
+      reason: `Date column "${columnName}" may contain date of birth`,
+    };
+  }
+
+  // inet/cidr types are likely IP addresses
+  if (lowerType === "inet" || lowerType === "cidr") {
+    return {
+      category: "ip_address",
+      confidence: "low",
+      method: "type_heuristic",
+      reason: `Column type "${columnType}" is likely an IP address`,
+    };
+  }
+
+  return null;
+}