@vorionsys/platform-core 0.1.0

package/dist/common/redaction.js

@@ -0,0 +1,217 @@
+/**
+ * Sensitive Data Redaction Utilities
+ *
+ * Provides deep redaction of sensitive data in objects and arrays.
+ * Supports configurable sensitive field patterns and custom redaction functions.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Default sensitive field patterns (case-insensitive)
+ */
+const DEFAULT_SENSITIVE_PATTERNS = [
+    // Authentication
+    /password/i,
+    /secret/i,
+    /token/i,
+    /apikey/i,
+    /api_key/i,
+    /api-key/i,
+    /bearer/i,
+    /authorization/i,
+    /auth/i,
+    /credential/i,
+    /private_key/i,
+    /privatekey/i,
+    // Personal data
+    /ssn/i,
+    /social_security/i,
+    /tax_id/i,
+    /passport/i,
+    /driver_license/i,
+    /credit_card/i,
+    /card_number/i,
+    /cvv/i,
+    /pin/i,
+    // Financial
+    /account_number/i,
+    /routing_number/i,
+    /bank_account/i,
+    /iban/i,
+    /swift/i,
+    // Healthcare
+    /medical_record/i,
+    /diagnosis/i,
+    /prescription/i,
+    /health_insurance/i,
+    // Contact info (partial redaction might be preferred)
+    /email/i,
+    /phone/i,
+    /address/i,
+];
+/**
+ * Default configuration
+ */
+const DEFAULT_CONFIG = {
+    sensitivePatterns: DEFAULT_SENSITIVE_PATTERNS,
+    replacement: '[REDACTED]',
+    maxDepth: 20,
+    preserveType: false,
+    customRedactor: () => undefined,
+    allowedFields: [],
+};
+/**
+ * Check if a field name matches any sensitive pattern
+ */
+function isSensitiveField(fieldName, patterns, allowedFields) {
+    // Check whitelist first
+    if (allowedFields.includes(fieldName)) {
+        return false;
+    }
+    // Check against patterns
+    return patterns.some((pattern) => pattern.test(fieldName));
+}
+/**
+ * Get type-preserving replacement value
+ */
+function getTypedReplacement(value, replacement) {
+    if (typeof value === 'string') {
+        return replacement;
+    }
+    if (typeof value === 'number') {
+        return 0;
+    }
+    if (typeof value === 'boolean') {
+        return false;
+    }
+    if (Array.isArray(value)) {
+        return [replacement];
+    }
+    if (value === null) {
+        return null;
+    }
+    if (typeof value === 'object') {
+        return { redacted: true };
+    }
+    return replacement;
+}
+/**
+ * Deep clone and redact sensitive data from an object
+ */
+export function redact(data, config = {}) {
+    const mergedConfig = {
+        ...DEFAULT_CONFIG,
+        ...config,
+        sensitivePatterns: config.sensitivePatterns ?? DEFAULT_SENSITIVE_PATTERNS,
+        allowedFields: config.allowedFields ?? [],
+    };
+    return redactRecursive(data, mergedConfig, 0, '');
+}
+/**
+ * Recursive redaction implementation
+ */
+function redactRecursive(data, config, depth, path) {
+    // Check depth limit
+    if (depth > config.maxDepth) {
+        return config.replacement;
+    }
+    // Handle null/undefined
+    if (data === null || data === undefined) {
+        return data;
+    }
+    // Handle arrays
+    if (Array.isArray(data)) {
+        return data.map((item, index) => redactRecursive(item, config, depth + 1, `${path}[${index}]`));
+    }
+    // Handle objects
+    if (typeof data === 'object') {
+        const result = {};
+        for (const [key, value] of Object.entries(data)) {
+            const fieldPath = path ? `${path}.${key}` : key;
+            // Check custom redactor first
+            const customResult = config.customRedactor(key, value);
+            if (customResult !== undefined) {
+                result[key] = customResult;
+                continue;
+            }
+            // Check if field is sensitive
+            if (isSensitiveField(key, config.sensitivePatterns, config.allowedFields)) {
+                result[key] = config.preserveType
+                    ? getTypedReplacement(value, config.replacement)
+                    : config.replacement;
+                continue;
+            }
+            // Recurse into nested objects/arrays
+            result[key] = redactRecursive(value, config, depth + 1, fieldPath);
+        }
+        return result;
+    }
+    // Return primitives as-is
+    return data;
+}
+/**
+ * Redact sensitive data from a string (e.g., log message)
+ */
+export function redactString(text, config = {}) {
+    const replacement = config.replacement ?? DEFAULT_CONFIG.replacement;
+    // Common patterns in strings
+    const stringPatterns = [
+        // Bearer tokens
+        /Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/gi,
+        // API keys (common formats)
+        /(?:api[_-]?key|apikey|key)[=:]\s*["']?([A-Za-z0-9\-_]{16,})["']?/gi,
+        // JWT tokens
+        /eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/g,
+        // Basic auth
+        /Basic\s+[A-Za-z0-9+/=]+/gi,
+        // Passwords in URLs
+        /(:\/\/[^:]+:)[^@]+(@)/gi,
+        // Email addresses (partial)
+        /([a-zA-Z0-9._%+-]+)@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/g,
+        // Credit card numbers (simple pattern)
+        /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,
+        // SSN
+        /\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/g,
+    ];
+    let result = text;
+    // Replace Bearer/Basic auth tokens
+    result = result.replace(/Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/gi, `Bearer ${replacement}`);
+    result = result.replace(/Basic\s+[A-Za-z0-9+/=]+/gi, `Basic ${replacement}`);
+    // Replace JWT-like tokens
+    result = result.replace(/eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/g, replacement);
+    // Replace password in URLs
+    result = result.replace(/(:\/\/[^:]+:)[^@]+(@)/gi, `$1${replacement}$2`);
+    // Partially redact emails (keep first char and domain)
+    result = result.replace(/([a-zA-Z0-9])[a-zA-Z0-9._%+-]*@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/g, `$1***@$2`);
+    // Redact credit card numbers (show last 4)
+    result = result.replace(/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?(\d{4})\b/g, `****-****-****-$1`);
+    // Redact SSN (show last 4)
+    result = result.replace(/\b\d{3}[-\s]?\d{2}[-\s]?(\d{4})\b/g, `***-**-$1`);
+    return result;
+}
+/**
+ * Create a redactor with preset configuration
+ */
+export function createRedactor(config = {}) {
+    return {
+        redact: (data) => redact(data, config),
+        redactString: (text) => redactString(text, config),
+    };
+}
+/**
+ * Safely stringify an object with redaction
+ */
+export function safeStringify(data, config = {}, space) {
+    const redacted = redact(data, config);
+    try {
+        return JSON.stringify(redacted, null, space);
+    }
+    catch {
+        return '[Unable to stringify]';
+    }
+}
+/**
+ * Export default patterns for customization
+ */
+export const SENSITIVE_PATTERNS = DEFAULT_SENSITIVE_PATTERNS;
+//# sourceMappingURL=redaction.js.map

package/dist/common/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/common/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,0BAA0B,GAAG;IACjC,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,aAAa;IACb,cAAc;IACd,aAAa;IAEb,gBAAgB;IAChB,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,MAAM;IACN,MAAM;IAEN,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,OAAO;IACP,QAAQ;IAER,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,eAAe;IACf,mBAAmB;IAEnB,sDAAsD;IACtD,QAAQ;IACR,QAAQ;IACR,UAAU;CACX,CAAC;AAoBF;;GAEG;AACH,MAAM,cAAc,GAA8B;IAChD,iBAAiB,EAAE,0BAA0B;IAC7C,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,KAAK;IACnB,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;IAC/B,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;GAEG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,QAAkB,EAClB,aAAuB;IAEvB,wBAAwB;IACxB,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yBAAyB;IACzB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,WAAmB;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CACpB,IAAO,EACP,SAA0B,EAAE;IAE5B,MAAM,YAAY,GAA8B;QAC9C,GAAG,cAAc;QACjB,GAAG,MAAM;QACT,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,0BAA0B;QACzE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;KAC1C,CAAC;IAEF,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,CAAM,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,IAAa,EACb,MAAiC,EACjC,KAAa,EACb,IAAY;IAEZ,oBAAoB;IACpB,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9B,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAEhD,8BAA8B;YAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,8BAA8B;YAC9B,IAAI,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY;oBAC/B,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;oBAChD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0BAA0B;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,SAAmC,EAAE;IAErC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;IAErE,6BAA6B;IAC7B,MAAM,cAAc,GAAG;QACrB,gBAAgB;QAChB,8DAA8D;QAC9D,4BAA4B;QAC5B,oEAAoE;QACpE,aAAa;QACb,0DAA0D;QAC1D,aAAa;QACb,2BAA2B;QAC3B,oBAAoB;QACpB,yBAAyB;QACzB,4BAA4B;QAC5B,qDAAqD;QACrD,uCAAuC;QACvC,6CAA6C;QAC7C,MAAM;QACN,kCAAkC;KACnC,CAAC;IAEF,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,mCAAmC;IACnC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,8DAA8D,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;IACjH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;IAE7E,0BAA0B;IAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,0DAA0D,EAAE,WAAW,CAAC,CAAC;IAEjG,2BAA2B;IAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC;IAEzE,uDAAuD;IACvD,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,gEAAgE,EAChE,UAAU,CACX,CAAC;IAEF,2CAA2C;IAC3C,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,+CAA+C,EAC/C,mBAAmB,CACpB,CAAC;IAEF,2BAA2B;IAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oCAAoC,EAAE,WAAW,CAAC,CAAC;IAE3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,SAA0B,EAAE;IACzD,OAAO;QACL,MAAM,EAAE,CAAI,IAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5C,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAa,EACb,SAA0B,EAAE,EAC5B,KAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC"}