@vorionsys/security 1.0.0

package/dist/common/redis.js

@@ -0,0 +1,73 @@
+/**
+ * Redis connection management
+ */
+import IORedis from 'ioredis';
+import { getConfig } from './config.js';
+import { createLogger } from './logger.js';
+import { withTimeout } from './timeout.js';
+const redisLogger = createLogger({ component: 'redis' });
+let redisClient = null;
+export function getRedis() {
+    if (!redisClient) {
+        const config = getConfig();
+        const redisOptions = {
+            host: config.redis.host,
+            port: config.redis.port,
+            db: config.redis.db,
+            lazyConnect: false,
+        };
+        // Only include password if defined
+        if (config.redis.password) {
+            redisOptions.password = config.redis.password;
+        }
+        redisClient = new IORedis(redisOptions);
+        redisClient.on('error', (error) => {
+            redisLogger.error({ error }, 'Redis connection error');
+        });
+        redisClient.on('connect', () => {
+            redisLogger.info('Redis connected');
+        });
+    }
+    return redisClient;
+}
+export async function closeRedis() {
+    if (redisClient) {
+        await redisClient.quit();
+        redisClient = null;
+    }
+}
+/**
+ * Check Redis health by running a PING command.
+ * Returns true if Redis is healthy, false otherwise.
+ *
+ * @param timeoutMs - Optional timeout in milliseconds (defaults to config value)
+ */
+export async function checkRedisHealth(timeoutMs) {
+    const client = getRedis();
+    const config = getConfig();
+    const timeout = timeoutMs ?? config.health.checkTimeoutMs;
+    const start = performance.now();
+    try {
+        const result = await withTimeout(client.ping(), timeout, 'Redis health check timed out');
+        const latencyMs = Math.round(performance.now() - start);
+        if (result === 'PONG') {
+            return { healthy: true, latencyMs };
+        }
+        return { healthy: false, latencyMs, error: `Unexpected response: ${result}` };
+    }
+    catch (error) {
+        const latencyMs = Math.round(performance.now() - start);
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        const isTimeout = errorMessage.includes('timed out');
+        if (isTimeout) {
+            redisLogger.warn({ latencyMs, timeoutMs: timeout }, 'Redis health check timed out');
+        }
+        return {
+            healthy: false,
+            latencyMs,
+            error: errorMessage,
+            timedOut: isTimeout,
+        };
+    }
+}
+//# sourceMappingURL=redis.js.map

package/dist/common/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/common/redis.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,OAA0C,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAEzD,IAAI,WAAW,GAAiB,IAAI,CAAC;AAErC,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAiB;YACjC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YACnB,WAAW,EAAE,KAAK;SACnB,CAAC;QAEF,mCAAmC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,WAAW,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;QAExC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAkB;IAMvD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,CAAC,IAAI,EAAE,EACb,OAAO,EACP,8BAA8B,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,MAAM,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,SAAS,EAAE,CAAC;YACd,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACtF,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,SAAS;YACT,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/common/secret-generator.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Secret Generator for Vorion
+ *
+ * Provides secure secret generation and management for deployment.
+ * Generates cryptographically secure secrets for JWT, encryption, CSRF, etc.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Generated secrets structure
+ */
+export interface GeneratedSecrets {
+    /** JWT signing secret (64 bytes, base64 encoded) */
+    jwtSecret: string;
+    /** AES-256-GCM encryption key (32 bytes, base64 encoded) */
+    encryptionKey: string;
+    /** PBKDF2 salt for key derivation (16 bytes, base64 encoded) */
+    encryptionSalt: string;
+    /** HMAC secret for deduplication hashing (32 bytes, base64 encoded) */
+    dedupeSecret: string;
+    /** HMAC secret for CSRF token signing (32 bytes, base64 encoded) */
+    csrfSecret: string;
+    /** Timestamp when secrets were generated */
+    generatedAt: string;
+    /** Version of the secret generation format */
+    version: number;
+}
+/**
+ * Calculate Shannon entropy of a string in bits.
+ *
+ * Used to validate secret quality and detect weak secrets.
+ * A good cryptographic secret should have high entropy (close to the
+ * theoretical maximum based on character set and length).
+ *
+ * @param str - The string to analyze
+ * @returns Entropy in bits
+ */
+export declare function calculateEntropy(str: string): number;
+/**
+ * Generate a cryptographically secure random secret.
+ *
+ * Uses Node.js crypto.randomBytes which is backed by the OS CSPRNG.
+ *
+ * @param bytes - Number of random bytes to generate (default: 64)
+ * @returns Base64-encoded secret string
+ */
+export declare function generateSecret(bytes?: number): string;
+/**
+ * Generate a cryptographically secure secret with entropy validation.
+ *
+ * Throws an error if the generated secret doesn't meet minimum entropy
+ * requirements (which should never happen with a working CSPRNG).
+ *
+ * @param bytes - Number of random bytes to generate
+ * @param minEntropy - Minimum required entropy in bits (default: 128)
+ * @returns Base64-encoded secret string
+ * @throws Error if generated secret has insufficient entropy
+ */
+export declare function generateSecretWithValidation(bytes?: number, minEntropy?: number): string;
+/**
+ * Generate all required secrets for Vorion deployment.
+ *
+ * Generates:
+ * - jwtSecret: 64 bytes for JWT signing (512 bits)
+ * - encryptionKey: 32 bytes for AES-256-GCM (256 bits)
+ * - encryptionSalt: 16 bytes for PBKDF2 (128 bits)
+ * - dedupeSecret: 32 bytes for HMAC (256 bits)
+ * - csrfSecret: 32 bytes for CSRF tokens (256 bits)
+ *
+ * @returns Generated secrets object
+ */
+export declare function generateSecrets(): GeneratedSecrets;
+/**
+ * Generate a deterministic key fingerprint for secret identification.
+ *
+ * Creates a short hash that can be used to identify which secrets are
+ * in use without exposing the actual secret values.
+ *
+ * @param secret - The secret to fingerprint
+ * @returns First 8 characters of SHA-256 hash
+ */
+export declare function getSecretFingerprint(secret: string): string;
+/**
+ * Load existing secrets from file or generate new ones.
+ *
+ * If secrets file exists and is valid, loads and returns existing secrets.
+ * Otherwise, generates new secrets and saves them with restricted permissions.
+ *
+ * The secrets file is created with mode 0o600 (owner read/write only).
+ *
+ * @param dataDir - Directory to store/load secrets from
+ * @returns Loaded or generated secrets
+ */
+export declare function loadOrGenerateSecrets(dataDir: string): Promise<GeneratedSecrets>;
+/**
+ * Apply generated secrets to environment variables.
+ *
+ * Sets the appropriate VORION_* environment variables from the secrets.
+ * Does not override variables that are already set.
+ *
+ * @param secrets - The secrets to apply
+ * @param override - Whether to override existing env vars (default: false)
+ */
+export declare function applySecretsToEnv(secrets: GeneratedSecrets, override?: boolean): void;
+/**
+ * Generate environment file content from secrets.
+ *
+ * Creates a .env file format string that can be written to disk
+ * or used with docker-compose.
+ *
+ * @param secrets - The secrets to format
+ * @returns Environment file content
+ */
+export declare function generateEnvFileContent(secrets: GeneratedSecrets): string;
+/**
+ * Rotate secrets by generating new ones.
+ *
+ * Generates a completely new set of secrets. The caller is responsible
+ * for handling the transition (e.g., supporting both old and new secrets
+ * during a migration period).
+ *
+ * @returns New generated secrets
+ */
+export declare function rotateSecrets(): GeneratedSecrets;
+/**
+ * Validate that a secret meets minimum security requirements.
+ *
+ * Checks:
+ * - Minimum length
+ * - Minimum entropy
+ * - Not a known weak pattern
+ *
+ * @param secret - The secret to validate
+ * @param name - Name of the secret (for error messages)
+ * @param minLength - Minimum required length (default: 32)
+ * @returns Validation result
+ */
+export declare function validateSecret(secret: string, name: string, minLength?: number): {
+    valid: boolean;
+    error?: string;
+};
+//# sourceMappingURL=secret-generator.d.ts.map

package/dist/common/secret-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-generator.d.ts","sourceRoot":"","sources":["../../src/common/secret-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAYD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBpD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,GAAE,MAAW,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,GAAE,MAAW,EAClB,UAAU,GAAE,MAAyB,GACpC,MAAM,CAaR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAalD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqDtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,GAAE,OAAe,GAAG,IAAI,CAe5F;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAwBxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,gBAAgB,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAW,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAkCpC"}

package/dist/common/secret-generator.js

@@ -0,0 +1,286 @@
+/**
+ * Secret Generator for Vorion
+ *
+ * Provides secure secret generation and management for deployment.
+ * Generates cryptographically secure secrets for JWT, encryption, CSRF, etc.
+ *
+ * @packageDocumentation
+ */
+import { randomBytes, createHash } from 'crypto';
+import { promises as fs } from 'fs';
+import { join } from 'path';
+/**
+ * Minimum entropy threshold in bits for production secrets
+ */
+const MIN_ENTROPY_BITS = 128;
+/**
+ * Current secret format version
+ */
+const SECRET_FORMAT_VERSION = 1;
+/**
+ * Calculate Shannon entropy of a string in bits.
+ *
+ * Used to validate secret quality and detect weak secrets.
+ * A good cryptographic secret should have high entropy (close to the
+ * theoretical maximum based on character set and length).
+ *
+ * @param str - The string to analyze
+ * @returns Entropy in bits
+ */
+export function calculateEntropy(str) {
+    if (!str || str.length === 0)
+        return 0;
+    // Count character frequencies
+    const freq = new Map();
+    for (const char of str) {
+        freq.set(char, (freq.get(char) ?? 0) + 1);
+    }
+    // Calculate Shannon entropy
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / str.length;
+        entropy -= p * Math.log2(p);
+    }
+    // Return total entropy (entropy per character * length)
+    return entropy * str.length;
+}
+/**
+ * Generate a cryptographically secure random secret.
+ *
+ * Uses Node.js crypto.randomBytes which is backed by the OS CSPRNG.
+ *
+ * @param bytes - Number of random bytes to generate (default: 64)
+ * @returns Base64-encoded secret string
+ */
+export function generateSecret(bytes = 64) {
+    return randomBytes(bytes).toString('base64');
+}
+/**
+ * Generate a cryptographically secure secret with entropy validation.
+ *
+ * Throws an error if the generated secret doesn't meet minimum entropy
+ * requirements (which should never happen with a working CSPRNG).
+ *
+ * @param bytes - Number of random bytes to generate
+ * @param minEntropy - Minimum required entropy in bits (default: 128)
+ * @returns Base64-encoded secret string
+ * @throws Error if generated secret has insufficient entropy
+ */
+export function generateSecretWithValidation(bytes = 64, minEntropy = MIN_ENTROPY_BITS) {
+    const secret = generateSecret(bytes);
+    const entropy = calculateEntropy(secret);
+    if (entropy < minEntropy) {
+        // This should never happen with a working CSPRNG
+        throw new Error(`Generated secret has insufficient entropy (${Math.floor(entropy)} bits, need ${minEntropy}+). ` +
+            'This may indicate a problem with the system random number generator.');
+    }
+    return secret;
+}
+/**
+ * Generate all required secrets for Vorion deployment.
+ *
+ * Generates:
+ * - jwtSecret: 64 bytes for JWT signing (512 bits)
+ * - encryptionKey: 32 bytes for AES-256-GCM (256 bits)
+ * - encryptionSalt: 16 bytes for PBKDF2 (128 bits)
+ * - dedupeSecret: 32 bytes for HMAC (256 bits)
+ * - csrfSecret: 32 bytes for CSRF tokens (256 bits)
+ *
+ * @returns Generated secrets object
+ */
+export function generateSecrets() {
+    return {
+        jwtSecret: generateSecretWithValidation(64),
+        encryptionKey: generateSecretWithValidation(32),
+        // Use 24 bytes for salt to ensure Shannon entropy meets 128-bit threshold
+        // when base64-encoded (16 bytes can occasionally produce lower Shannon entropy
+        // due to character distribution even though raw entropy is 128 bits)
+        encryptionSalt: generateSecretWithValidation(24),
+        dedupeSecret: generateSecretWithValidation(32),
+        csrfSecret: generateSecretWithValidation(32),
+        generatedAt: new Date().toISOString(),
+        version: SECRET_FORMAT_VERSION,
+    };
+}
+/**
+ * Generate a deterministic key fingerprint for secret identification.
+ *
+ * Creates a short hash that can be used to identify which secrets are
+ * in use without exposing the actual secret values.
+ *
+ * @param secret - The secret to fingerprint
+ * @returns First 8 characters of SHA-256 hash
+ */
+export function getSecretFingerprint(secret) {
+    return createHash('sha256').update(secret).digest('hex').slice(0, 8);
+}
+/**
+ * Load existing secrets from file or generate new ones.
+ *
+ * If secrets file exists and is valid, loads and returns existing secrets.
+ * Otherwise, generates new secrets and saves them with restricted permissions.
+ *
+ * The secrets file is created with mode 0o600 (owner read/write only).
+ *
+ * @param dataDir - Directory to store/load secrets from
+ * @returns Loaded or generated secrets
+ */
+export async function loadOrGenerateSecrets(dataDir) {
+    const secretsPath = join(dataDir, '.vorion-secrets.json');
+    try {
+        const content = await fs.readFile(secretsPath, 'utf-8');
+        const secrets = JSON.parse(content);
+        // Validate loaded secrets have all required fields
+        const requiredFields = [
+            'jwtSecret',
+            'encryptionKey',
+            'encryptionSalt',
+            'dedupeSecret',
+            'csrfSecret',
+        ];
+        for (const field of requiredFields) {
+            if (!secrets[field] || typeof secrets[field] !== 'string') {
+                throw new Error(`Missing or invalid field: ${field}`);
+            }
+        }
+        // Validate entropy of loaded secrets
+        const minLengths = {
+            jwtSecret: 32,
+            encryptionKey: 32,
+            encryptionSalt: 16,
+            dedupeSecret: 32,
+            csrfSecret: 32,
+        };
+        for (const [field, minLength] of Object.entries(minLengths)) {
+            const secret = secrets[field];
+            if (secret.length < minLength) {
+                throw new Error(`Secret ${field} is too short (${secret.length} < ${minLength})`);
+            }
+        }
+        return secrets;
+    }
+    catch (error) {
+        // File doesn't exist or is invalid - generate new secrets
+        const secrets = generateSecrets();
+        // Ensure directory exists
+        await fs.mkdir(dataDir, { recursive: true });
+        // Write with restricted permissions (owner read/write only)
+        await fs.writeFile(secretsPath, JSON.stringify(secrets, null, 2), {
+            mode: 0o600,
+        });
+        return secrets;
+    }
+}
+/**
+ * Apply generated secrets to environment variables.
+ *
+ * Sets the appropriate VORION_* environment variables from the secrets.
+ * Does not override variables that are already set.
+ *
+ * @param secrets - The secrets to apply
+ * @param override - Whether to override existing env vars (default: false)
+ */
+export function applySecretsToEnv(secrets, override = false) {
+    const envMappings = [
+        ['jwtSecret', 'VORION_JWT_SECRET'],
+        ['encryptionKey', 'VORION_ENCRYPTION_KEY'],
+        ['encryptionSalt', 'VORION_ENCRYPTION_SALT'],
+        ['dedupeSecret', 'VORION_DEDUPE_SECRET'],
+        ['csrfSecret', 'VORION_CSRF_SECRET'],
+    ];
+    for (const [secretKey, envVar] of envMappings) {
+        const value = secrets[secretKey];
+        if (typeof value === 'string' && (override || !process.env[envVar])) {
+            process.env[envVar] = value;
+        }
+    }
+}
+/**
+ * Generate environment file content from secrets.
+ *
+ * Creates a .env file format string that can be written to disk
+ * or used with docker-compose.
+ *
+ * @param secrets - The secrets to format
+ * @returns Environment file content
+ */
+export function generateEnvFileContent(secrets) {
+    const lines = [
+        '# Vorion Auto-Generated Secrets',
+        `# Generated: ${secrets.generatedAt}`,
+        `# Version: ${secrets.version}`,
+        '',
+        '# JWT signing secret (do not share)',
+        `VORION_JWT_SECRET=${secrets.jwtSecret}`,
+        '',
+        '# Encryption key for data at rest',
+        `VORION_ENCRYPTION_KEY=${secrets.encryptionKey}`,
+        '',
+        '# PBKDF2 salt for key derivation',
+        `VORION_ENCRYPTION_SALT=${secrets.encryptionSalt}`,
+        '',
+        '# HMAC secret for deduplication',
+        `VORION_DEDUPE_SECRET=${secrets.dedupeSecret}`,
+        '',
+        '# HMAC secret for CSRF tokens',
+        `VORION_CSRF_SECRET=${secrets.csrfSecret}`,
+        '',
+    ];
+    return lines.join('\n');
+}
+/**
+ * Rotate secrets by generating new ones.
+ *
+ * Generates a completely new set of secrets. The caller is responsible
+ * for handling the transition (e.g., supporting both old and new secrets
+ * during a migration period).
+ *
+ * @returns New generated secrets
+ */
+export function rotateSecrets() {
+    return generateSecrets();
+}
+/**
+ * Validate that a secret meets minimum security requirements.
+ *
+ * Checks:
+ * - Minimum length
+ * - Minimum entropy
+ * - Not a known weak pattern
+ *
+ * @param secret - The secret to validate
+ * @param name - Name of the secret (for error messages)
+ * @param minLength - Minimum required length (default: 32)
+ * @returns Validation result
+ */
+export function validateSecret(secret, name, minLength = 32) {
+    if (!secret) {
+        return { valid: false, error: `${name} is required` };
+    }
+    if (secret.length < minLength) {
+        return {
+            valid: false,
+            error: `${name} must be at least ${minLength} characters (got ${secret.length})`,
+        };
+    }
+    const entropy = calculateEntropy(secret);
+    if (entropy < MIN_ENTROPY_BITS) {
+        return {
+            valid: false,
+            error: `${name} has insufficient entropy (${Math.floor(entropy)} bits, need ${MIN_ENTROPY_BITS}+)`,
+        };
+    }
+    // Check for obviously weak patterns
+    const weakPatterns = [
+        /^(.)\1+$/, // All same character
+        /^(012345|123456|abcdef|qwerty)/i, // Sequential patterns
+        /^(password|secret|key|token)/i, // Common weak prefixes
+    ];
+    for (const pattern of weakPatterns) {
+        if (pattern.test(secret)) {
+            return { valid: false, error: `${name} matches a weak pattern` };
+        }
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=secret-generator.js.map

package/dist/common/secret-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-generator.js","sourceRoot":"","sources":["../../src/common/secret-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAsB5B;;GAEG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,8BAA8B;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,wDAAwD;IACxD,OAAO,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE;IAC/C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAAE,EAClB,aAAqB,gBAAgB;IAErC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;QACzB,iDAAiD;QACjD,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,UAAU,MAAM;YAChG,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,SAAS,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAC3C,aAAa,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAC/C,0EAA0E;QAC1E,+EAA+E;QAC/E,qEAAqE;QACrE,cAAc,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAChD,YAAY,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAC9C,UAAU,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,OAAO,EAAE,qBAAqB;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB,CAAC;QAExD,mDAAmD;QACnD,MAAM,cAAc,GAA+B;YACjD,WAAW;YACX,eAAe;YACf,gBAAgB;YAChB,cAAc;YACd,YAAY;SACb,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAA2B;YACzC,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE;YACjB,cAAc,EAAE,EAAE;YAClB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE;SACf,CAAC;QAEF,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAA+B,CAAW,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,MAAM,CAAC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0DAA0D;QAC1D,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAElC,0BAA0B;QAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,4DAA4D;QAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAChE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAyB,EAAE,WAAoB,KAAK;IACpF,MAAM,WAAW,GAA4C;QAC3D,CAAC,WAAW,EAAE,mBAAmB,CAAC;QAClC,CAAC,eAAe,EAAE,uBAAuB,CAAC;QAC1C,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;QAC5C,CAAC,cAAc,EAAE,sBAAsB,CAAC;QACxC,CAAC,YAAY,EAAE,oBAAoB,CAAC;KACrC,CAAC;IAEF,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB;IAC9D,MAAM,KAAK,GAAG;QACZ,iCAAiC;QACjC,gBAAgB,OAAO,CAAC,WAAW,EAAE;QACrC,cAAc,OAAO,CAAC,OAAO,EAAE;QAC/B,EAAE;QACF,qCAAqC;QACrC,qBAAqB,OAAO,CAAC,SAAS,EAAE;QACxC,EAAE;QACF,mCAAmC;QACnC,yBAAyB,OAAO,CAAC,aAAa,EAAE;QAChD,EAAE;QACF,kCAAkC;QAClC,0BAA0B,OAAO,CAAC,cAAc,EAAE;QAClD,EAAE;QACF,iCAAiC;QACjC,wBAAwB,OAAO,CAAC,YAAY,EAAE;QAC9C,EAAE;QACF,+BAA+B;QAC/B,sBAAsB,OAAO,CAAC,UAAU,EAAE;QAC1C,EAAE;KACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,IAAY,EACZ,YAAoB,EAAE;IAEtB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,IAAI,qBAAqB,SAAS,oBAAoB,MAAM,CAAC,MAAM,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,gBAAgB,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,IAAI,8BAA8B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,gBAAgB,IAAI;SACnG,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE,qBAAqB;QACjC,iCAAiC,EAAE,sBAAsB;QACzD,+BAA+B,EAAE,uBAAuB;KACzD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/common/security-mode.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Security Mode Configuration
+ *
+ * Enforces security boundaries between development and production environments.
+ * Prevents accidental deployment of insecure configurations.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Security mode levels
+ */
+export type SecurityMode = 'production' | 'staging' | 'development' | 'testing';
+/**
+ * Security mode configuration
+ */
+export interface SecurityModeConfig {
+    /** Allow insecure defaults in development */
+    allowInsecureDefaults: boolean;
+    /** Allow ephemeral signing keys */
+    allowEphemeralKeys: boolean;
+    /** Allow skipping signature verification */
+    allowSkipVerification: boolean;
+    /** Allow debug endpoints */
+    allowDebugEndpoints: boolean;
+    /** Allow verbose error messages */
+    allowVerboseErrors: boolean;
+    /** Require HTTPS */
+    requireHttps: boolean;
+    /** Require strong secrets */
+    requireStrongSecrets: boolean;
+}
+/**
+ * Get the current security mode based on environment
+ *
+ * Priority:
+ * 1. VORION_SECURITY_MODE (explicit override)
+ * 2. VORION_ENV
+ * 3. NODE_ENV
+ * 4. Default to 'production' (fail-safe)
+ */
+export declare function getSecurityMode(): SecurityMode;
+/**
+ * Get security configuration for current mode
+ */
+export declare function getSecurityConfig(): SecurityModeConfig;
+/**
+ * Check if current mode is production-grade (production or staging)
+ */
+export declare function isProductionGrade(): boolean;
+/**
+ * Check if current mode allows development features
+ */
+export declare function isDevelopmentMode(): boolean;
+/**
+ * Require production-grade security
+ *
+ * Call this before operations that should never run with reduced security.
+ *
+ * @throws Error if not in production-grade mode
+ */
+export declare function requireProductionSecurity(operation: string): void;
+/**
+ * Assert a security condition, throwing if not met in production
+ *
+ * In development, logs a warning instead of throwing.
+ */
+export declare function assertSecurityCondition(condition: boolean, message: string, context?: Record<string, unknown>): void;
+/**
+ * Check if a specific security feature is allowed in current mode
+ */
+export declare function isSecurityFeatureAllowed(feature: keyof SecurityModeConfig): boolean;
+/**
+ * Guard for insecure development defaults
+ *
+ * Use this when providing fallback values that should only work in development.
+ *
+ * @example
+ * const secret = process.env.JWT_SECRET ?? devOnlyDefault('jwt-secret', 'dev-secret');
+ */
+export declare function devOnlyDefault<T>(name: string, defaultValue: T): T;
+/**
+ * Guard for ephemeral keys
+ *
+ * Use this when generating keys that won't persist across restarts.
+ */
+export declare function allowEphemeralKey(keyType: string): void;
+/**
+ * Validate that a secret meets minimum strength requirements
+ *
+ * @returns true if valid, throws in production if invalid
+ */
+export declare function validateSecretStrength(secretName: string, secret: string, minLength?: number, minEntropy?: number): boolean;
+/**
+ * Reset cached mode (for testing only)
+ */
+export declare function resetSecurityMode(): void;
+/**
+ * Override security mode (for testing only)
+ */
+export declare function overrideSecurityMode(mode: SecurityMode): void;
+//# sourceMappingURL=security-mode.d.ts.map

package/dist/common/security-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-mode.d.ts","sourceRoot":"","sources":["../../src/common/security-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mCAAmC;IACnC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,4CAA4C;IAC5C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,4BAA4B;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mCAAmC;IACnC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,oBAAoB;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,6BAA6B;IAC7B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAkDD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,YAAY,CA4C9C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,kBAAkB,CAGtD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CASjE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAYN;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,kBAAkB,GAAG,OAAO,CAUnF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAiBlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAevD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAW,EACtB,UAAU,GAAE,MAAY,GACvB,OAAO,CAoCT;AA4DD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAMxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAO7D"}