aigroup-workflow 2.1.1 → 2.2.0

package/skills/rust-engineer/references/traits.md

@@ -1,413 +0,0 @@
-# Traits, Generics, and Type System
-
-## Basic Trait Definition
-
-```rust
-// Simple trait
-trait Drawable {
-    fn draw(&self);
-}
-
-// Trait with default implementation
-trait Describable {
-    fn describe(&self) -> String {
-        String::from("No description available")
-    }
-}
-
-// Implementing traits
-struct Circle {
-    radius: f64,
-}
-
-impl Drawable for Circle {
-    fn draw(&self) {
-        println!("Drawing circle with radius {}", self.radius);
-    }
-}
-
-impl Describable for Circle {
-    fn describe(&self) -> String {
-        format!("A circle with radius {}", self.radius)
-    }
-}
-```
-
-## Associated Types
-
-```rust
-// Associated types vs generic parameters
-trait Container {
-    type Item;
-
-    fn add(&mut self, item: Self::Item);
-    fn get(&self, index: usize) -> Option<&Self::Item>;
-}
-
-impl Container for Vec<i32> {
-    type Item = i32;
-
-    fn add(&mut self, item: i32) {
-        self.push(item);
-    }
-
-    fn get(&self, index: usize) -> Option<&i32> {
-        self.get(index)
-    }
-}
-
-// Iterator trait (standard library example)
-trait MyIterator {
-    type Item;
-
-    fn next(&mut self) -> Option<Self::Item>;
-}
-```
-
-## Generic Traits and Bounds
-
-```rust
-// Generic trait with multiple bounds
-fn print_info<T>(item: &T)
-where
-    T: std::fmt::Display + std::fmt::Debug,
-{
-    println!("Display: {}", item);
-    println!("Debug: {:?}", item);
-}
-
-// Generic struct with trait bounds
-struct Pair<T: PartialOrd> {
-    first: T,
-    second: T,
-}
-
-impl<T: PartialOrd> Pair<T> {
-    fn new(first: T, second: T) -> Self {
-        Self { first, second }
-    }
-
-    fn larger(&self) -> &T {
-        if self.first > self.second {
-            &self.first
-        } else {
-            &self.second
-        }
-    }
-}
-
-// Blanket implementation
-trait MyTrait {
-    fn do_something(&self);
-}
-
-impl<T: std::fmt::Display> MyTrait for T {
-    fn do_something(&self) {
-        println!("Value: {}", self);
-    }
-}
-```
-
-## Trait Objects (Dynamic Dispatch)
-
-```rust
-// Static dispatch (monomorphization)
-fn static_dispatch<T: Drawable>(item: &T) {
-    item.draw();
-}
-
-// Dynamic dispatch (trait objects)
-fn dynamic_dispatch(item: &dyn Drawable) {
-    item.draw();
-}
-
-// Storing trait objects
-struct Canvas {
-    shapes: Vec<Box<dyn Drawable>>,
-}
-
-impl Canvas {
-    fn new() -> Self {
-        Self { shapes: Vec::new() }
-    }
-
-    fn add_shape(&mut self, shape: Box<dyn Drawable>) {
-        self.shapes.push(shape);
-    }
-
-    fn draw_all(&self) {
-        for shape in &self.shapes {
-            shape.draw();
-        }
-    }
-}
-
-// Object safety: traits must meet criteria
-trait ObjectSafe {
-    fn method(&self);  // OK: takes &self
-}
-
-trait NotObjectSafe {
-    fn generic<T>(&self);  // NOT OK: generic method
-    fn by_value(self);     // NOT OK: takes self by value
-}
-```
-
-## Derive Macros
-
-```rust
-// Standard derive macros
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
-struct User {
-    id: u64,
-    name: String,
-}
-
-// Deriving more traits
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
-struct Point {
-    x: i32,
-    y: i32,
-}
-
-// Custom derive with serde
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Serialize, Deserialize)]
-struct Config {
-    host: String,
-    port: u16,
-}
-```
-
-## Advanced Trait Patterns
-
-```rust
-// Extension trait pattern
-trait StringExt {
-    fn truncate_to(&self, max_len: usize) -> String;
-}
-
-impl StringExt for str {
-    fn truncate_to(&self, max_len: usize) -> String {
-        if self.len() <= max_len {
-            self.to_string()
-        } else {
-            format!("{}...", &self[..max_len])
-        }
-    }
-}
-
-// Sealed trait pattern (prevent external implementation)
-mod sealed {
-    pub trait Sealed {}
-}
-
-pub trait MySealed: sealed::Sealed {
-    fn method(&self);
-}
-
-struct MyType;
-impl sealed::Sealed for MyType {}
-impl MySealed for MyType {
-    fn method(&self) {
-        println!("Implemented");
-    }
-}
-
-// Supertraits
-trait Printable {
-    fn print(&self);
-}
-
-trait Loggable: Printable {  // Supertrait: must also impl Printable
-    fn log(&self) {
-        self.print();  // Can call supertrait methods
-    }
-}
-```
-
-## Associated Constants
-
-```rust
-trait Config {
-    const MAX_SIZE: usize;
-    const DEFAULT_TIMEOUT: u64;
-}
-
-struct ServerConfig;
-
-impl Config for ServerConfig {
-    const MAX_SIZE: usize = 1024;
-    const DEFAULT_TIMEOUT: u64 = 30;
-}
-
-fn use_config<T: Config>() {
-    println!("Max size: {}", T::MAX_SIZE);
-}
-```
-
-## Generic Associated Types (GATs)
-
-```rust
-// GATs allow generics in associated types
-trait LendingIterator {
-    type Item<'a> where Self: 'a;
-
-    fn next<'a>(&'a mut self) -> Option<Self::Item<'a>>;
-}
-
-struct WindowsMut<'data, T> {
-    data: &'data mut [T],
-    index: usize,
-}
-
-impl<'data, T> LendingIterator for WindowsMut<'data, T> {
-    type Item<'a> = &'a mut [T] where Self: 'a;
-
-    fn next<'a>(&'a mut self) -> Option<Self::Item<'a>> {
-        if self.index >= self.data.len() {
-            return None;
-        }
-
-        let start = self.index;
-        self.index += 2;
-
-        Some(&mut self.data[start..start.min(self.data.len())])
-    }
-}
-```
-
-## Marker Traits
-
-```rust
-use std::marker::{PhantomData, Send, Sync};
-
-// Send: type can be transferred across thread boundaries
-// Sync: type can be shared between threads (&T is Send)
-
-// Custom marker trait
-trait Trusted {}
-
-struct TrustedData<T> {
-    data: T,
-    _marker: PhantomData<T>,
-}
-
-impl<T: Trusted> TrustedData<T> {
-    fn new(data: T) -> Self {
-        Self {
-            data,
-            _marker: PhantomData,
-        }
-    }
-}
-```
-
-## Operator Overloading
-
-```rust
-use std::ops::{Add, Mul};
-
-#[derive(Debug, Clone, Copy)]
-struct Vector2D {
-    x: f64,
-    y: f64,
-}
-
-impl Add for Vector2D {
-    type Output = Self;
-
-    fn add(self, other: Self) -> Self {
-        Self {
-            x: self.x + other.x,
-            y: self.y + other.y,
-        }
-    }
-}
-
-impl Mul<f64> for Vector2D {
-    type Output = Self;
-
-    fn mul(self, scalar: f64) -> Self {
-        Self {
-            x: self.x * scalar,
-            y: self.y * scalar,
-        }
-    }
-}
-
-// Usage
-let v1 = Vector2D { x: 1.0, y: 2.0 };
-let v2 = Vector2D { x: 3.0, y: 4.0 };
-let v3 = v1 + v2;
-let v4 = v1 * 2.5;
-```
-
-## From/Into Conversion Traits
-
-```rust
-struct UserId(u64);
-
-impl From<u64> for UserId {
-    fn from(id: u64) -> Self {
-        UserId(id)
-    }
-}
-
-// Into is automatically implemented
-fn accept_user_id(id: impl Into<UserId>) {
-    let user_id = id.into();
-    println!("User ID: {}", user_id.0);
-}
-
-// TryFrom for fallible conversions
-use std::convert::TryFrom;
-
-impl TryFrom<i64> for UserId {
-    type Error = &'static str;
-
-    fn try_from(value: i64) -> Result<Self, Self::Error> {
-        if value < 0 {
-            Err("User ID cannot be negative")
-        } else {
-            Ok(UserId(value as u64))
-        }
-    }
-}
-```
-
-## Const Traits (Nightly)
-
-```rust
-// Const trait implementations (requires nightly)
-#![feature(const_trait_impl)]
-
-#[const_trait]
-trait ConstAdd {
-    fn add(self, other: Self) -> Self;
-}
-
-impl const ConstAdd for i32 {
-    fn add(self, other: Self) -> Self {
-        self + other
-    }
-}
-
-const fn compute() -> i32 {
-    5.add(10)  // Can use in const context
-}
-```
-
-## Best Practices
-
-- Prefer associated types when there's one clear type per implementation
-- Use generic parameters when multiple types might be used simultaneously
-- Keep traits small and focused (single responsibility)
-- Use extension traits to add functionality to existing types
-- Document trait requirements and invariants
-- Use marker traits for compile-time guarantees
-- Prefer static dispatch for performance, dynamic dispatch for flexibility
-- Use #[derive] when possible instead of manual implementations
-- Implement standard traits (Debug, Clone, etc.) for better ecosystem integration
-- Use sealed traits to prevent external implementations when needed

package/skills/secure-code-guardian/SKILL.md

@@ -1,191 +0,0 @@
----
-name: secure-code-guardian
-description: Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
-license: MIT
-metadata:
-  author: https://github.com/Jeffallan
-  version: "1.1.0"
-  domain: security
-  triggers: security, authentication, authorization, encryption, OWASP, vulnerability, secure coding, password, JWT, OAuth
-  role: specialist
-  scope: implementation
-  output-format: code
-  related-skills: fullstack-guardian, security-reviewer, architecture-designer
----
-
-# Secure Code Guardian
-
-## Core Workflow
-
-1. **Threat model** — Identify attack surface and threats
-2. **Design** — Plan security controls
-3. **Implement** — Write secure code with defense in depth; see code examples below
-4. **Validate** — Test security controls with explicit checkpoints (see below)
-5. **Document** — Record security decisions
-
-### Validation Checkpoints
-
-After each implementation step, verify:
-
-- **Authentication**: Test brute-force protection (lockout/rate limit triggers), session fixation resistance, token expiration, and invalid-credential error messages (must not leak user existence).
-- **Authorization**: Verify horizontal and vertical privilege escalation paths are blocked; test with tokens belonging to different roles/users.
-- **Input handling**: Confirm SQL injection payloads (`' OR 1=1--`) are rejected; confirm XSS payloads (`<script>alert(1)</script>`) are escaped or rejected.
-- **Headers/CORS**: Validate with a security scanner (e.g., `curl -I`, Mozilla Observatory) that security headers are present and CORS origin allowlist is correct.
-
-## Reference Guide
-
-Load detailed guidance based on context:
-
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| OWASP | `references/owasp-prevention.md` | OWASP Top 10 patterns |
-| Authentication | `references/authentication.md` | Password hashing, JWT |
-| Input Validation | `references/input-validation.md` | Zod, SQL injection |
-| XSS/CSRF | `references/xss-csrf.md` | XSS prevention, CSRF |
-| Headers | `references/security-headers.md` | Helmet, rate limiting |
-
-## Constraints
-
-### MUST DO
-- Hash passwords with bcrypt/argon2 (never MD5/SHA-1/unsalted hashes)
-- Use parameterized queries (never string-interpolated SQL)
-- Validate and sanitize all user input before use
-- Implement rate limiting on auth endpoints
-- Set security headers (CSP, HSTS, X-Frame-Options)
-- Log security events (failed auth, privilege escalation attempts)
-- Store secrets in environment variables or secret managers (never in source code)
-
-### MUST NOT DO
-- Store passwords in plaintext or reversibly encrypted form
-- Trust user input without validation
-- Expose sensitive data in logs or error responses
-- Use weak or deprecated algorithms (MD5, SHA-1, DES, ECB mode)
-- Hardcode secrets or credentials in code
-
-## Code Examples
-
-### Password Hashing (bcrypt)
-
-```typescript
-import bcrypt from 'bcrypt';
-
-const SALT_ROUNDS = 12; // minimum 10; 12 balances security and performance
-
-export async function hashPassword(plaintext: string): Promise<string> {
-  return bcrypt.hash(plaintext, SALT_ROUNDS);
-}
-
-export async function verifyPassword(plaintext: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(plaintext, hash);
-}
-```
-
-### Parameterized SQL Query (Node.js / pg)
-
-```typescript
-// NEVER: `SELECT * FROM users WHERE email = '${email}'`
-// ALWAYS: use positional parameters
-import { Pool } from 'pg';
-const pool = new Pool();
-
-export async function getUserByEmail(email: string) {
-  const { rows } = await pool.query(
-    'SELECT id, email, role FROM users WHERE email = $1',
-    [email]  // value passed separately — never interpolated
-  );
-  return rows[0] ?? null;
-}
-```
-
-### Input Validation with Zod
-
-```typescript
-import { z } from 'zod';
-
-const LoginSchema = z.object({
-  email: z.string().email().max(254),
-  password: z.string().min(8).max(128),
-});
-
-export function validateLoginInput(raw: unknown) {
-  const result = LoginSchema.safeParse(raw);
-  if (!result.success) {
-    // Return generic error — never echo raw input back
-    throw new Error('Invalid credentials format');
-  }
-  return result.data;
-}
-```
-
-### JWT Validation
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-const JWT_SECRET = process.env.JWT_SECRET!; // never hardcode
-
-export function verifyToken(token: string): jwt.JwtPayload {
-  // Throws if expired, tampered, or wrong algorithm
-  const payload = jwt.verify(token, JWT_SECRET, {
-    algorithms: ['HS256'],   // explicitly allowlist algorithm
-    issuer: 'your-app',
-    audience: 'your-app',
-  });
-  if (typeof payload === 'string') throw new Error('Invalid token payload');
-  return payload;
-}
-```
-
-### Securing an Endpoint — Full Flow
-
-```typescript
-import express from 'express';
-import rateLimit from 'express-rate-limit';
-import helmet from 'helmet';
-
-const app = express();
-app.use(helmet()); // sets CSP, HSTS, X-Frame-Options, etc.
-app.use(express.json({ limit: '10kb' })); // limit payload size
-
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 10,                   // 10 attempts per window per IP
-  standardHeaders: true,
-  legacyHeaders: false,
-});
-
-app.post('/api/login', authLimiter, async (req, res) => {
-  // 1. Validate input
-  const { email, password } = validateLoginInput(req.body);
-
-  // 2. Authenticate — parameterized query, constant-time compare
-  const user = await getUserByEmail(email);
-  if (!user || !(await verifyPassword(password, user.passwordHash))) {
-    // Generic message — do not reveal whether email exists
-    return res.status(401).json({ error: 'Invalid credentials' });
-  }
-
-  // 3. Authorize — issue scoped, short-lived token
-  const token = jwt.sign(
-    { sub: user.id, role: user.role },
-    JWT_SECRET,
-    { algorithm: 'HS256', expiresIn: '15m', issuer: 'your-app', audience: 'your-app' }
-  );
-
-  // 4. Secure response — token in httpOnly cookie, not body
-  res.cookie('token', token, { httpOnly: true, secure: true, sameSite: 'strict' });
-  return res.json({ message: 'Authenticated' });
-});
-```
-
-## Output Templates
-
-When implementing security features, provide:
-1. Secure implementation code
-2. Security considerations noted
-3. Configuration requirements (env vars, headers)
-4. Testing recommendations
-
-## Knowledge Reference
-
-OWASP Top 10, bcrypt/argon2, JWT, OAuth 2.0, OIDC, CSP, CORS, rate limiting, input validation, output encoding, encryption (AES, RSA), TLS, security headers