aigroup-workflow 2.1.1 → 2.2.0

package/skills/secure-code-guardian/references/authentication.md

@@ -1,136 +0,0 @@
-# Authentication
-
-## Password Hashing
-
-```typescript
-import bcrypt from 'bcrypt';
-
-const SALT_ROUNDS = 12;
-
-async function hashPassword(password: string): Promise<string> {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-async function verifyPassword(password: string, hash: string): Promise<boolean> {
-  return bcrypt.compare(password, hash);
-}
-
-// Password requirements
-const PASSWORD_REGEX = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{12,}$/;
-
-function validatePassword(password: string): { valid: boolean; errors: string[] } {
-  const errors: string[] = [];
-
-  if (password.length < 12) errors.push('Minimum 12 characters');
-  if (!/[a-z]/.test(password)) errors.push('Requires lowercase');
-  if (!/[A-Z]/.test(password)) errors.push('Requires uppercase');
-  if (!/\d/.test(password)) errors.push('Requires digit');
-  if (!/[@$!%*?&]/.test(password)) errors.push('Requires special character');
-
-  return { valid: errors.length === 0, errors };
-}
-```
-
-## JWT Implementation
-
-```typescript
-import jwt from 'jsonwebtoken';
-
-const JWT_SECRET = process.env.JWT_SECRET!;
-const ACCESS_TOKEN_EXPIRY = '15m';
-const REFRESH_TOKEN_EXPIRY = '7d';
-
-interface TokenPayload {
-  sub: string;
-  type: 'access' | 'refresh';
-}
-
-function generateAccessToken(userId: string): string {
-  return jwt.sign(
-    { sub: userId, type: 'access' },
-    JWT_SECRET,
-    { expiresIn: ACCESS_TOKEN_EXPIRY }
-  );
-}
-
-function generateRefreshToken(userId: string): string {
-  return jwt.sign(
-    { sub: userId, type: 'refresh' },
-    JWT_SECRET,
-    { expiresIn: REFRESH_TOKEN_EXPIRY }
-  );
-}
-
-function verifyToken(token: string): TokenPayload {
-  return jwt.verify(token, JWT_SECRET) as TokenPayload;
-}
-```
-
-## Auth Middleware
-
-```typescript
-function authMiddleware(req: Request, res: Response, next: NextFunction) {
-  const header = req.headers.authorization;
-
-  if (!header?.startsWith('Bearer ')) {
-    return res.status(401).json({ error: 'Missing token' });
-  }
-
-  try {
-    const token = header.slice(7);
-    const payload = verifyToken(token);
-
-    if (payload.type !== 'access') {
-      return res.status(401).json({ error: 'Invalid token type' });
-    }
-
-    req.userId = payload.sub;
-    next();
-  } catch (error) {
-    if (error instanceof jwt.TokenExpiredError) {
-      return res.status(401).json({ error: 'Token expired' });
-    }
-    return res.status(401).json({ error: 'Invalid token' });
-  }
-}
-```
-
-## Account Lockout
-
-```typescript
-const MAX_ATTEMPTS = 5;
-const LOCKOUT_DURATION = 15 * 60 * 1000; // 15 minutes
-
-async function handleLoginAttempt(email: string, success: boolean) {
-  const key = `login:attempts:${email}`;
-
-  if (success) {
-    await redis.del(key);
-    return;
-  }
-
-  const attempts = await redis.incr(key);
-  await redis.expire(key, LOCKOUT_DURATION / 1000);
-
-  if (attempts >= MAX_ATTEMPTS) {
-    await redis.set(`login:locked:${email}`, '1', 'PX', LOCKOUT_DURATION);
-    throw new Error('Account locked. Try again later.');
-  }
-}
-```
-
-## Quick Reference
-
-| Practice | Implementation |
-|----------|----------------|
-| Password hash | bcrypt (12+ rounds) |
-| Token expiry | Access: 15m, Refresh: 7d |
-| Lockout | 5 attempts, 15min lockout |
-| MFA | TOTP (authenticator apps) |
-
-| JWT Claim | Purpose |
-|-----------|---------|
-| `sub` | User ID |
-| `exp` | Expiration |
-| `iat` | Issued at |
-| `type` | access/refresh |

package/skills/secure-code-guardian/references/input-validation.md

@@ -1,146 +0,0 @@
-# Input Validation
-
-## Zod Validation
-
-```typescript
-import { z } from 'zod';
-
-const UserSchema = z.object({
-  email: z.string().email().max(255),
-  name: z.string().min(1).max(100).regex(/^[\w\s-]+$/),
-  age: z.number().int().min(0).max(150).optional(),
-  role: z.enum(['user', 'admin']).default('user'),
-});
-
-function validateUser(data: unknown) {
-  return UserSchema.parse(data); // Throws on invalid
-}
-
-// Safe parse (no throw)
-const result = UserSchema.safeParse(data);
-if (!result.success) {
-  console.error(result.error.issues);
-}
-```
-
-## SQL Injection Prevention
-
-```typescript
-// ❌ NEVER do this
-const bad = `SELECT * FROM users WHERE id = ${userId}`;
-const bad2 = `SELECT * FROM users WHERE name = '${name}'`;
-
-// ✅ Parameterized queries
-const good = await db.query(
-  'SELECT * FROM users WHERE id = $1 AND name = $2',
-  [userId, name]
-);
-
-// ✅ Use ORM
-const user = await prisma.user.findFirst({
-  where: { id: userId, name: name }
-});
-
-// ✅ Query builder
-const user = await knex('users')
-  .where({ id: userId, name: name })
-  .first();
-```
-
-## Path Traversal Prevention
-
-```typescript
-import path from 'path';
-
-// ❌ Vulnerable
-const vulnerable = path.join('/uploads', userInput);
-
-// ✅ Safe - validate and sanitize
-function getSecurePath(baseDir: string, userInput: string): string {
-  // Remove any path traversal attempts
-  const sanitized = path.basename(userInput);
-
-  // Resolve and verify it's within base directory
-  const fullPath = path.resolve(baseDir, sanitized);
-
-  if (!fullPath.startsWith(path.resolve(baseDir))) {
-    throw new Error('Invalid path');
-  }
-
-  return fullPath;
-}
-```
-
-## Command Injection Prevention
-
-```typescript
-import { execFile } from 'child_process';
-
-// ❌ Never use exec with user input
-exec(`convert ${userInput}`); // Vulnerable!
-
-// ✅ Use execFile with arguments array
-execFile('convert', ['-resize', '100x100', safeFilename], (error, stdout) => {
-  // ...
-});
-
-// ✅ Better: Use library functions instead of shell
-import sharp from 'sharp';
-await sharp(inputPath).resize(100, 100).toFile(outputPath);
-```
-
-## URL Validation
-
-```typescript
-function validateUrl(input: string, allowedHosts: string[]): URL {
-  const url = new URL(input);
-
-  // Check protocol
-  if (!['http:', 'https:'].includes(url.protocol)) {
-    throw new Error('Invalid protocol');
-  }
-
-  // Check host allowlist
-  if (!allowedHosts.includes(url.hostname)) {
-    throw new Error('Host not allowed');
-  }
-
-  return url;
-}
-```
-
-## File Upload Validation
-
-```typescript
-const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/gif'];
-const MAX_SIZE = 5 * 1024 * 1024; // 5MB
-
-function validateUpload(file: Express.Multer.File) {
-  if (!ALLOWED_TYPES.includes(file.mimetype)) {
-    throw new Error('Invalid file type');
-  }
-
-  if (file.size > MAX_SIZE) {
-    throw new Error('File too large');
-  }
-
-  // Verify magic bytes (not just extension)
-  const buffer = fs.readFileSync(file.path);
-  const type = fileType.fromBuffer(buffer);
-
-  if (!type || !ALLOWED_TYPES.includes(type.mime)) {
-    throw new Error('Invalid file content');
-  }
-}
-```
-
-## Quick Reference
-
-| Input Type | Validation |
-|------------|------------|
-| Email | Regex + max length |
-| URL | Protocol + host allowlist |
-| File path | basename + resolve check |
-| SQL | Parameterized queries |
-| Command | execFile + no shell |
-| File upload | Type + size + magic bytes |

package/skills/secure-code-guardian/references/owasp-prevention.md

@@ -1,135 +0,0 @@
-# OWASP Top 10 Prevention
-
-## OWASP Top 10 Quick Reference
-
-| # | Vulnerability | Prevention |
-|---|---------------|------------|
-| 1 | Injection | Parameterized queries, ORMs |
-| 2 | Broken Auth | Strong passwords, MFA, secure sessions |
-| 3 | Sensitive Data | Encryption at rest/transit |
-| 4 | XXE | Disable DTDs, use JSON |
-| 5 | Broken Access | Deny by default, server-side validation |
-| 6 | Misconfig | Security headers, disable defaults |
-| 7 | XSS | Output encoding, CSP |
-| 8 | Insecure Deserialization | Schema validation, allowlists |
-| 9 | Known Vulnerabilities | Dependency scanning |
-| 10 | Insufficient Logging | Log security events |
-
-## A01: Injection Prevention
-
-```typescript
-// SQL Injection - Use parameterized queries
-// ❌ Bad
-const bad = `SELECT * FROM users WHERE id = ${userId}`;
-
-// ✅ Good
-const good = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
-
-// ✅ Good - Use ORM
-const user = await prisma.user.findUnique({ where: { id: userId } });
-
-// Command Injection - Avoid shell execution
-// ❌ Bad
-exec(`ls ${userInput}`);
-
-// ✅ Good - Use library functions
-const files = fs.readdirSync(safeDirectory);
-```
-
-## A02: Broken Authentication
-
-```typescript
-// Use bcrypt for passwords
-const hash = await bcrypt.hash(password, 12);
-const isValid = await bcrypt.compare(password, hash);
-
-// Implement account lockout
-if (failedAttempts >= 5) {
-  await lockAccount(userId, 15 * 60 * 1000); // 15 min
-}
-
-// Use secure session configuration
-app.use(session({
-  secret: process.env.SESSION_SECRET,
-  cookie: {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'strict',
-    maxAge: 15 * 60 * 1000, // 15 minutes
-  },
-}));
-```
-
-## A03: Sensitive Data Exposure
-
-```typescript
-// Encrypt sensitive data at rest
-import crypto from 'crypto';
-
-function encrypt(text: string, key: Buffer): string {
-  const iv = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
-  // ... encryption logic
-}
-
-// Use HTTPS only
-app.use((req, res, next) => {
-  if (!req.secure) {
-    return res.redirect(`https://${req.hostname}${req.url}`);
-  }
-  next();
-});
-```
-
-## A05: Broken Access Control
-
-```typescript
-// Always validate on server side
-async function getResource(userId: string, resourceId: string) {
-  const resource = await db.resource.findUnique({ where: { id: resourceId } });
-
-  // Verify ownership
-  if (resource.ownerId !== userId) {
-    throw new ForbiddenError('Access denied');
-  }
-
-  return resource;
-}
-
-// Use role-based access
-function requireRole(...roles: string[]) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    if (!roles.includes(req.user.role)) {
-      return res.status(403).json({ error: 'Forbidden' });
-    }
-    next();
-  };
-}
-```
-
-## A07: XSS Prevention
-
-```typescript
-// Use Content Security Policy
-app.use(helmet.contentSecurityPolicy({
-  directives: {
-    defaultSrc: ["'self'"],
-    scriptSrc: ["'self'"],
-    styleSrc: ["'self'", "'unsafe-inline'"],
-  },
-}));
-
-// Sanitize user input for HTML
-import DOMPurify from 'dompurify';
-const clean = DOMPurify.sanitize(userInput);
-```
-
-## Quick Reference
-
-| Attack | Defense |
-|--------|---------|
-| SQL Injection | Parameterized queries |
-| XSS | Output encoding, CSP |
-| CSRF | CSRF tokens |
-| IDOR | Authorization checks |
-| Command Injection | Avoid exec(), validate input |

package/skills/secure-code-guardian/references/security-headers.md

@@ -1,133 +0,0 @@
-# Security Headers
-
-## Helmet (Express)
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet()); // Enable all defaults
-
-// Or configure individually
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'"],
-    },
-  },
-  hsts: {
-    maxAge: 31536000,
-    includeSubDomains: true,
-    preload: true,
-  },
-}));
-```
-
-## Manual Headers
-
-```typescript
-app.use((req, res, next) => {
-  // Prevent clickjacking
-  res.setHeader('X-Frame-Options', 'DENY');
-
-  // Prevent MIME sniffing
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-
-  // HSTS (HTTPS only)
-  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-
-  // Referrer policy
-  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-
-  // Permissions policy
-  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
-
-  next();
-});
-```
-
-## Rate Limiting
-
-```typescript
-import rateLimit from 'express-rate-limit';
-
-// General API rate limit
-const apiLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100,
-  message: { error: 'Too many requests' },
-  standardHeaders: true,
-  legacyHeaders: false,
-});
-
-app.use('/api/', apiLimiter);
-
-// Strict limit for auth endpoints
-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5,
-  message: { error: 'Too many login attempts' },
-  skipSuccessfulRequests: true,
-});
-
-app.post('/api/login', authLimiter, loginHandler);
-app.post('/api/register', authLimiter, registerHandler);
-```
-
-## CORS Configuration
-
-```typescript
-import cors from 'cors';
-
-// Strict CORS
-app.use(cors({
-  origin: ['https://example.com', 'https://app.example.com'],
-  methods: ['GET', 'POST', 'PUT', 'DELETE'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-  credentials: true,
-  maxAge: 86400, // Cache preflight for 24 hours
-}));
-
-// Dynamic origin validation
-app.use(cors({
-  origin: (origin, callback) => {
-    const allowedOrigins = ['https://example.com'];
-    if (!origin || allowedOrigins.includes(origin)) {
-      callback(null, true);
-    } else {
-      callback(new Error('Not allowed by CORS'));
-    }
-  },
-}));
-```
-
-## Cookie Security
-
-```typescript
-res.cookie('session', token, {
-  httpOnly: true,      // No JavaScript access
-  secure: true,        // HTTPS only
-  sameSite: 'strict',  // CSRF protection
-  maxAge: 900000,      // 15 minutes
-  path: '/',
-  domain: '.example.com',
-});
-```
-
-## Quick Reference
-
-| Header | Value | Purpose |
-|--------|-------|---------|
-| X-Frame-Options | DENY | Clickjacking |
-| X-Content-Type-Options | nosniff | MIME sniffing |
-| Strict-Transport-Security | max-age=31536000 | Force HTTPS |
-| Content-Security-Policy | default-src 'self' | XSS |
-| Referrer-Policy | strict-origin-when-cross-origin | Privacy |
-
-| Cookie Flag | Purpose |
-|-------------|---------|
-| httpOnly | No JS access |
-| secure | HTTPS only |
-| sameSite=strict | CSRF protection |
-| maxAge | Expiration |

package/skills/secure-code-guardian/references/xss-csrf.md

@@ -1,157 +0,0 @@
-# XSS & CSRF Prevention
-
-## XSS Prevention
-
-### Output Encoding
-
-```typescript
-// React automatically escapes by default
-function SafeComponent({ userInput }: { userInput: string }) {
-  return <div>{userInput}</div>; // Safe - auto-escaped
-}
-
-// If you must render HTML, sanitize first
-import DOMPurify from 'dompurify';
-
-function HtmlContent({ html }: { html: string }) {
-  return (
-    <div
-      dangerouslySetInnerHTML={{
-        __html: DOMPurify.sanitize(html)
-      }}
-    />
-  );
-}
-```
-
-### Content Security Policy
-
-```typescript
-import helmet from 'helmet';
-
-app.use(helmet.contentSecurityPolicy({
-  directives: {
-    defaultSrc: ["'self'"],
-    scriptSrc: ["'self'"],
-    styleSrc: ["'self'", "'unsafe-inline'"],
-    imgSrc: ["'self'", "data:", "https:"],
-    connectSrc: ["'self'", "https://api.example.com"],
-    fontSrc: ["'self'"],
-    objectSrc: ["'none'"],
-    frameSrc: ["'none'"],
-    upgradeInsecureRequests: [],
-  },
-}));
-```
-
-### Input Sanitization
-
-```typescript
-import DOMPurify from 'dompurify';
-
-// Sanitize HTML
-const clean = DOMPurify.sanitize(dirty);
-
-// Sanitize with config
-const cleanStrict = DOMPurify.sanitize(dirty, {
-  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
-  ALLOWED_ATTR: ['href'],
-});
-
-// Strip all HTML
-const textOnly = DOMPurify.sanitize(dirty, { ALLOWED_TAGS: [] });
-```
-
-## CSRF Prevention
-
-### Synchronizer Token Pattern
-
-```typescript
-import csrf from 'csurf';
-
-const csrfProtection = csrf({ cookie: true });
-
-// Add to forms
-app.get('/form', csrfProtection, (req, res) => {
-  res.render('form', { csrfToken: req.csrfToken() });
-});
-
-// Validate on submission
-app.post('/submit', csrfProtection, (req, res) => {
-  // Token validated automatically
-});
-```
-
-### Double Submit Cookie
-
-```typescript
-// Set CSRF cookie
-res.cookie('csrf', token, {
-  httpOnly: false, // Must be readable by JS
-  secure: true,
-  sameSite: 'strict',
-});
-
-// Client sends in header
-fetch('/api/action', {
-  method: 'POST',
-  headers: {
-    'X-CSRF-Token': getCookie('csrf'),
-  },
-});
-
-// Server validates
-if (req.cookies.csrf !== req.headers['x-csrf-token']) {
-  return res.status(403).json({ error: 'CSRF validation failed' });
-}
-```
-
-### SameSite Cookies
-
-```typescript
-// Modern CSRF protection
-app.use(session({
-  cookie: {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'strict', // Or 'lax' for GET requests
-  },
-}));
-```
-
-## HTTP Headers
-
-```typescript
-// Security headers
-app.use((req, res, next) => {
-  // Prevent clickjacking
-  res.setHeader('X-Frame-Options', 'DENY');
-
-  // Prevent MIME sniffing
-  res.setHeader('X-Content-Type-Options', 'nosniff');
-
-  // XSS filter (legacy)
-  res.setHeader('X-XSS-Protection', '1; mode=block');
-
-  // Referrer policy
-  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-
-  next();
-});
-```
-
-## Quick Reference
-
-| Attack | Prevention |
-|--------|------------|
-| Reflected XSS | Output encoding |
-| Stored XSS | Input sanitization + encoding |
-| DOM XSS | Avoid innerHTML, use textContent |
-| CSRF | Tokens + SameSite cookies |
-
-| Header | Purpose |
-|--------|---------|
-| CSP | Script/resource restrictions |
-| X-Frame-Options | Clickjacking |
-| X-Content-Type-Options | MIME sniffing |
-| SameSite | CSRF protection |