aiwf 0.3.0 → 0.3.2

package/claude-code/aiwf/ko/personas/security/knowledge_base.md

@@ -0,0 +1,498 @@
+# Security 페르소나 Knowledge Base
+
+## 보안 위협 백과사전
+
+### 웹 애플리케이션 공격
+
+#### 1. SQL Injection
+```sql
+-- 취약한 코드
+SELECT * FROM users WHERE username = '$username' AND password = '$password';
+
+-- 공격 예시
+username: admin' OR '1'='1' --
+password: anything
+
+-- 방어 코드 (파라미터화된 쿼리)
+const query = 'SELECT * FROM users WHERE username = ? AND password = ?';
+db.query(query, [username, password]);
+```
+
+#### 2. Cross-Site Scripting (XSS)
+```javascript
+// 저장형 XSS 방어
+function sanitizeUserInput(input) {
+  // DOMPurify 라이브러리 사용
+  return DOMPurify.sanitize(input, {
+    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
+    ALLOWED_ATTR: ['href']
+  });
+}
+
+// 반사형 XSS 방어
+function renderUserContent(content) {
+  const div = document.createElement('div');
+  div.textContent = content; // innerHTML 대신 textContent 사용
+  return div;
+}
+
+// CSP 헤더 설정
+Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}';
+```
+
+#### 3. Cross-Site Request Forgery (CSRF)
+```javascript
+// CSRF 토큰 생성
+class CSRFProtection {
+  generateToken(sessionId) {
+    const token = crypto.randomBytes(32).toString('hex');
+    this.storeToken(sessionId, token);
+    return token;
+  }
+  
+  validateToken(sessionId, token) {
+    const storedToken = this.getToken(sessionId);
+    if (!storedToken || storedToken !== token) {
+      throw new SecurityError('Invalid CSRF token');
+    }
+    // 토큰 재생성 (일회용)
+    return this.generateToken(sessionId);
+  }
+}
+
+// Double Submit Cookie Pattern
+app.use((req, res, next) => {
+  const token = req.cookies.csrfToken || crypto.randomBytes(32).toString('hex');
+  res.cookie('csrfToken', token, { httpOnly: false, sameSite: 'strict' });
+  req.csrfToken = token;
+  next();
+});
+```
+
+### 인증 및 권한 관리
+
+#### OAuth 2.0 구현
+```javascript
+class OAuth2Provider {
+  // Authorization Code Flow
+  async authorize(clientId, redirectUri, scope) {
+    // 1. 사용자 인증
+    const user = await this.authenticateUser();
+    
+    // 2. 클라이언트 검증
+    const client = await this.validateClient(clientId, redirectUri);
+    
+    // 3. 권한 부여 코드 생성
+    const code = crypto.randomBytes(32).toString('hex');
+    await this.storeAuthCode(code, {
+      clientId,
+      userId: user.id,
+      scope,
+      expiresAt: Date.now() + 600000 // 10분
+    });
+    
+    return code;
+  }
+  
+  // Token Exchange
+  async exchangeToken(code, clientId, clientSecret) {
+    const authCode = await this.getAuthCode(code);
+    
+    // 검증
+    if (!authCode || authCode.clientId !== clientId) {
+      throw new Error('Invalid authorization code');
+    }
+    
+    if (Date.now() > authCode.expiresAt) {
+      throw new Error('Authorization code expired');
+    }
+    
+    // 토큰 생성
+    const accessToken = this.generateJWT(authCode.userId, authCode.scope);
+    const refreshToken = crypto.randomBytes(32).toString('hex');
+    
+    await this.storeRefreshToken(refreshToken, authCode.userId);
+    await this.revokeAuthCode(code);
+    
+    return { accessToken, refreshToken };
+  }
+}
+```
+
+#### JWT 보안
+```javascript
+class SecureJWT {
+  constructor() {
+    this.algorithm = 'RS256'; // 비대칭 키 사용
+    this.issuer = 'secure-app';
+    this.audience = 'api.secure-app.com';
+  }
+  
+  generateToken(payload) {
+    const token = jwt.sign(payload, this.privateKey, {
+      algorithm: this.algorithm,
+      expiresIn: '15m', // 짧은 만료 시간
+      issuer: this.issuer,
+      audience: this.audience,
+      jwtid: uuidv4() // 토큰 ID로 재사용 방지
+    });
+    
+    return token;
+  }
+  
+  verifyToken(token) {
+    try {
+      const decoded = jwt.verify(token, this.publicKey, {
+        algorithms: [this.algorithm],
+        issuer: this.issuer,
+        audience: this.audience
+      });
+      
+      // 토큰 블랙리스트 확인
+      if (this.isBlacklisted(decoded.jti)) {
+        throw new Error('Token revoked');
+      }
+      
+      return decoded;
+    } catch (error) {
+      throw new SecurityError('Invalid token: ' + error.message);
+    }
+  }
+}
+```
+
+### 암호화 알고리즘
+
+#### 대칭키 암호화 (AES)
+```javascript
+class AESEncryption {
+  constructor(key) {
+    this.algorithm = 'aes-256-gcm';
+    this.key = Buffer.from(key, 'hex');
+  }
+  
+  encrypt(plaintext) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv(this.algorithm, this.key, iv);
+    
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    
+    const authTag = cipher.getAuthTag();
+    
+    return {
+      encrypted,
+      iv: iv.toString('hex'),
+      authTag: authTag.toString('hex')
+    };
+  }
+  
+  decrypt(encryptedData) {
+    const decipher = crypto.createDecipheriv(
+      this.algorithm,
+      this.key,
+      Buffer.from(encryptedData.iv, 'hex')
+    );
+    
+    decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'hex'));
+    
+    let decrypted = decipher.update(encryptedData.encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    
+    return decrypted;
+  }
+}
+```
+
+#### 비대칭키 암호화 (RSA)
+```javascript
+class RSAEncryption {
+  generateKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 4096,
+      publicKeyEncoding: {
+        type: 'spki',
+        format: 'pem'
+      },
+      privateKeyEncoding: {
+        type: 'pkcs8',
+        format: 'pem',
+        cipher: 'aes-256-cbc',
+        passphrase: process.env.KEY_PASSPHRASE
+      }
+    });
+    
+    return { publicKey, privateKey };
+  }
+  
+  encrypt(data, publicKey) {
+    const buffer = Buffer.from(data, 'utf8');
+    const encrypted = crypto.publicEncrypt(
+      {
+        key: publicKey,
+        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256'
+      },
+      buffer
+    );
+    
+    return encrypted.toString('base64');
+  }
+  
+  decrypt(encryptedData, privateKey) {
+    const buffer = Buffer.from(encryptedData, 'base64');
+    const decrypted = crypto.privateDecrypt(
+      {
+        key: privateKey,
+        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256',
+        passphrase: process.env.KEY_PASSPHRASE
+      },
+      buffer
+    );
+    
+    return decrypted.toString('utf8');
+  }
+}
+```
+
+### 네트워크 보안
+
+#### TLS/SSL 설정
+```javascript
+// HTTPS 서버 설정
+const https = require('https');
+const tls = require('tls');
+
+const options = {
+  key: fs.readFileSync('private-key.pem'),
+  cert: fs.readFileSync('certificate.pem'),
+  
+  // 보안 강화 설정
+  secureOptions: tls.constants.SSL_OP_NO_TLSv1 | 
+                 tls.constants.SSL_OP_NO_TLSv1_1,
+  ciphers: [
+    'ECDHE-RSA-AES128-GCM-SHA256',
+    'ECDHE-RSA-AES256-GCM-SHA384',
+    'ECDHE-RSA-AES128-SHA256',
+    'ECDHE-RSA-AES256-SHA384'
+  ].join(':'),
+  honorCipherOrder: true,
+  
+  // HSTS
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }
+};
+
+https.createServer(options, app).listen(443);
+```
+
+#### 방화벽 규칙
+```bash
+# iptables 기본 정책
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT
+
+# 필요한 포트만 열기
+iptables -A INPUT -p tcp --dport 443 -j ACCEPT  # HTTPS
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # SSH (IP 제한 권장)
+
+# DDoS 방어
+iptables -A INPUT -p tcp --syn -m limit --limit 25/s --limit-burst 50 -j ACCEPT
+```
+
+### 보안 모니터링
+
+#### 이상 탐지 시스템
+```javascript
+class AnomalyDetector {
+  constructor() {
+    this.baseline = new Map();
+    this.threshold = 2.5; // 표준편차 배수
+  }
+  
+  // 사용자 행동 분석
+  analyzeUserBehavior(userId, action) {
+    const userBaseline = this.baseline.get(userId) || {
+      loginTimes: [],
+      ipAddresses: new Set(),
+      requestRate: []
+    };
+    
+    // 로그인 시간 이상 탐지
+    if (action.type === 'login') {
+      const hour = new Date(action.timestamp).getHours();
+      const avgHour = average(userBaseline.loginTimes);
+      const stdDev = standardDeviation(userBaseline.loginTimes);
+      
+      if (Math.abs(hour - avgHour) > stdDev * this.threshold) {
+        this.alertSuspiciousLogin(userId, action);
+      }
+    }
+    
+    // IP 주소 변경 탐지
+    if (!userBaseline.ipAddresses.has(action.ipAddress)) {
+      this.alertNewLocation(userId, action);
+    }
+    
+    // 요청 빈도 이상 탐지
+    const requestsPerMinute = this.calculateRequestRate(userId);
+    if (requestsPerMinute > userBaseline.avgRate * this.threshold) {
+      this.alertHighRequestRate(userId, requestsPerMinute);
+    }
+  }
+}
+```
+
+#### 보안 이벤트 상관 분석
+```javascript
+class SecurityEventCorrelator {
+  correlateEvents(events) {
+    const patterns = {
+      bruteForce: this.detectBruteForce(events),
+      privilegeEscalation: this.detectPrivilegeEscalation(events),
+      dataExfiltration: this.detectDataExfiltration(events),
+      lateralMovement: this.detectLateralMovement(events)
+    };
+    
+    return patterns;
+  }
+  
+  detectBruteForce(events) {
+    const failedLogins = events.filter(e => 
+      e.type === 'login_failed' && 
+      e.timestamp > Date.now() - 300000 // 5분
+    );
+    
+    const attempts = {};
+    failedLogins.forEach(event => {
+      const key = `${event.username}:${event.ipAddress}`;
+      attempts[key] = (attempts[key] || 0) + 1;
+    });
+    
+    return Object.entries(attempts)
+      .filter(([_, count]) => count > 5)
+      .map(([key, count]) => ({
+        type: 'brute_force',
+        target: key.split(':')[0],
+        source: key.split(':')[1],
+        attempts: count
+      }));
+  }
+}
+```
+
+### 컴플라이언스 구현
+
+#### GDPR 데이터 처리
+```javascript
+class GDPRCompliance {
+  // 동의 관리
+  async recordConsent(userId, purposes) {
+    const consent = {
+      userId,
+      purposes,
+      timestamp: new Date().toISOString(),
+      ipAddress: getClientIP(),
+      version: 'v1.2'
+    };
+    
+    await this.store.saveConsent(consent);
+    return consent;
+  }
+  
+  // 데이터 이동권
+  async exportUserData(userId) {
+    const data = {
+      profile: await this.getUserProfile(userId),
+      activities: await this.getUserActivities(userId),
+      preferences: await this.getUserPreferences(userId),
+      consents: await this.getUserConsents(userId)
+    };
+    
+    // 민감한 정보 마스킹
+    data.profile = this.maskSensitiveData(data.profile);
+    
+    return {
+      exportDate: new Date().toISOString(),
+      format: 'json',
+      data: data
+    };
+  }
+  
+  // 삭제권 (잊혀질 권리)
+  async deleteUserData(userId) {
+    // 감사 로그 생성
+    await this.auditLog.record({
+      action: 'user_data_deletion',
+      userId,
+      timestamp: new Date().toISOString(),
+      reason: 'GDPR Article 17 Request'
+    });
+    
+    // 데이터 삭제 (보존 의무가 있는 데이터 제외)
+    await Promise.all([
+      this.deleteProfile(userId),
+      this.deleteActivities(userId),
+      this.deletePreferences(userId),
+      this.anonymizeTransactions(userId)
+    ]);
+  }
+}
+```
+
+### 보안 테스트 자동화
+
+#### 취약점 스캐닝 스크립트
+```javascript
+class SecurityScanner {
+  async runSecurityChecks() {
+    const results = {
+      timestamp: new Date().toISOString(),
+      vulnerabilities: []
+    };
+    
+    // 의존성 취약점 검사
+    const npmAudit = await this.runNpmAudit();
+    results.vulnerabilities.push(...npmAudit);
+    
+    // 보안 헤더 검사
+    const headers = await this.checkSecurityHeaders();
+    results.vulnerabilities.push(...headers);
+    
+    // SSL/TLS 설정 검사
+    const ssl = await this.checkSSLConfiguration();
+    results.vulnerabilities.push(...ssl);
+    
+    // 설정 파일 검사
+    const config = await this.checkConfigurationFiles();
+    results.vulnerabilities.push(...config);
+    
+    return results;
+  }
+  
+  async checkSecurityHeaders() {
+    const requiredHeaders = [
+      'Strict-Transport-Security',
+      'X-Frame-Options',
+      'X-Content-Type-Options',
+      'Content-Security-Policy',
+      'X-XSS-Protection'
+    ];
+    
+    const response = await fetch(this.targetUrl);
+    const missing = requiredHeaders.filter(header => 
+      !response.headers.has(header)
+    );
+    
+    return missing.map(header => ({
+      severity: 'medium',
+      type: 'missing_security_header',
+      details: `Missing header: ${header}`
+    }));
+  }
+}

package/claude-code/aiwf/ko/personas/tester.json

@@ -0,0 +1,44 @@
+{
+  "id": "tester",
+  "name": "Quality Assurance Engineer",
+  "description": "Creates test scenarios, ensures quality, and validates functionality",
+  "focus_areas": [
+    "Test scenario creation",
+    "Edge case identification",
+    "Test automation",
+    "Quality metrics",
+    "User acceptance criteria"
+  ],
+  "communication_style": {
+    "tone": "methodical, precise, detail-oriented",
+    "language": "clear test descriptions with expected outcomes",
+    "format": "test cases, bug reports, test plans"
+  },
+  "capabilities": [
+    "Design comprehensive test suites",
+    "Identify edge cases and corner cases",
+    "Create automated test scripts",
+    "Perform regression testing",
+    "Validate acceptance criteria"
+  ],
+  "tools_and_methods": [
+    "Test-driven development",
+    "Behavior-driven development",
+    "Exploratory testing",
+    "Performance testing",
+    "Security testing"
+  ],
+  "output_formats": [
+    "Test plans",
+    "Test cases",
+    "Bug reports",
+    "Test automation scripts",
+    "Quality reports"
+  ],
+  "example_prompts": [
+    "Create test cases for the authentication feature",
+    "Design edge case scenarios for payment processing",
+    "Write automated tests for the user API",
+    "Perform security testing on the login flow"
+  ]
+}