aiwf 0.3.6 → 0.3.8

package/src/lib/resources/personas/security/knowledge_base.md

@@ -0,0 +1,498 @@
+# Security 페르소나 Knowledge Base
+
+## 보안 위협 백과사전
+
+### 웹 애플리케이션 공격
+
+#### 1. SQL Injection
+```sql
+-- 취약한 코드
+SELECT * FROM users WHERE username = '$username' AND password = '$password';
+
+-- 공격 예시
+username: admin' OR '1'='1' --
+password: anything
+
+-- 방어 코드 (파라미터화된 쿼리)
+const query = 'SELECT * FROM users WHERE username = ? AND password = ?';
+db.query(query, [username, password]);
+```
+
+#### 2. Cross-Site Scripting (XSS)
+```javascript
+// 저장형 XSS 방어
+function sanitizeUserInput(input) {
+  // DOMPurify 라이브러리 사용
+  return DOMPurify.sanitize(input, {
+    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
+    ALLOWED_ATTR: ['href']
+  });
+}
+
+// 반사형 XSS 방어
+function renderUserContent(content) {
+  const div = document.createElement('div');
+  div.textContent = content; // innerHTML 대신 textContent 사용
+  return div;
+}
+
+// CSP 헤더 설정
+Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}';
+```
+
+#### 3. Cross-Site Request Forgery (CSRF)
+```javascript
+// CSRF 토큰 생성
+class CSRFProtection {
+  generateToken(sessionId) {
+    const token = crypto.randomBytes(32).toString('hex');
+    this.storeToken(sessionId, token);
+    return token;
+  }
+  
+  validateToken(sessionId, token) {
+    const storedToken = this.getToken(sessionId);
+    if (!storedToken || storedToken !== token) {
+      throw new SecurityError('Invalid CSRF token');
+    }
+    // 토큰 재생성 (일회용)
+    return this.generateToken(sessionId);
+  }
+}
+
+// Double Submit Cookie Pattern
+app.use((req, res, next) => {
+  const token = req.cookies.csrfToken || crypto.randomBytes(32).toString('hex');
+  res.cookie('csrfToken', token, { httpOnly: false, sameSite: 'strict' });
+  req.csrfToken = token;
+  next();
+});
+```
+
+### 인증 및 권한 관리
+
+#### OAuth 2.0 구현
+```javascript
+class OAuth2Provider {
+  // Authorization Code Flow
+  async authorize(clientId, redirectUri, scope) {
+    // 1. 사용자 인증
+    const user = await this.authenticateUser();
+    
+    // 2. 클라이언트 검증
+    const client = await this.validateClient(clientId, redirectUri);
+    
+    // 3. 권한 부여 코드 생성
+    const code = crypto.randomBytes(32).toString('hex');
+    await this.storeAuthCode(code, {
+      clientId,
+      userId: user.id,
+      scope,
+      expiresAt: Date.now() + 600000 // 10분
+    });
+    
+    return code;
+  }
+  
+  // Token Exchange
+  async exchangeToken(code, clientId, clientSecret) {
+    const authCode = await this.getAuthCode(code);
+    
+    // 검증
+    if (!authCode || authCode.clientId !== clientId) {
+      throw new Error('Invalid authorization code');
+    }
+    
+    if (Date.now() > authCode.expiresAt) {
+      throw new Error('Authorization code expired');
+    }
+    
+    // 토큰 생성
+    const accessToken = this.generateJWT(authCode.userId, authCode.scope);
+    const refreshToken = crypto.randomBytes(32).toString('hex');
+    
+    await this.storeRefreshToken(refreshToken, authCode.userId);
+    await this.revokeAuthCode(code);
+    
+    return { accessToken, refreshToken };
+  }
+}
+```
+
+#### JWT 보안
+```javascript
+class SecureJWT {
+  constructor() {
+    this.algorithm = 'RS256'; // 비대칭 키 사용
+    this.issuer = 'secure-app';
+    this.audience = 'api.secure-app.com';
+  }
+  
+  generateToken(payload) {
+    const token = jwt.sign(payload, this.privateKey, {
+      algorithm: this.algorithm,
+      expiresIn: '15m', // 짧은 만료 시간
+      issuer: this.issuer,
+      audience: this.audience,
+      jwtid: uuidv4() // 토큰 ID로 재사용 방지
+    });
+    
+    return token;
+  }
+  
+  verifyToken(token) {
+    try {
+      const decoded = jwt.verify(token, this.publicKey, {
+        algorithms: [this.algorithm],
+        issuer: this.issuer,
+        audience: this.audience
+      });
+      
+      // 토큰 블랙리스트 확인
+      if (this.isBlacklisted(decoded.jti)) {
+        throw new Error('Token revoked');
+      }
+      
+      return decoded;
+    } catch (error) {
+      throw new SecurityError('Invalid token: ' + error.message);
+    }
+  }
+}
+```
+
+### 암호화 알고리즘
+
+#### 대칭키 암호화 (AES)
+```javascript
+class AESEncryption {
+  constructor(key) {
+    this.algorithm = 'aes-256-gcm';
+    this.key = Buffer.from(key, 'hex');
+  }
+  
+  encrypt(plaintext) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv(this.algorithm, this.key, iv);
+    
+    let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    
+    const authTag = cipher.getAuthTag();
+    
+    return {
+      encrypted,
+      iv: iv.toString('hex'),
+      authTag: authTag.toString('hex')
+    };
+  }
+  
+  decrypt(encryptedData) {
+    const decipher = crypto.createDecipheriv(
+      this.algorithm,
+      this.key,
+      Buffer.from(encryptedData.iv, 'hex')
+    );
+    
+    decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'hex'));
+    
+    let decrypted = decipher.update(encryptedData.encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    
+    return decrypted;
+  }
+}
+```
+
+#### 비대칭키 암호화 (RSA)
+```javascript
+class RSAEncryption {
+  generateKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 4096,
+      publicKeyEncoding: {
+        type: 'spki',
+        format: 'pem'
+      },
+      privateKeyEncoding: {
+        type: 'pkcs8',
+        format: 'pem',
+        cipher: 'aes-256-cbc',
+        passphrase: process.env.KEY_PASSPHRASE
+      }
+    });
+    
+    return { publicKey, privateKey };
+  }
+  
+  encrypt(data, publicKey) {
+    const buffer = Buffer.from(data, 'utf8');
+    const encrypted = crypto.publicEncrypt(
+      {
+        key: publicKey,
+        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256'
+      },
+      buffer
+    );
+    
+    return encrypted.toString('base64');
+  }
+  
+  decrypt(encryptedData, privateKey) {
+    const buffer = Buffer.from(encryptedData, 'base64');
+    const decrypted = crypto.privateDecrypt(
+      {
+        key: privateKey,
+        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256',
+        passphrase: process.env.KEY_PASSPHRASE
+      },
+      buffer
+    );
+    
+    return decrypted.toString('utf8');
+  }
+}
+```
+
+### 네트워크 보안
+
+#### TLS/SSL 설정
+```javascript
+// HTTPS 서버 설정
+const https = require('https');
+const tls = require('tls');
+
+const options = {
+  key: fs.readFileSync('private-key.pem'),
+  cert: fs.readFileSync('certificate.pem'),
+  
+  // 보안 강화 설정
+  secureOptions: tls.constants.SSL_OP_NO_TLSv1 | 
+                 tls.constants.SSL_OP_NO_TLSv1_1,
+  ciphers: [
+    'ECDHE-RSA-AES128-GCM-SHA256',
+    'ECDHE-RSA-AES256-GCM-SHA384',
+    'ECDHE-RSA-AES128-SHA256',
+    'ECDHE-RSA-AES256-SHA384'
+  ].join(':'),
+  honorCipherOrder: true,
+  
+  // HSTS
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true
+  }
+};
+
+https.createServer(options, app).listen(443);
+```
+
+#### 방화벽 규칙
+```bash
+# iptables 기본 정책
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT
+
+# 필요한 포트만 열기
+iptables -A INPUT -p tcp --dport 443 -j ACCEPT  # HTTPS
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT   # SSH (IP 제한 권장)
+
+# DDoS 방어
+iptables -A INPUT -p tcp --syn -m limit --limit 25/s --limit-burst 50 -j ACCEPT
+```
+
+### 보안 모니터링
+
+#### 이상 탐지 시스템
+```javascript
+class AnomalyDetector {
+  constructor() {
+    this.baseline = new Map();
+    this.threshold = 2.5; // 표준편차 배수
+  }
+  
+  // 사용자 행동 분석
+  analyzeUserBehavior(userId, action) {
+    const userBaseline = this.baseline.get(userId) || {
+      loginTimes: [],
+      ipAddresses: new Set(),
+      requestRate: []
+    };
+    
+    // 로그인 시간 이상 탐지
+    if (action.type === 'login') {
+      const hour = new Date(action.timestamp).getHours();
+      const avgHour = average(userBaseline.loginTimes);
+      const stdDev = standardDeviation(userBaseline.loginTimes);
+      
+      if (Math.abs(hour - avgHour) > stdDev * this.threshold) {
+        this.alertSuspiciousLogin(userId, action);
+      }
+    }
+    
+    // IP 주소 변경 탐지
+    if (!userBaseline.ipAddresses.has(action.ipAddress)) {
+      this.alertNewLocation(userId, action);
+    }
+    
+    // 요청 빈도 이상 탐지
+    const requestsPerMinute = this.calculateRequestRate(userId);
+    if (requestsPerMinute > userBaseline.avgRate * this.threshold) {
+      this.alertHighRequestRate(userId, requestsPerMinute);
+    }
+  }
+}
+```
+
+#### 보안 이벤트 상관 분석
+```javascript
+class SecurityEventCorrelator {
+  correlateEvents(events) {
+    const patterns = {
+      bruteForce: this.detectBruteForce(events),
+      privilegeEscalation: this.detectPrivilegeEscalation(events),
+      dataExfiltration: this.detectDataExfiltration(events),
+      lateralMovement: this.detectLateralMovement(events)
+    };
+    
+    return patterns;
+  }
+  
+  detectBruteForce(events) {
+    const failedLogins = events.filter(e => 
+      e.type === 'login_failed' && 
+      e.timestamp > Date.now() - 300000 // 5분
+    );
+    
+    const attempts = {};
+    failedLogins.forEach(event => {
+      const key = `${event.username}:${event.ipAddress}`;
+      attempts[key] = (attempts[key] || 0) + 1;
+    });
+    
+    return Object.entries(attempts)
+      .filter(([_, count]) => count > 5)
+      .map(([key, count]) => ({
+        type: 'brute_force',
+        target: key.split(':')[0],
+        source: key.split(':')[1],
+        attempts: count
+      }));
+  }
+}
+```
+
+### 컴플라이언스 구현
+
+#### GDPR 데이터 처리
+```javascript
+class GDPRCompliance {
+  // 동의 관리
+  async recordConsent(userId, purposes) {
+    const consent = {
+      userId,
+      purposes,
+      timestamp: new Date().toISOString(),
+      ipAddress: getClientIP(),
+      version: 'v1.2'
+    };
+    
+    await this.store.saveConsent(consent);
+    return consent;
+  }
+  
+  // 데이터 이동권
+  async exportUserData(userId) {
+    const data = {
+      profile: await this.getUserProfile(userId),
+      activities: await this.getUserActivities(userId),
+      preferences: await this.getUserPreferences(userId),
+      consents: await this.getUserConsents(userId)
+    };
+    
+    // 민감한 정보 마스킹
+    data.profile = this.maskSensitiveData(data.profile);
+    
+    return {
+      exportDate: new Date().toISOString(),
+      format: 'json',
+      data: data
+    };
+  }
+  
+  // 삭제권 (잊혀질 권리)
+  async deleteUserData(userId) {
+    // 감사 로그 생성
+    await this.auditLog.record({
+      action: 'user_data_deletion',
+      userId,
+      timestamp: new Date().toISOString(),
+      reason: 'GDPR Article 17 Request'
+    });
+    
+    // 데이터 삭제 (보존 의무가 있는 데이터 제외)
+    await Promise.all([
+      this.deleteProfile(userId),
+      this.deleteActivities(userId),
+      this.deletePreferences(userId),
+      this.anonymizeTransactions(userId)
+    ]);
+  }
+}
+```
+
+### 보안 테스트 자동화
+
+#### 취약점 스캐닝 스크립트
+```javascript
+class SecurityScanner {
+  async runSecurityChecks() {
+    const results = {
+      timestamp: new Date().toISOString(),
+      vulnerabilities: []
+    };
+    
+    // 의존성 취약점 검사
+    const npmAudit = await this.runNpmAudit();
+    results.vulnerabilities.push(...npmAudit);
+    
+    // 보안 헤더 검사
+    const headers = await this.checkSecurityHeaders();
+    results.vulnerabilities.push(...headers);
+    
+    // SSL/TLS 설정 검사
+    const ssl = await this.checkSSLConfiguration();
+    results.vulnerabilities.push(...ssl);
+    
+    // 설정 파일 검사
+    const config = await this.checkConfigurationFiles();
+    results.vulnerabilities.push(...config);
+    
+    return results;
+  }
+  
+  async checkSecurityHeaders() {
+    const requiredHeaders = [
+      'Strict-Transport-Security',
+      'X-Frame-Options',
+      'X-Content-Type-Options',
+      'Content-Security-Policy',
+      'X-XSS-Protection'
+    ];
+    
+    const response = await fetch(this.targetUrl);
+    const missing = requiredHeaders.filter(header => 
+      !response.headers.has(header)
+    );
+    
+    return missing.map(header => ({
+      severity: 'medium',
+      type: 'missing_security_header',
+      details: `Missing header: ${header}`
+    }));
+  }
+}

package/src/lib/resources/personas/tester.json

@@ -0,0 +1,44 @@
+{
+  "id": "tester",
+  "name": "Quality Assurance Engineer",
+  "description": "Creates test scenarios, ensures quality, and validates functionality",
+  "focus_areas": [
+    "Test scenario creation",
+    "Edge case identification",
+    "Test automation",
+    "Quality metrics",
+    "User acceptance criteria"
+  ],
+  "communication_style": {
+    "tone": "methodical, precise, detail-oriented",
+    "language": "clear test descriptions with expected outcomes",
+    "format": "test cases, bug reports, test plans"
+  },
+  "capabilities": [
+    "Design comprehensive test suites",
+    "Identify edge cases and corner cases",
+    "Create automated test scripts",
+    "Perform regression testing",
+    "Validate acceptance criteria"
+  ],
+  "tools_and_methods": [
+    "Test-driven development",
+    "Behavior-driven development",
+    "Exploratory testing",
+    "Performance testing",
+    "Security testing"
+  ],
+  "output_formats": [
+    "Test plans",
+    "Test cases",
+    "Bug reports",
+    "Test automation scripts",
+    "Quality reports"
+  ],
+  "example_prompts": [
+    "Create test cases for the authentication feature",
+    "Design edge case scenarios for payment processing",
+    "Write automated tests for the user API",
+    "Perform security testing on the login flow"
+  ]
+}

package/src/lib/resources/templates/README.md

@@ -0,0 +1,78 @@
+# AIWF 프로젝트 템플릿
+
+이 디렉토리에는 AIWF 프로젝트 템플릿이 포함되어 있습니다.
+
+## 사용 가능한 템플릿
+
+### 1. web-app (웹 애플리케이션)
+- React 18 + TypeScript
+- Vite 빌드 도구
+- Tailwind CSS
+- React Router
+- Zustand 상태 관리
+- AIWF 대시보드 통합
+
+### 2. api-server (API 서버)
+- Express + TypeScript
+- JWT 인증
+- Swagger 문서화
+- 에러 핸들링
+- AIWF API 엔드포인트
+
+### 3. npm-library (NPM 라이브러리)
+- TypeScript 기반
+- Rollup 번들링
+- Jest 테스트
+- 듀얼 모듈 시스템 (ESM/CJS)
+- 자동 버전 관리
+
+## 템플릿 사용법
+
+```bash
+# 대화형 모드
+aiwf create
+
+# 직접 지정
+aiwf create web-app my-app
+
+# 오프라인 모드
+aiwf create --offline web-app my-app
+```
+
+## 템플릿 구조
+
+각 템플릿은 다음 구조를 따릅니다:
+
+```
+template-name/
+├── config.json       # 템플릿 메타데이터
+└── template/         # 실제 프로젝트 파일
+    ├── src/          # 소스 코드
+    ├── .aiwf/        # AIWF 설정
+    ├── package.json  # 의존성
+    └── README.md     # 프로젝트 문서
+```
+
+## 템플릿 커스터마이징
+
+템플릿의 플레이스홀더:
+- `{{projectName}}` - 프로젝트 이름
+- `{{description}}` - 프로젝트 설명
+- `{{author}}` - 작성자
+- `{{year}}` - 현재 연도
+- `{{createdAt}}` - 생성 시간
+
+## 캐시 관리
+
+템플릿은 오프라인 사용을 위해 캐시될 수 있습니다:
+
+```bash
+# 캐시 생성
+aiwf cache create
+
+# 캐시 확인
+aiwf cache check
+
+# 캐시 삭제
+aiwf cache clear
+```

package/src/lib/resources/templates/api-server/config.json

@@ -0,0 +1,64 @@
+{
+  "name": "api-server",
+  "displayName": "API 서버 (Node.js + Express)",
+  "description": "Express와 TypeScript로 구성된 RESTful API 서버 템플릿",
+  "type": "api-server",
+  "language": "typescript",
+  "framework": "express",
+  "features": [
+    "Express 4",
+    "TypeScript",
+    "JWT Authentication",
+    "Swagger Documentation",
+    "Database Ready",
+    "AIWF Integration",
+    "Error Handling",
+    "Request Validation"
+  ],
+  "structure": {
+    "src": "소스 코드",
+    "tests": "테스트 파일",
+    ".aiwf": "AIWF 설정 및 메타데이터",
+    "docs": "API 문서"
+  },
+  "dependencies": {
+    "express": "^4.18.2",
+    "cors": "^2.8.5",
+    "helmet": "^7.0.0",
+    "compression": "^1.7.4",
+    "dotenv": "^16.3.1",
+    "jsonwebtoken": "^9.0.1",
+    "bcryptjs": "^2.4.3",
+    "express-validator": "^7.0.1",
+    "swagger-jsdoc": "^6.2.8",
+    "swagger-ui-express": "^5.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.17",
+    "@types/node": "^20.0.0",
+    "@types/cors": "^2.8.13",
+    "@types/compression": "^1.7.2",
+    "@types/jsonwebtoken": "^9.0.2",
+    "@types/bcryptjs": "^2.4.2",
+    "@types/swagger-jsdoc": "^6.0.1",
+    "@types/swagger-ui-express": "^4.1.3",
+    "@typescript-eslint/eslint-plugin": "^5.60.0",
+    "@typescript-eslint/parser": "^5.60.0",
+    "typescript": "^5.1.0",
+    "ts-node": "^10.9.0",
+    "nodemon": "^3.0.0",
+    "eslint": "^8.43.0",
+    "jest": "^29.5.0",
+    "@types/jest": "^29.5.0",
+    "supertest": "^6.3.0",
+    "@types/supertest": "^2.0.12"
+  },
+  "scripts": {
+    "dev": "nodemon",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "jest",
+    "lint": "eslint . --ext .ts",
+    "aiwf": "node .aiwf/scripts/cli.js"
+  }
+}