beddel 0.2.2 → 0.3.0

package/src/firebase/tenantManager.ts

@@ -1,443 +0,0 @@
-/**
- * Multi-Tenant Firebase Manager v2025
- * Isolamento completo de tenants com LGPD/GDPR compliance automático
- */
-
-import * as admin from "firebase-admin";
-import { runtimeConfig } from "../config";
-import { AuditTrail } from "../audit/auditTrail";
-import { GDPRCompliance } from "../compliance/gdprEngine";
-import { LGPDCompliance } from "../compliance/lgpdEngine";
-
-export interface TenantConfig {
-  tenantId: string;
-  projectId: string;
-  databaseURL: string;
-  storageBucket: string;
-  securityProfile: "ultra-secure" | "tenant-isolated";
-  dataRetentionDays: number;
-  lgpdEnabled: boolean;
-  gdprEnabled: boolean;
-}
-
-export interface TenantIsolationResult {
-  success: boolean;
-  tenantId: string;
-  securityScore: number;
-  auditHash: string;
-  executionTime: number;
-  complianceStatus: {
-    lgpd: boolean;
-    gdpr: boolean;
-  };
-}
-
-export class MultiTenantFirebaseManager {
-  private static instance: MultiTenantFirebaseManager;
-  private tenants: Map<string, admin.app.App>;
-  private auditTrail: AuditTrail;
-  private gdprCompliance: GDPRCompliance;
-  private lgpdCompliance: LGPDCompliance;
-
-  private constructor() {
-    this.tenants = new Map();
-    this.auditTrail = new AuditTrail();
-    this.gdprCompliance = new GDPRCompliance();
-    this.lgpdCompliance = new LGPDCompliance();
-  }
-
-  public static getInstance(): MultiTenantFirebaseManager {
-    if (!this.instance) {
-      this.instance = new MultiTenantFirebaseManager();
-    }
-    return this.instance;
-  }
-
-  /**
-   * Initialize tenant with complete isolation
-   */
-  public async initializeTenant(
-    config: TenantConfig
-  ): Promise<TenantIsolationResult> {
-    const startTime = Date.now();
-
-    try {
-      // Validate tenant configuration
-      this.validateTenantConfig(config);
-
-      // Check if tenant already exists
-      if (this.tenants.has(config.tenantId)) {
-        throw new Error(`Tenant ${config.tenantId} already initialized`);
-      }
-
-      // Initialize Firebase app for this tenant
-      const app = admin.initializeApp(
-        {
-          credential: admin.credential.applicationDefault(),
-          projectId: config.projectId,
-          databaseURL: config.databaseURL,
-          storageBucket: config.storageBucket,
-        },
-        `tenant-${config.tenantId}`
-      );
-
-      // Configure security rules
-      await this.configureSecurityRules(app, config);
-
-      // Store tenant app
-      this.tenants.set(config.tenantId, app);
-
-      // Generate audit trail
-      const operationId = `init-${config.tenantId}-${Date.now()}`;
-      const auditHash = await this.auditTrail.logOperation({
-        operationId,
-        tenantId: config.tenantId,
-        operation: "tenant_init",
-        data: this.sanitizeForAudit(config),
-        timestamp: new Date(),
-      });
-
-      // Verify compliance
-      const complianceStatus = await this.verifyCompliance(config);
-
-      const executionTime = Date.now() - startTime;
-
-      // Calculate security score
-      const securityScore = this.calculateSecurityScore(config);
-
-      return {
-        success: true,
-        tenantId: config.tenantId,
-        securityScore,
-        auditHash,
-        executionTime,
-        complianceStatus,
-      };
-    } catch (error) {
-      const executionTime = Date.now() - startTime;
-
-      await this.auditTrail.logOperation({
-        operationId: `error-${config.tenantId}-${Date.now()}`,
-        tenantId: config.tenantId,
-        operation: "tenant_init_error",
-        data: {
-          error: error instanceof Error ? error.message : String(error),
-          config: this.sanitizeForAudit(config),
-        },
-        timestamp: new Date(),
-        success: false,
-      });
-
-      throw error;
-    }
-  }
-
-  /**
-   * Get isolated tenant app with security profile
-   */
-  public getTenantApp(tenantId: string): admin.app.App {
-    if (!this.tenants.has(tenantId)) {
-      throw new Error(`Tenant ${tenantId} not found or not initialized`);
-    }
-
-    return this.tenants.get(tenantId)!;
-  }
-
-  /**
-   * Execute operation in tenant context
-   */
-  public async executeInTenant<T>(
-    tenantId: string,
-    operation: string,
-    data: any,
-    callback: () => Promise<T>
-  ): Promise<T> {
-    const startTime = Date.now();
-
-    try {
-      const app = this.getTenantApp(tenantId);
-
-      // Generate audit trail
-      const operationId = `${operation}-${tenantId}-${Date.now()}`;
-      const auditHash = await this.auditTrail.logOperation({
-        operationId,
-        tenantId,
-        operation,
-        data: this.sanitizeForAudit(data),
-        timestamp: new Date(),
-      });
-
-      // Execute operation
-      const result = await callback();
-
-      // Record successful operation
-      const executionTime = Date.now() - startTime;
-      await this.auditTrail.logOperation({
-        operationId: `${operationId}-complete`,
-        tenantId,
-        operation: `${operation}_complete`,
-        data: { result: this.sanitizeForAudit(result), executionTime },
-        timestamp: new Date(),
-        success: true,
-      });
-
-      return result;
-    } catch (error) {
-      const executionTime = Date.now() - startTime;
-
-      await this.auditTrail.logOperation({
-        operationId: `${operation}-${tenantId}-${Date.now()}-error`,
-        tenantId,
-        operation: `${operation}_error`,
-        data: {
-          error: error instanceof Error ? error.message : String(error),
-          executionTime,
-        },
-        timestamp: new Date(),
-        success: false,
-      });
-
-      throw error;
-    }
-  }
-
-  /**
-   * Configure security rules for tenant
-   */
-  private async configureSecurityRules(
-    app: admin.app.App,
-    config: TenantConfig
-  ): Promise<void> {
-    // Configure Firestore security rules based on profile
-    const db = app.firestore();
-
-    // Tenant-isolated rules
-    const rules = this.generateSecurityRules(config);
-
-    // Apply security configuration
-    // Note: In production, this would be set via Firebase console or API
-    await this.auditTrail.logOperation({
-      operationId: `security-${config.tenantId}-${Date.now()}`,
-      tenantId: config.tenantId,
-      operation: "security_config",
-      data: { securityLevel: config.securityProfile },
-      timestamp: new Date(),
-    });
-  }
-
-  /**
-   * Generate security rules based on profile
-   */
-  private generateSecurityRules(config: TenantConfig): string {
-    switch (config.securityProfile) {
-      case "ultra-secure":
-        return `
-          rules_version = '2';
-          service cloud.firestore {
-            match /databases/{database}/documents {
-              match /{document=**} {
-                allow read, write: if false;
-              }
-            }
-          }
-        `;
-      case "tenant-isolated":
-        return `
-          rules_version = '2';
-          service cloud.firestore {
-            match /databases/{database}/documents {
-              match /tenants/${config.tenantId}/{document=**} {
-                allow read, write: if request.auth.uid != null;
-              }
-              match /{document=**} {
-                allow read, write: if false;
-              }
-            }
-          }
-        `;
-      default:
-        throw new Error(`Unknown security profile: ${config.securityProfile}`);
-    }
-  }
-
-  /**
-   * Verify LGPD/GDPR compliance for tenant
-   */
-  private async verifyCompliance(config: TenantConfig): Promise<{
-    lgpd: boolean;
-    gdpr: boolean;
-  }> {
-    let lgpd = false;
-    let gdpr = false;
-
-    if (config.lgpdEnabled) {
-      lgpd = await this.lgpdCompliance.verifyCompliance({
-        tenantId: config.tenantId,
-        dataConsent: true,
-        dataAnonymization: true,
-        dataRetentionDays: config.dataRetentionDays,
-        brazilianDataResidency: true,
-        rightToDelete: true,
-        dataOwnerRights: true,
-        automaticDeletion: true,
-      });
-    }
-
-    if (config.gdprEnabled) {
-      gdpr = await this.gdprCompliance.verifyCompliance({
-        tenantId: config.tenantId,
-        dataAnonymization: true,
-        consentManagement: true,
-        rightToBeForgotten: true,
-        dataPortability: true,
-        dataRetentionDays: config.dataRetentionDays,
-      });
-    }
-
-    return { lgpd, gdpr };
-  }
-
-  /**
-   * Calculate security score based on configuration
-   */
-  private calculateSecurityScore(config: TenantConfig): number {
-    let score = 5.0; // Base score
-
-    // Multi-tenant isolation
-    if (this.tenants.has(config.tenantId)) {
-      score += 1.0;
-    }
-
-    // Security profile
-    switch (config.securityProfile) {
-      case "ultra-secure":
-        score += 2.0;
-        break;
-      case "tenant-isolated":
-        score += 1.5;
-        break;
-    }
-
-    // Compliance features
-    if (config.lgpdEnabled) {
-      score += 0.5;
-    }
-    if (config.gdprEnabled) {
-      score += 0.5;
-    }
-
-    // Audit trail
-    if (runtimeConfig.auditEnabled) {
-      score += 1.0;
-    }
-
-    // Memory limit enforcement (1MB para multi-tenant)
-    const memoryLimit = runtimeConfig.memoryLimit;
-    if (memoryLimit <= 1) {
-      score += 0.5;
-    }
-
-    return Math.min(score, 10.0); // Máximo 10.0
-  }
-
-  /**
-   * Validate tenant configuration
-   */
-  private validateTenantConfig(config: TenantConfig): void {
-    if (!config.tenantId || config.tenantId.length < 3) {
-      throw new Error("Invalid tenant ID - must be at least 3 characters");
-    }
-
-    if (!config.projectId) {
-      throw new Error("Project ID is required");
-    }
-
-    if (!config.securityProfile) {
-      config.securityProfile = "tenant-isolated";
-    }
-
-    if (!config.dataRetentionDays) {
-      config.dataRetentionDays = 365; // 1 ano padrão LGPD
-    }
-
-    if (config.dataRetentionDays < 90) {
-      throw new Error("Data retention minimum 90 days for LGPD compliance");
-    }
-  }
-
-  /**
-   * Sanitize data for audit trail
-   */
-  private sanitizeForAudit(data: any): any {
-    return JSON.parse(
-      JSON.stringify(data, (key, value) => {
-        // Remove sensitive information
-        if (
-          key.includes("password") ||
-          key.includes("secret") ||
-          key.includes("key")
-        ) {
-          return "[REDACTED]";
-        }
-        return value;
-      })
-    );
-  }
-
-  /**
-   * Get all active tenants
-   */
-  public getActiveTenants(): string[] {
-    return Array.from(this.tenants.keys());
-  }
-
-  /**
-   * Get statistics for all tenants
-   */
-  public async getTenantStats(): Promise<Map<string, TenantIsolationResult>> {
-    const stats = new Map<string, TenantIsolationResult>();
-
-    for (const tenantId of this.tenants.keys()) {
-      // Simulate getting stats (in real implementation, would query actual metrics)
-      const mockStats: TenantIsolationResult = {
-        success: true,
-        tenantId,
-        securityScore: 9.5, // Target 9.5/10
-        auditHash: "SHA256-" + Math.random().toString(36),
-        executionTime: 95, // Target <100ms
-        complianceStatus: {
-          lgpd: true,
-          gdpr: true,
-        },
-      };
-
-      stats.set(tenantId, mockStats);
-    }
-
-    return stats;
-  }
-
-  /**
-   * Safely remove tenant
-   */
-  public async removeTenant(tenantId: string): Promise<void> {
-    if (!this.tenants.has(tenantId)) {
-      throw new Error(`Tenant ${tenantId} not found`);
-    }
-
-    const app = this.tenants.get(tenantId)!;
-
-    // Log removal
-    await this.auditTrail.logOperation({
-      operationId: `remove-${tenantId}-${Date.now()}`,
-      tenantId,
-      operation: "tenant_removal",
-      data: { reason: "admin_removal" },
-      timestamp: new Date(),
-    });
-
-    // Delete tenant app
-    await app.delete();
-    this.tenants.delete(tenantId);
-  }
-}