beddel 0.2.3 → 1.0.0

package/src/integration/secure-yaml-runtime.ts

@@ -1,341 +0,0 @@
-/**
- * Secure YAML Runtime Integration
- * Integrates SecureYamlParser with IsolatedRuntimeManager for ultra-secure YAML processing
- */
-import { SecureYamlParser } from "../parser/secure-yaml-parser";
-import { IsolatedRuntimeManager } from "../runtime/isolatedRuntime";
-import { SecurityScanner } from "../security/scanner";
-import { performanceTargets, securityProfiles } from "../config";
-
-export interface RuntimeYAMLConfig {
-  securityProfile?: string;
-  tenantId?: string;
-  timeout?: number;
-  memoryLimit?: number;
-  validateSecurity?: boolean;
-  auditEnabled?: boolean;
-}
-
-export interface RuntimeYAMLResult {
-  success: boolean;
-  result?: any;
-  error?: Error;
-  executionTime: number;
-  memoryUsed: number;
-  securityScore?: number;
-  auditHash?: string;
-  tenantId?: string;
-}
-
-export class SecureYamlRuntime {
-  private readonly runtimeManager: IsolatedRuntimeManager;
-  private readonly securityScanner: SecurityScanner;
-
-  constructor(private runtimeManagerInstance: IsolatedRuntimeManager) {
-    this.runtimeManager = runtimeManagerInstance;
-    this.securityScanner = new SecurityScanner();
-  }
-
-  /**
-   * Parse YAML in isolated runtime environment
-   */
-  public async parseYamlSecureRuntime(
-    yamlContent: string,
-    config: RuntimeYAMLConfig = {}
-  ): Promise<RuntimeYAMLResult> {
-    const startTime = performance.now();
-
-    try {
-      // Validate input
-      this.validateInput(yamlContent);
-
-      // Security scan if enabled
-      if (config.validateSecurity !== false) {
-        const scanResult = await this.securityScanner.scan({
-          code: yamlContent,
-          executionId: `yaml-parse-${Date.now()}`,
-        });
-
-        if (!scanResult.secure) {
-          throw new Error(
-            `Security scan failed: ${scanResult.warnings.join(", ")}`
-          );
-        }
-      }
-
-      // Prepare execution code
-      const executionCode = this.buildYamlExecutionCode(yamlContent);
-
-      // Execute in isolated runtime
-      const executionResult = await this.runtimeManager.execute({
-        code: executionCode,
-        securityProfile: config.securityProfile || "ultra-secure",
-        timeout: config.timeout || 5000,
-        memoryLimit: config.memoryLimit || 2,
-        tenantId: config.tenantId,
-        scanForSecurity: config.validateSecurity,
-      });
-
-      const endTime = performance.now();
-      const totalTime = endTime - startTime;
-
-      // Validate performance targets
-      this.validatePerformanceTargets(totalTime, executionResult.memoryUsed);
-
-      const auditHash = this.generateAuditHash(
-        yamlContent,
-        executionResult,
-        config
-      );
-
-      return {
-        success: executionResult.success,
-        result: executionResult.result,
-        error: executionResult.error,
-        executionTime: totalTime,
-        memoryUsed: executionResult.memoryUsed,
-        securityScore: this.calculateSecurityScore(executionResult, config),
-        auditHash,
-        tenantId: config.tenantId,
-      };
-    } catch (error) {
-      const endTime = performance.now();
-      const totalTime = endTime - startTime;
-
-      return {
-        success: false,
-        error: error instanceof Error ? error : new Error(String(error)),
-        executionTime: totalTime,
-        memoryUsed: 0,
-        tenantId: config.tenantId,
-      };
-    }
-  }
-
-  /**
-   * Multi-tenant YAML processing with isolation
-   */
-  public async parseYamlMultiTenant(
-    yamlContent: string,
-    tenantId: string,
-    config: RuntimeYAMLConfig = {}
-  ): Promise<RuntimeYAMLResult> {
-    const tenantConfig = {
-      ...config,
-      tenantId,
-      securityProfile: config.securityProfile || "tenant-isolated",
-      validateSecurity: config.validateSecurity !== false,
-      auditEnabled: config.auditEnabled !== false,
-    };
-
-    return this.parseYamlSecureRuntime(yamlContent, tenantConfig);
-  }
-
-  /**
-   * Batch process YAML for multiple tenants
-   */
-  public async parseYamlBatch(
-    yamlContents: Array<{ content: string; tenantId: string }>,
-    config: RuntimeYAMLConfig = {}
-  ): Promise<Map<string, RuntimeYAMLResult>> {
-    const results = new Map<string, RuntimeYAMLResult>();
-
-    // Process each tenant's YAML in isolated runtime
-    for (const { content, tenantId } of yamlContents) {
-      const result = await this.parseYamlMultiTenant(content, tenantId, config);
-      results.set(tenantId, result);
-    }
-
-    return results;
-  }
-
-  /**
-   * Test multi-tenant isolation
-   */
-  public async testTenantIsolation(
-    tenantIds: string[]
-  ): Promise<{ [tenantId: string]: boolean }> {
-    const results: { [tenantId: string]: boolean } = {};
-
-    for (const tenantId of tenantIds) {
-      try {
-        // Execute code that should trigger isolation violations if not properly isolated
-        const testCode = `
-          const memoryLeak = [];
-          for (let i = 0; i < 1000; i++) {
-            memoryLeak.push(new Array(10000).fill('${tenantId}'));
-          }
-          global.tenantData = '${tenantId}';
-          return global.tenantData;
-        `;
-
-        const executionResult = await this.runtimeManager.execute({
-          code: testCode,
-          tenantId,
-          securityProfile: "tenant-isolated",
-          timeout: 2000,
-          memoryLimit: 1,
-        });
-
-        results[tenantId] =
-          executionResult.success && executionResult.result === tenantId;
-      } catch (error) {
-        results[tenantId] = false;
-      }
-    }
-
-    return results;
-  }
-
-  /**
-   * Validate performance targets
-   */
-  private validatePerformanceTargets(
-    executionTime: number,
-    memoryUsed: number
-  ): void {
-    const timeTarget = performanceTargets.find(
-      (t) => t.metric === "executionTime"
-    );
-    const memoryTarget = performanceTargets.find(
-      (t) => t.metric === "memoryUsage"
-    );
-
-    if (timeTarget && executionTime > timeTarget.target) {
-      console.warn(
-        `[SecureYamlRuntime] Performance warning: execution time ${executionTime}ms exceeds target ${timeTarget.target}ms`
-      );
-    }
-
-    if (memoryTarget && memoryUsed > memoryTarget.target) {
-      console.warn(
-        `[SecureYamlRuntime] Performance warning: memory usage ${memoryUsed}MB exceeds target ${memoryTarget.target}MB`
-      );
-    }
-  }
-
-  /**
-   * Calculate security score
-   */
-  private calculateSecurityScore(
-    executionResult: any,
-    config: RuntimeYAMLConfig
-  ): number {
-    const profile = securityProfiles[config.securityProfile || "ultra-secure"];
-
-    let score = 9.5; // Base score
-
-    if (!executionResult.success) {
-      score -= 1.0;
-    }
-
-    if (config.tenantId) {
-      score += 0.5;
-    }
-
-    if (config.validateSecurity === false) {
-      score -= 1.5;
-    }
-
-    return Math.max(0, Math.min(10, score));
-  }
-
-  /**
-   * Validate input
-   */
-  private validateInput(yamlContent: string): void {
-    if (typeof yamlContent !== "string") {
-      throw new Error("YAML content must be a string");
-    }
-
-    if (yamlContent.length === 0) {
-      throw new Error("YAML content cannot be empty");
-    }
-
-    if (yamlContent.length > 1024 * 1024) {
-      // 1MB max
-      throw new Error("YAML content exceeds maximum size limit (1MB)");
-    }
-  }
-
-  /**
-   * Build execution code for YAML parsing
-   */
-  private buildYamlExecutionCode(yamlContent: string): string {
-    // Escape the YAML content to avoid injection attacks
-    const escapedYaml = JSON.stringify(yamlContent);
-
-    return `
-      // Secure YAML Parser implementation
-      class SecureYamlRuntime {
-        constructor() {
-          this.schema = 'FAILSAFE_SCHEMA';
-          this.allowedTypes = ['null', 'boolean', 'integer', 'float', 'string'];
-        }
-
-        parseSecure(yamlContent) {
-          // Simulate basic YAML parsing logic
-          const lines = yamlContent.split('\\n');
-          const result = {};
-          
-          for (const line of lines) {
-            const trimmedLine = line.trim();
-            if (trimmedLine && !trimmedLine.startsWith('#')) {
-              const colonIndex = trimmedLine.indexOf(':');
-              if (colonIndex !== -1) {
-                const key = trimmedLine.substring(0, colonIndex).trim();
-                const value = trimmedLine.substring(colonIndex + 1).trim();
-                
-                // Basic type conversion
-                if (value === 'null') {
-                  result[key] = null;
-                } else if (value === 'true') {
-                  result[key] = true;
-                } else if (value === 'false') {
-                  result[key] = false;
-                } else if (!isNaN(parseFloat(value))) {
-                  result[key] = parseFloat(value);
-                } else {
-                  result[key] = value;
-                }
-              }
-            }
-          }
-          
-          return result;
-        }
-      }
-
-      const runtime = new SecureYamlRuntime();
-      const yamlContent = ${escapedYaml};
-      return runtime.parseSecure(yamlContent);
-    `;
-  }
-
-  /**
-   * Generate audit hash
-   */
-  private generateAuditHash(
-    yamlContent: string,
-    executionResult: any,
-    config: RuntimeYAMLConfig
-  ): string {
-    const crypto = require("node:crypto");
-    const auditData = {
-      yamlHash: crypto.createHash("sha256").update(yamlContent).digest("hex"),
-      executionResult: executionResult.success,
-      securityProfile: config.securityProfile || "ultra-secure",
-      tenantId: config.tenantId,
-      timestamp: Date.now(),
-      executionTime: executionResult.executionTime,
-      memoryUsed: executionResult.memoryUsed,
-    };
-
-    return crypto
-      .createHash("sha256")
-      .update(JSON.stringify(auditData))
-      .digest("hex");
-  }
-}
-
-export default SecureYamlRuntime;

package/src/parser/secure-yaml-parser.ts

@@ -1,273 +0,0 @@
-import { load, FAILSAFE_SCHEMA } from 'js-yaml';
-import { AllowedYamlPrimitive, YAMLParserConfig } from '../config';
-import { YAMLParseError, YAMLSecurityError } from '../errors';
-
-/**
- * Parser YAML seguro com FAILSAFE_SCHEMA e validações rigorosas
- * Preloading de módulos críticos realizada no construtor
- */
-export class SecureYamlParser {
-  private readonly config: YAMLParserConfig;
-  
-  constructor(config: YAMLParserConfig = {}) {
-    this.config = this.validateAndMergeConfig(config);
-  }
-
-  /**
-   * Valida e merge configuração com padrões seguros
-   */
-  private validateAndMergeConfig(userConfig: YAMLParserConfig): Required<YAMLParserConfig> {
-    const defaultConfig: Required<YAMLParserConfig> = {
-      schema: 'FAILSAFE_SCHEMA',
-      allowedTypes: ['null', 'boolean', 'integer', 'float', 'string'],
-      performanceTarget: 100,
-      maxDepth: 1000,
-      maxKeys: 10000,
-      maxStringLength: 1024 * 1024, // 1MB
-      maxValueSize: 10 * 1024 * 1024, // 10MB total
-      lazyLoading: true,
-      enableCaching: true,
-      validateUTF8: true,
-      strictMode: true,
-      filename: 'secure-parser'
-    };
-
-    // Merge com configurações do usuário, validando tipos
-    const merged = { ...defaultConfig, ...userConfig };
-    
-    // Validar tipos permitidos contra FAILSAFE_SCHEMA
-    const invalidTypes = merged.allowedTypes.filter((type: AllowedYamlPrimitive) => 
-      !defaultConfig.allowedTypes.includes(type)
-    );
-    
-    if (invalidTypes.length > 0) {
-      throw new YAMLSecurityError(
-        `Tipos não permitidos na FAILSAFE_SCHEMA: ${invalidTypes.join(', ')}`
-      );
-    }
-
-    return merged;
-  }
-
-  /**
-   * Parse YAML com segurança máxima usando FAILSAFE_SCHEMA
-   */
-  parseSecure(yamlContent: string): any {
-    const startTime = performance.now();
-    
-    try {
-      // Validar entrada
-      this.validateInput(yamlContent);
-      
-      // Configurar opções de segurança para FAILSAFE_SCHEMA
-      const parseOptions = this.buildSecureOptions();
-      
-      // Fazer parsing com FAILSAFE_SCHEMA
-      const result = load(yamlContent, parseOptions);
-      
-      // Validar resultado
-      this.validateResult(result);
-      
-      const endTime = performance.now();
-      const parseTime = endTime - startTime;
-      
-      // Log performance se exceder target
-      const target = this.config.performanceTarget || 100;
-      if (parseTime > target) {
-        console.warn(`[SecureYamlParser] Performance warning: ${parseTime}ms > ${target}ms target`);
-      }
-      
-      return result;
-      
-    } catch (error) {
-      if (error instanceof Error && error.name === 'YAMLException') {
-        throw new YAMLParseError(`Erro ao fazer parse do YAML: ${error.message}`);
-      }
-      throw error;
-    }
-  }
-
-  /**
-   * Constrói opções de segurança para FAILSAFE_SCHEMA
-   */
-  private buildSecureOptions(): any {
-    return {
-      schema: FAILSAFE_SCHEMA,
-      json: false,  // Desabilitar JSON mode para maior segurança
-      onWarning: (warning: any) => {
-        console.warn(`[SecureYamlParser] WARN: ${warning}`);
-      },
-      maxDepth: this.config.maxDepth,
-      maxKeys: this.config.maxKeys,
-      strict: this.config.strictMode,
-      // Security hardening
-      filename: this.config.filename || 'secure-parser',
-      onError: (error: any) => {
-        throw new YAMLSecurityError(`Erro de segurança durante parsing: ${error.message}`);
-      }
-    };
-  }
-
-  /**
-   * Valida entrada antes do parsing
-   */
-  private validateInput(input: string): void {
-    if (typeof input !== 'string') {
-      throw new YAMLParseError('Input deve ser uma string');
-    }
-    
-    const maxStringLength = this.config.maxStringLength || 1048576; // Default 1MB
-    if (input.length > maxStringLength) {
-      throw new YAMLSecurityError(
-        `Tamanho do input (${input.length}) excede limite máximo (${maxStringLength})`
-      );
-    }
-    
-    if (input.trim().length === 0) {
-      throw new YAMLParseError('Input vazio não é permitido');
-    }
-    
-    // Validações UTF-8 básicas
-    if ((this.config.validateUTF8 ?? true) && !this.isValidUTF8(input)) {
-      throw new YAMLSecurityError('Input contém caracteres UTF-8 inválidos');
-    }
-  }
-
-  /**
-   * Valida resultado após parsing
-   */
-  private validateResult(result: any): void {
-    // Validar profundidade máxima antes de serialização
-    const depth = this.getObjectDepth(result);
-    const maxDepth = this.config.maxDepth || 1000;
-    if (depth > maxDepth) {
-      throw new YAMLSecurityError(
-        `Profundidade do objeto (${depth}) excede limite máximo (${maxDepth})`
-      );
-    }
-    
-    // Validar tipos permitidos
-    if (!this.isAllowedType(result)) {
-      const allowedTypes = this.config.allowedTypes || ['null', 'boolean', 'integer', 'float', 'string'];
-      throw new YAMLSecurityError(
-        'O resultado contém tipos não permitidos. Tipos permitidos: ' + 
-        allowedTypes.join(', ')
-      );
-    }
-    
-    // Validar tamanho total aproximado
-    const size = this.estimateObjectSize(result);
-    const maxValueSize = this.config.maxValueSize || 10485760; // Default 10MB
-    if (size > maxValueSize) {
-      throw new YAMLSecurityError(
-        `Tamanho do objeto (${size} bytes) excede limite máximo (${maxValueSize} bytes)`
-      );
-    }
-  }
-
-  /**
-   * Verifica se é UTF-8 válido
-   */
-  private isValidUTF8(str: string): boolean {
-    try {
-      encodeURIComponent(str);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  /**
-   * Calcula profundidade do objeto
-   */
-  private getObjectDepth(obj: any, currentDepth = 0): number {
-    if (obj === null || typeof obj !== 'object') {
-      return currentDepth;
-    }
-    
-    if (Array.isArray(obj)) {
-      return obj.reduce((max, item) => 
-        Math.max(max as number, this.getObjectDepth(item, currentDepth + 1)), currentDepth + 1);
-    }
-    
-    const values = Object.values(obj);
-    return values.reduce((max: number, value) => 
-      Math.max(max, this.getObjectDepth(value, currentDepth + 1)), currentDepth + 1);
-  }
-
-  /**
-   * Verifica se os tipos são permitidos
-   */
-  private isAllowedType(obj: any): boolean {
-    const type = this.getType(obj);
-    
-    // Verificar tipos básicos permitidos
-    const allowedTypes = this.config.allowedTypes || ['null', 'boolean', 'integer', 'float', 'string'];
-    if (!allowedTypes.includes(type as any)) {
-      return false;
-    }
-    
-    // Recursivamente verificar objetos e arrays
-    if (typeof obj === 'object' && obj !== null) {
-      const values = Array.isArray(obj) ? obj : Object.values(obj);
-      return values.every(value => this.isAllowedType(value));
-    }
-    
-    return true;
-  }
-
-  /**
-   * Estima tamanho do objeto em bytes
-   */
-  private estimateObjectSize(obj: any): number {
-    return JSON.stringify(obj).length;
-  }
-
-  /**
-   * Obtém tipo completo do objeto
-   */
-  private getType(obj: any): string {
-    if (obj === null) return 'null';
-    if (Array.isArray(obj)) return 'array';
-    if (typeof obj === 'object') return 'object';
-    if (typeof obj === 'number') {
-      return Number.isInteger(obj) ? 'integer' : 'float';
-    }
-    return typeof obj;
-  }
-
-  /**
-   * Parse assíncrono para lazy loading
-   */
-  async parseSecureAsync(yamlContent: string): Promise<any> {
-    if (this.config.lazyLoading) {
-      // Lazy loading - criar Promise para carregar parser apenas quando necessário
-      return new Promise((resolve, reject) => {
-        setTimeout(() => {
-          try {
-            resolve(this.parseSecure(yamlContent));
-          } catch (error) {
-            reject(error);
-          }
-        }, 0);
-      });
-    } else {
-      return this.parseSecure(yamlContent);
-    }
-  }
-}
-
-/**
- * Factory function para criar parser com configuração padrão segura
- */
-export function createSecureYamlParser(config?: Partial<YAMLParserConfig>): SecureYamlParser {
-  return new SecureYamlParser(config);
-}
-
-/**
- * Função utilitária para parse rápido com configuração padrão
- */
-export function parseSecureYaml(yamlContent: string, config?: Partial<YAMLParserConfig>): any {
-  const parser = createSecureYamlParser(config);
-  return parser.parseSecure(yamlContent);
-}