npm - cokit-cli - Versions diffs - 1.0.8 → 1.2.0 - Mend

cokit-cli 1.0.8 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1507) hide show

package/templates/repo/.github/skills/ck-backend-development/references/backend-authentication.md DELETED Viewed

@@ -1,338 +0,0 @@
-# Backend Authentication & Authorization
-Modern authentication patterns including OAuth 2.1, JWT, RBAC, and MFA (2025 standards).
-## OAuth 2.1 (2025 Standard)
-### Key Changes from OAuth 2.0
-**Mandatory:**
-- PKCE (Proof Key for Code Exchange) for all clients
-- Exact redirect URI matching
-- State parameter for CSRF protection
-**Deprecated:**
-- Implicit grant flow (security risk)
-- Resource owner password credentials grant
-- Bearer token in query strings
-### Authorization Code Flow with PKCE
-```typescript
-// Step 1: Generate code verifier and challenge
-import crypto from 'crypto';
-const codeVerifier = crypto.randomBytes(32).toString('base64url');
-const codeChallenge = crypto
-  .createHash('sha256')
-  .update(codeVerifier)
-  .digest('base64url');
-// Step 2: Redirect to authorization endpoint
-const authUrl = new URL('https://auth.example.com/authorize');
-authUrl.searchParams.set('client_id', 'your-client-id');
-authUrl.searchParams.set('redirect_uri', 'https://app.example.com/callback');
-authUrl.searchParams.set('response_type', 'code');
-authUrl.searchParams.set('scope', 'openid profile email');
-authUrl.searchParams.set('state', crypto.randomBytes(16).toString('hex'));
-authUrl.searchParams.set('code_challenge', codeChallenge);
-authUrl.searchParams.set('code_challenge_method', 'S256');
-// Step 3: Exchange code for token (with code_verifier)
-const tokenResponse = await fetch('https://auth.example.com/token', {
-  method: 'POST',
-  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-  body: new URLSearchParams({
-    grant_type: 'authorization_code',
-    code: authCode,
-    redirect_uri: redirectUri,
-    client_id: clientId,
-    code_verifier: codeVerifier,
-  }),
-});
-```
-## JWT (JSON Web Tokens)
-### Structure
-```
-Header.Payload.Signature
-eyJhbGciOi...  .  eyJzdWIiOi...  .  SflKxwRJ...
-```
-### Best Practices (2025)
-1. **Short expiration** - Access tokens: 15 minutes, Refresh tokens: 7 days
-2. **Use RS256** - Asymmetric signing (not HS256 for public APIs)
-3. **Validate everything** - Signature, issuer, audience, expiration
-4. **Include minimal claims** - Don't include sensitive data
-5. **Refresh token rotation** - Issue new refresh token on each use
-### Implementation
-```typescript
-import jwt from 'jsonwebtoken';
-// Generate JWT
-const accessToken = jwt.sign(
-  {
-    sub: user.id,
-    email: user.email,
-    roles: user.roles,
-  },
-  process.env.JWT_PRIVATE_KEY,
-  {
-    algorithm: 'RS256',
-    expiresIn: '15m',
-    issuer: 'https://api.example.com',
-    audience: 'https://app.example.com',
-  }
-);
-// Verify JWT
-const decoded = jwt.verify(token, process.env.JWT_PUBLIC_KEY, {
-  algorithms: ['RS256'],
-  issuer: 'https://api.example.com',
-  audience: 'https://app.example.com',
-});
-```
-## Role-Based Access Control (RBAC)
-### RBAC Model
-```
-Users → Roles → Permissions → Resources
-```
-### Implementation (NestJS Example)
-```typescript
-// Define roles
-export enum Role {
-  ADMIN = 'admin',
-  EDITOR = 'editor',
-  VIEWER = 'viewer',
-}
-// Role decorator
-export const Roles = (...roles: Role[]) => SetMetadata('roles', roles);
-// Guard implementation
-@Injectable()
-export class RolesGuard implements CanActivate {
-  constructor(private reflector: Reflector) {}
-  canActivate(context: ExecutionContext): boolean {
-    const requiredRoles = this.reflector.get<Role[]>('roles', context.getHandler());
-    if (!requiredRoles) return true;
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    return requiredRoles.some((role) => user.roles?.includes(role));
-  }
-}
-// Usage
-@Post()
-@UseGuards(JwtAuthGuard, RolesGuard)
-@Roles(Role.ADMIN, Role.EDITOR)
-async createPost(@Body() createPostDto: CreatePostDto) {
-  return this.postsService.create(createPostDto);
-}
-```
-### RBAC Best Practices
-1. **Deny by default** - Explicitly grant permissions
-2. **Least privilege** - Minimum permissions needed
-3. **Role hierarchy** - Admin inherits Editor inherits Viewer
-4. **Separate roles and permissions** - Flexible permission assignment
-5. **Audit trail** - Log role changes and access
-## Multi-Factor Authentication (MFA)
-### TOTP (Time-Based One-Time Password)
-```typescript
-import speakeasy from 'speakeasy';
-import QRCode from 'qrcode';
-// Generate secret
-const secret = speakeasy.generateSecret({
-  name: 'MyApp',
-  issuer: 'MyCompany',
-});
-// Generate QR code for user
-const qrCode = await QRCode.toDataURL(secret.otpauth_url);
-// Verify TOTP token
-const verified = speakeasy.totp.verify({
-  secret: secret.base32,
-  encoding: 'base32',
-  token: userToken,
-  window: 2, // Allow 2 time steps drift
-});
-```
-### FIDO2/WebAuthn (Passwordless - 2025 Standard)
-**Benefits:**
-- Phishing-resistant
-- No shared secrets
-- Hardware-backed security
-- Better UX (biometrics, security keys)
-**Implementation:**
-```typescript
-// Registration
-const publicKeyCredentialCreationOptions = {
-  challenge: crypto.randomBytes(32),
-  rp: { name: 'MyApp', id: 'example.com' },
-  user: {
-    id: Buffer.from(user.id),
-    name: user.email,
-    displayName: user.name,
-  },
-  pubKeyCredParams: [{ alg: -7, type: 'public-key' }], // ES256
-  authenticatorSelection: {
-    authenticatorAttachment: 'platform', // 'platform' or 'cross-platform'
-    userVerification: 'required',
-  },
-  timeout: 60000,
-  attestation: 'direct',
-};
-// Use @simplewebauthn/server library
-import { verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server';
-```
-## Session Management
-### Best Practices
-1. **Secure cookies** - HttpOnly, Secure, SameSite=Strict
-2. **Session timeout** - Idle: 15 minutes, Absolute: 8 hours
-3. **Regenerate session ID** - After login, privilege elevation
-4. **Server-side storage** - Redis for distributed systems
-5. **CSRF protection** - SameSite cookies + CSRF tokens
-### Implementation
-```typescript
-import session from 'express-session';
-import RedisStore from 'connect-redis';
-import { createClient } from 'redis';
-const redisClient = createClient();
-await redisClient.connect();
-app.use(
-  session({
-    store: new RedisStore({ client: redisClient }),
-    secret: process.env.SESSION_SECRET,
-    resave: false,
-    saveUninitialized: false,
-    cookie: {
-      secure: true, // HTTPS only
-      httpOnly: true, // No JavaScript access
-      sameSite: 'strict', // CSRF protection
-      maxAge: 1000 * 60 * 15, // 15 minutes
-    },
-  })
-);
-```
-## Password Security
-### Argon2id (2025 Standard - Replaces bcrypt)
-**Why Argon2id:**
-- Winner of Password Hashing Competition (2015)
-- Memory-hard (resistant to GPU/ASIC attacks)
-- Configurable CPU and memory cost
-- Combines Argon2i (data-independent) + Argon2d (data-dependent)
-```typescript
-import argon2 from 'argon2';
-// Hash password
-const hash = await argon2.hash('password123', {
-  type: argon2.argon2id,
-  memoryCost: 65536, // 64 MB
-  timeCost: 3, // 3 iterations
-  parallelism: 4, // 4 threads
-});
-// Verify password
-const valid = await argon2.verify(hash, 'password123');
-```
-### Password Policy (2025 NIST Guidelines)
-- **Minimum length:** 12 characters (not 8)
-- **No composition rules** - Allow passphrases
-- **Check against breach databases** - HaveIBeenPwned API
-- **No periodic rotation** - Only on compromise
-- **Allow all printable characters** - Including spaces, emojis
-## API Key Authentication
-### Best Practices
-1. **Prefix keys** - `sk_live_`, `pk_test_` (identify type/environment)
-2. **Hash stored keys** - Store SHA-256 hash, not plaintext
-3. **Key rotation** - Allow users to rotate keys
-4. **Scope limiting** - Separate keys for read/write operations
-5. **Rate limiting** - Per API key limits
-```typescript
-// Generate API key
-const apiKey = `sk_${env}_${crypto.randomBytes(24).toString('base64url')}`;
-// Store hashed version
-const hashedKey = crypto.createHash('sha256').update(apiKey).digest('hex');
-await db.apiKeys.create({ userId, hashedKey, scopes: ['read'] });
-// Validate API key
-const providedHash = crypto.createHash('sha256').update(providedKey).digest('hex');
-const keyRecord = await db.apiKeys.findOne({ hashedKey: providedHash });
-```
-## Authentication Decision Matrix
-| Use Case | Recommended Approach |
-|----------|---------------------|
-| Web application | OAuth 2.1 + JWT |
-| Mobile app | OAuth 2.1 + PKCE |
-| SPA (Single Page App) | OAuth 2.1 Authorization Code + PKCE |
-| Server-to-server | Client credentials grant + mTLS |
-| Third-party API access | API keys with scopes |
-| High-security | WebAuthn/FIDO2 + MFA |
-| Internal admin | JWT + RBAC + MFA |
-| Microservices | Service mesh (mTLS) + JWT |
-## Security Checklist
-- [ ] OAuth 2.1 with PKCE implemented
-- [ ] JWT tokens expire in 15 minutes
-- [ ] Refresh token rotation enabled
-- [ ] RBAC with deny-by-default
-- [ ] MFA required for admin accounts
-- [ ] Passwords hashed with Argon2id
-- [ ] Session cookies: HttpOnly, Secure, SameSite
-- [ ] Rate limiting on auth endpoints (10 attempts/15 min)
-- [ ] Account lockout after failed attempts
-- [ ] Password policy: 12+ chars, breach check
-- [ ] Audit logging for authentication events
-## Resources
-- **OAuth 2.1:** https://oauth.net/2.1/
-- **JWT Best Practices:** https://datatracker.ietf.org/doc/html/rfc8725
-- **WebAuthn:** https://webauthn.guide/
-- **NIST Password Guidelines:** https://pages.nist.gov/800-63-3/
-- **OWASP Auth Cheat Sheet:** https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

package/templates/repo/.github/skills/ck-backend-development/references/backend-security.md DELETED Viewed

@@ -1,290 +0,0 @@
-# Backend Security
-Security best practices, OWASP Top 10 mitigation, and modern security standards (2025).
-## OWASP Top 10 (2025 RC1)
-### New Entries (2025)
-- **Supply Chain Failures** - Vulnerable dependencies, compromised packages
-- **Mishandling of Exceptional Conditions** - Improper error handling exposing system info
-### Top Vulnerabilities & Mitigation
-#### 1. Broken Access Control
-**Risk:** Users access unauthorized resources (28% of vulnerabilities)
-**Mitigation:**
-- Implement RBAC (Role-Based Access Control)
-- Deny by default, explicitly allow
-- Log access control failures
-- Enforce authorization on backend (never client-side)
-- Use JWT with proper claims validation
-```typescript
-// Good: Server-side authorization check
-@UseGuards(JwtAuthGuard, RolesGuard)
-@Roles('admin')
-async deleteUser(@Param('id') id: string) {
-  // Verify user can access this resource
-  return this.usersService.delete(id);
-}
-```
-#### 2. Cryptographic Failures
-**Risk:** Sensitive data exposure, weak encryption
-**Mitigation:**
-- Use Argon2id for password hashing (replaces bcrypt as of 2025)
-- TLS 1.3 for data in transit
-- Encrypt sensitive data at rest (AES-256)
-- Use crypto.randomBytes() for tokens, not Math.random()
-- Never store passwords in plain text
-```python
-# Good: Argon2id password hashing
-from argon2 import PasswordHasher
-ph = PasswordHasher()
-hash = ph.hash("password123")  # Auto-salted, memory-hard
-ph.verify(hash, "password123")  # Verify password
-```
-#### 3. Injection Attacks
-**Risk:** SQL injection, NoSQL injection, command injection (6x increase 2020-2024)
-**Mitigation (98% vulnerability reduction):**
-- Use parameterized queries ALWAYS
-- Input validation with allow-lists
-- Escape special characters
-- Use ORMs properly (avoid raw queries)
-```typescript
-// Bad: Vulnerable to SQL injection
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-// Good: Parameterized query
-const query = 'SELECT * FROM users WHERE email = $1';
-const result = await db.query(query, [email]);
-```
-#### 4. Insecure Design
-**Risk:** Flawed architecture, missing security controls
-**Mitigation:**
-- Threat modeling during design phase
-- Security requirements from start
-- Principle of least privilege
-- Defense in depth (multiple security layers)
-#### 5. Security Misconfiguration
-**Risk:** Default credentials, verbose errors, unnecessary features enabled
-**Mitigation:**
-- Remove default accounts
-- Disable directory listing
-- Use security headers (CSP, HSTS, X-Frame-Options)
-- Minimize attack surface
-- Regular security audits
-```typescript
-// Security headers middleware
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'"],
-    },
-  },
-  hsts: {
-    maxAge: 31536000,
-    includeSubDomains: true,
-  },
-}));
-```
-#### 6. Vulnerable Components
-**Risk:** Outdated dependencies with known vulnerabilities
-**Mitigation:**
-- Regular dependency updates (npm audit, pip-audit)
-- Use Dependabot/Renovate for automated updates
-- Monitor CVE databases
-- Software composition analysis (SCA) in CI/CD
-- Lock file integrity checks
-```bash
-# Check for vulnerabilities
-npm audit fix
-pip-audit --fix
-```
-#### 7. Authentication Failures
-**Risk:** Weak passwords, session hijacking, credential stuffing
-**Mitigation:**
-- MFA mandatory for admin accounts
-- Rate limiting on login endpoints (10 attempts/minute)
-- Strong password policies (12+ chars, complexity)
-- Session timeout (15 mins idle, 8 hours absolute)
-- FIDO2/WebAuthn for passwordless auth
-#### 8. Software & Data Integrity Failures
-**Risk:** CI/CD pipeline compromise, unsigned updates
-**Mitigation:**
-- Code signing for releases
-- Verify integrity of packages (lock files)
-- Secure CI/CD pipelines (immutable builds)
-- Checksum verification
-#### 9. Logging & Monitoring Failures
-**Risk:** Breaches undetected, insufficient audit trail
-**Mitigation:**
-- Log authentication events (success/failure)
-- Log access control failures
-- Centralized logging (ELK Stack, Splunk)
-- Alerting on suspicious patterns
-- Log rotation and retention policies
-#### 10. Server-Side Request Forgery (SSRF)
-**Risk:** Server makes malicious requests to internal resources
-**Mitigation:**
-- Validate and sanitize URLs
-- Allow-list for remote resources
-- Network segmentation
-- Disable unnecessary protocols (file://, gopher://)
-## Input Validation (Prevents 70%+ Vulnerabilities)
-### Validation Strategies
-**1. Type Validation**
-```typescript
-// Use class-validator with NestJS
-class CreateUserDto {
-  @IsEmail()
-  email: string;
-  @IsString()
-  @MinLength(12)
-  @Matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/)
-  password: string;
-  @IsInt()
-  @Min(18)
-  age: number;
-}
-```
-**2. Sanitization**
-```typescript
-import DOMPurify from 'isomorphic-dompurify';
-// Sanitize HTML input
-const clean = DOMPurify.sanitize(userInput);
-```
-**3. Allow-lists (Preferred over Deny-lists)**
-```typescript
-// Good: Allow-list approach
-const allowedFields = ['name', 'email', 'age'];
-const sanitized = Object.keys(input)
-  .filter(key => allowedFields.includes(key))
-  .reduce((obj, key) => ({ ...obj, [key]: input[key] }), {});
-```
-## Rate Limiting
-### Token Bucket Algorithm (Industry Standard)
-```typescript
-import rateLimit from 'express-rate-limit';
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100, // 100 requests per window
-  standardHeaders: true,
-  legacyHeaders: false,
-  message: 'Too many requests, please try again later',
-});
-app.use('/api/', limiter);
-```
-### API-Specific Limits
-- **Authentication:** 10 attempts/15 min
-- **Public APIs:** 100 requests/15 min
-- **Authenticated APIs:** 1000 requests/15 min
-- **Admin endpoints:** 50 requests/15 min
-## Security Headers
-```typescript
-// Essential security headers (2025)
-{
-  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
-  'Content-Security-Policy': "default-src 'self'",
-  'X-Frame-Options': 'DENY',
-  'X-Content-Type-Options': 'nosniff',
-  'Referrer-Policy': 'strict-origin-when-cross-origin',
-  'Permissions-Policy': 'geolocation=(), microphone=()',
-}
-```
-## Secrets Management
-### Best Practices
-1. **Never commit secrets** - Use .env files (gitignored)
-2. **Environment-specific** - Different secrets per environment
-3. **Rotation policy** - Rotate secrets every 90 days
-4. **Encryption at rest** - Encrypt secrets in secret managers
-5. **Least privilege** - Minimal permissions per secret
-### Tools
-- **HashiCorp Vault** - Multi-cloud, dynamic secrets
-- **AWS Secrets Manager** - Managed service, auto-rotation
-- **Azure Key Vault** - Integrated with Azure services
-- **Pulumi ESC** - Unified secrets orchestration (2025 trend)
-```typescript
-// Good: Secrets from environment
-const dbPassword = process.env.DB_PASSWORD;
-if (!dbPassword) throw new Error('DB_PASSWORD not set');
-```
-## API Security Checklist
-- [ ] Use HTTPS/TLS 1.3 only
-- [ ] Implement OAuth 2.1 + JWT for authentication
-- [ ] Rate limiting on all endpoints
-- [ ] Input validation on all inputs
-- [ ] Parameterized queries (prevent SQL injection)
-- [ ] Security headers configured
-- [ ] CORS properly configured (not `*` in production)
-- [ ] API versioning implemented
-- [ ] Error messages don't leak system info
-- [ ] Logging authentication events
-- [ ] MFA for admin accounts
-- [ ] Regular security audits (quarterly)
-## Common Security Pitfalls
-1. **Client-side validation only** - Always validate on server
-2. **Using Math.random() for tokens** - Use crypto.randomBytes()
-3. **Storing passwords with bcrypt** - Use Argon2id (2025 standard)
-4. **Trusting user input** - Validate and sanitize everything
-5. **Weak CORS configuration** - Don't use `*` in production
-6. **Insufficient logging** - Log all authentication/authorization events
-7. **No rate limiting** - Implement on all public endpoints
-## Resources
-- **OWASP Top 10 (2025):** https://owasp.org/www-project-top-ten/
-- **OWASP Cheat Sheets:** https://cheatsheetseries.owasp.org/
-- **CWE Top 25:** https://cwe.mitre.org/top25/
-- **NIST Guidelines:** https://www.nist.gov/cybersecurity