create-genia-os 2.4.0 → 3.0.0

package/template/.aiox-core/development/tasks/security-audit.md

@@ -0,0 +1,554 @@
+# Task: Security Audit
+
+**Purpose**: Comprehensive database security and quality audit (RLS coverage, schema design, full system)
+
+**Elicit**: true
+
+**Consolidated From (Story 6.1.2.3):**
+- `db-rls-audit.md` - RLS policy coverage checking
+- `schema-audit.md` - Schema design quality validation
+
+---
+
+## Execution Modes
+
+**Choose your execution mode:**
+
+### 1. YOLO Mode - Fast, Autonomous (0-1 prompts)
+- Autonomous decision making with logging
+- Minimal user interaction
+- **Best for:** Simple, deterministic tasks
+
+### 2. Interactive Mode - Balanced, Educational (5-10 prompts) **[DEFAULT]**
+- Explicit decision checkpoints
+- Educational explanations
+- **Best for:** Learning, complex decisions
+
+### 3. Pre-Flight Planning - Comprehensive Upfront Planning
+- Task analysis phase (identify all ambiguities)
+- Zero ambiguity execution
+- **Best for:** Ambiguous requirements, critical work
+
+**Parameter:** `mode` (optional, default: `interactive`)
+
+---
+
+## Task Definition (AIOX Task Format V1.0)
+
+```yaml
+task: securityAudit()
+responsável: Quinn (Guardian)
+responsavel_type: Agente
+atomic_layer: Strategy
+
+**Entrada:**
+- campo: target
+  tipo: string
+  origem: User Input
+  obrigatório: true
+  validação: Valid path or resource
+
+- campo: scan_depth
+  tipo: number
+  origem: config
+  obrigatório: false
+  validação: Default: 2 (1-5)
+
+- campo: rules
+  tipo: array
+  origem: config
+  obrigatório: true
+  validação: Security rule set
+
+**Saída:**
+- campo: scan_report
+  tipo: object
+  destino: File (.ai/security/*)
+  persistido: true
+
+- campo: vulnerabilities
+  tipo: array
+  destino: Memory
+  persistido: false
+
+- campo: risk_score
+  tipo: number
+  destino: Memory
+  persistido: false
+```
+
+---
+
+## Pre-Conditions
+
+**Purpose:** Validate prerequisites BEFORE task execution (blocking)
+
+**Checklist:**
+
+```yaml
+pre-conditions:
+  - [ ] Scanner available; target accessible; rules configured
+    tipo: pre-condition
+    blocker: true
+    validação: |
+      Check scanner available; target accessible; rules configured
+    error_message: "Pre-condition failed: Scanner available; target accessible; rules configured"
+```
+
+---
+
+## Post-Conditions
+
+**Purpose:** Validate execution success AFTER task completes
+
+**Checklist:**
+
+```yaml
+post-conditions:
+  - [ ] Scan completed; vulnerabilities reported; no scan errors
+    tipo: post-condition
+    blocker: true
+    validação: |
+      Verify scan completed; vulnerabilities reported; no scan errors
+    error_message: "Post-condition failed: Scan completed; vulnerabilities reported; no scan errors"
+```
+
+---
+
+## Acceptance Criteria
+
+**Purpose:** Definitive pass/fail criteria for task completion
+
+**Checklist:**
+
+```yaml
+acceptance-criteria:
+  - [ ] No critical vulnerabilities; all checks passed
+    tipo: acceptance-criterion
+    blocker: true
+    validação: |
+      Assert no critical vulnerabilities; all checks passed
+    error_message: "Acceptance criterion not met: No critical vulnerabilities; all checks passed"
+```
+
+---
+
+## Tools
+
+**External/shared resources used by this task:**
+
+- **Tool:** security-scanner
+  - **Purpose:** Static security analysis and vulnerability detection
+  - **Source:** npm: eslint-plugin-security or similar
+
+- **Tool:** dependency-checker
+  - **Purpose:** Check for vulnerable dependencies
+  - **Source:** npm audit or snyk
+
+---
+
+## Scripts
+
+**Agent-specific code for this task:**
+
+- **Script:** security-scan.js
+  - **Purpose:** Run security scans and generate reports
+  - **Language:** JavaScript
+  - **Location:** .aiox-core/scripts/security-scan.js
+
+---
+
+## Error Handling
+
+**Strategy:** retry
+
+**Common Errors:**
+
+1. **Error:** Scanner Unavailable
+   - **Cause:** Security scanner not installed or failed
+   - **Resolution:** Install scanner or check configuration
+   - **Recovery:** Skip scan with high-risk warning
+
+2. **Error:** Critical Vulnerability Detected
+   - **Cause:** High-severity security issue found
+   - **Resolution:** Review vulnerability report, apply patches
+   - **Recovery:** Block deployment, alert team
+
+3. **Error:** Scan Timeout
+   - **Cause:** Large codebase exceeds scan time limit
+   - **Resolution:** Reduce scope or increase timeout
+   - **Recovery:** Partial scan results with warning
+
+---
+
+## Performance
+
+**Expected Metrics:**
+
+```yaml
+duration_expected: 5-20 min (estimated)
+cost_estimated: $0.003-0.015
+token_usage: ~2,000-8,000 tokens
+```
+
+**Optimization Notes:**
+- Iterative analysis with depth limits; cache intermediate results; batch similar operations
+
+---
+
+## Metadata
+
+```yaml
+story: N/A
+version: 1.0.0
+dependencies:
+  - N/A
+tags:
+  - security
+  - audit
+updated_at: 2025-11-17
+```
+
+---
+
+
+## Elicitation
+
+**Prompt user to select audit scope:**
+
+```
+Select security audit scope:
+
+1. **rls** - RLS policy coverage only (quick)
+2. **schema** - Schema design quality only (quick)
+3. **full** - Complete security audit (comprehensive)
+
+Which scope? [rls/schema/full]:
+```
+
+**Capture:** `{scope}`
+
+---
+
+## Process
+
+### Scope: RLS Audit
+
+**When:** User selects `rls` or `full`
+
+**Purpose:** Report tables with/without RLS and list all policies
+
+```bash
+psql "$SUPABASE_DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
+\echo '=== RLS Coverage Audit ==='
+\echo ''
+
+-- Tables with/without RLS
+WITH t AS (
+  SELECT tablename, rowsecurity
+  FROM pg_tables WHERE schemaname='public'
+)
+SELECT
+  tablename,
+  CASE WHEN rowsecurity THEN '✓ ENABLED' ELSE '❌ DISABLED' END AS rls_status,
+  (SELECT json_agg(json_build_object(
+    'policy', policyname,
+    'cmd', cmd,
+    'roles', roles,
+    'qual', qual,
+    'with_check', with_check
+  ))
+   FROM pg_policies p
+   WHERE p.tablename=t.tablename
+   AND p.schemaname='public') AS policies
+FROM t
+ORDER BY rowsecurity DESC, tablename;
+
+\echo ''
+\echo '=== RLS Summary ==='
+
+SELECT
+  COUNT(*) AS total_tables,
+  COUNT(*) FILTER (WHERE rowsecurity) AS rls_enabled,
+  COUNT(*) FILTER (WHERE NOT rowsecurity) AS rls_disabled
+FROM pg_tables
+WHERE schemaname='public';
+
+\echo ''
+\echo '=== Tables Without RLS (Security Risk) ==='
+
+SELECT tablename
+FROM pg_tables
+WHERE schemaname='public'
+AND rowsecurity = false
+ORDER BY tablename;
+
+\echo ''
+\echo '=== Policy Coverage by Command ==='
+
+SELECT
+  tablename,
+  COUNT(*) FILTER (WHERE cmd='SELECT') AS select_policies,
+  COUNT(*) FILTER (WHERE cmd='INSERT') AS insert_policies,
+  COUNT(*) FILTER (WHERE cmd='UPDATE') AS update_policies,
+  COUNT(*) FILTER (WHERE cmd='DELETE') AS delete_policies
+FROM pg_policies
+WHERE schemaname='public'
+GROUP BY tablename
+ORDER BY tablename;
+
+SQL
+```
+
+---
+
+### Scope: Schema Audit
+
+**When:** User selects `schema` or `full`
+
+**Purpose:** Validate schema design quality and best practices
+
+```bash
+psql "$SUPABASE_DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
+\echo '=== Schema Design Quality Audit ==='
+\echo ''
+
+-- Missing Primary Keys
+\echo '1. Tables Without Primary Keys (CRITICAL):'
+SELECT t.tablename
+FROM pg_tables t
+LEFT JOIN pg_constraint c ON c.conrelid = (t.schemaname||'.'||t.tablename)::regclass
+  AND c.contype = 'p'
+WHERE t.schemaname = 'public'
+  AND c.conname IS NULL
+ORDER BY t.tablename;
+
+\echo ''
+\echo '2. Missing NOT NULL on Required Fields:'
+SELECT
+  table_name,
+  column_name,
+  data_type
+FROM information_schema.columns
+WHERE table_schema = 'public'
+  AND is_nullable = 'YES'
+  AND column_name IN ('email', 'user_id', 'created_at', 'updated_at', 'status')
+ORDER BY table_name, column_name;
+
+\echo ''
+\echo '3. Missing Foreign Key Constraints:'
+-- Tables with _id columns but no FK
+SELECT
+  c.table_name,
+  c.column_name,
+  'Missing FK to ' || REPLACE(c.column_name, '_id', 's') AS suggestion
+FROM information_schema.columns c
+LEFT JOIN information_schema.table_constraints tc
+  ON tc.table_name = c.table_name
+  AND tc.constraint_type = 'FOREIGN KEY'
+LEFT JOIN information_schema.key_column_usage kcu
+  ON kcu.constraint_name = tc.constraint_name
+  AND kcu.column_name = c.column_name
+WHERE c.table_schema = 'public'
+  AND c.column_name LIKE '%_id'
+  AND c.column_name != 'id'
+  AND kcu.column_name IS NULL
+ORDER BY c.table_name, c.column_name;
+
+\echo ''
+\echo '4. Missing Audit Timestamps (created_at, updated_at):'
+SELECT
+  t.tablename,
+  CASE WHEN created_col.column_name IS NULL THEN '❌ No created_at' ELSE '✓' END AS created,
+  CASE WHEN updated_col.column_name IS NULL THEN '❌ No updated_at' ELSE '✓' END AS updated
+FROM pg_tables t
+LEFT JOIN information_schema.columns created_col
+  ON created_col.table_name = t.tablename
+  AND created_col.column_name = 'created_at'
+  AND created_col.table_schema = 'public'
+LEFT JOIN information_schema.columns updated_col
+  ON updated_col.table_name = t.tablename
+  AND updated_col.column_name = 'updated_at'
+  AND updated_col.table_schema = 'public'
+WHERE t.schemaname = 'public'
+  AND (created_col.column_name IS NULL OR updated_col.column_name IS NULL)
+ORDER BY t.tablename;
+
+\echo ''
+\echo '5. Missing Indexes on Foreign Keys:'
+SELECT
+  t.tablename,
+  c.column_name,
+  'CREATE INDEX idx_' || t.tablename || '_' || c.column_name || ' ON ' || t.tablename || '(' || c.column_name || ');' AS suggested_index
+FROM pg_tables t
+JOIN information_schema.columns c ON c.table_name = t.tablename
+LEFT JOIN pg_indexes i ON i.tablename = t.tablename
+  AND i.indexdef LIKE '%' || c.column_name || '%'
+WHERE t.schemaname = 'public'
+  AND c.table_schema = 'public'
+  AND c.column_name LIKE '%_id'
+  AND c.column_name != 'id'
+  AND i.indexname IS NULL
+ORDER BY t.tablename, c.column_name;
+
+\echo ''
+\echo '=== Schema Audit Summary ==='
+SELECT
+  (SELECT COUNT(*) FROM pg_tables WHERE schemaname='public') AS total_tables,
+  (SELECT COUNT(DISTINCT tablename) FROM pg_policies WHERE schemaname='public') AS tables_with_policies,
+  (SELECT COUNT(*) FROM pg_constraint WHERE contype='f') AS foreign_keys,
+  (SELECT COUNT(*) FROM pg_indexes WHERE schemaname='public') AS total_indexes;
+
+SQL
+```
+
+---
+
+### Scope: Full Audit
+
+**When:** User selects `full`
+
+**Executes:** Both RLS audit + Schema audit sequentially
+
+**Additional Checks:**
+
+```bash
+psql "$SUPABASE_DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
+\echo ''
+\echo '=== Security Best Practices Check ==='
+\echo ''
+
+-- Check for sensitive data exposure
+\echo '6. Potential PII/Sensitive Columns (Review for RLS):'
+SELECT
+  table_name,
+  column_name,
+  data_type
+FROM information_schema.columns
+WHERE table_schema = 'public'
+  AND (
+    column_name ILIKE '%password%'
+    OR column_name ILIKE '%token%'
+    OR column_name ILIKE '%secret%'
+    OR column_name ILIKE '%ssn%'
+    OR column_name ILIKE '%credit%'
+    OR column_name ILIKE '%api_key%'
+  )
+ORDER BY table_name, column_name;
+
+\echo ''
+\echo '7. Public Schema Permissions:'
+SELECT
+  schemaname,
+  tablename,
+  tableowner,
+  hasindexes,
+  hasrules,
+  hastriggers
+FROM pg_tables
+WHERE schemaname = 'public'
+ORDER BY tablename;
+
+SQL
+```
+
+---
+
+## Output
+
+### RLS Audit Output
+
+```
+=== RLS Coverage Audit ===
+
+ tablename | rls_status |           policies
+-----------+------------+-------------------------------
+ users     | ✓ ENABLED  | [{"policy":"Users read own",...}]
+ posts     | ✓ ENABLED  | [{"policy":"Public read",...}]
+ secrets   | ❌ DISABLED| null
+
+=== RLS Summary ===
+
+ total_tables | rls_enabled | rls_disabled
+--------------+-------------+--------------
+           10 |           8 |            2
+
+=== Tables Without RLS (Security Risk) ===
+
+ tablename
+-----------
+ secrets
+ internal_logs
+```
+
+### Schema Audit Output
+
+```
+=== Schema Design Quality Audit ===
+
+1. Tables Without Primary Keys (CRITICAL):
+ tablename
+-----------
+ (0 rows) ✓
+
+2. Missing NOT NULL on Required Fields:
+ table_name | column_name | data_type
+------------+-------------+-----------
+ users      | email       | text
+
+3. Missing Foreign Key Constraints:
+ table_name | column_name | suggestion
+------------+-------------+----------------------
+ posts      | user_id     | Missing FK to users
+
+... (additional checks)
+```
+
+---
+
+## Interpretation
+
+### Critical Issues (Fix Immediately)
+
+- **RLS Disabled:** Tables without RLS are publicly accessible
+- **No Primary Keys:** Data integrity at risk
+- **Sensitive Columns Exposed:** PII/secrets without RLS protection
+
+### High Priority Issues (Fix Soon)
+
+- **Missing Foreign Keys:** Data integrity and query performance
+- **Missing NOT NULL:** Data quality issues
+- **Missing Indexes on FKs:** Query performance degradation
+
+### Medium Priority Issues (Technical Debt)
+
+- **Missing Audit Timestamps:** Tracking challenges
+- **Inconsistent Naming:** Maintainability issues
+
+---
+
+## Recommendations
+
+**After RLS Audit:**
+1. Enable RLS on all public tables: `ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;`
+2. Create policies for all CRUD operations (use `*policy-apply` command)
+3. Test with `*test-as-user` command
+
+**After Schema Audit:**
+1. Add missing primary keys: `ALTER TABLE {table} ADD PRIMARY KEY (id);`
+2. Add missing foreign keys: `ALTER TABLE {table} ADD FOREIGN KEY ({col}) REFERENCES {ref_table}(id);`
+3. Add missing NOT NULL: `ALTER TABLE {table} ALTER COLUMN {col} SET NOT NULL;`
+4. Create indexes on foreign keys: `CREATE INDEX idx_{table}_{col} ON {table}({col});`
+
+---
+
+## Related Commands
+
+- `*policy-apply {table} {mode}` - Install RLS policies after audit
+- `*test-as-user {user_id}` - Test RLS policies
+- `*verify-order {migration}` - Validate migration DDL ordering
+- `*create-migration-plan` - Plan schema changes
+
+---
+
+**Note:** This consolidated task replaces `db-rls-audit.md` and `schema-audit.md` (deprecated in v3.0)