devfortress-sdk 4.2.0 → 4.2.1

package/dist/internal-closed-loop-engine.js

@@ -0,0 +1,683 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalClosedLoopEngine = void 0;
+class BoundedMap {
+    constructor(maxSize) {
+        this.map = new Map();
+        this.maxSize = maxSize;
+    }
+    get(key) {
+        const val = this.map.get(key);
+        if (val !== undefined) {
+            this.map.delete(key);
+            this.map.set(key, val);
+        }
+        return val;
+    }
+    set(key, value) {
+        if (this.map.has(key)) {
+            this.map.delete(key);
+        }
+        else if (this.map.size >= this.maxSize) {
+            const first = this.map.keys().next().value;
+            if (first !== undefined)
+                this.map.delete(first);
+        }
+        this.map.set(key, value);
+    }
+    has(key) {
+        return this.map.has(key);
+    }
+    delete(key) {
+        return this.map.delete(key);
+    }
+    get size() {
+        return this.map.size;
+    }
+    clear() {
+        this.map.clear();
+    }
+    values() {
+        return this.map.values();
+    }
+    keys() {
+        return this.map.keys();
+    }
+}
+const SQL_INJECTION_PATTERNS = [
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER|CREATE|TRUNCATE)\b.*\b(FROM|INTO|TABLE|SET|WHERE)\b)/i,
+    /(\bOR\b\s+\d+\s*=\s*\d+)/i,
+    /(';\s*--)/,
+    /(\/\*.*\*\/)/,
+    /(\bEXEC\b|\bEXECUTE\b)\s*\(/i,
+    /(\bxp_\w+)/i,
+];
+const XSS_PATTERNS = [
+    /<script[\s>]/i,
+    /javascript\s*:/i,
+    /on(load|error|click|mouseover|submit|focus|blur)\s*=/i,
+    /(<iframe|<object|<embed|<applet)/i,
+    /(document\.(cookie|write|location))/i,
+    /(window\.(location|open))/i,
+];
+const PATH_TRAVERSAL_PATTERNS = [
+    /\.\.\//,
+    /\.\.%2[fF]/,
+    /\.\.\\$/,
+    /%2e%2e[%\/\\]/i,
+    /\/etc\/(passwd|shadow|hosts)/,
+    /\/proc\/self/,
+    /(\/\.env|\/\.git|\/\.ssh)/,
+];
+const SCANNER_SIGNATURES = [
+    /sqlmap/i,
+    /nikto/i,
+    /nmap/i,
+    /dirbuster/i,
+    /gobuster/i,
+    /wpscan/i,
+    /burp\s*suite/i,
+    /acunetix/i,
+    /nessus/i,
+    /masscan/i,
+    /zgrab/i,
+    /nuclei/i,
+];
+class InternalClosedLoopEngine {
+    constructor(config = {}) {
+        this.auditLog = [];
+        this.rules = [];
+        this.eventCounter = 0;
+        this.config = {
+            failMode: config.failMode ?? 'closed',
+            enableExternalRelay: config.enableExternalRelay ?? false,
+            maxBlockedEntries: config.maxBlockedEntries ?? 10000,
+            maxRateLimitEntries: config.maxRateLimitEntries ?? 50000,
+            maxAuditEntries: config.maxAuditEntries ?? 100000,
+            defaultBlockTtlSeconds: config.defaultBlockTtlSeconds ?? 3600,
+            tier2Scorer: config.tier2Scorer,
+            blockThreshold: config.blockThreshold ?? 85,
+            rateLimitThreshold: config.rateLimitThreshold ?? 60,
+            rateLimitMax: config.rateLimitMax ?? 100,
+            rateLimitWindowMs: config.rateLimitWindowMs ?? 60000,
+            debug: config.debug ?? false,
+            onAction: config.onAction,
+        };
+        this.blockedIPs = new BoundedMap(this.config.maxBlockedEntries);
+        this.blockedUsers = new BoundedMap(this.config.maxBlockedEntries);
+        this.blockedSessions = new BoundedMap(this.config.maxBlockedEntries);
+        this.quarantinedAgents = new BoundedMap(this.config.maxBlockedEntries);
+        this.rateLimiter = new BoundedMap(this.config.maxRateLimitEntries);
+        this.registerDefaultRules();
+        this.log('info', `Internal Closed-Loop Engine initialized (failMode=${this.config.failMode})`);
+    }
+    async evaluate(req) {
+        const startTime = performance.now();
+        const now = req.timestamp ?? Date.now();
+        const eventId = this.generateEventId();
+        try {
+            const preCheck = this.checkBlocked(req, now);
+            if (preCheck) {
+                const elapsed = Math.round((performance.now() - startTime) * 1000);
+                const result = {
+                    decision: preCheck.decision,
+                    score: 100,
+                    tier: 1,
+                    matchedRules: [preCheck.reason],
+                    evaluationTimeUs: elapsed,
+                    actions: [],
+                    eventId,
+                };
+                this.recordAudit(result, req);
+                return result;
+            }
+            const tier1Result = this.evaluateTier1(req);
+            if (tier1Result.decision !== 'allow') {
+                const elapsed = Math.round((performance.now() - startTime) * 1000);
+                const actions = this.executeActions(tier1Result, req, eventId, now);
+                const result = {
+                    ...tier1Result,
+                    evaluationTimeUs: elapsed,
+                    actions,
+                    eventId,
+                };
+                this.recordAudit(result, req);
+                if (this.config.enableExternalRelay) {
+                    this.relayToExternal(result, req).catch(() => { });
+                }
+                return result;
+            }
+            const rateLimited = this.checkRateLimit(req.ip, now);
+            if (rateLimited) {
+                const elapsed = Math.round((performance.now() - startTime) * 1000);
+                const actions = this.executeActions({
+                    decision: 'rate_limit',
+                    score: 65,
+                    tier: 1,
+                    matchedRules: ['rate_limit_exceeded'],
+                }, req, eventId, now);
+                const result = {
+                    decision: 'rate_limit',
+                    score: 65,
+                    tier: 1,
+                    matchedRules: ['rate_limit_exceeded'],
+                    evaluationTimeUs: elapsed,
+                    actions,
+                    eventId,
+                };
+                this.recordAudit(result, req);
+                return result;
+            }
+            this.recordRequest(req.ip, now);
+            if (this.config.tier2Scorer) {
+                const tier2Score = await this.config.tier2Scorer(req);
+                if (tier2Score >= this.config.blockThreshold) {
+                    const elapsed = Math.round((performance.now() - startTime) * 1000);
+                    const tier2Decision = {
+                        decision: 'block',
+                        score: tier2Score,
+                        tier: 2,
+                        matchedRules: ['tier2_ml_score'],
+                    };
+                    const actions = this.executeActions(tier2Decision, req, eventId, now);
+                    const result = {
+                        ...tier2Decision,
+                        evaluationTimeUs: elapsed,
+                        actions,
+                        eventId,
+                    };
+                    this.recordAudit(result, req);
+                    if (this.config.enableExternalRelay) {
+                        this.relayToExternal(result, req).catch(() => { });
+                    }
+                    return result;
+                }
+                else if (tier2Score >= this.config.rateLimitThreshold) {
+                    const elapsed = Math.round((performance.now() - startTime) * 1000);
+                    const result = {
+                        decision: 'rate_limit',
+                        score: tier2Score,
+                        tier: 2,
+                        matchedRules: ['tier2_ml_elevated'],
+                        evaluationTimeUs: elapsed,
+                        actions: [],
+                        eventId,
+                    };
+                    this.recordAudit(result, req);
+                    return result;
+                }
+            }
+            const elapsed = Math.round((performance.now() - startTime) * 1000);
+            const result = {
+                decision: 'allow',
+                score: 0,
+                tier: 1,
+                matchedRules: [],
+                evaluationTimeUs: elapsed,
+                actions: [],
+                eventId,
+            };
+            return result;
+        }
+        catch (error) {
+            const elapsed = Math.round((performance.now() - startTime) * 1000);
+            this.log('error', `Evaluation error: ${error instanceof Error ? error.message : 'Unknown'}`);
+            if (this.config.failMode === 'closed') {
+                return {
+                    decision: 'block',
+                    score: 100,
+                    tier: 1,
+                    matchedRules: ['fail_closed_error'],
+                    evaluationTimeUs: elapsed,
+                    actions: [],
+                    eventId,
+                };
+            }
+            return {
+                decision: 'allow',
+                score: 0,
+                tier: 1,
+                matchedRules: ['fail_open_error'],
+                evaluationTimeUs: elapsed,
+                actions: [],
+                eventId,
+            };
+        }
+    }
+    blockIP(ip, reason, ttlSeconds) {
+        const ttl = ttlSeconds ?? this.config.defaultBlockTtlSeconds;
+        this.blockedIPs.set(ip, {
+            expiresAt: Date.now() + ttl * 1000,
+            reason,
+        });
+        this.log('info', `IP blocked: ${ip} — ${reason} (TTL: ${ttl}s)`);
+    }
+    unblockIP(ip) {
+        const existed = this.blockedIPs.has(ip);
+        this.blockedIPs.delete(ip);
+        if (existed)
+            this.log('info', `IP unblocked: ${ip}`);
+        return existed;
+    }
+    blockUser(userId, reason, ttlSeconds) {
+        const ttl = ttlSeconds ?? this.config.defaultBlockTtlSeconds;
+        this.blockedUsers.set(userId, {
+            expiresAt: Date.now() + ttl * 1000,
+            reason,
+        });
+        this.log('info', `User blocked: ${userId} — ${reason}`);
+    }
+    blockSession(sessionId, reason, ttlSeconds) {
+        const ttl = ttlSeconds ?? this.config.defaultBlockTtlSeconds;
+        this.blockedSessions.set(sessionId, {
+            expiresAt: Date.now() + ttl * 1000,
+            reason,
+        });
+        this.log('info', `Session blocked: ${sessionId} — ${reason}`);
+    }
+    quarantineAgent(agentId, reason) {
+        this.quarantinedAgents.set(agentId, {
+            reason,
+            timestamp: Date.now(),
+        });
+        this.log('info', `Agent quarantined: ${agentId} — ${reason}`);
+    }
+    unquarantineAgent(agentId) {
+        const existed = this.quarantinedAgents.has(agentId);
+        this.quarantinedAgents.delete(agentId);
+        if (existed)
+            this.log('info', `Agent unquarantined: ${agentId}`);
+        return existed;
+    }
+    isIPBlocked(ip) {
+        const entry = this.blockedIPs.get(ip);
+        if (!entry)
+            return false;
+        if (Date.now() > entry.expiresAt) {
+            this.blockedIPs.delete(ip);
+            return false;
+        }
+        return true;
+    }
+    isAgentQuarantined(agentId) {
+        return this.quarantinedAgents.has(agentId);
+    }
+    addRule(rule) {
+        this.rules.push(rule);
+        this.log('debug', `Rule added: ${rule.name}`);
+    }
+    removeRule(name) {
+        const idx = this.rules.findIndex(r => r.name === name);
+        if (idx >= 0) {
+            this.rules.splice(idx, 1);
+            this.log('debug', `Rule removed: ${name}`);
+            return true;
+        }
+        return false;
+    }
+    getRules() {
+        return this.rules.map(({ name, description, severity, score, decision, enabled }) => ({
+            name,
+            description,
+            severity,
+            score,
+            decision,
+            enabled,
+        }));
+    }
+    getAuditLog(limit = 100) {
+        return this.auditLog.slice(-limit);
+    }
+    getStats() {
+        return {
+            blockedIPs: this.blockedIPs.size,
+            blockedUsers: this.blockedUsers.size,
+            blockedSessions: this.blockedSessions.size,
+            quarantinedAgents: this.quarantinedAgents.size,
+            rateLimitEntries: this.rateLimiter.size,
+            auditLogSize: this.auditLog.length,
+            rulesCount: this.rules.length,
+            failMode: this.config.failMode,
+        };
+    }
+    importBlockedIPs(entries) {
+        let count = 0;
+        for (const entry of entries) {
+            this.blockIP(entry.ip, entry.reason, entry.ttlSeconds);
+            count++;
+        }
+        return count;
+    }
+    _reset() {
+        this.blockedIPs.clear();
+        this.blockedUsers.clear();
+        this.blockedSessions.clear();
+        this.quarantinedAgents.clear();
+        this.rateLimiter.clear();
+        this.auditLog = [];
+        this.eventCounter = 0;
+    }
+    checkBlocked(req, now) {
+        const ipBlock = this.blockedIPs.get(req.ip);
+        if (ipBlock) {
+            if (now > ipBlock.expiresAt) {
+                this.blockedIPs.delete(req.ip);
+            }
+            else {
+                return { decision: 'block', reason: `ip_blocked:${ipBlock.reason}` };
+            }
+        }
+        if (req.userId) {
+            const userBlock = this.blockedUsers.get(req.userId);
+            if (userBlock) {
+                if (now > userBlock.expiresAt) {
+                    this.blockedUsers.delete(req.userId);
+                }
+                else {
+                    return {
+                        decision: 'block',
+                        reason: `user_blocked:${userBlock.reason}`,
+                    };
+                }
+            }
+        }
+        if (req.sessionId) {
+            const sessionBlock = this.blockedSessions.get(req.sessionId);
+            if (sessionBlock) {
+                if (now > sessionBlock.expiresAt) {
+                    this.blockedSessions.delete(req.sessionId);
+                }
+                else {
+                    return {
+                        decision: 'block',
+                        reason: `session_blocked:${sessionBlock.reason}`,
+                    };
+                }
+            }
+        }
+        if (req.agentId) {
+            if (this.quarantinedAgents.has(req.agentId)) {
+                return {
+                    decision: 'quarantine',
+                    reason: `agent_quarantined:${req.agentId}`,
+                };
+            }
+        }
+        return null;
+    }
+    evaluateTier1(req) {
+        const matchedRules = [];
+        let maxScore = 0;
+        let decision = 'allow';
+        for (const rule of this.rules) {
+            if (!rule.enabled)
+                continue;
+            try {
+                if (rule.match(req)) {
+                    matchedRules.push(rule.name);
+                    if (rule.score > maxScore) {
+                        maxScore = rule.score;
+                        decision = rule.decision;
+                    }
+                }
+            }
+            catch {
+                this.log('error', `Rule ${rule.name} threw an error`);
+            }
+        }
+        return {
+            decision,
+            score: maxScore,
+            tier: 1,
+            matchedRules,
+        };
+    }
+    checkRateLimit(ip, now) {
+        const entry = this.rateLimiter.get(ip);
+        if (!entry)
+            return false;
+        const windowStart = now - this.config.rateLimitWindowMs;
+        entry.timestamps = entry.timestamps.filter(t => t > windowStart);
+        if (entry.timestamps.length >= this.config.rateLimitMax) {
+            entry.blocked = true;
+            return true;
+        }
+        return false;
+    }
+    recordRequest(ip, now) {
+        let entry = this.rateLimiter.get(ip);
+        if (!entry) {
+            entry = { timestamps: [], blocked: false };
+        }
+        entry.timestamps.push(now);
+        this.rateLimiter.set(ip, entry);
+    }
+    executeActions(result, req, eventId, now) {
+        const actions = [];
+        const ttl = this.config.defaultBlockTtlSeconds;
+        if (result.decision === 'block' || result.decision === 'quarantine') {
+            this.blockedIPs.set(req.ip, {
+                expiresAt: now + ttl * 1000,
+                reason: result.matchedRules.join(', '),
+            });
+            actions.push({
+                type: 'block_ip',
+                target: req.ip,
+                reason: result.matchedRules.join(', '),
+                ttlSeconds: ttl,
+                timestamp: now,
+                eventId,
+            });
+            if (req.sessionId) {
+                this.blockedSessions.set(req.sessionId, {
+                    expiresAt: now + ttl * 1000,
+                    reason: result.matchedRules.join(', '),
+                });
+                actions.push({
+                    type: 'block_session',
+                    target: req.sessionId,
+                    reason: result.matchedRules.join(', '),
+                    ttlSeconds: ttl,
+                    timestamp: now,
+                    eventId,
+                });
+            }
+            if (req.agentId) {
+                this.quarantinedAgents.set(req.agentId, {
+                    reason: result.matchedRules.join(', '),
+                    timestamp: now,
+                });
+                actions.push({
+                    type: 'quarantine_agent',
+                    target: req.agentId,
+                    reason: result.matchedRules.join(', '),
+                    ttlSeconds: 0,
+                    timestamp: now,
+                    eventId,
+                });
+            }
+        }
+        if (this.config.onAction) {
+            for (const action of actions) {
+                try {
+                    const maybePromise = this.config.onAction(action);
+                    if (maybePromise &&
+                        typeof maybePromise.catch === 'function') {
+                        maybePromise.catch(() => { });
+                    }
+                }
+                catch {
+                    this.log('error', `onAction callback error for ${action.type}`);
+                }
+            }
+        }
+        return actions;
+    }
+    recordAudit(result, req) {
+        if (this.auditLog.length >= this.config.maxAuditEntries) {
+            this.auditLog.splice(0, Math.floor(this.config.maxAuditEntries * 0.1));
+        }
+        this.auditLog.push({
+            eventId: result.eventId,
+            timestamp: req.timestamp ?? Date.now(),
+            ip: req.ip,
+            decision: result.decision,
+            score: result.score,
+            tier: result.tier,
+            matchedRules: result.matchedRules,
+            userId: req.userId,
+            agentId: req.agentId,
+            path: req.path,
+            method: req.method,
+        });
+    }
+    async relayToExternal(result, req) {
+        this.log('debug', `Tier 3 relay: ${result.eventId} → external platform`);
+    }
+    generateEventId() {
+        this.eventCounter++;
+        const ts = Date.now().toString(36);
+        const counter = this.eventCounter.toString(36).padStart(4, '0');
+        const rand = Math.random().toString(36).substring(2, 6);
+        return `icl_${ts}_${counter}_${rand}`;
+    }
+    registerDefaultRules() {
+        this.rules.push({
+            name: 'sql_injection',
+            description: 'Detects SQL injection patterns in path, query, and body',
+            severity: 'critical',
+            score: 95,
+            decision: 'block',
+            enabled: true,
+            match: req => {
+                const targets = [req.path, req.query, req.body].filter(Boolean);
+                return targets.some(t => SQL_INJECTION_PATTERNS.some(p => p.test(t)));
+            },
+        });
+        this.rules.push({
+            name: 'xss_attempt',
+            description: 'Detects cross-site scripting patterns',
+            severity: 'high',
+            score: 90,
+            decision: 'block',
+            enabled: true,
+            match: req => {
+                const targets = [req.path, req.query, req.body].filter(Boolean);
+                return targets.some(t => XSS_PATTERNS.some(p => p.test(t)));
+            },
+        });
+        this.rules.push({
+            name: 'path_traversal',
+            description: 'Detects directory traversal attempts',
+            severity: 'high',
+            score: 90,
+            decision: 'block',
+            enabled: true,
+            match: req => {
+                const targets = [req.path, req.query].filter(Boolean);
+                return targets.some(t => PATH_TRAVERSAL_PATTERNS.some(p => p.test(t)));
+            },
+        });
+        this.rules.push({
+            name: 'scanner_detected',
+            description: 'Detects known vulnerability scanner user agents',
+            severity: 'medium',
+            score: 75,
+            decision: 'block',
+            enabled: true,
+            match: req => {
+                if (!req.userAgent)
+                    return false;
+                return SCANNER_SIGNATURES.some(p => p.test(req.userAgent));
+            },
+        });
+        this.rules.push({
+            name: 'sensitive_file_access',
+            description: 'Detects access to sensitive files (.env, .git, wp-admin, etc.)',
+            severity: 'high',
+            score: 85,
+            decision: 'block',
+            enabled: true,
+            match: req => {
+                const sensitivePatterns = [
+                    /\/\.env/,
+                    /\/\.git/,
+                    /\/\.ssh/,
+                    /\/wp-admin/,
+                    /\/wp-login/,
+                    /\/phpmyadmin/i,
+                    /\/admin\.php/,
+                    /\/\.htaccess/,
+                    /\/\.htpasswd/,
+                    /\/server-status/,
+                    /\/actuator/,
+                    /\/debug\//,
+                ];
+                return sensitivePatterns.some(p => p.test(req.path));
+            },
+        });
+        this.rules.push({
+            name: 'credential_stuffing_pattern',
+            description: 'Detects credential stuffing via POST to auth endpoints',
+            severity: 'high',
+            score: 80,
+            decision: 'rate_limit',
+            enabled: true,
+            match: req => {
+                if (req.method !== 'POST')
+                    return false;
+                const authPaths = [
+                    '/login',
+                    '/signin',
+                    '/auth',
+                    '/api/auth',
+                    '/api/login',
+                    '/oauth/token',
+                ];
+                return authPaths.some(p => req.path.toLowerCase().includes(p));
+            },
+        });
+        this.rules.push({
+            name: 'agent_unsanctioned_tool',
+            description: 'Detects agent attempting to use dangerous tools',
+            severity: 'critical',
+            score: 95,
+            decision: 'quarantine',
+            enabled: true,
+            match: req => {
+                if (!req.agentId || !req.toolName)
+                    return false;
+                const dangerousTools = [
+                    'shell_exec',
+                    'eval',
+                    'exec',
+                    'rm',
+                    'sudo',
+                    'chmod',
+                    'kill',
+                ];
+                return dangerousTools.includes(req.toolName.toLowerCase());
+            },
+        });
+    }
+    log(level, message) {
+        if (!this.config.debug && level === 'debug')
+            return;
+        const prefix = '[DevFortress ICL]';
+        switch (level) {
+            case 'error':
+                console.error(`${prefix} ${message}`);
+                break;
+            case 'warn':
+                console.warn(`${prefix} ${message}`);
+                break;
+            case 'info':
+            case 'debug':
+                if (this.config.debug) {
+                    console.log(`${prefix} ${message}`);
+                }
+                break;
+        }
+    }
+}
+exports.InternalClosedLoopEngine = InternalClosedLoopEngine;

package/dist/middleware/express.d.ts

@@ -1,9 +1,3 @@
-/**
- * Express.js Middleware for DevFortress Surveillance
- */
 import { Request, Response, NextFunction } from 'express';
 import type { DevFortressMiddlewareOptions } from '../types';
-/**
- * Create Express middleware for automatic threat monitoring
- */
 export declare function devfortressMiddleware(options: DevFortressMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;