enigma-memory 0.1.16 → 0.1.18

package/scripts/scan-secrets.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+// Enigma Memory — working-tree secret scanner.
+// Scans for PEM private keys, bearer-token patterns, DSNs, AWS-style keys,
+// and literal SECURITY.md placeholders. Approved test fixtures must carry an
+// explicit approval comment on the same or previous non-empty line:
+//   // secret-scan:approved
+//   # secret-scan:approved
+// This script exits non-zero when any unapproved detection remains.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const __filename = fileURLToPath(import.meta.url)
+const APPROVAL_MARKERS = [
+  /secret-scan:(?:approved|ignore)/i,
+  /\bno[-_]?secret[-_]?scan\b/i,
+]
+
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.enigma',
+  '.enigma-review-packet',
+  '.enigma-review-packet-debug',
+  'coverage',
+  'dist',
+  'build',
+  '.cache',
+  'tmp',
+  '.vscode',
+  '.idea',
+])
+
+const SKIP_EXTENSIONS = new Set([
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.svg',
+  '.ico',
+  '.pdf',
+  '.zip',
+  '.tar',
+  '.gz',
+  '.tgz',
+  '.woff',
+  '.woff2',
+  '.ttf',
+  '.otf',
+  '.eot',
+  '.mp4',
+  '.webm',
+  '.mp3',
+  '.ogg',
+])
+
+// The security-placeholder detector matches its own pattern literal below.
+// The preceding comment marks that line as an approved self-reference.
+const DETECTORS = [
+  {
+    id: 'pem-private-key',
+    pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/i,
+  },
+  {
+    id: 'aws-access-key-id',
+    pattern: /\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b/,
+  },
+  {
+    id: 'aws-secret-access-key',
+    pattern: /\b(?:aws[_-]?secret[_-]?access[_-]?key|AWS[_-]?SECRET[_-]?ACCESS[_-]?KEY)\s*[=:]\s*["'][A-Za-z0-9/+=]{40}["']/i,
+  },
+  {
+    id: 'bearer-token',
+    // Skip placeholders like <token>, ${var}, and $ENV_VAR.
+    pattern: /(?:Authorization\s*:\s*Bearer\s+(?![<$\(])\S{8,}|\bbearer\s+[:=]\s*["']?[a-zA-Z0-9_\-]{16,}|\bapi[_-]?token\s*[:=]\s*["'][a-zA-Z0-9_\-]{16,}["'])/i,
+  },
+  {
+    id: 'dsn-with-password',
+    pattern: /\b(?:postgres|postgresql|mysql|mysql2|mongodb|redis|amqp|amqps):\/\/[^:]+:[^@\s]+@[^\/\s]+/i,
+  },
+  {
+    id: 'security-placeholder',
+    pattern: /REPLACE-WITH/i, // secret-scan:approved self-reference pattern
+  },
+]
+
+function hasApprovalComment(line) {
+  return APPROVAL_MARKERS.some((m) => m.test(line))
+}
+
+function isApproved(lines, index) {
+  if (hasApprovalComment(lines[index])) return true
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const trimmed = lines[i].trim()
+    if (trimmed === '') continue
+    return hasApprovalComment(trimmed)
+  }
+  return false
+}
+
+function isSkippableFile(rel) {
+  const ext = path.extname(rel).toLowerCase()
+  if (SKIP_EXTENSIONS.has(ext)) return true
+  const base = path.basename(rel)
+  if (base === 'package-lock.json') return true
+  return false
+}
+
+function* walk(root) {
+  const entries = fs.readdirSync(root, { withFileTypes: true })
+  for (const entry of entries) {
+    const full = path.join(root, entry.name)
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      yield* walk(full)
+    } else if (entry.isFile()) {
+      yield full
+    }
+  }
+}
+
+export function scanForSecrets(root) {
+  const findings = []
+  const rootResolved = path.resolve(root)
+  for (const fullPath of walk(rootResolved)) {
+    const rel = path.relative(rootResolved, fullPath)
+    if (isSkippableFile(rel)) continue
+    let text
+    try {
+      text = fs.readFileSync(fullPath, 'utf8')
+    } catch {
+      continue
+    }
+    const lines = text.split(/\r?\n/)
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i]
+      if (isApproved(lines, i)) continue
+      for (const detector of DETECTORS) {
+        if (detector.pattern.test(line)) {
+          findings.push({
+            file: rel,
+            line: i + 1,
+            type: detector.id,
+          })
+          break
+        }
+      }
+    }
+  }
+  return findings
+}
+
+function formatFindings(findings) {
+  return findings
+    .map((f) => `${f.file}:${f.line}: ${f.type}`)
+    .join('\n')
+}
+
+function main() {
+  const rootArg = process.argv.includes('--root')
+    ? process.argv[process.argv.indexOf('--root') + 1]
+    : path.resolve(path.dirname(__filename), '..')
+  const root = path.resolve(rootArg)
+  const findings = scanForSecrets(root)
+  if (findings.length > 0) {
+    process.stderr.write(`secret-scan: ${findings.length} unapproved detection(s)\n`)
+    process.stderr.write(formatFindings(findings) + '\n')
+    process.exit(1)
+  }
+  process.stdout.write('secret-scan ok\n')
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main()
+}

package/scripts/simulate-production-env.mjs

@@ -5,13 +5,14 @@
 // are not production secrets, HSM custody, or real operator evidence.
 
 import { spawnSync } from 'node:child_process'
-import { generateKeyPairSync, randomUUID } from 'node:crypto'
+import { createHash, generateKeyPairSync, randomUUID } from 'node:crypto'
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const DEFAULT_SECRETS_DIR = path.join(ROOT, 'deploy', 'secrets-simulation')
+const DEFAULT_SECRETS_DIR = path.join(os.homedir(), '.enigma', 'simulation-secrets')
 
 const REQUIRED_SECRET_FILES = [
   'relay-signing-key',
@@ -27,6 +28,11 @@ const REQUIRED_SECRET_FILES = [
   'tls.key',
 ]
 
+const BEARER_FILES_FOR_DIGEST = {
+  'gateway-admin-auth-bearer': 'ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256',
+  'gateway-data-plane-auth-bearer': 'ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256',
+}
+
 function parseArgs(argv) {
   const flags = { check: false, secretsDir: DEFAULT_SECRETS_DIR }
   for (let i = 0; i < argv.length; i += 1) {
@@ -41,8 +47,9 @@ function parseArgs(argv) {
       process.stdout.write(
         'Usage: node scripts/simulate-production-env.mjs [--check] [--secrets-dir <dir>]\n' +
           '\n' +
-          'Generates local-simulation secret files and a self-signed TLS certificate\n' +
-          `under ${DEFAULT_SECRETS_DIR} (customizable with --secrets-dir).\n` +
+          'Generates local-simulation secret files and a self-signed TLS certificate.\n' +
+          `By default files are written outside the repo to ${DEFAULT_SECRETS_DIR}.\n` +
+          'A path inside the repository is rejected to prevent accidental commits.\n' +
           'Run with --check to verify required files exist and are non-empty.\n'
       )
       process.exit(0)
@@ -51,6 +58,22 @@ function parseArgs(argv) {
   return flags
 }
 
+function isPathInside(child, parent) {
+  const c = path.resolve(child)
+  const p = path.resolve(parent)
+  const rel = path.relative(p, c)
+  return rel === '' || !rel.startsWith('..')
+}
+
+function assertSecretsDirOutsideRepo(secretsDir) {
+  if (isPathInside(secretsDir, ROOT)) {
+    throw new Error(
+      `Refusing to use secrets directory inside the repository: ${secretsDir}\n` +
+        'Choose a path outside the repo (e.g. --secrets-dir ~/.enigma/simulation-secrets).'
+    )
+  }
+}
+
 function generateKmsKeyRef() {
   const pair = generateKeyPairSync('ed25519', {
     privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
@@ -75,6 +98,7 @@ function generateKmsKeyRef() {
 const SECRET_GENERATORS = {
   'relay-signing-key': () => 'local-simulation-relay-signing-key-ref\n',
   'gateway-signing-key': () => 'local-simulation-gateway-signing-key-ref\n',
+  // Simulation-only DSN. Never a real credential. secret-scan:approved
   'external-storage-dsn': () => 'postgres://enigma:enigma@postgres:5432/enigma?sslmode=disable\n',
   'kms-key-ref': generateKmsKeyRef,
   'backup-target-uri': () => 'file:///tmp/enigma-backups\n',
@@ -97,6 +121,28 @@ function isMissingOrEmpty(filePath) {
   }
 }
 
+function sha256Hex(bufferOrString) {
+  return createHash('sha256').update(bufferOrString).digest('hex')
+}
+
+function gatewayBearerSha256(filePath) {
+  const token = fs.readFileSync(filePath)
+  return `sha256:${sha256Hex(token)}`
+}
+
+function writeSimulationEnv(secretsDir) {
+  const lines = [
+    '# Generated by scripts/simulate-production-env.mjs',
+    '# This file contains simulation-only digests, not production secrets.',
+    '# It is kept next to the other simulation secrets outside the repo.',
+  ]
+  for (const [name, envVar] of Object.entries(BEARER_FILES_FOR_DIGEST)) {
+    const digest = gatewayBearerSha256(path.join(secretsDir, name))
+    lines.push(`${envVar}=${digest}`)
+  }
+  fs.writeFileSync(path.join(secretsDir, 'simulation.env'), lines.join('\n') + '\n', { mode: 0o600 })
+}
+
 function generateTlsCerts(secretsDir) {
   const key = path.join(secretsDir, 'tls.key')
   const cert = path.join(secretsDir, 'tls.crt')
@@ -149,6 +195,7 @@ function generateTlsCerts(secretsDir) {
 
 function generateSecrets(secretsDir) {
   ensureDir(secretsDir)
+  assertSecretsDirOutsideRepo(secretsDir)
   for (const name of REQUIRED_SECRET_FILES) {
     if (name === 'tls.crt' || name === 'tls.key') continue
     const filePath = path.join(secretsDir, name)
@@ -161,6 +208,7 @@ function generateSecrets(secretsDir) {
   if (isMissingOrEmpty(keyPath) || isMissingOrEmpty(certPath)) {
     generateTlsCerts(secretsDir)
   }
+  writeSimulationEnv(secretsDir)
 }
 
 function check(secretsDir) {
@@ -177,10 +225,17 @@ function check(secretsDir) {
   )
 }
 
-function printStartInstructions() {
+function printStartInstructions(secretsDir) {
+  process.stdout.write('\n')
+  process.stdout.write('Simulation secrets written outside the repo to:\n')
+  process.stdout.write(`  ${secretsDir}\n`)
+  process.stdout.write('\n')
+  process.stdout.write('To start the local production simulation, set the secrets path and run:\n')
+  process.stdout.write(`  export ENIGMA_SIM_SECRETS_DIR=${secretsDir}\n`)
+  process.stdout.write(`  docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file ${path.join(secretsDir, 'simulation.env')} up --build -d\n`)
   process.stdout.write('\n')
-  process.stdout.write('To start the local production simulation, run:\n')
-  process.stdout.write('  docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d\n')
+  process.stdout.write('To tear down, use the same env file so the gateway bearer hashes resolve:\n')
+  process.stdout.write(`  docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file ${path.join(secretsDir, 'simulation.env')} down -v --remove-orphans\n`)
   process.stdout.write('\n')
   process.stdout.write('To make the public-looking domain resolve locally, add this line to /etc/hosts\n')
   process.stdout.write('(or C:\\Windows\\System32\\drivers\\etc\\hosts on Windows):\n')
@@ -198,13 +253,14 @@ function printStartInstructions() {
 
 function main() {
   const flags = parseArgs(process.argv.slice(2))
+  assertSecretsDirOutsideRepo(flags.secretsDir)
   if (flags.check) {
     check(flags.secretsDir)
     return
   }
   generateSecrets(flags.secretsDir)
   check(flags.secretsDir)
-  printStartInstructions()
+  printStartInstructions(flags.secretsDir)
 }
 
 main()