guardrail-compliance 1.0.0

package/dist/automation/reporting-engine.js

@@ -0,0 +1,329 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportingEngine = exports.ReportingEngine = void 0;
+const database_1 = require("@guardrail/database");
+const audit_logger_1 = require("./audit-logger");
+/**
+ * Automated Compliance Reporting Engine
+ *
+ * Generates comprehensive compliance reports with evidence,
+ * recommendations, and visual analytics
+ */
+class ReportingEngine {
+    reportTemplates = new Map();
+    constructor() {
+        this.initializeTemplates();
+    }
+    /**
+     * Generate compliance report
+     */
+    async generateReport(request) {
+        // Get project details
+        const project = await database_1.prisma.project.findUnique({
+            where: { id: request.projectId },
+        });
+        if (!project) {
+            throw new Error(`Project ${request.projectId} not found`);
+        }
+        // Get assessment if not provided
+        let assessment = request.assessment;
+        if (!assessment) {
+            const latest = await database_1.prisma.complianceAssessment.findFirst({
+                where: {
+                    projectId: request.projectId,
+                    frameworkId: request.frameworkId,
+                },
+                orderBy: { createdAt: "desc" },
+            });
+            if (!latest) {
+                throw new Error("No assessment found for this project and framework");
+            }
+            // Convert database record to assessment result with proper type handling
+            assessment = {
+                projectId: latest.projectId,
+                frameworkId: latest.frameworkId,
+                summary: latest.summary || {
+                    totalControls: 0,
+                    compliant: 0,
+                    partial: 0,
+                    nonCompliant: 0,
+                    score: 0,
+                },
+                evidence: latest.evidence || [],
+                controls: latest.controls || [],
+                gaps: latest.gaps || [],
+            };
+        }
+        // Get evidence if requested
+        let evidence = request.evidence;
+        if (request.includeEvidence && !evidence) {
+            // For now, skip evidence collection if no database table exists
+            evidence = [];
+        }
+        // Generate report ID
+        const reportId = `report_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+        // Build report sections based on type
+        if (!assessment) {
+            throw new Error("No assessment data available");
+        }
+        const sections = await this.buildSections(request.type, assessment, evidence);
+        // Generate recommendations if needed
+        const recommendations = request.includeRecommendations
+            ? await this.generateRecommendations(assessment)
+            : [];
+        // Generate charts if needed
+        const charts = request.includeCharts
+            ? await this.generateCharts(assessment)
+            : [];
+        // Create report
+        const report = {
+            id: reportId,
+            projectId: request.projectId,
+            frameworkId: request.frameworkId,
+            type: request.type,
+            format: request.format,
+            generatedAt: new Date(),
+            period: request.period,
+            summary: this.generateSummary(assessment),
+            sections, // Use the sections we already built
+            evidence: request.includeEvidence ? evidence : undefined,
+            recommendations, // Use the recommendations we already built
+            charts, // Use the charts we already built
+            metadata: {
+                version: "1.0",
+                generatedBy: "Guardrail Compliance Engine",
+            },
+        };
+        // Save report to database - skip if table doesn't exist
+        try {
+            await this.saveReport(report);
+        }
+        catch (error) {
+            console.warn("Could not save report to database:", error);
+        }
+        // Log report generation
+        await audit_logger_1.auditLogger.logEvent({
+            type: "report_generated",
+            category: "compliance",
+            projectId: request.projectId,
+            frameworkId: request.frameworkId,
+            timestamp: new Date(),
+            severity: "low",
+            source: "reporting-engine",
+            metadata: {
+                reportId,
+                type: request.type,
+                format: request.format,
+                includeEvidence: request.includeEvidence,
+                recipientCount: request.recipients?.length || 0,
+            },
+            details: {
+                action: "Compliance report generated",
+                reportId,
+                type: request.type,
+                score: report.summary.overallScore,
+            },
+        });
+        // Send report if recipients specified
+        if (request.recipients?.length) {
+            await this.sendReport(report, request.recipients);
+        }
+        return report;
+    }
+    /**
+     * Get report by ID
+     */
+    async getReport(reportId) {
+        try {
+            const report = await database_1.prisma.complianceReport.findUnique({
+                where: { id: reportId },
+            });
+            if (!report)
+                return null;
+            // Convert database report to ComplianceReport format
+            // @ts-ignore - Prisma client type issue
+            return {
+                id: report.id,
+                projectId: report.projectId,
+                frameworkId: report.frameworkId,
+                type: report.type,
+                format: report.format,
+                generatedAt: report.generatedAt || report.createdAt,
+                period: report.period,
+                summary: report.summary,
+                sections: report.sections || [],
+                evidence: report.evidence || undefined,
+                recommendations: report.recommendations || [],
+                charts: report.charts || [],
+                metadata: report.metadata || {
+                    version: "1.0",
+                    generatedBy: "Guardrail Compliance Engine",
+                },
+            };
+        }
+        catch (error) {
+            console.warn("Could not retrieve report from database:", error);
+            return null;
+        }
+    }
+    /**
+     * List reports for project
+     */
+    async listReports(projectId, frameworkId, limit = 50) {
+        try {
+            const reports = await database_1.prisma.complianceReport.findMany({
+                where: {
+                    projectId,
+                    ...(frameworkId && { frameworkId }),
+                },
+                orderBy: { createdAt: "desc" },
+                take: limit,
+            });
+            // Convert database reports to ComplianceReport format
+            // @ts-ignore - Prisma client type issue
+            return reports.map((report) => ({
+                id: report.id,
+                projectId: report.projectId,
+                frameworkId: report.frameworkId,
+                type: report.type,
+                format: report.format,
+                generatedAt: report.generatedAt || report.createdAt,
+                period: report.period,
+                summary: report.summary,
+                sections: report.sections || [],
+                evidence: report.evidence || undefined,
+                recommendations: report.recommendations || [],
+                charts: report.charts || [],
+                metadata: report.metadata || {
+                    version: "1.0",
+                    generatedBy: "Guardrail Compliance Engine",
+                },
+            }));
+        }
+        catch (error) {
+            console.warn("Could not retrieve reports from database:", error);
+            return [];
+        }
+    }
+    /**
+     * Delete report
+     */
+    async deleteReport(reportId) {
+        try {
+            await database_1.prisma.complianceReport.delete({
+                where: { id: reportId },
+            });
+        }
+        catch (error) {
+            console.warn("Could not delete report from database:", error);
+        }
+    }
+    async saveReport(report) {
+        // @ts-ignore - Prisma client type issue
+        await database_1.prisma.complianceReport.create({
+            data: {
+                projectId: report.projectId,
+                title: `${report.type} Report - ${report.frameworkId}`,
+                content: report,
+                summary: report.summary,
+                status: "draft",
+            },
+        });
+    }
+    async sendReport(report, recipients) {
+        // In production, implement email delivery service
+        console.log(`Sending report ${report.id} to ${recipients.join(", ")}`);
+    }
+    initializeTemplates() {
+        // Initialize report templates
+        this.reportTemplates.set("compliance", "standard-compliance-template");
+        this.reportTemplates.set("audit", "audit-report-template");
+        this.reportTemplates.set("executive", "executive-summary-template");
+        this.reportTemplates.set("technical", "technical-detail-template");
+        this.reportTemplates.set("remediation", "remediation-plan-template");
+    }
+    async buildSections(_type, assessment, evidence) {
+        const sections = [
+            {
+                id: "summary",
+                title: "Executive Summary",
+                type: "summary",
+                content: assessment.summary,
+                order: 1,
+            },
+            {
+                id: "details",
+                title: "Compliance Details",
+                type: "details",
+                content: {
+                    controls: assessment.controls,
+                    gaps: assessment.gaps,
+                },
+                order: 2,
+            },
+        ];
+        if (evidence && evidence.length > 0) {
+            sections.push({
+                id: "evidence",
+                title: "Evidence",
+                type: "evidence",
+                content: evidence,
+                order: 3,
+            });
+        }
+        return sections;
+    }
+    async generateRecommendations(assessment) {
+        // Generate recommendations based on gaps and failed controls
+        const recommendations = [];
+        for (const gap of assessment.gaps) {
+            recommendations.push({
+                id: `rec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`,
+                controlId: gap.controlId,
+                priority: gap.severity,
+                category: "compliance",
+                title: `Address compliance gap for ${gap.controlId}`,
+                description: gap.description,
+                impact: "Non-compliance risk",
+                effort: "medium",
+                status: "open",
+            });
+        }
+        return recommendations;
+    }
+    async generateCharts(assessment) {
+        return [
+            {
+                id: "chart_compliance_score",
+                type: "pie",
+                title: "Compliance Score Distribution",
+                data: {
+                    compliant: assessment.summary.compliant,
+                    partial: assessment.summary.partial,
+                    nonCompliant: assessment.summary.nonCompliant,
+                },
+            },
+        ];
+    }
+    generateSummary(assessment) {
+        return {
+            overallScore: assessment.summary.score,
+            status: assessment.summary.score >= 90
+                ? "compliant"
+                : assessment.summary.score >= 70
+                    ? "partial"
+                    : "non-compliant",
+            totalControls: assessment.summary.totalControls,
+            compliantControls: assessment.summary.compliant,
+            partialControls: assessment.summary.partial,
+            nonCompliantControls: assessment.summary.nonCompliant,
+            highRiskGaps: assessment.gaps.filter((g) => g.severity === "high").length,
+            mediumRiskGaps: assessment.gaps.filter((g) => g.severity === "medium")
+                .length,
+            lowRiskGaps: assessment.gaps.filter((g) => g.severity === "low").length,
+        };
+    }
+}
+exports.ReportingEngine = ReportingEngine;
+// Export singleton instance
+exports.reportingEngine = new ReportingEngine();

package/dist/container/index.d.ts

@@ -0,0 +1,4 @@
+export * from './scanner';
+export * from './kubernetes';
+export * from './rules';
+//# sourceMappingURL=index.d.ts.map

package/dist/container/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/container/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC"}

package/dist/container/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./scanner"), exports);
+__exportStar(require("./kubernetes"), exports);
+__exportStar(require("./rules"), exports);

package/dist/container/kubernetes.d.ts

@@ -0,0 +1,94 @@
+export interface K8sManifest {
+    apiVersion: string;
+    kind: string;
+    metadata: {
+        name: string;
+        namespace?: string;
+    };
+    spec: any;
+}
+export interface K8sFinding {
+    ruleId: string;
+    title: string;
+    description: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    resourceType: string;
+    resourceName: string;
+    namespace?: string;
+    filePath: string;
+    recommendation: string;
+}
+export interface RBACAnalysis {
+    roles: Array<{
+        name: string;
+        namespace?: string;
+        rules: any[];
+        riskyPermissions: string[];
+    }>;
+    roleBindings: Array<{
+        name: string;
+        namespace?: string;
+        subjects: any[];
+        roleRef: any;
+    }>;
+    findings: string[];
+}
+export interface PodSecurityAnalysis {
+    totalPods: number;
+    privilegedPods: number;
+    hostNetworkPods: number;
+    runAsRootPods: number;
+    findings: K8sFinding[];
+}
+export interface NetworkPolicyAnalysis {
+    hasNetworkPolicies: boolean;
+    totalPolicies: number;
+    unprotectedNamespaces: string[];
+    findings: string[];
+}
+export interface KubernetesScanResult {
+    projectId: string;
+    summary: {
+        totalResources: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+    findings: K8sFinding[];
+    rbacAnalysis?: RBACAnalysis;
+    podSecurity?: PodSecurityAnalysis;
+    networkPolicies?: NetworkPolicyAnalysis;
+}
+export declare class KubernetesScanner {
+    /**
+     * Scan Kubernetes manifests
+     */
+    scanManifests(projectPath: string, projectId: string): Promise<KubernetesScanResult>;
+    /**
+     * Analyze RBAC configuration
+     */
+    analyzeRBAC(manifests: K8sManifest[]): Promise<RBACAnalysis>;
+    /**
+     * Check pod security
+     */
+    checkPodSecurity(manifests: K8sManifest[]): Promise<PodSecurityAnalysis>;
+    /**
+     * Validate network policies
+     */
+    validateNetworkPolicies(manifests: K8sManifest[]): Promise<NetworkPolicyAnalysis>;
+    /**
+     * Scan for security issues using rules
+     */
+    private scanForSecurityIssues;
+    /**
+     * Find Kubernetes manifest files
+     */
+    private findManifestFiles;
+    /**
+     * Simple YAML parser (in production, use proper YAML library)
+     */
+    private parseYAML;
+}
+export declare const kubernetesScanner: KubernetesScanner;
+//# sourceMappingURL=kubernetes.d.ts.map

package/dist/container/kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../src/container/kubernetes.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,IAAI,EAAE,GAAG,CAAC;CACX;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,GAAG,EAAE,CAAC;QACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChB,OAAO,EAAE,GAAG,CAAC;KACd,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,qBAAa,iBAAiB;IAC5B;;OAEG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6E1F;;OAEG;IACG,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAuDlE;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwC9E;;OAEG;IACG,uBAAuB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiCvF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;OAEG;IACH,OAAO,CAAC,SAAS;CAQlB;AAED,eAAO,MAAM,iBAAiB,mBAA0B,CAAC"}