lean-claudient-core 0.1.0

package/src/security/phase8Hardening.ts

@@ -0,0 +1,536 @@
+/**
+ * Phase 8 Security & Audit Hardening
+ * CRM data redaction, financial validation, access control, audit trail integrity
+ * Phase 8D Task 13
+ */
+
+import { v4 as uuidv4 } from 'uuid';
+import { EnrichedLead } from '../intelligence/leadEnrichmentTypes.js';
+import { RevenueProjection } from '../metrics/revenueTypes.js';
+import { CRMOpportunity } from '../automation/crmExport.js';
+
+/**
+ * Redaction result tracking
+ */
+export interface RedactionResult {
+  original: string;
+  redacted: string;
+  patternType: string;
+  count: number;
+}
+
+/**
+ * Revenue projection validation result
+ */
+export interface ProjectionValidation {
+  valid: boolean;
+  errors: string[];
+  warnings: string[];
+}
+
+/**
+ * Audit log entry
+ */
+export interface AuditEntry {
+  id: string;
+  timestamp: string;
+  eventType: string;
+  userId?: string;
+  entityId: string;
+  entityType: string;
+  action: string;
+  changes?: Record<string, any>;
+  context?: Record<string, any>;
+}
+
+/**
+ * Role-based access control
+ */
+export type UserRole = 'ADMIN' | 'SALES' | 'OBSERVER';
+
+export interface AccessRequest {
+  userId: string;
+  role: UserRole;
+  endpoint: string;
+  method: string;
+}
+
+export interface AccessDecision {
+  allowed: boolean;
+  reason?: string;
+  requiredRole?: UserRole;
+}
+
+/**
+ * Token rotation status
+ */
+export interface TokenStatus {
+  tokenId: string;
+  createdAt: string;
+  lastRotatedAt: string;
+  expiresAt: string;
+  daysUntilExpiry: number;
+  needsRotation: boolean;
+}
+
+/**
+ * Phase 8 Security Hardener
+ */
+export class Phase8SecurityHardener {
+  private auditLog: AuditEntry[] = [];
+  private auditLogLocked: boolean = false; // Append-only enforcement
+  private redactionPatterns = {
+    email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+    phone: /\d{3}-\d{3}-\d{4}/g,
+    creditCard: /\d{4}-\d{4}-\d{4}-\d{4}/g,
+    ssn: /\d{3}-\d{2}-\d{4}/g,
+  };
+
+  private rolePermissions: Record<UserRole, Set<string>> = {
+    ADMIN: new Set([
+      '/api/leads',
+      '/api/leads/:id',
+      '/api/revenue',
+      '/api/alerts',
+      '/api/admin',
+      '/api/export',
+      '/api/audit',
+      '/api/dashboard',
+    ]),
+    SALES: new Set([
+      '/api/leads',
+      '/api/leads/:id',
+      '/api/revenue',
+      '/api/dashboard',
+    ]),
+    OBSERVER: new Set([
+      '/api/dashboard',
+    ]),
+  };
+
+  /**
+   * Redact PII from CRM export data
+   */
+  redactCRMExport(exportData: any): any {
+    const redacted = JSON.parse(JSON.stringify(exportData));
+    const redactions: RedactionResult[] = [];
+
+    const redactValue = (value: string, pattern: RegExp, type: string): [string, number] => {
+      let count = 0;
+      const replacement = value.replace(pattern, () => {
+        count++;
+        return `[${type.toUpperCase()}_REDACTED]`;
+      });
+      return [replacement, count];
+    };
+
+    // Recursively redact all string fields
+    const walk = (obj: any, path: string[] = []) => {
+      if (obj === null || obj === undefined) return;
+
+      if (typeof obj === 'string') {
+        let current = obj;
+        let totalCount = 0;
+
+        // Apply all redaction patterns
+        for (const [type, pattern] of Object.entries(this.redactionPatterns)) {
+          const [redacted, count] = redactValue(current, pattern, type);
+          if (count > 0) {
+            redactions.push({
+              original: obj,
+              redacted,
+              patternType: type,
+              count,
+            });
+            current = redacted;
+            totalCount += count;
+          }
+        }
+
+        return current;
+      }
+
+      if (Array.isArray(obj)) {
+        obj.forEach((item, idx) => {
+          obj[idx] = walk(item, [...path, `[${idx}]`]);
+        });
+      } else if (typeof obj === 'object') {
+        Object.entries(obj).forEach(([key, value]) => {
+          obj[key] = walk(value, [...path, key]);
+        });
+      }
+
+      return obj;
+    };
+
+    walk(redacted);
+    return redacted;
+  }
+
+  /**
+   * Validate revenue projection against business rules
+   */
+  validateRevenueProjection(projection: RevenueProjection, acv?: number): ProjectionValidation {
+    const errors: string[] = [];
+    const warnings: string[] = [];
+
+    const usedAcv = acv ?? 50000; // Default ACV
+
+    // Validate projected revenue is positive
+    if (projection.projectedRevenue < 0) {
+      errors.push('Projected revenue cannot be negative');
+    }
+
+    // Prevent unrealistic inflation (>200% of ACV)
+    const maxRevenue = usedAcv * 2;
+    if (projection.projectedRevenue > maxRevenue) {
+      errors.push(
+        `Projected revenue $${projection.projectedRevenue} exceeds 2x ACV limit ($${maxRevenue})`
+      );
+    }
+
+    // Validate confidence score
+    if (projection.confidence < 0 || projection.confidence > 100) {
+      errors.push('Confidence must be between 0-100');
+    }
+
+    // Validate conversion rate if present
+    if (projection.factors?.conversionRate !== undefined) {
+      if (projection.factors.conversionRate < 0 || projection.factors.conversionRate > 1) {
+        errors.push('Conversion rate must be between 0-1 (0-100%)');
+      }
+      if (projection.factors.conversionRate < 0.05) {
+        warnings.push('Conversion rate is unusually low (<5%)');
+      }
+    }
+
+    // Validate signal count if present
+    if (projection.factors?.signalBoost !== undefined) {
+      // signalBoost is typically 1.0 to 1.2, so implied signal count is 0-10
+      const impliedSignalCount = (projection.factors.signalBoost - 1.0) * 50; // Rough estimate
+      if (impliedSignalCount < 0 || impliedSignalCount > 10) {
+        warnings.push('Signal count appears out of typical range (0-10)');
+      }
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors,
+      warnings,
+    };
+  }
+
+  /**
+   * Enforce role-based access control
+   * Usage: enforceAccessControl(req, 'SALES')
+   */
+  enforceAccessControl(
+    request: AccessRequest
+  ): AccessDecision {
+    const role = request.role;
+    const endpoint = request.endpoint;
+
+    // Find matching endpoint permission
+    const permissions = this.rolePermissions[role];
+    if (!permissions) {
+      return {
+        allowed: false,
+        reason: `Unknown role: ${role}`,
+      };
+    }
+
+    // Check exact match
+    if (permissions.has(endpoint)) {
+      return { allowed: true };
+    }
+
+    // Check wildcard match (e.g., /api/leads/:id)
+    for (const perm of permissions) {
+      const pattern = perm.replace(/:[\w]+/g, '[^/]+');
+      const regex = new RegExp(`^${pattern}$`);
+      if (regex.test(endpoint)) {
+        return { allowed: true };
+      }
+    }
+
+    return {
+      allowed: false,
+      reason: `Role ${role} does not have access to ${endpoint}`,
+      requiredRole: 'ADMIN',
+    };
+  }
+
+  /**
+   * Validate and log lead mutations
+   */
+  validateLeadMutation(
+    lead: EnrichedLead,
+    operation: 'CREATE' | 'UPDATE' | 'DELETE' | 'EXPORT',
+    userId?: string
+  ): [boolean, string[]] {
+    const errors: string[] = [];
+
+    // Validate lead structure
+    if (!lead.id) {
+      errors.push('Lead ID is required');
+    }
+
+    if (!lead.name && !lead.company) {
+      errors.push('Lead must have name or company');
+    }
+
+    if (lead.score < 0 || lead.score > 100) {
+      errors.push('Lead quality score must be 0-100');
+    }
+
+    if (lead.signalCount < 0 || lead.signalCount > 10) {
+      errors.push('Signal count must be 0-10');
+    }
+
+    // Log the mutation
+    const entry: AuditEntry = {
+      id: uuidv4(),
+      timestamp: new Date().toISOString(),
+      eventType: `lead:${operation.toLowerCase()}`,
+      userId,
+      entityId: lead.id,
+      entityType: 'lead',
+      action: operation,
+      context: {
+        leadName: lead.name,
+        leadCompany: lead.company,
+        quality: lead.score,
+        signals: lead.signalCount,
+      },
+    };
+
+    this.logAuditEntry(entry);
+
+    return [errors.length === 0, errors];
+  }
+
+  /**
+   * Append-only audit log entry
+   * Prevents deletion or modification of audit records
+   */
+  private logAuditEntry(entry: AuditEntry): void {
+    this.auditLog.push(entry);
+    // In production: persist to immutable storage (append-only database)
+  }
+
+  /**
+   * Retrieve audit trail with filtering
+   * Immutable read-only access
+   */
+  getAuditTrail(filters?: {
+    entityId?: string;
+    eventType?: string;
+    userId?: string;
+    startDate?: string;
+    endDate?: string;
+  }): AuditEntry[] {
+    let results = [...this.auditLog]; // Copy for immutability
+
+    if (filters) {
+      if (filters.entityId) {
+        results = results.filter((e) => e.entityId === filters.entityId);
+      }
+      if (filters.eventType) {
+        results = results.filter((e) => e.eventType === filters.eventType);
+      }
+      if (filters.userId) {
+        results = results.filter((e) => e.userId === filters.userId);
+      }
+      if (filters.startDate) {
+        const startTime = new Date(filters.startDate).getTime();
+        results = results.filter((e) => new Date(e.timestamp).getTime() >= startTime);
+      }
+      if (filters.endDate) {
+        const endTime = new Date(filters.endDate).getTime();
+        results = results.filter((e) => new Date(e.timestamp).getTime() <= endTime);
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Check for stale tokens requiring rotation
+   */
+  checkTokenRotation(tokens: Map<string, TokenStatus>): TokenStatus[] {
+    const needsRotation: TokenStatus[] = [];
+    const now = new Date();
+
+    tokens.forEach((status) => {
+      const expiryDate = new Date(status.expiresAt);
+      const daysUntilExpiry = (expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
+
+      status.daysUntilExpiry = daysUntilExpiry;
+      status.needsRotation = daysUntilExpiry < 7; // Rotate if <7 days remaining
+
+      if (status.needsRotation) {
+        needsRotation.push(status);
+
+        // Log token rotation alert
+        this.logAuditEntry({
+          id: uuidv4(),
+          timestamp: new Date().toISOString(),
+          eventType: 'security:token-rotation-needed',
+          entityId: status.tokenId,
+          entityType: 'token',
+          action: 'ALERT',
+          context: {
+            daysUntilExpiry: Math.round(daysUntilExpiry),
+            expiresAt: status.expiresAt,
+          },
+        });
+      }
+    });
+
+    return needsRotation;
+  }
+
+  /**
+   * Validate CRM export for sensitive data leakage
+   */
+  validateCRMExportSecurity(opportunity: CRMOpportunity): [boolean, string[]] {
+    const issues: string[] = [];
+    const jsonString = JSON.stringify(opportunity);
+
+    // Check for common sensitive patterns
+    if (this.redactionPatterns.email.test(jsonString)) {
+      issues.push('CRM export contains unredacted email addresses');
+    }
+
+    if (this.redactionPatterns.phone.test(jsonString)) {
+      issues.push('CRM export contains unredacted phone numbers');
+    }
+
+    if (this.redactionPatterns.creditCard.test(jsonString)) {
+      issues.push('CRM export contains unredacted credit card numbers');
+    }
+
+    if (this.redactionPatterns.ssn.test(jsonString)) {
+      issues.push('CRM export contains unredacted SSNs');
+    }
+
+    return [issues.length === 0, issues];
+  }
+
+  /**
+   * Get audit statistics
+   */
+  getAuditStats(): {
+    totalEntries: number;
+    byEventType: Record<string, number>;
+    timeRange: { oldest: string; newest: string };
+  } {
+    const byEventType: Record<string, number> = {};
+    let oldest = '';
+    let newest = '';
+
+    this.auditLog.forEach((entry) => {
+      byEventType[entry.eventType] = (byEventType[entry.eventType] || 0) + 1;
+
+      if (!oldest || entry.timestamp < oldest) oldest = entry.timestamp;
+      if (!newest || entry.timestamp > newest) newest = entry.timestamp;
+    });
+
+    return {
+      totalEntries: this.auditLog.length,
+      byEventType,
+      timeRange: { oldest, newest },
+    };
+  }
+
+  /**
+   * Clear audit log (admin only - should require approval)
+   * Returns false if log is locked
+   */
+  clearAuditLog(): boolean {
+    if (this.auditLogLocked) {
+      return false; // Cannot clear locked log
+    }
+    // In production: prevent clearing without cryptographic approval
+    return true;
+  }
+
+  /**
+   * Lock audit log to prevent modifications (admin function)
+   */
+  lockAuditLog(): void {
+    this.auditLogLocked = true;
+  }
+
+  /**
+   * SQL injection prevention check
+   */
+  sanitizeSQLInput(input: string): [string, boolean] {
+    const sqlInjectionPatterns = [
+      /(\bOR\b|\bAND\b)\s+1\s*=\s*1/gi,
+      /;\s*(DROP|DELETE|UPDATE|INSERT)/gi,
+      /--\s*$/m,
+      /\/\*.*?\*\//gs,
+    ];
+
+    let hasSuspiciousPatterns = false;
+
+    for (const pattern of sqlInjectionPatterns) {
+      if (pattern.test(input)) {
+        hasSuspiciousPatterns = true;
+        break;
+      }
+    }
+
+    // Sanitize by escaping special characters
+    const sanitized = input
+      .replace(/'/g, "''")
+      .replace(/"/g, '""')
+      .replace(/\\/g, '\\\\');
+
+    return [sanitized, hasSuspiciousPatterns];
+  }
+
+  /**
+   * HTML escaping for XSS prevention
+   */
+  escapeHTMLContent(html: string): string {
+    const map: Record<string, string> = {
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#039;',
+    };
+    return html.replace(/[&<>"']/g, (char) => map[char]);
+  }
+
+  /**
+   * Validate Composio token before use
+   */
+  validateComposioToken(token: string): [boolean, string] {
+    if (!token || token.length === 0) {
+      return [false, 'Token is empty'];
+    }
+
+    if (token.length < 20) {
+      return [false, 'Token appears invalid (too short)'];
+    }
+
+    // Check if token contains suspicious patterns
+    if (/[^a-zA-Z0-9._-]/.test(token)) {
+      return [false, 'Token contains invalid characters'];
+    }
+
+    return [true, 'Token is valid'];
+  }
+}
+
+/**
+ * Factory function
+ */
+export function createPhase8SecurityHardener(): Phase8SecurityHardener {
+  return new Phase8SecurityHardener();
+}
+
+export default Phase8SecurityHardener;