lean-claudient-core 0.1.0

package/src/security/piiRedaction.ts

@@ -0,0 +1,215 @@
+/**
+ * PII Redaction Module
+ * Masks personally identifiable information in logs and metrics
+ */
+
+import { createHash } from 'crypto';
+
+const PATTERNS = {
+  EMAIL: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+  PHONE: /(\d{3})[-.\s]?(\d{3})[-.\s]?(\d{4})/g,
+  SSN: /(\d{3})[-]?(\d{2})[-]?(\d{4})/g,
+  CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+  IPV4: /\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/g,
+  UUID: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
+  SESSION_ID: /(?:sessionId|session_id|sid)['":\s=]*([a-zA-Z0-9-]{20,})/gi,
+  USER_ID: /(?:userId|user_id|uid)['":\s=]*(\d+|[a-f0-9-]{36})/gi,
+};
+
+/**
+ * Mask email address
+ * user@example.com → user@***.com
+ */
+export function redactEmail(email: string): string {
+  return email.replace(PATTERNS.EMAIL, (match) => {
+    const [local, domain] = match.split('@');
+    return `${local}@***.${domain.split('.').pop()}`;
+  });
+}
+
+/**
+ * Mask phone number
+ * 555-123-4567 → ***-***-4567
+ */
+export function redactPhone(phone: string): string {
+  return phone.replace(PATTERNS.PHONE, '***-***-$3');
+}
+
+/**
+ * Mask SSN
+ * 123-45-6789 → ***-**-6789
+ */
+export function redactSSN(ssn: string): string {
+  return ssn.replace(PATTERNS.SSN, '***-**-$3');
+}
+
+/**
+ * Mask credit card
+ * 1234-5678-9012-3456 → **-3456
+ */
+export function redactCreditCard(text: string): string {
+  return text.replace(PATTERNS.CREDIT_CARD, (match) => {
+    const lastFour = match.replace(/\D/g, '').slice(-4);
+    return `**-${lastFour}`;
+  });
+}
+
+/**
+ * Mask IPv4 address
+ * 192.168.1.1 → 192.168.*.*
+ */
+export function redactIPv4(text: string): string {
+  return text.replace(PATTERNS.IPV4, (match) => {
+    const parts = match.split('.');
+    return `${parts[0]}.${parts[1]}.*.*`;
+  });
+}
+
+/**
+ * Hash session ID for logs
+ * Allows correlation without exposing the actual ID
+ */
+export function redactSessionId(sessionId: string): string {
+  if (!sessionId) return 'unknown';
+  const hash = createHash('sha256').update(sessionId).digest('hex');
+  return hash.substring(0, 8);
+}
+
+/**
+ * Hash user ID for logs
+ * Allows correlation without exposing the actual ID
+ */
+export function redactUserId(userId: string | number): string {
+  if (!userId) return 'unknown';
+  const str = String(userId);
+  const hash = createHash('sha256').update(str).digest('hex');
+  return hash.substring(0, 8);
+}
+
+/**
+ * Mask UUID
+ * a1b2c3d4-e5f6-7890-abcd-ef1234567890 → a1b2****-****-****-****-****34567890
+ */
+export function redactUUID(text: string): string {
+  return text.replace(PATTERNS.UUID, (match) => {
+    return `${match.substring(0, 4)}****-****-****-****-****${match.substring(32)}`;
+  });
+}
+
+/**
+ * Redact all PII from a string
+ */
+export function redactText(text: string): string {
+  if (!text || typeof text !== 'string') return text;
+
+  let result = text;
+  result = redactEmail(result);
+  result = redactPhone(result);
+  result = redactSSN(result);
+  result = redactCreditCard(result);
+  result = redactIPv4(result);
+  result = redactUUID(result);
+
+  return result;
+}
+
+/**
+ * Redact PII from metrics payload
+ */
+export function redactMetrics(metrics: any): any {
+  if (!metrics || typeof metrics !== 'object') return metrics;
+
+  const redacted = JSON.parse(JSON.stringify(metrics));
+
+  // Redact known PII fields
+  const piiFields = [
+    'email',
+    'phone',
+    'ssn',
+    'creditCard',
+    'userId',
+    'userName',
+    'sessionId',
+    'ipAddress',
+    'hostname',
+  ];
+
+  for (const field of piiFields) {
+    if (redacted[field]) {
+      switch (field) {
+        case 'email':
+          redacted[field] = redactEmail(redacted[field]);
+          break;
+        case 'phone':
+          redacted[field] = redactPhone(redacted[field]);
+          break;
+        case 'ssn':
+          redacted[field] = redactSSN(redacted[field]);
+          break;
+        case 'creditCard':
+          redacted[field] = redactCreditCard(redacted[field]);
+          break;
+        case 'userId':
+          redacted[field] = redactUserId(redacted[field]);
+          break;
+        case 'sessionId':
+          redacted[field] = redactSessionId(redacted[field]);
+          break;
+        case 'ipAddress':
+          redacted[field] = redactIPv4(redacted[field]);
+          break;
+        case 'hostname':
+          redacted[field] = `***`;
+          break;
+      }
+    }
+  }
+
+  // Recursively redact nested objects
+  for (const key in redacted) {
+    if (typeof redacted[key] === 'string') {
+      redacted[key] = redactText(redacted[key]);
+    } else if (typeof redacted[key] === 'object' && redacted[key] !== null) {
+      redacted[key] = redactMetrics(redacted[key]);
+    }
+  }
+
+  return redacted;
+}
+
+/**
+ * Create a safe log entry with PII redacted
+ */
+export function createSafeLogEntry(
+  level: string,
+  message: string,
+  context?: any
+): {
+  level: string;
+  message: string;
+  timestamp: string;
+  context?: any;
+} {
+  return {
+    level,
+    message: redactText(message),
+    timestamp: new Date().toISOString(),
+    context: context ? redactMetrics(context) : undefined,
+  };
+}
+
+/**
+ * Validate that no PII is present in the given text
+ * Returns true if PII is found, false if clean
+ */
+export function containsPII(text: string): boolean {
+  if (!text || typeof text !== 'string') return false;
+
+  return (
+    PATTERNS.EMAIL.test(text) ||
+    PATTERNS.PHONE.test(text) ||
+    PATTERNS.SSN.test(text) ||
+    PATTERNS.CREDIT_CARD.test(text) ||
+    PATTERNS.IPV4.test(text)
+  );
+}

package/src/security/secretsDetection.js

@@ -0,0 +1,271 @@
+/**
+ * Secrets Detection Module
+ * Scans for hardcoded credentials, API keys, tokens, and other sensitive data
+ */
+const PATTERNS = {
+    AWS_KEY: /AKIA[0-9A-Z]{16}/g,
+    GITHUB_PAT: /ghp_[A-Za-z0-9_]{36}/g,
+    ANTHROPIC_KEY: /sk-ant-[A-Za-z0-9_-]{48}/g,
+    OPENAI_KEY: /sk-[A-Za-z0-9]{20,}/g,
+    PRIVATE_KEY_RSA: /-----BEGIN RSA PRIVATE KEY-----[\s\S]*?-----END RSA PRIVATE KEY-----/g,
+    PRIVATE_KEY_EC: /-----BEGIN EC PRIVATE KEY-----[\s\S]*?-----END EC PRIVATE KEY-----/g,
+    PRIVATE_KEY_ED25519: /-----BEGIN PRIVATE KEY-----[\s\S]*?-----END PRIVATE KEY-----/g,
+    JWT_TOKEN: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+    PASSWORD_ASSIGNMENT: /(?:password|passwd|pwd)\s*[:=]\s*['"](.*?)['"]/gi,
+    DATABASE_URL: /(?:mongodb|mysql|postgresql|sqlite):[/\w:@.?#&=+-]*/gi,
+    SLACK_TOKEN: /xox[baprs]-[0-9a-zA-Z]{10,48}/g,
+    SLACK_WEBHOOK: /https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+\/[A-Za-z0-9]+/g,
+    STRIPE_KEY: /sk_(?:live|test)_[0-9a-zA-Z]{20,}/g,
+    TWILIO_AUTH: /AC[a-zA-Z0-9]{32}/g,
+    SENDGRID_KEY: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/g,
+};
+/**
+ * Calculate Shannon entropy of a string
+ * Values > 4.0 indicate potential secrets
+ */
+export function calculateEntropy(text) {
+    if (!text || text.length === 0)
+        return 0;
+    const freq = {};
+    for (const char of text) {
+        freq[char] = (freq[char] || 0) + 1;
+    }
+    let entropy = 0;
+    for (const count of Object.values(freq)) {
+        const p = count / text.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/**
+ * Detect API keys in text
+ */
+export function detectAPIKey(text) {
+    const findings = [];
+    // AWS
+    for (const match of text.matchAll(PATTERNS.AWS_KEY)) {
+        findings.push({
+            type: 'AWS_ACCESS_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Use AWS IAM roles or temporary credentials instead',
+        });
+    }
+    // GitHub
+    for (const match of text.matchAll(PATTERNS.GITHUB_PAT)) {
+        findings.push({
+            type: 'GITHUB_PAT',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Use GitHub App or OAuth token with minimal scopes',
+        });
+    }
+    // Anthropic
+    for (const match of text.matchAll(PATTERNS.ANTHROPIC_KEY)) {
+        findings.push({
+            type: 'ANTHROPIC_API_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Set ANTHROPIC_API_KEY as environment variable',
+        });
+    }
+    // OpenAI
+    for (const match of text.matchAll(PATTERNS.OPENAI_KEY)) {
+        findings.push({
+            type: 'OPENAI_API_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Set OPENAI_API_KEY as environment variable',
+        });
+    }
+    // Slack
+    for (const match of text.matchAll(PATTERNS.SLACK_TOKEN)) {
+        findings.push({
+            type: 'SLACK_TOKEN',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Use Slack token rotation and store in secrets manager',
+        });
+    }
+    // Stripe
+    for (const match of text.matchAll(PATTERNS.STRIPE_KEY)) {
+        findings.push({
+            type: 'STRIPE_API_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Use environment variables for Stripe keys',
+        });
+    }
+    // Twilio
+    for (const match of text.matchAll(PATTERNS.TWILIO_AUTH)) {
+        findings.push({
+            type: 'TWILIO_AUTH_TOKEN',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Store Twilio credentials in environment variables',
+        });
+    }
+    // SendGrid
+    for (const match of text.matchAll(PATTERNS.SENDGRID_KEY)) {
+        findings.push({
+            type: 'SENDGRID_API_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0],
+            suggestion: 'Use environment variable for SendGrid API key',
+        });
+    }
+    return findings;
+}
+/**
+ * Detect private keys in text
+ */
+export function detectPrivateKey(text) {
+    const findings = [];
+    // RSA
+    for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_RSA)) {
+        findings.push({
+            type: 'RSA_PRIVATE_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0].substring(0, 50) + '...',
+            suggestion: 'Move private key to separate .pem file, add to .gitignore',
+        });
+    }
+    // EC
+    for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_EC)) {
+        findings.push({
+            type: 'EC_PRIVATE_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0].substring(0, 50) + '...',
+            suggestion: 'Move private key to separate .pem file, add to .gitignore',
+        });
+    }
+    // Ed25519
+    for (const match of text.matchAll(PATTERNS.PRIVATE_KEY_ED25519)) {
+        findings.push({
+            type: 'ED25519_PRIVATE_KEY',
+            severity: 'CRITICAL',
+            pattern: match[0].substring(0, 50) + '...',
+            suggestion: 'Move private key to separate .pem file, add to .gitignore',
+        });
+    }
+    return findings;
+}
+/**
+ * Detect plaintext passwords in text
+ */
+export function detectPassword(text) {
+    const findings = [];
+    for (const match of text.matchAll(PATTERNS.PASSWORD_ASSIGNMENT)) {
+        const password = match[1];
+        if (password && password.length > 0) {
+            findings.push({
+                type: 'PLAINTEXT_PASSWORD',
+                severity: 'CRITICAL',
+                pattern: password.substring(0, 20) + '...',
+                suggestion: 'Use bcrypt or similar for password hashing, store in environment variables',
+            });
+        }
+    }
+    // Database URLs
+    for (const match of text.matchAll(PATTERNS.DATABASE_URL)) {
+        findings.push({
+            type: 'DATABASE_URL',
+            severity: 'HIGH',
+            pattern: match[0].substring(0, 40) + '...',
+            suggestion: 'Store database URLs in environment variables',
+        });
+    }
+    return findings;
+}
+/**
+ * Detect JWT tokens in text
+ */
+export function detectJWT(text) {
+    const findings = [];
+    for (const match of text.matchAll(PATTERNS.JWT_TOKEN)) {
+        const token = match[0];
+        try {
+            const parts = token.split('.');
+            if (parts.length === 3) {
+                const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));
+                findings.push({
+                    type: 'JWT_TOKEN',
+                    severity: 'HIGH',
+                    pattern: token.substring(0, 30) + '...',
+                    context: JSON.stringify(payload).substring(0, 100),
+                    suggestion: 'Use short-lived tokens and refresh tokens, never hardcode',
+                });
+            }
+        }
+        catch {
+            findings.push({
+                type: 'JWT_TOKEN',
+                severity: 'HIGH',
+                pattern: token.substring(0, 30) + '...',
+                suggestion: 'Never hardcode JWT tokens, use session/environment',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Detect high-entropy strings that may be secrets
+ */
+export function detectHighEntropyStrings(text, minLength = 20) {
+    const findings = [];
+    const lines = text.split('\n');
+    for (const line of lines) {
+        const tokens = line.split(/[\s=:"',;]/);
+        for (const token of tokens) {
+            if (token.length >= minLength && /^[a-zA-Z0-9_-]+$/.test(token)) {
+                const entropy = calculateEntropy(token);
+                if (entropy > 4.0) {
+                    findings.push({
+                        type: 'HIGH_ENTROPY_STRING',
+                        severity: 'MEDIUM',
+                        pattern: token.substring(0, 30) + '...',
+                        entropy,
+                        suggestion: 'Review this string - high entropy suggests it may be a secret or token',
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Main entry point: detect all secrets in text
+ */
+export function detectSecrets(text) {
+    if (!text || typeof text !== 'string') {
+        return [];
+    }
+    const findings = [
+        ...detectPrivateKey(text),
+        ...detectAPIKey(text),
+        ...detectPassword(text),
+        ...detectJWT(text),
+        ...detectHighEntropyStrings(text),
+    ];
+    // Deduplicate by pattern
+    const seen = new Set();
+    const unique = findings.filter((f) => {
+        if (seen.has(f.pattern))
+            return false;
+        seen.add(f.pattern);
+        return true;
+    });
+    // Sort by severity
+    const severityOrder = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
+    return unique.sort((a, b) => severityOrder[a.severity] - severityOrder[b.severity]);
+}
+/**
+ * Scan file content for secrets
+ */
+export async function scanFileForSecrets(filePath, content) {
+    const findings = detectSecrets(content);
+    return findings.map((f) => ({
+        ...f,
+        location: filePath,
+    }));
+}