nsauditor-ai 0.2.27 → 0.2.28

package/README.md

@@ -17,7 +17,7 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**GRC connector trio complete (Secureframe) + cross-framework report-quality leak closure (Enterprise 0.32.2).** Enterprise now ships the **Secureframe** GRC push connector — completing the **Vanta · Drata · Secureframe** trio at the same early-access opt-in shape — and closes a **cross-framework leak** in the Enterprise compliance reports' "Why this violates" rationales: an internal `Inherits from soc2.json` note, bare foreign control-ids, and cross-framework routing-maps no longer leak a **foreign** framework's name into a HIPAA / PCI / ISO / NIST / CIS / GDPR Report on Compliance. Matrix-neutral, no new plugins. See the **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** section below, and **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
+**GRC-push startup preflight + RDS cluster-level SSL enforcement (CE 0.2.28 / Enterprise 0.32.3).** The CE CLI now **fails fast** on a bad GRC configuration — a wrong token, control-map, or provider is caught at scan **startup** (before the full multi-region scan) instead of only at push time, a real per-org fix for MSP/MSSP operators. Paired Enterprise 0.32.3 is a **matrix-neutral** RDS false-negative depth pass: plugin 1140 now audits the Aurora **cluster** parameter group (`DescribeDBClusterParameters`), closing a cleartext false-negative on **instance-less Aurora Serverless v1** clusters the instance-level SSL check never saw, and applies **staged-parameter (`ParameterApplyStatus`) discipline** so a set-but-not-yet-applied `rds.force_ssl` / `pgaudit` is no longer affirmed as effective. No new plugins, all seven coverage matrices unchanged. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
 
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)
 

package/cli.mjs

@@ -883,6 +883,43 @@ function maxSeverityInConclusion(conclusion) {
   return max;
 }
 
+/**
+ * CLI GRC-push startup preflight. Gates on the SAME condition the push itself runs
+ * under — a `scan` that requests a compliance framework — so a framework-less recon
+ * scan or a non-scan command with a globally-set `COMPLIANCE_GRC_PROVIDER` is NEVER
+ * hard-failed at startup (the push is gated by `runCompliancePhase` returning null
+ * with no frameworks — `nsauditor-ai-ee/utils/compliance_phase.mjs`). When a push IS
+ * configured, validate the config now via EE's `preflightGrcConfig` so a bad token /
+ * control-map / provider / redaction mode fails IMMEDIATELY instead of after a full
+ * scan (a real per-org UX gap for an MSP). GRC push is an EE feature, so:
+ *   - not a scan / no framework / GRC not requested → no-op (never imports EE);
+ *   - EE unavailable → skip silently (no EE ⇒ no push ⇒ nothing to preflight;
+ *     mirrors the enrichScan EE-optional pattern);
+ *   - EE too old to export the fn → skip;
+ *   - a `GrcConfigError` from preflightGrcConfig PROPAGATES so main() can
+ *     fail-fast (exit 1) with the module's token-free message.
+ * @param {object} env - process.env (or a test env)
+ * @param {object} [opts] - { cmd, frameworks, importEE(test seam) }
+ * @returns {Promise<{ran:boolean, reason?:string}>}
+ */
+export async function preflightGrcIfRequested(env, opts = {}) {
+  const { cmd, frameworks, importEE } = opts;
+  if (cmd !== 'scan') return { ran: false, reason: 'not-scan' };
+  if (!String(frameworks ?? '').trim()) return { ran: false, reason: 'no-frameworks' };
+  if (!String(env?.COMPLIANCE_GRC_PROVIDER ?? '').trim()) return { ran: false, reason: 'not-requested' };
+  let ee;
+  try {
+    ee = importEE ? await importEE() : await import('@nsasoft/nsauditor-ai-ee');
+  } catch {
+    return { ran: false, reason: 'ee-unavailable' };
+  }
+  if (typeof ee?.preflightGrcConfig !== 'function') return { ran: false, reason: 'ee-too-old' };
+  // Config fail-fast. The zero-map guard runs UNSCOPED (frameworks not threaded) —
+  // safe (no false-fails); a per-framework-empty map still warns+no_ops at push time.
+  await ee.preflightGrcConfig(env);
+  return { ran: true };
+}
+
 export async function main() {
   const args = await parseArgs(process.argv);
   const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, awsRegion } = args;
@@ -1062,6 +1099,20 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     process.exit(1);
   }
 
+  // GRC-push startup preflight (EE 0.32.x): if this scan would push (a `scan` with a
+  // compliance framework + COMPLIANCE_GRC_PROVIDER set), validate the config NOW (after
+  // --env load) so a bad token / control-map / provider fails fast instead of after a
+  // full scan. The helper gates on the exact push condition (so a framework-less recon
+  // scan / non-scan command is never hard-failed) + silently skips if EE isn't installed.
+  try {
+    await preflightGrcIfRequested(process.env, { cmd, frameworks: args.compliance ?? process.env.COMPLIANCE_FRAMEWORKS });
+  } catch (err) {
+    // GrcConfigError (bad token/map/provider/redaction). The module's message is
+    // token-free by construction; surface it and fail-fast.
+    console.error(`Error: GRC push config invalid — ${err.message}`);
+    process.exit(1);
+  }
+
   // Build the AWS region intent AFTER env load so AWS_REGION (.env/shell) is visible.
   // Explicit --aws-region fail-fasts on an unknown region.
   let awsRegionIntent = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,