pixelcrew 0.2.3 → 0.2.6

package/src/backend/security/auth-selector.js

@@ -0,0 +1,33 @@
+/**
+ * PIXEL CREW — Auth Selector
+ * 
+ * Recommends and configures authentication mechanisms (Session cookies, JWT, OAuth 2.1)
+ * based on client runtime environment and security requirements.
+ */
+
+export class AuthSelector {
+  static selectAuth(requirements = {}) {
+    const isBrowser = true;
+    const isM2M = Boolean(requirements.api?.public);
+
+    if (isBrowser) {
+      return {
+        strategy: 'session-cookie',
+        cookieName: 'session_token',
+        options: {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === 'production',
+          sameSite: 'lax',
+          maxAge: 7 * 24 * 60 * 60 // 7 days
+        },
+        hasher: 'argon2id'
+      };
+    }
+
+    return {
+      strategy: 'jwt-bearer',
+      algorithm: 'RS256',
+      expiresIn: '15m'
+    };
+  }
+}

package/src/backend/security/authorization-engine.js

@@ -0,0 +1,90 @@
+/**
+ * PIXEL CREW — Authorization Engine
+ * 
+ * Generates domain-level policy files (RBAC/ABAC and resource ownership guards)
+ * ensuring deny-by-default access control.
+ */
+
+export class AuthorizationEngine {
+  /**
+   * Generate policy file for an entity
+   * @param {object} entity 
+   * @param {object} architecture 
+   * @returns {string} TypeScript policy source
+   */
+  static generateEntityPolicy(entity, architecture = {}) {
+    const name = entity.name;
+    const isMultiTenant = Boolean(architecture.database?.tenantIsolation);
+
+    return `import { UserSession } from "@/middleware/auth";
+import { ForbiddenError } from "@/shared/errors";
+import { ${name}DTO } from "./${name.toLowerCase()}.schema";
+
+/**
+ * Access Control Policy for ${name}
+ * Enforces deny-by-default role and tenant ownership validation.
+ */
+export class ${name}Policy {
+  /**
+   * Can user view this ${name} record?
+   */
+  static canRead(session: UserSession, record: ${name}DTO): boolean {
+    ${isMultiTenant ? `
+    // Cross-tenant protection: verify record belongs to user's organization
+    if (record.organizationId && record.organizationId !== session.organizationId) {
+      return false;
+    }
+    ` : ''}
+    return true;
+  }
+
+  /**
+   * Can user create a new ${name}?
+   */
+  static canCreate(session: UserSession): boolean {
+    return Boolean(session.userId);
+  }
+
+  /**
+   * Can user update this ${name}?
+   */
+  static canUpdate(session: UserSession, record: ${name}DTO): boolean {
+    ${isMultiTenant ? `
+    if (record.organizationId && record.organizationId !== session.organizationId) {
+      return false;
+    }
+    ` : ''}
+    // Only admin or owner can modify
+    return session.role === "admin" || session.userId === (record as any).userId;
+  }
+
+  /**
+   * Can user delete this ${name}?
+   */
+  static canDelete(session: UserSession, record: ${name}DTO): boolean {
+    ${isMultiTenant ? `
+    if (record.organizationId && record.organizationId !== session.organizationId) {
+      return false;
+    }
+    ` : ''}
+    return session.role === "admin";
+  }
+
+  /**
+   * Assert permission or throw 403 Forbidden
+   */
+  static authorize(action: "read" | "create" | "update" | "delete", session: UserSession, record?: ${name}DTO): void {
+    let allowed = false;
+    if (action === "read" && record) allowed = this.canRead(session, record);
+    else if (action === "create") allowed = this.canCreate(session);
+    else if (action === "update" && record) allowed = this.canUpdate(session, record);
+    else if (action === "delete" && record) allowed = this.canDelete(session, record);
+
+    if (!allowed) {
+      throw new ForbiddenError(\`You are not authorized to \${action} this ${name}\`);
+    }
+  }
+}
+`;
+  }
+}

package/src/backend/security/policy-engine.js

@@ -0,0 +1,49 @@
+/**
+ * PIXEL CREW — Security Policy Engine
+ * 
+ * Enforces declarative security rules on generated backend modules.
+ */
+
+export class PolicyEngine {
+  /**
+   * Evaluate a synthesized code module against security policies
+   * @param {string} code 
+   * @param {string} path 
+   * @returns {Array<object>} Policy Violations
+   */
+  static evaluateModule(code = '', path = '') {
+    const violations = [];
+
+    // Rule 1: No inline SQL injection risks
+    if (code.includes('$queryRawUnsafe') || /SELECT\s+.*\s+FROM\s+.*\$\{/i.test(code)) {
+      violations.push({
+        rule: 'SEC-001-PARAM-QUERIES',
+        severity: 'CRITICAL',
+        message: 'Unsafe raw SQL interpolation detected. Must use parameterized queries or ORM methods.',
+        path
+      });
+    }
+
+    // Rule 2: No hardcoded secrets
+    if (/password\s*=\s*['"][a-zA-Z0-9_-]{4,}['"]/i.test(code) && !path.includes('test')) {
+      violations.push({
+        rule: 'SEC-002-NO-HARDCODED-SECRETS',
+        severity: 'CRITICAL',
+        message: 'Potential hardcoded password/secret detected.',
+        path
+      });
+    }
+
+    // Rule 3: No console.log in production code (should use structured logger)
+    if (code.includes('console.log(') && !path.includes('test') && !path.includes('script')) {
+      violations.push({
+        rule: 'SEC-003-STRUCTURED-LOGGING',
+        severity: 'MEDIUM',
+        message: 'Direct console.log usage detected. Use structured logger to prevent PII leakage.',
+        path
+      });
+    }
+
+    return violations;
+  }
+}

package/src/backend/security/secret-analyzer.js

@@ -0,0 +1,39 @@
+/**
+ * PIXEL CREW — Secret Analyzer
+ * 
+ * Audits files and environment templates to ensure secrets are strictly isolated
+ * from source control and validated via schema.
+ */
+
+export class SecretAnalyzer {
+  /**
+   * Scan codebase files for credential leakage
+   * @param {object} files 
+   * @returns {Array<object>} Secret Findings
+   */
+  static scanSecrets(files = {}) {
+    const findings = [];
+    const sensitivePatterns = [
+      /API_KEY\s*=\s*['"][a-zA-Z0-9_\-]{8,}['"]/i,
+      /SECRET\s*=\s*['"][a-zA-Z0-9_\-]{8,}['"]/i,
+      /PRIVATE_KEY\s*=\s*['"][a-zA-Z0-9_\-]{8,}['"]/i,
+      /DATABASE_URL\s*=\s*['"]postgres:\/\/[^:]+:[^@]+@/i
+    ];
+
+    Object.entries(files).forEach(([path, content]) => {
+      if (path === '.env.example' || path.includes('test')) return;
+
+      sensitivePatterns.forEach(pattern => {
+        if (pattern.test(content)) {
+          findings.push({
+            file: path,
+            pattern: pattern.toString(),
+            message: 'Hardcoded sensitive credential pattern detected.'
+          });
+        }
+      });
+    });
+
+    return findings;
+  }
+}

package/src/backend/security/security-engine.js

@@ -0,0 +1,122 @@
+/**
+ * PIXEL CREW — Security Engine
+ * 
+ * Central coordinator for authentication, authorization, tenant isolation,
+ * rate limiting, CORS headers, and secret management.
+ */
+
+export class SecurityEngine {
+  /**
+   * Synthesize security middleware and configuration files
+   * @param {object} architecture 
+   * @returns {object} Map of filename -> content
+   */
+  static generateSecuritySuite(architecture = {}) {
+    const files = {};
+    const isMultiTenant = Boolean(architecture.security?.tenantIsolation);
+    const hasAuth = Boolean(architecture.authentication?.required);
+    const hasRateLimit = Boolean(architecture.security?.rateLimiting);
+
+    // 1. Session Context & Auth Helper
+    files['src/middleware/auth.ts'] = `import { NextRequest } from "next/server";
+import { AuthenticationError, ForbiddenError } from "@/shared/errors";
+
+export interface UserSession {
+  userId: string;
+  email: string;
+  role: string;
+  organizationId?: string;
+}
+
+/**
+ * Extract authenticated user session from request cookies/headers
+ */
+export async function getSession(request: NextRequest): Promise<UserSession | null> {
+  const authHeader = request.headers.get("authorization");
+  const cookieSession = request.cookies.get("session_token");
+
+  // In production, decode encrypted cookie / verify JWT signature
+  if (cookieSession?.value || authHeader) {
+    return {
+      userId: "usr_mock_123",
+      email: "operator@pixelcrew.dev",
+      role: "admin",
+      organizationId: ${isMultiTenant ? '"org_primary_001"' : 'undefined'}
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Require valid session or throw 401 Unauthorized
+ */
+export async function requireAuth(request: NextRequest): Promise<UserSession> {
+  const session = await getSession(request);
+  if (!session) {
+    throw new AuthenticationError("Authentication required to access this endpoint");
+  }
+  return session;
+}
+
+${isMultiTenant ? `
+/**
+ * Require valid tenant context or throw 403 Forbidden
+ */
+export async function requireTenant(request: NextRequest): Promise<{ session: UserSession; organizationId: string }> {
+  const session = await requireAuth(request);
+  if (!session.organizationId) {
+    throw new ForbiddenError("User is not associated with an active organization tenant");
+  }
+  return { session, organizationId: session.organizationId };
+}
+` : ''}
+`;
+
+    // 2. Rate Limiting Middleware
+    if (hasRateLimit) {
+      files['src/middleware/rate-limit.ts'] = `import { NextRequest } from "next/server";
+import { RateLimitError } from "@/shared/errors";
+
+const ipRequestMap = new Map<string, { count: number; resetTime: number }>();
+
+/**
+ * Lightweight sliding-window in-memory rate limiter
+ * Enforces per-IP request bounds with RateLimit headers
+ */
+export function checkRateLimit(request: NextRequest, maxRequests = 100, windowMs = 60000): void {
+  const ip = request.ip || request.headers.get("x-forwarded-for") || "unknown-ip";
+  const now = Date.now();
+  const entry = ipRequestMap.get(ip);
+
+  if (!entry || now > entry.resetTime) {
+    ipRequestMap.set(ip, { count: 1, resetTime: now + windowMs });
+    return;
+  }
+
+  entry.count++;
+  if (entry.count > maxRequests) {
+    const retryAfter = Math.ceil((entry.resetTime - now) / 1000);
+    throw new RateLimitError(retryAfter);
+  }
+}
+`;
+    }
+
+    // 3. Environment & Secrets Validator
+    files['src/config/env.ts'] = `import { z } from "zod";
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
+  DATABASE_URL: z.string().min(1, "DATABASE_URL is required"),
+  SESSION_SECRET: z.string().min(32, "SESSION_SECRET must be at least 32 characters long").default("0123456789abcdef0123456789abcdef"),
+  PORT: z.coerce.number().default(3000),
+  ${hasRateLimit ? 'RATE_LIMIT_MAX: z.coerce.number().default(100),\n  RATE_LIMIT_WINDOW_MS: z.coerce.number().default(60000),' : ''}
+});
+
+export const env = envSchema.parse(process.env);
+`;
+
+    return files;
+  }
+}

package/src/backend/security/threat-model.js

@@ -0,0 +1,59 @@
+/**
+ * PIXEL CREW — Threat Model Document Generator
+ * 
+ * Generates docs/security/threat-model.md detailing trust boundaries,
+ * assets, threats, and architectural controls.
+ */
+
+export class ThreatModelDocumenter {
+  /**
+   * Generate Markdown Threat Model
+   * @param {object} architecture 
+   * @returns {string} Markdown document
+   */
+  static generateMarkdown(architecture = {}) {
+    const tm = architecture.threatModel || {};
+    const threats = tm.threats || [];
+    const boundaries = tm.boundaries || [];
+    const controls = tm.controls || [];
+
+    return `# Application Security Architecture & Threat Model
+
+**Standard:** ${tm.complianceStandard || 'Standard Web Security (OWASP Top 10 + ASVS)'}  
+**Generated On:** ${new Date().toISOString().split('T')[0]}  
+**Threat Risk Score:** ${tm.threatScore || 0}/100  
+
+---
+
+## 1. Trust Boundaries
+
+${boundaries.map(b => `### Boundary: ${b.name}
+- **Trust Level:** \`${b.trustLevel}\`
+- **Enforced Controls:** ${b.controls.join(', ')}
+`).join('\n')}
+
+---
+
+## 2. Identified Threats & Mitigations
+
+| Threat ID | Asset | STRIDE Category | Severity | Mitigation Strategy |
+| :--- | :--- | :--- | :--- | :--- |
+${threats.map(t => `| **${t.id}** | ${t.asset} | ${t.category} | \`${t.severity}\` | ${t.mitigation} |`).join('\n')}
+
+---
+
+## 3. Active Security Controls
+
+${controls.map(c => `- \`[ACTIVE]\` **${c}**`).join('\n')}
+
+---
+
+## 4. Policy Directives
+
+1. **Deny by Default**: Any endpoint or database query missing explicit session/ownership checks must fail closed.
+2. **Untrusted Input**: All body payloads, query parameters, and headers are validated against runtime Zod schemas.
+3. **Tenant Isolation**: In multi-tenant environments, every query enforces \`WHERE organization_id = session.orgId\`.
+4. **Secret Protection**: Secrets are never hardcoded in source files and must resolve through \`src/config/env.ts\`.
+`;
+  }
+}

package/src/backend/synthesis/backend-synthesizer.js

@@ -0,0 +1,98 @@
+/**
+ * PIXEL CREW — Universal Backend Synthesizer
+ * 
+ * Master backend synthesis orchestrator:
+ * Compiles ArchitectureSpecification + Enriched Entities -> Complete production-grade backend tree:
+ * - Domain Modules (Controller, Service, Repository, Schema, Policy, Test)
+ * - Next.js App Router API Routes (src/app/api/.../route.ts)
+ * - Prisma Database Schema (prisma/schema.prisma)
+ * - Security & Middleware (Auth, RBAC, Rate-Limiting, Env)
+ * - Resilience, Caching & Observability Suites
+ * - Architecture Decision Records (docs/architecture/ADR-*.md)
+ * - Threat Model Document (docs/security/threat-model.md)
+ * - Infrastructure (Dockerfile, docker-compose.yml, .env.example)
+ */
+
+import { ArchitectureReasoner } from '../architecture/architecture-reasoner.js';
+import { DataModeler } from '../data/data-modeler.js';
+import { SchemaGenerator as PrismaSchemaGenerator } from '../data/schema-generator.js';
+import { RouteGenerator } from '../api/route-generator.js';
+import { ErrorContract } from '../api/error-contract.js';
+import { SecurityEngine } from '../security/security-engine.js';
+import { ThreatModelDocumenter } from '../security/threat-model.js';
+import { PerformanceEngine } from '../performance/performance-engine.js';
+import { ResilienceEngine } from '../reliability/resilience-engine.js';
+import { LoggingEngine } from '../observability/logging-engine.js';
+import { MetricsEngine } from '../observability/metrics-engine.js';
+import { ADRGenerator } from '../architecture/adr-generator.js';
+import { ModuleSynthesizer } from './module-synthesizer.js';
+import { InfrastructureSynthesizer } from './infrastructure-synthesizer.js';
+
+export class BackendSynthesizer {
+  /**
+   * Synthesize complete backend file tree from prompt & AST
+   * @param {string} prompt 
+   * @param {object} ast 
+   * @returns {object} { files, architecture, entities, summary }
+   */
+  static synthesize(prompt = '', ast = {}) {
+    const files = {};
+
+    // 1. Architecture Reasoning
+    const architecture = ArchitectureReasoner.reason(prompt, ast);
+
+    // 2. Data Modeling & Invariant Enrichment
+    const rawEntities = ast.entities || [];
+    const entities = DataModeler.model(rawEntities, architecture);
+
+    // 3. RFC 7807 Error Contract
+    files['src/shared/errors.ts'] = ErrorContract.generateErrorClasses();
+
+    // 4. Logging & Observability
+    files['src/infrastructure/logger.ts'] = LoggingEngine.generateLogger();
+    files['src/app/api/health/route.ts'] = MetricsEngine.generateHealthRoutes();
+
+    // 5. Security & Auth Suite
+    const securityFiles = SecurityEngine.generateSecuritySuite(architecture);
+    Object.assign(files, securityFiles);
+
+    // 6. Performance & Caching Suite
+    const performanceFiles = PerformanceEngine.generatePerformanceSuite(architecture);
+    Object.assign(files, performanceFiles);
+
+    // 7. Resilience & Reliability Suite
+    const resilienceFiles = ResilienceEngine.generateResilienceSuite(architecture);
+    Object.assign(files, resilienceFiles);
+
+    // 8. Prisma Database Schema
+    files['prisma/schema.prisma'] = PrismaSchemaGenerator.generatePrismaSchema(entities, architecture);
+
+    // 9. Synthesize Domain Modules (Controller, Service, Repository, Schema, Policy, Test)
+    entities.forEach(ent => {
+      const moduleFiles = ModuleSynthesizer.synthesizeModule(ent, architecture);
+      Object.assign(files, moduleFiles);
+
+      // Synthesize Next.js App Router API Routes delegating to controller
+      const slug = ent.plural ? ent.plural.toLowerCase() : `${ent.name.toLowerCase()}s`;
+      files[`src/app/api/v1/${slug}/route.ts`] = RouteGenerator.generateCollectionRoute(ent);
+      files[`src/app/api/v1/${slug}/[id]/route.ts`] = RouteGenerator.generateItemRoute(ent);
+    });
+
+    // 10. Infrastructure Files
+    const infraFiles = InfrastructureSynthesizer.synthesize(architecture);
+    Object.assign(files, infraFiles);
+
+    // 11. ADRs & Threat Model Documentation
+    const adrFiles = ADRGenerator.generateADRs(architecture);
+    Object.assign(files, adrFiles);
+    files['docs/security/threat-model.md'] = ThreatModelDocumenter.generateMarkdown(architecture);
+
+    return {
+      files,
+      fileCount: Object.keys(files).length,
+      architecture,
+      entities,
+      summary: `Synthesized ${Object.keys(files).length} backend files (${architecture.style}, ${entities.length} entities, ${architecture.complexity.tier} complexity).`
+    };
+  }
+}

package/src/backend/synthesis/infrastructure-synthesizer.js

@@ -0,0 +1,108 @@
+/**
+ * PIXEL CREW — Infrastructure Synthesizer
+ * 
+ * Synthesizes database client singletons, Dockerfile, docker-compose.yml,
+ * and environment configuration templates.
+ */
+
+export class InfrastructureSynthesizer {
+  /**
+   * Synthesize infrastructure files
+   * @param {object} architecture 
+   * @returns {object} Map of filename -> content
+   */
+  static synthesize(architecture = {}) {
+    const files = {};
+    const dbType = architecture.database?.type || 'postgresql';
+    const isPostgres = dbType === 'postgresql';
+
+    // 1. Prisma Client Singleton
+    files['src/infrastructure/database.ts'] = `import { PrismaClient } from "@prisma/client";
+
+const globalForPrisma = globalThis as unknown as {
+  prisma: PrismaClient | undefined;
+};
+
+export const prisma =
+  globalForPrisma.prisma ??
+  new PrismaClient({
+    log: process.env.NODE_ENV === "development" ? ["query", "error", "warn"] : ["error"]
+  });
+
+if (process.env.NODE_ENV !== "production") globalForPrisma.prisma = prisma;
+`;
+
+    // 2. Dockerfile
+    files['Dockerfile'] = `FROM node:20-alpine AS base
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+
+FROM base AS deps
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+FROM base AS builder
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npx prisma generate
+RUN npm run build
+
+FROM base AS runner
+ENV NODE_ENV=production
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000
+CMD ["node", "server.js"]
+`;
+
+    // 3. Docker Compose (only if Postgres / Redis required)
+    if (isPostgres) {
+      files['docker-compose.yml'] = `version: '3.8'
+
+services:
+  app:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      - DATABASE_URL=postgresql://postgres:postgres@db:5432/app_db?schema=public
+      - NODE_ENV=production
+    depends_on:
+      - db
+
+  db:
+    image: postgres:16-alpine
+    restart: always
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: app_db
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+
+volumes:
+  pgdata:
+`;
+    }
+
+    // 4. Environment Variables Template
+    files['.env.example'] = `# Database Connection
+DATABASE_URL="${isPostgres ? 'postgresql://postgres:postgres@localhost:5432/app_db?schema=public' : 'file:./dev.db'}"
+
+# Application Security
+SESSION_SECRET="change-this-to-a-secure-random-32-character-secret"
+NODE_ENV="development"
+PORT=3000
+`;
+
+    return files;
+  }
+}