timonel 3.1.1 → 3.1.2

package/dist/lib/validation/inputValidator.js

@@ -1,4 +1,12 @@
+/**
+ * Input validation utilities for the Policy Engine
+ * Provides comprehensive validation for all user inputs to prevent
+ * injection attacks and malformed data processing
+ */
 import { PolicyValidationError } from '../policy/errors.js';
+/**
+ * Default validation options
+ */
 const DEFAULT_OPTIONS = {
     maxStringLength: 10000,
     maxArrayLength: 1000,
@@ -6,15 +14,22 @@ const DEFAULT_OPTIONS = {
     allowedProtocols: ['http', 'https'],
     sanitizeStrings: true,
 };
+/**
+ * Input validator class for policy engine inputs
+ */
 export class InputValidator {
     constructor(options = {}) {
         this.options = { ...DEFAULT_OPTIONS, ...options };
     }
+    /**
+     * Validates a PolicyConfig object
+     */
     validatePolicyConfig(config) {
         if (!config || typeof config !== 'object') {
             throw new PolicyValidationError('PolicyConfig must be a non-null object');
         }
         const typedConfig = config;
+        // Validate required fields
         if (!typedConfig.id || typeof typedConfig.id !== 'string') {
             throw new PolicyValidationError('PolicyConfig.id must be a non-empty string');
         }
@@ -24,9 +39,12 @@ export class InputValidator {
         if (!Array.isArray(typedConfig.rules)) {
             throw new PolicyValidationError('PolicyConfig.rules must be an array');
         }
+        // Validate string lengths
         this.validateStringLength(typedConfig.id, 'PolicyConfig.id');
         this.validateStringLength(typedConfig.name, 'PolicyConfig.name');
+        // Validate array length
         this.validateArrayLength(typedConfig.rules, 'PolicyConfig.rules');
+        // Validate each rule
         const validatedRules = typedConfig.rules.map((rule, index) => {
             try {
                 return this.validatePolicyRule(rule);
@@ -35,6 +53,7 @@ export class InputValidator {
                 throw new PolicyValidationError(`PolicyConfig.rules[${index}]: ${error.message}`);
             }
         });
+        // Sanitize strings if enabled
         const sanitizedConfig = {
             id: this.sanitizeString(typedConfig.id),
             name: this.sanitizeString(typedConfig.name),
@@ -49,11 +68,15 @@ export class InputValidator {
         }
         return sanitizedConfig;
     }
+    /**
+     * Validates a PolicyRule object
+     */
     validatePolicyRule(rule) {
         if (!rule || typeof rule !== 'object') {
             throw new PolicyValidationError('PolicyRule must be a non-null object');
         }
         const typedRule = rule;
+        // Validate required fields
         if (!typedRule.id || typeof typedRule.id !== 'string') {
             throw new PolicyValidationError('PolicyRule.id must be a non-empty string');
         }
@@ -63,8 +86,10 @@ export class InputValidator {
         if (!typedRule.condition || typeof typedRule.condition !== 'object') {
             throw new PolicyValidationError('PolicyRule.condition must be an object');
         }
+        // Validate string lengths
         this.validateStringLength(typedRule.id, 'PolicyRule.id');
         this.validateStringLength(typedRule.type, 'PolicyRule.type');
+        // Validate object depth
         this.validateObjectDepth(typedRule.condition, 'PolicyRule.condition');
         const sanitizedRule = {
             id: this.sanitizeString(typedRule.id),
@@ -78,23 +103,34 @@ export class InputValidator {
         }
         return sanitizedRule;
     }
+    /**
+     * Validates a PolicyContext object
+     */
     validatePolicyContext(context) {
         if (!context || typeof context !== 'object') {
             throw new PolicyValidationError('PolicyContext must be a non-null object');
         }
         const typedContext = context;
+        // Validate object depth
         this.validateObjectDepth(typedContext, 'PolicyContext');
+        // Sanitize the entire context object
         return this.sanitizeObject(typedContext);
     }
+    /**
+     * Validates a PluginConfig object
+     */
     validatePluginConfig(config) {
         if (!config || typeof config !== 'object') {
             throw new PolicyValidationError('PluginConfig must be a non-null object');
         }
         const typedConfig = config;
+        // Validate required fields
         if (!typedConfig.name || typeof typedConfig.name !== 'string') {
             throw new PolicyValidationError('PluginConfig.name must be a non-empty string');
         }
+        // Validate string lengths
         this.validateStringLength(typedConfig.name, 'PluginConfig.name');
+        // Validate configuration object if present
         if (typedConfig.config && typeof typedConfig.config === 'object') {
             this.validateObjectDepth(typedConfig.config, 'PluginConfig.config');
         }
@@ -110,16 +146,25 @@ export class InputValidator {
         }
         return sanitizedConfig;
     }
+    /**
+     * Validates string length against maximum allowed
+     */
     validateStringLength(value, fieldName) {
         if (value.length > this.options.maxStringLength) {
             throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxStringLength} characters`);
         }
     }
+    /**
+     * Validates array length against maximum allowed
+     */
     validateArrayLength(value, fieldName) {
         if (value.length > this.options.maxArrayLength) {
             throw new PolicyValidationError(`${fieldName} exceeds maximum length of ${this.options.maxArrayLength} items`);
         }
     }
+    /**
+     * Validates object depth to prevent deeply nested objects
+     */
     validateObjectDepth(obj, fieldName, currentDepth = 0) {
         if (currentDepth > this.options.maxObjectDepth) {
             throw new PolicyValidationError(`${fieldName} exceeds maximum object depth of ${this.options.maxObjectDepth}`);
@@ -130,32 +175,45 @@ export class InputValidator {
             }
         }
     }
+    /**
+     * Sanitizes a string by removing potentially dangerous characters
+     * Focuses on policy configuration validation, not HTML sanitization
+     */
     sanitizeString(value) {
         if (!this.options.sanitizeStrings) {
             return value;
         }
+        // Remove null bytes and control characters only
         let sanitized = value
-            .replace(/\0/g, '')
+            .replace(/\0/g, '') // Remove null bytes
             .split('')
             .filter((char) => {
             const code = char.charCodeAt(0);
-            return code > 31 && code !== 127;
+            return code > 31 && code !== 127; // Keep printable characters only
         })
             .join('');
+        // Remove only genuinely dangerous patterns for policy configurations
+        // No HTML sanitization needed - these are policy configs, not web content
         sanitized = sanitized.trim();
         return sanitized;
     }
+    /**
+     * Sanitizes an object recursively
+     */
     sanitizeObject(obj) {
         const sanitized = {};
         for (const [key, value] of Object.entries(obj)) {
             const sanitizedKey = this.sanitizeString(key);
             if (typeof value === 'string') {
+                // eslint-disable-next-line security/detect-object-injection
                 sanitized[sanitizedKey] = this.sanitizeString(value);
             }
             else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                // eslint-disable-next-line security/detect-object-injection
                 sanitized[sanitizedKey] = this.sanitizeObject(value);
             }
             else if (Array.isArray(value)) {
+                // eslint-disable-next-line security/detect-object-injection
                 sanitized[sanitizedKey] = value.map((item) => typeof item === 'string'
                     ? this.sanitizeString(item)
                     : typeof item === 'object' && item !== null
@@ -163,13 +221,20 @@ export class InputValidator {
                         : item);
             }
             else {
+                // eslint-disable-next-line security/detect-object-injection
                 sanitized[sanitizedKey] = value;
             }
         }
         return sanitized;
     }
 }
+/**
+ * Default input validator instance
+ */
 export const defaultValidator = new InputValidator();
+/**
+ * Convenience functions for common validation scenarios
+ */
 export const validatePolicyConfig = (config) => defaultValidator.validatePolicyConfig(config);
 export const validatePolicyRule = (rule) => defaultValidator.validatePolicyRule(rule);
 export const validatePolicyContext = (context) => defaultValidator.validatePolicyContext(context);

package/dist/types/index.d.ts

@@ -1,27 +1,61 @@
+/**
+ * Type definitions for the Policy Engine input validation
+ */
+/**
+ * Configuration for a policy
+ */
 export interface PolicyConfig {
+    /** Unique identifier for the policy */
     id: string;
+    /** Human-readable name for the policy */
     name: string;
+    /** Array of policy rules */
     rules: PolicyRule[];
+    /** Optional description of the policy */
     description?: string;
+    /** Version of the policy */
     version?: string;
+    /** Whether the policy is enabled */
     enabled?: boolean;
 }
+/**
+ * A single policy rule
+ */
 export interface PolicyRule {
+    /** Unique identifier for the rule */
     id: string;
+    /** Type of the rule (e.g., 'security', 'compliance') */
     type: string;
+    /** Condition object that defines when the rule applies */
     condition: Record<string, unknown>;
+    /** Optional action to take when rule is violated */
     action?: string;
+    /** Priority of the rule (higher numbers = higher priority) */
     priority?: number;
+    /** Whether the rule is enabled */
     enabled?: boolean;
 }
+/**
+ * Context data for policy execution
+ */
 export interface PolicyContext {
+    /** Environment (e.g., 'production', 'staging') */
     environment?: string;
+    /** Additional metadata */
     metadata?: Record<string, unknown>;
+    /** Any other context data */
     [key: string]: unknown;
 }
+/**
+ * Configuration for a plugin
+ */
 export interface PluginConfig {
+    /** Name of the plugin */
     name: string;
+    /** Version of the plugin */
     version?: string;
+    /** Plugin-specific configuration */
     config?: Record<string, unknown>;
+    /** Whether the plugin is enabled */
     enabled?: boolean;
 }

package/dist/types/index.js

@@ -1 +1,4 @@
+/**
+ * Type definitions for the Policy Engine input validation
+ */
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -43,6 +43,7 @@
     "prepare": "husky",
     "prepack": "pnpm build",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck:consumer": "tsc -p tests/types/tsconfig.json --noEmit",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write .",
@@ -58,10 +59,10 @@
     "test:unit": "vitest run --config vitest.config.ts",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
+    "test:coverage": "vitest run --coverage --exclude tests/performance-benchmarks.test.ts",
     "doc:coverage": "tsx scripts/project-doc-coverage.ts",
     "doc:coverage:validate": "tsx scripts/validate-doc-coverage.ts",
-    "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",
+    "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build && pnpm typecheck:consumer",
     "release": "semantic-release",
     "release:dry": "semantic-release --dry-run",
     "version:patch": "npm version patch && echo 'Remember to update CHANGELOG.md'",
@@ -78,7 +79,7 @@
   "author": "Franklin García <KenkoGeek>",
   "license": "MIT",
   "engines": {
-    "node": ">=22",
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0",
     "pnpm": ">=9.0.0"
   },
   "repository": {
@@ -102,43 +103,41 @@
     ]
   },
   "dependencies": {
-    "cdk8s": "^2.70.51",
-    "cdk8s-plus-33": "^2.4.37",
-    "constructs": "^10.5.1",
-    "handlebars": "^4.7.8",
+    "cdk8s": "^2.70.100",
+    "cdk8s-plus-33": "^2.5.53",
+    "constructs": "^10.8.1",
+    "handlebars": "^4.7.9",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "ts-node": "^10.9.2",
-    "yaml": "^2.8.2"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.5.0",
-    "@commitlint/config-conventional": "^20.5.0",
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
     "@eslint/js": "^10.0.1",
-    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
-    "@semantic-release/git": "^10.0.1",
-    "@types/node": "^25.5.0",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
-    "@typescript-eslint/parser": "^8.57.0",
-    "@vitest/coverage-v8": "^4.1.0",
-    "conventional-changelog-cli": "^5.0.0",
-    "eslint": "^10.0.3",
+    "@semantic-release/git": "^11.0.1",
+    "@types/node": "^26.4.1",
+    "@typescript-eslint/eslint-plugin": "^8.69.0",
+    "@typescript-eslint/parser": "^8.69.0",
+    "@vitest/coverage-v8": "^5.0.0",
+    "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-security": "^4.0.0",
-    "eslint-plugin-sonarjs": "^4.0.2",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-security": "^4.0.1",
+    "eslint-plugin-sonarjs": "^4.2.0",
     "eslint-plugin-unused-imports": "^4.4.1",
     "husky": "^9.1.7",
-    "lint-staged": "^16.4.0",
-    "markdownlint": "^0.40.0",
-    "markdownlint-cli": "^0.48.0",
-    "prettier": "^3.8.1",
-    "semantic-release": "^25.0.3",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "lint-staged": "^17.4.1",
+    "markdownlint": "^0.41.1",
+    "markdownlint-cli": "^0.49.1",
+    "prettier": "^3.9.6",
+    "semantic-release": "^25.0.9",
+    "tsx": "^4.23.13",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.0"
   },
   "files": [
     "dist",
@@ -151,11 +150,5 @@
     "access": "public",
     "provenance": true
   },
-  "packageManager": "pnpm@10.15.0+sha512.486ebc259d3e999a4e8691ce03b5cac4a71cbeca39372a9b762cb500cfdf0873e2cb16abe3d951b1ee2cf012503f027b98b6584e4df22524e0c7450d9ec7aa7b",
-  "pnpm": {
-    "overrides": {
-      "@conventional-changelog/git-client": ">=2.0.0",
-      "glob": "^13.0.0"
-    }
-  }
+  "packageManager": "pnpm@10.34.5+sha512.a4ee05f2f73658255bd6a89859c065a45c28a57daefae2c893a168ee2b73168c37b91e83e57ea67654ad03f03031746430e8bce38e362e042605fb8abc80192e"
 }