ts-prorm-orm 1.1.0 → 1.2.0

package/dist/compliance/pseudonymization.d.ts

@@ -0,0 +1,96 @@
+/**
+ * PseudonymizationService
+ *
+ * Replaces identifiers with non-reversible tokens for analytics, logging,
+ * and cross-system sharing while preserving referential integrity.
+ * Supports deterministic tokenization (same input → same token) using HMAC-SHA256.
+ *
+ * Covers ~34 compliance frameworks including:
+ *   GDPR Art 25 (Privacy by Design), ISO 27701, ISO 29151, HIPAA Safe Harbor,
+ *   PIPL (China), KVKK (Turkey), NIST SP 800-122, and more.
+ *
+ * Usage:
+ *   // Configure once at startup:
+ *   await PseudonymizationService.configure({
+ *     secretKey: process.env.PSEUDO_SECRET_KEY,
+ *     store: 'database', // or 'memory'
+ *   });
+ *
+ *   // Tokenize a value:
+ *   const token = await PseudonymizationService.tokenize('user-123');
+ *   // token: 'a1b2c3d4e5f6...' (deterministic, same input = same output)
+ *
+ *   // Detokenize (reverse):
+ *   const original = await PseudonymizationService.detokenize(token);
+ *   // original: 'user-123'
+ *
+ *   // Or use the decorator on a model field:
+ *   @Pseudonymize('nationalId')
+ *   class Patient extends Model { ... }
+ *
+ *   // Apply hooks to auto-tokenize on write:
+ *   PseudonymizationService.applyHooks(Patient, 'nationalId');
+ */
+export type StorageMode = 'memory' | 'database';
+export interface PseudonymizationConfig {
+    /** HMAC secret key (must be >= 32 bytes for security) */
+    secretKey: string;
+    /** Storage for token↔value mappings */
+    store?: StorageMode;
+    /** Database model for storing mappings (required if store='database') */
+    model?: any;
+    /** Algorithm. Default: 'sha256' */
+    algorithm?: string;
+}
+/**
+ * Configure the pseudonymization service.
+ *
+ * @param cfg - Configuration options
+ */
+export declare function configure(cfg: PseudonymizationConfig): Promise<void>;
+/**
+ * Tokenize a value (replace with a pseudonym/token).
+ * Returns the same token for the same input (deterministic).
+ */
+export declare function tokenize(value: string): Promise<string>;
+/**
+ * Detokenize (reverse) a token to get the original value.
+ */
+export declare function detokenize(token: string): Promise<string | null>;
+/**
+ * Check if a token exists.
+ */
+export declare function exists(token: string): Promise<boolean>;
+/**
+ * Delete a token (irreversible — useful for right to erasure).
+ */
+export declare function removeToken(token: string): Promise<boolean>;
+/**
+ * Delete tokens for a specific original value.
+ */
+export declare function removeOriginal(original: string): Promise<boolean>;
+export declare function getPseudonymizedFields(target: Function): string[];
+/**
+ * Mark a field for automatic pseudonymization.
+ *
+ *   @Pseudonymize('nationalId')
+ *   class Patient extends Model { ... }
+ */
+export declare function Pseudonymize(field: string): (target: Function) => void;
+/**
+ * Wire hooks onto a model to auto-tokenize the specified field on write
+ * and auto-detokenize on read.
+ *
+ * @param Model  - The model class
+ * @param field  - The field to pseudonymize
+ */
+export declare function applyHooks(Model: any, field: string): void;
+export declare class PseudonymizationService {
+    static configure: typeof configure;
+    static tokenize: typeof tokenize;
+    static detokenize: typeof detokenize;
+    static exists: typeof exists;
+    static removeToken: typeof removeToken;
+    static removeOriginal: typeof removeOriginal;
+    static applyHooks: typeof applyHooks;
+}