ts-prorm-orm 1.1.0 → 1.2.0

package/dist/compliance/query-firewall.d.ts

@@ -0,0 +1,661 @@
+/**
+ * Database Firewall / Query Allowlist
+ *
+ * A security layer that:
+ * - Blocks dangerous queries or commands
+ * - Allows only approved query patterns
+ * - Logs and alerts on blocked queries
+ * - Required for: OWASP, CIS Benchmarks compliance
+ *
+ * Usage:
+ *   // Create firewall instance
+ *   const firewall = QueryFirewall.create(prorm, {
+ *     mode: 'allowlist',
+ *     onBlock: (block) => console.log('Blocked:', block.query),
+ *   });
+ *
+ *   // Add allowed patterns
+ *   firewall.allow('^SELECT \\* FROM users WHERE');
+ *   firewall.allow('^INSERT INTO orders');
+ *
+ *   // Add blocked patterns (dangerous commands)
+ *   firewall.block('^DROP (TABLE|DATABASE)');
+ *   firewall.block('^TRUNCATE');
+ *
+ *   // Check if query is allowed
+ *   const result = firewall.checkQuery('SELECT * FROM users WHERE id = 1');
+ *   if (!result.allowed) {
+ *     console.log('Query blocked:', result.reason);
+ *   }
+ *
+ *   // Get blocked history
+ *   const history = firewall.getBlockedHistory();
+ */
+import { Prorm } from '../prorm';
+export type FirewallRuleType = 'allow' | 'block';
+export type FirewallMode = 'allowlist' | 'blocklist' | 'strict';
+/**
+ * Companion enum for {@link FirewallMode}. Provided for callers who prefer
+ * enum-based ergonomics (autocomplete, refactor-safety) over raw string
+ * literals. The underlying values are identical to the `FirewallMode`
+ * string literals, so either form may be used interchangeably.
+ */
+export declare enum FirewallModeEnum {
+    Allowlist = "allowlist",
+    Blocklist = "blocklist",
+    Strict = "strict"
+}
+export interface FirewallRule {
+    id: string;
+    type: FirewallRuleType;
+    pattern: string | RegExp;
+    description?: string;
+    createdAt: Date;
+}
+export interface QueryAnalysis {
+    query: string;
+    allowed: boolean;
+    reason?: string;
+    matchedRule?: string;
+    riskScore: number;
+    operation: QueryOperation;
+    tables: string[];
+    containsSensitiveData: boolean;
+}
+export type QueryOperation = 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'DROP' | 'TRUNCATE' | 'ALTER' | 'CREATE' | 'EXECUTE' | 'UNKNOWN';
+export interface BlockedQuery {
+    id: string;
+    timestamp: Date;
+    query: string;
+    reason: string;
+    matchedRule: string;
+    operation: QueryOperation;
+    user?: string;
+}
+export interface FirewallOptions {
+    /** Firewall mode: allowlist (only allow matching), blocklist (block matching), strict (both) */
+    mode?: FirewallMode | FirewallModeEnum;
+    /** Default blocked patterns for dangerous operations */
+    blockDangerousByDefault?: boolean;
+    /** Callback when a query is blocked */
+    onBlock?: (blocked: BlockedQuery) => void;
+    /** Callback when a query is allowed */
+    onAllow?: (analysis: QueryAnalysis) => void;
+    /** Maximum blocked queries to keep in history */
+    maxHistory?: number;
+    /** Log all queries (including allowed) */
+    logAllQueries?: boolean;
+    /** Enable case-insensitive matching */
+    caseInsensitive?: boolean;
+    /** Custom rules to apply at startup */
+    rules?: Array<{
+        type: FirewallRuleType;
+        pattern: string;
+        description?: string;
+    }>;
+    /** Active compliance frameworks for auto-configuration */
+    frameworks?: string[];
+}
+/** Exportable rule constants for custom configurations */
+export declare const FIREWALL_RULES: {
+    readonly DESTRUCTIVE: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "DROP object";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "TRUNCATE table";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DELETE without WHERE clause";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ALTER TABLE DROP";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ALTER TABLE RENAME";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DROP index";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DROP trigger";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DROP sequence";
+    }];
+    readonly SCHEMA_MODIFICATION: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "CREATE table/database/schema";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ADD column";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "MODIFY column";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CHANGE column";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ADD index";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE index";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE index";
+    }];
+    readonly PERMISSIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "GRANT permissions";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "REVOKE permissions";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE user";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DROP user";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ALTER user";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "SET password";
+    }];
+    readonly CODE_EXECUTION: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "EXEC stored procedure";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "EXECUTE stored procedure";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CALL procedure/function";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "xp_cmdshell (SQL Server)";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "sp_executesql (SQL Server)";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE function/procedure";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DROP function/procedure";
+    }];
+    readonly FILE_OPERATIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "LOAD_FILE() - read file";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "INTO OUTFILE - write file";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "INTO DUMPFILE - write binary file";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Path traversal attempt";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Access /etc/passwd";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Access Windows system32";
+    }];
+    readonly INFORMATION_GATHERING: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "SHOW databases/tables/columns";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "DESCRIBE table";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "EXPLAIN query";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Get database version";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Get current user";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Get current user";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Get data directory";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Access information_schema";
+    }];
+    readonly TRANSACTION_CONTROL: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "BEGIN transaction";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "START TRANSACTION";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "COMMIT transaction";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "ROLLBACK transaction";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "SET TRANSACTION ISOLATION";
+    }];
+    readonly BULK_OPERATIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "BULK INSERT";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Bulk insert with wildcard";
+    }];
+    readonly REMOTE_OPERATIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "Cross-database query";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "Remote execution (Oracle)";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "OPENQUERY - linked server";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "OPENDATASOURCE";
+    }];
+    readonly CRYPTO_OPERATIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "CREATE asymmetric key";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE symmetric key";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "CREATE certificate";
+    }];
+    readonly BACKUP_OPERATIONS: readonly [{
+        readonly pattern: RegExp;
+        readonly description: "BACKUP database/log";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "RESTORE database/log";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "mysqldump command";
+    }, {
+        readonly pattern: RegExp;
+        readonly description: "pg_dump command";
+    }];
+};
+/** OWASP Top 10 SQL Injection patterns */
+export declare const OWASP_SQL_INJECTION_PATTERNS: RegExp[];
+/** CIS Benchmarks database security rules */
+export declare const CIS_BENCHMARK_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** PCI DSS compliance rules */
+export declare const PCI_DSS_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** HIPAA compliance rules */
+export declare const HIPAA_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** SOX compliance rules */
+export declare const SOX_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** NIST CSF rules */
+export declare const NIST_CSF_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** PostgreSQL-specific dangerous patterns */
+export declare const POSTGRESQL_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** MySQL-specific dangerous patterns */
+export declare const MYSQL_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** MariaDB-specific dangerous patterns */
+export declare const MARIADB_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** Microsoft SQL Server-specific dangerous patterns */
+export declare const MSSQL_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** Oracle-specific dangerous patterns */
+export declare const ORACLE_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** SQLite-specific dangerous patterns */
+export declare const SQLITE_RULES: {
+    pattern: RegExp;
+    description: string;
+}[];
+/** Database type union */
+export type DatabaseType = 'postgresql' | 'mysql' | 'mariadb' | 'mssql' | 'oracle' | 'sqlite';
+/** All database-specific rules */
+export declare const DATABASE_RULES: Record<DatabaseType, readonly {
+    pattern: RegExp;
+    description: string;
+}[]>;
+export declare class QueryFirewall {
+    private prorm;
+    private options;
+    private allowRules;
+    private blockRules;
+    private blockedHistory;
+    private queryLog;
+    private originalQuery;
+    private isActive;
+    private static instances;
+    private constructor();
+    /**
+     * Create a new firewall instance (factory method)
+     */
+    static create(prorm: Prorm, options?: FirewallOptions): QueryFirewall;
+    /**
+     * Get existing instance for a Prorm instance
+     */
+    static getInstance(prorm: Prorm): QueryFirewall | undefined;
+    /**
+     * Initialize default rules
+     */
+    private initializeRules;
+    /**
+     * Add an allowed pattern
+     */
+    allow(pattern: string | RegExp, description?: string): FirewallRule;
+    /**
+     * Add a blocked pattern
+     */
+    block(pattern: string | RegExp, description?: string): FirewallRule;
+    /**
+     * Remove a rule by ID
+     */
+    removeRule(ruleId: string): boolean;
+    /**
+     * Check if a query is allowed
+     */
+    checkQuery(sql: string): QueryAnalysis;
+    /**
+     * Analyze a query without applying firewall rules
+     */
+    analyzeQuery(sql: string): QueryAnalysis;
+    /**
+     * Match a pattern against a query
+     */
+    private matchPattern;
+    /**
+     * Get blocked query history
+     */
+    getBlockedHistory(options?: {
+        since?: Date;
+        operation?: QueryOperation;
+        limit?: number;
+    }): BlockedQuery[];
+    /**
+     * Get query log (if logging enabled)
+     */
+    getQueryLog(limit?: number): QueryAnalysis[];
+    /**
+     * Get all rules
+     */
+    getRules(): {
+        allowRules: FirewallRule[];
+        blockRules: FirewallRule[];
+    };
+    /**
+     * Get statistics
+     */
+    getStats(): {
+        totalBlocked: number;
+        totalAllowed: number;
+        blockedByOperation: Record<QueryOperation, number>;
+        allowRulesCount: number;
+        blockRulesCount: number;
+        isActive: boolean;
+    };
+    /**
+     * Apply CIS Benchmarks rules
+     */
+    applyCisRules(): void;
+    /**
+     * Apply PCI DSS rules
+     */
+    applyPciRules(): void;
+    /**
+     * Apply HIPAA rules
+     */
+    applyHipaaRules(): void;
+    /**
+     * Apply SOX rules
+     */
+    applySoxRules(): void;
+    /**
+     * Apply NIST CSF rules
+     */
+    applyNistRules(): void;
+    /**
+     * Apply OWASP SQL Injection patterns
+     */
+    applyOwaspRules(): void;
+    /**
+     * Apply all destructive operation rules
+     */
+    applyDestructiveRules(): void;
+    /**
+     * Apply all schema modification rules
+     */
+    applySchemaRules(): void;
+    /**
+     * Apply all permission rules
+     */
+    applyPermissionRules(): void;
+    /**
+     * Apply all file operation rules
+     */
+    applyFileRules(): void;
+    /**
+     * Apply all information gathering rules
+     */
+    applyInfoGatheringRules(): void;
+    /**
+     * Apply all code execution rules
+     */
+    applyCodeExecutionRules(): void;
+    /**
+     * Apply all transaction control rules
+     */
+    applyTransactionRules(): void;
+    /**
+     * Apply all remote operation rules
+     */
+    applyRemoteOperationRules(): void;
+    /**
+     * Apply all crypto operation rules
+     */
+    applyCryptoRules(): void;
+    /**
+     * Apply all backup operation rules
+     */
+    applyBackupRules(): void;
+    /**
+     * Apply database-specific rules
+     * @param database - 'postgresql' | 'mysql' | 'mariadb' | 'mssql' | 'oracle' | 'sqlite'
+     */
+    applyDatabaseRules(database: DatabaseType): void;
+    /**
+     * Apply all predefined security rules
+     */
+    applyAllSecurityRules(): void;
+    /**
+     * Apply predefined compliance framework rules
+     * @param framework - 'CIS', 'PCI', 'HIPAA', 'SOX', 'NIST', 'OWASP'
+     */
+    applyFrameworkRules(framework: 'CIS' | 'PCI' | 'HIPAA' | 'SOX' | 'NIST' | 'OWASP'): void;
+    /**
+     * Start the firewall - intercept queries
+     */
+    start(): void;
+    /**
+     * Stop the firewall - restore original query method
+     */
+    stop(): void;
+    /**
+     * Check if firewall is active
+     */
+    isFirewallActive(): boolean;
+    /**
+     * Clear blocked history
+     */
+    clearHistory(): void;
+    /**
+     * Clear query log
+     */
+    clearLog(): void;
+    /**
+     * Export rules for audit purposes
+     */
+    exportRules(): string;
+    /**
+     * Import rules from JSON
+     */
+    importRules(json: string): void;
+}
+/**
+ * Analyze a query for security issues (static method)
+ */
+export declare function analyzeQuerySecurity(query: string): {
+    isSQLInjection: boolean;
+    isDangerousOperation: boolean;
+    riskLevel: 'low' | 'medium' | 'high' | 'critical';
+    detectedPatterns: string[];
+};
+/**
+ * Get recommended firewall rules for compliance frameworks
+ */
+export declare function getRecommendedRules(frameworks: string[]): Array<{
+    type: FirewallRuleType;
+    pattern: string;
+    description: string;
+}>;
+export interface FirewallRuleDecoratorOptions {
+    /** Database type for database-specific rules */
+    database?: DatabaseType;
+    /** Additional rules to apply */
+    rules?: Array<{
+        pattern: string | RegExp;
+        description: string;
+    }>;
+    /** Block all Destructive operations */
+    blockDestructive?: boolean;
+    /** Block all Schema modifications */
+    blockSchemaModification?: boolean;
+    /** Block all Permission changes */
+    blockPermissions?: boolean;
+    /** Block all File operations */
+    blockFileOperations?: boolean;
+    /** Block all Information gathering */
+    blockInfoGathering?: boolean;
+    /** Block all Code execution */
+    blockCodeExecution?: boolean;
+    /** Block all Transaction control */
+    blockTransactions?: boolean;
+    /** Block all Remote operations */
+    blockRemoteOperations?: boolean;
+}
+/**
+ * Decorator to apply firewall rules to a model class
+ *
+ * @example
+ * // Block destructive operations and file operations on a model
+ * @FirewallRules({
+ *   blockDestructive: true,
+ *   blockFileOperations: true,
+ * })
+ * class SensitiveData extends Model { ... }
+ *
+ * // Apply database-specific rules
+ * @FirewallRules({
+ *   database: 'postgresql',
+ *   blockCodeExecution: true,
+ * })
+ * class UserDefinedFunction extends Model { ... }
+ *
+ * // Custom rules
+ * @FirewallRules({
+ *   rules: [
+ *     { pattern: /^SELECT\s+FROM\s+logs/i, description: 'Block log access' },
+ *   ],
+ * })
+ * class AuditLog extends Model { ... }
+ */
+export declare function FirewallRules(options?: FirewallRuleDecoratorOptions): (target: any) => void;
+/**
+ * Decorator for PostgreSQL-specific firewall rules
+ *
+ * @example
+ * @PostgreSQLFirewall()
+ * class PostgresSensitive extends Model { ... }
+ */
+export declare function PostgreSQLFirewall(): (target: any) => void;
+/**
+ * Decorator for MySQL-specific firewall rules
+ *
+ * @example
+ * @MySQLFirewall()
+ * class MySQLSensitive extends Model { ... }
+ */
+export declare function MySQLFirewall(): (target: any) => void;
+/**
+ * Decorator for MariaDB-specific firewall rules
+ *
+ * @example
+ * @MariaDBFirewall()
+ * class MariaDBSensitive extends Model { ... }
+ */
+export declare function MariaDBFirewall(): (target: any) => void;
+/**
+ * Decorator for SQL Server-specific firewall rules
+ *
+ * @example
+ * @MSSQLFirewall()
+ * class MSSQLSensitive extends Model { ... }
+ */
+export declare function MSSQLFirewall(): (target: any) => void;
+/**
+ * Decorator for Oracle-specific firewall rules
+ *
+ * @example
+ * @OracleFirewall()
+ * class OracleSensitive extends Model { ... }
+ */
+export declare function OracleFirewall(): (target: any) => void;
+/**
+ * Decorator for SQLite-specific firewall rules
+ *
+ * @example
+ * @SQLiteFirewall()
+ * class SQLiteSensitive extends Model { ... }
+ */
+export declare function SQLiteFirewall(): (target: any) => void;
+/**
+ * Apply firewall rules from a decorated model to a firewall instance
+ */
+export declare function applyFirewallRulesToModel(model: any, firewall: QueryFirewall): void;