ts-prorm-orm 1.1.0

package/dist/compliance/data-classifier.js

@@ -0,0 +1,258 @@
+"use strict";
+/**
+ * DataClassifier
+ *
+ * Tags model fields with sensitivity classifications (PII, PHI, PCI, etc.)
+ * to enable other compliance classes to auto-identify sensitive data.
+ * Stores classifications in model metadata for runtime discovery.
+ *
+ * Covers ~25 compliance frameworks including:
+ *   NIST CSF, NIST SP 800-122, FIPS 199, ISO 29101, China Data Security Law,
+ *   PIPL, AI Act EU, GDPR Art 25/30/32, and data classification requirements.
+ *
+ * Usage:
+ *   // Tag fields with sensitivity levels:
+ *   @Classify('PII')
+ *   @FieldClassification('email', 'PII')
+ *   @FieldClassification('ssn', 'PHI')  // PHI = Personal Health Information
+ *   @FieldClassification('creditCard', 'PCI')
+ *   @FieldClassification('salary', 'CONFIDENTIAL')
+ *   class User extends Model { ... }
+ *
+ *   // Query classifications:
+ *   const fields = DataClassifier.getPIIFields(User);
+ *   const classification = DataClassifier.getClassification(User, 'email');
+ *   const all = DataClassifier.getClassifications(User);
+ *
+ *   // Auto-discover fields by name patterns:
+ *   DataClassifier.autoDiscover(User, ['ssn', 'social', 'dob', 'card', 'password']);
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataClassifier = void 0;
+exports.Classify = Classify;
+exports.FieldClassification = FieldClassification;
+exports.getClassification = getClassification;
+exports.getClassificationsForModel = getClassificationsForModel;
+exports.getFieldsByCategory = getFieldsByCategory;
+exports.getPIIFields = getPIIFields;
+exports.getPHIFields = getPHIFields;
+exports.getPCIFields = getPCIFields;
+exports.getFinancialFields = getFinancialFields;
+exports.getFieldsByLevel = getFieldsByLevel;
+exports.getConfidentialFields = getConfidentialFields;
+exports.isSensitive = isSensitive;
+exports.autoDiscover = autoDiscover;
+exports.inheritClassifications = inheritClassifications;
+const CLASSIFICATION_KEY = '__orm_classifications__';
+// ==================== Registry ====================
+function getClassifications(target) {
+    if (!target[CLASSIFICATION_KEY]) {
+        target[CLASSIFICATION_KEY] = new Map();
+    }
+    return target[CLASSIFICATION_KEY];
+}
+/**
+ * Classify the entire model (applies to all fields, use field-level for specifics).
+ *
+ *   @Classify('CONFIDENTIAL')
+ *   class FinancialRecord extends Model { ... }
+ */
+function Classify(level) {
+    return function (target) {
+        // Apply a default classification to all fields
+        const map = getClassifications(target);
+        // Store at a special key to indicate model-level classification
+        map.set('__model__', { level, category: 'PII' });
+    };
+}
+/**
+ * Classify a specific field.
+ *
+ *   @FieldClassification('email', 'PII')
+ *   @FieldClassification('ssn', 'PHI', { level: 'SECRET', regulations: ['HIPAA'] })
+ *   @FieldClassification('creditCard', 'PCI_PAN', { level: 'TOP_SECRET' })
+ */
+function FieldClassification(field, category, options = {}) {
+    return function (target) {
+        const map = getClassifications(target);
+        map.set(field, {
+            level: options.level ?? 'CONFIDENTIAL',
+            category,
+            isIdentifier: options.isIdentifier ?? false,
+            canLog: options.canLog ?? false,
+            regulations: options.regulations,
+            description: options.description,
+        });
+    };
+}
+// ==================== Query Methods ====================
+/**
+ * Get the classification for a specific field.
+ */
+function getClassification(Model, field) {
+    return getClassifications(Model).get(field);
+}
+/**
+ * Get all classifications for a model.
+ */
+function getClassificationsForModel(Model) {
+    return getClassifications(Model);
+}
+/**
+ * Get all fields with a specific category (e.g., all PII fields).
+ */
+function getFieldsByCategory(Model, category) {
+    const map = getClassifications(Model);
+    const fields = [];
+    for (const [field, meta] of map.entries()) {
+        if (field === '__model__')
+            continue;
+        if (meta.category === category) {
+            fields.push(field);
+        }
+    }
+    return fields;
+}
+/**
+ * Convenience: get all PII (Personally Identifiable Information) fields.
+ */
+function getPIIFields(Model) {
+    return getFieldsByCategory(Model, 'PII');
+}
+/**
+ * Convenience: get all PHI (Protected Health Information) fields.
+ */
+function getPHIFields(Model) {
+    return getFieldsByCategory(Model, 'PHI');
+}
+/**
+ * Convenience: get all PCI (Payment Card Industry) fields.
+ */
+function getPCIFields(Model) {
+    return getFieldsByCategory(Model, 'PCI');
+}
+/**
+ * Convenience: get all financial data fields.
+ */
+function getFinancialFields(Model) {
+    return getFieldsByCategory(Model, 'FINANCIAL');
+}
+/**
+ * Get all fields with a specific sensitivity level.
+ */
+function getFieldsByLevel(Model, level) {
+    const map = getClassifications(Model);
+    const fields = [];
+    for (const [field, meta] of map.entries()) {
+        if (field === '__model__')
+            continue;
+        if (meta.level === level) {
+            fields.push(field);
+        }
+    }
+    return fields;
+}
+/**
+ * Get all fields classified as CONFIDENTIAL or higher.
+ */
+function getConfidentialFields(Model) {
+    const levels = ['CONFIDENTIAL', 'SECRET', 'TOP_SECRET'];
+    const map = getClassifications(Model);
+    const fields = [];
+    for (const [field, meta] of map.entries()) {
+        if (field === '__model__')
+            continue;
+        if (levels.includes(meta.level)) {
+            fields.push(field);
+        }
+    }
+    return fields;
+}
+/**
+ * Check if a field contains sensitive data (PII, PHI, PCI, etc.).
+ */
+function isSensitive(Model, field) {
+    const meta = getClassification(Model, field);
+    if (!meta)
+        return false;
+    return ['PII', 'PHI', 'PCI', 'PCI_PAN', 'FINANCIAL', 'HEALTH', 'BIOMETRIC', 'CUI', 'SENSITIVE'].includes(meta.category);
+}
+// ==================== Auto-Discovery ====================
+const DEFAULT_PATTERNS = {
+    PII: [/name/i, /email/i, /phone/i, /address/i, /dob/i, /birth/i, /passport/i, /driver/i],
+    PHI: [/medical/i, /diagnosis/i, /prescription/i, /health/i, /treatment/i, /condition/i],
+    PCI: [/card/i, /payment/i, /credit/i, /debit/i, /cvv/i, /expir/i],
+    PCI_PAN: [/card.?number/i, /pan/i, /card.number/i],
+    FINANCIAL: [/salary/i, /income/i, /account/i, /balance/i, /transaction/i, /iban/i, /swift/i],
+    HEALTH: [/blood/i, /pulse/i, /heart/i, /weight/i, /height/i, /allergy/i],
+    BIOMETRIC: [/fingerprint/i, /face/i, /iris/i, /biometric/i, /voice/i],
+    CUI: [/military/i, /government/i, /classified/i],
+    SENSITIVE: [/password/i, /secret/i, /private/i, /token/i, /api.?key/i],
+};
+/**
+ * Automatically classify fields based on their names.
+ * Call this after model definition to tag common sensitive fields.
+ *
+ * @param Model - The model to scan
+ * @param patterns - Optional custom patterns (merged with defaults)
+ */
+function autoDiscover(Model, additionalPatterns) {
+    const attributes = Model.rawAttributes ?? {};
+    const map = getClassifications(Model);
+    // Build pattern list
+    const patterns = { ...DEFAULT_PATTERNS };
+    if (additionalPatterns) {
+        for (const p of additionalPatterns) {
+            const regex = typeof p === 'string' ? new RegExp(p, 'i') : p;
+            patterns.PII.push(regex);
+        }
+    }
+    // Scan each attribute
+    for (const fieldName of Object.keys(attributes)) {
+        if (map.has(fieldName))
+            continue; // skip if already classified
+        for (const [category, regexes] of Object.entries(patterns)) {
+            for (const regex of regexes) {
+                if (regex.test(fieldName)) {
+                    map.set(fieldName, {
+                        level: category === 'PCI_PAN' || category === 'PHI' ? 'TOP_SECRET' : 'CONFIDENTIAL',
+                        category: category,
+                        isIdentifier: category === 'PII',
+                        canLog: false,
+                    });
+                    break;
+                }
+            }
+        }
+    }
+}
+/**
+ * Merge classifications from another model (useful for inheritance).
+ */
+function inheritClassifications(child, parent) {
+    const parentMap = getClassifications(parent);
+    const childMap = getClassifications(child);
+    for (const [field, meta] of parentMap) {
+        if (!childMap.has(field)) {
+            childMap.set(field, meta);
+        }
+    }
+}
+// ==================== Class Export ====================
+class DataClassifier {
+}
+exports.DataClassifier = DataClassifier;
+DataClassifier.Classify = Classify;
+DataClassifier.FieldClassification = FieldClassification;
+DataClassifier.getClassification = getClassification;
+DataClassifier.getClassifications = getClassificationsForModel;
+DataClassifier.getFieldsByCategory = getFieldsByCategory;
+DataClassifier.getPIIFields = getPIIFields;
+DataClassifier.getPHIFields = getPHIFields;
+DataClassifier.getPCIFields = getPCIFields;
+DataClassifier.getFinancialFields = getFinancialFields;
+DataClassifier.getFieldsByLevel = getFieldsByLevel;
+DataClassifier.getConfidentialFields = getConfidentialFields;
+DataClassifier.isSensitive = isSensitive;
+DataClassifier.autoDiscover = autoDiscover;
+DataClassifier.inheritClassifications = inheritClassifications;