ts-prorm-orm 1.1.0

package/dist/compliance/query-firewall.js

@@ -0,0 +1,1182 @@
+"use strict";
+/**
+ * Database Firewall / Query Allowlist
+ *
+ * A security layer that:
+ * - Blocks dangerous queries or commands
+ * - Allows only approved query patterns
+ * - Logs and alerts on blocked queries
+ * - Required for: OWASP, CIS Benchmarks compliance
+ *
+ * Usage:
+ *   // Create firewall instance
+ *   const firewall = QueryFirewall.create(prorm, {
+ *     mode: 'allowlist',
+ *     onBlock: (block) => console.log('Blocked:', block.query),
+ *   });
+ *
+ *   // Add allowed patterns
+ *   firewall.allow('^SELECT \\* FROM users WHERE');
+ *   firewall.allow('^INSERT INTO orders');
+ *
+ *   // Add blocked patterns (dangerous commands)
+ *   firewall.block('^DROP (TABLE|DATABASE)');
+ *   firewall.block('^TRUNCATE');
+ *
+ *   // Check if query is allowed
+ *   const result = firewall.checkQuery('SELECT * FROM users WHERE id = 1');
+ *   if (!result.allowed) {
+ *     console.log('Query blocked:', result.reason);
+ *   }
+ *
+ *   // Get blocked history
+ *   const history = firewall.getBlockedHistory();
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueryFirewall = exports.DATABASE_RULES = exports.SQLITE_RULES = exports.ORACLE_RULES = exports.MSSQL_RULES = exports.MARIADB_RULES = exports.MYSQL_RULES = exports.POSTGRESQL_RULES = exports.NIST_CSF_RULES = exports.SOX_RULES = exports.HIPAA_RULES = exports.PCI_DSS_RULES = exports.CIS_BENCHMARK_RULES = exports.OWASP_SQL_INJECTION_PATTERNS = exports.FIREWALL_RULES = exports.FirewallModeEnum = void 0;
+exports.analyzeQuerySecurity = analyzeQuerySecurity;
+exports.getRecommendedRules = getRecommendedRules;
+exports.FirewallRules = FirewallRules;
+exports.PostgreSQLFirewall = PostgreSQLFirewall;
+exports.MySQLFirewall = MySQLFirewall;
+exports.MariaDBFirewall = MariaDBFirewall;
+exports.MSSQLFirewall = MSSQLFirewall;
+exports.OracleFirewall = OracleFirewall;
+exports.SQLiteFirewall = SQLiteFirewall;
+exports.applyFirewallRulesToModel = applyFirewallRulesToModel;
+/**
+ * Companion enum for {@link FirewallMode}. Provided for callers who prefer
+ * enum-based ergonomics (autocomplete, refactor-safety) over raw string
+ * literals. The underlying values are identical to the `FirewallMode`
+ * string literals, so either form may be used interchangeably.
+ */
+var FirewallModeEnum;
+(function (FirewallModeEnum) {
+    FirewallModeEnum["Allowlist"] = "allowlist";
+    FirewallModeEnum["Blocklist"] = "blocklist";
+    FirewallModeEnum["Strict"] = "strict";
+})(FirewallModeEnum || (exports.FirewallModeEnum = FirewallModeEnum = {}));
+// ==================== Firewall Rule Categories ====================
+/** Exportable rule constants for custom configurations */
+exports.FIREWALL_RULES = {
+    // Destructive Operations
+    DESTRUCTIVE: [
+        { pattern: /^DROP\s+(TABLE|DATABASE|SCHEMA|INDEX|PROCEDURE|FUNCTION|VIEW|MATERIALIZED)/i, description: 'DROP object' },
+        { pattern: /^TRUNCATE\s+(TABLE)?/i, description: 'TRUNCATE table' },
+        { pattern: /^DELETE\s+FROM\s+\w+\s*$/i, description: 'DELETE without WHERE clause' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+DROP/i, description: 'ALTER TABLE DROP' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+RENAME/i, description: 'ALTER TABLE RENAME' },
+        { pattern: /^DROP\s+INDEX/i, description: 'DROP index' },
+        { pattern: /^DROP\s+TRIGGER/i, description: 'DROP trigger' },
+        { pattern: /^DROP\s+SEQUENCE/i, description: 'DROP sequence' },
+    ],
+    // Schema Modification
+    SCHEMA_MODIFICATION: [
+        { pattern: /^CREATE\s+(TABLE|DATABASE|SCHEMA)/i, description: 'CREATE table/database/schema' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+ADD\s+COLUMN/i, description: 'ADD column' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+MODIFY/i, description: 'MODIFY column' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+CHANGE/i, description: 'CHANGE column' },
+        { pattern: /^ALTER\s+TABLE\s+\w+\s+ADD\s+INDEX/i, description: 'ADD index' },
+        { pattern: /^CREATE\s+INDEX/i, description: 'CREATE index' },
+        { pattern: /^CREATE\s+(UNIQUE\s+)?INDEX/i, description: 'CREATE index' },
+    ],
+    // Permission Changes
+    PERMISSIONS: [
+        { pattern: /^GRANT\s+/i, description: 'GRANT permissions' },
+        { pattern: /^REVOKE\s+/i, description: 'REVOKE permissions' },
+        { pattern: /^CREATE\s+USER/i, description: 'CREATE user' },
+        { pattern: /^DROP\s+USER/i, description: 'DROP user' },
+        { pattern: /^ALTER\s+USER/i, description: 'ALTER user' },
+        { pattern: /^SET\s+PASSWORD/i, description: 'SET password' },
+    ],
+    // Execution / Code Execution
+    CODE_EXECUTION: [
+        { pattern: /^EXEC\s*\(/i, description: 'EXEC stored procedure' },
+        { pattern: /^EXECUTE\s*\(/i, description: 'EXECUTE stored procedure' },
+        { pattern: /^CALL\s+\w+\s*\(/i, description: 'CALL procedure/function' },
+        { pattern: /^xp_cmdshell/i, description: 'xp_cmdshell (SQL Server)' },
+        { pattern: /^sp_executesql/i, description: 'sp_executesql (SQL Server)' },
+        { pattern: /^CREATE\s+(FUNCTION|PROCEDURE)/i, description: 'CREATE function/procedure' },
+        { pattern: /^DROP\s+(FUNCTION|PROCEDURE)/i, description: 'DROP function/procedure' },
+    ],
+    // File Operations
+    FILE_OPERATIONS: [
+        { pattern: /^load_file\s*\(/i, description: 'LOAD_FILE() - read file' },
+        { pattern: /^into\s+outfile/i, description: 'INTO OUTFILE - write file' },
+        { pattern: /^into\s+dumpfile/i, description: 'INTO DUMPFILE - write binary file' },
+        { pattern: /^SELECT\s+.+\s+FROM\s+\w+\s+WHERE\s+.+\s+like\s+['"]%[\/\\]/i, description: 'Path traversal attempt' },
+        { pattern: /\/etc\/passwd/i, description: 'Access /etc/passwd' },
+        { pattern: /windows[\/\\]system32/i, description: 'Access Windows system32' },
+    ],
+    // Information Gathering
+    INFORMATION_GATHERING: [
+        { pattern: /^SHOW\s+(DATABASES|TABLES|COLUMNS|INDEXES)/i, description: 'SHOW databases/tables/columns' },
+        { pattern: /^DESCRIBE\s+\w+/i, description: 'DESCRIBE table' },
+        { pattern: /^EXPLAIN\s+/i, description: 'EXPLAIN query' },
+        { pattern: /^SELECT\s+@@version/i, description: 'Get database version' },
+        { pattern: /^SELECT\s+user\s*\(\s*\)/i, description: 'Get current user' },
+        { pattern: /^SELECT\s+current_user/i, description: 'Get current user' },
+        { pattern: /^SELECT\s+@@datadir/i, description: 'Get data directory' },
+        { pattern: /^SELECT\s+information_schema/i, description: 'Access information_schema' },
+    ],
+    // Transaction Control
+    TRANSACTION_CONTROL: [
+        { pattern: /^BEGIN\s*;?\s*$/i, description: 'BEGIN transaction' },
+        { pattern: /^START\s+TRANSACTION/i, description: 'START TRANSACTION' },
+        { pattern: /^COMMIT\s*;?\s*$/i, description: 'COMMIT transaction' },
+        { pattern: /^ROLLBACK\s*;?\s*$/i, description: 'ROLLBACK transaction' },
+        { pattern: /^SET\s+TRANSACTION\s+ISOLATION/i, description: 'SET TRANSACTION ISOLATION' },
+    ],
+    // Bulk Operations
+    BULK_OPERATIONS: [
+        { pattern: /^BULK\s+INSERT/i, description: 'BULK INSERT' },
+        { pattern: /^INSERT\s+INTO\s+\w+\s+SELECT\s+.*\s+FROM\s+\w+\s+WHERE\s+['"]%.*['"]/i, description: 'Bulk insert with wildcard' },
+    ],
+    // Database Links / Remote Operations
+    REMOTE_OPERATIONS: [
+        { pattern: /^SELECT\s+.*\s+FROM\s+\w+\.\w+/i, description: 'Cross-database query' },
+        { pattern: /^EXEC\s+at\s+\w+/i, description: 'Remote execution (Oracle)' },
+        { pattern: /^openquery\s*\(/i, description: 'OPENQUERY - linked server' },
+        { pattern: /^opendatasource\s*\(/i, description: 'OPENDATASOURCE' },
+    ],
+    // Encryption/Decryption
+    CRYPTO_OPERATIONS: [
+        { pattern: /^CREATE\s+ASYMMETRIC\s+KEY/i, description: 'CREATE asymmetric key' },
+        { pattern: /^CREATE\s+SYMMETRIC\s+KEY/i, description: 'CREATE symmetric key' },
+        { pattern: /^CREATE\s+CERTIFICATE/i, description: 'CREATE certificate' },
+    ],
+    // Backup Operations
+    BACKUP_OPERATIONS: [
+        { pattern: /^BACKUP\s+(DATABASE|LOG)/i, description: 'BACKUP database/log' },
+        { pattern: /^RESTORE\s+(DATABASE|LOG)/i, description: 'RESTORE database/log' },
+        { pattern: /^mysqldump/i, description: 'mysqldump command' },
+        { pattern: /^pg_dump/i, description: 'pg_dump command' },
+    ],
+};
+/** OWASP Top 10 SQL Injection patterns */
+exports.OWASP_SQL_INJECTION_PATTERNS = [
+    /('\s*or\s*'1'\s*=\s*'1)/i,
+    /('\s*or\s*1\s*=\s*1)/i,
+    /(union\s+select)/i,
+    /(union\s+all\s+select)/i,
+    /(\bor\b.*\b=\b)/,
+    /(exec\s*\()/i,
+    /(;\s*drop\s+table)/i,
+    /(\/\*.*\*\/)/,
+    /(--\s*)/,
+    /(char\s*\(\s*\d+)/,
+    /(0x[\da-f]+)/i,
+    /(\bor\b\s+\d+\s*=\s*\d+)/,
+    /('\s+and\s+'\s*=\s*')/i,
+    /(having\s+\d+\s*=\s*\d+)/i,
+    /(order\s+by\s+\d+)/i,
+    /(benchmark\s*\()/i,
+    /(sleep\s*\()/i,
+];
+/** CIS Benchmarks database security rules */
+exports.CIS_BENCHMARK_RULES = [
+    { pattern: /^DROP\s+(TABLE|DATABASE|SCHEMA)/i, description: 'CIS: Block DROP TABLE/DATABASE' },
+    { pattern: /^DELETE\s+FROM\s+\w+\s*$/i, description: 'CIS: Block DELETE without WHERE' },
+    { pattern: /^GRANT\s+ALL/i, description: 'CIS: Block GRANT ALL' },
+    { pattern: /^CREATE\s+(FUNCTION|PROCEDURE)\s+.*\s+RETURNS\s+void/i, description: 'CIS: Block void-returning functions' },
+];
+/** PCI DSS compliance rules */
+exports.PCI_DSS_RULES = [
+    { pattern: /^SELECT\s+.*\s+FROM\s+credit_cards/i, description: 'PCI: Direct SELECT on credit_cards table' },
+    { pattern: /^SELECT\s+.*\s+FROM\s+payments\s+WHERE\s+card_number/i, description: 'PCI: Query card numbers' },
+    { pattern: /^INSERT\s+INTO\s+audit_log/i, description: 'PCI: All queries must be logged' },
+    { pattern: /^DELETE\s+FROM\s+audit_log/i, description: 'PCI: Cannot delete audit logs' },
+];
+/** HIPAA compliance rules */
+exports.HIPAA_RULES = [
+    { pattern: /^SELECT\s+.*\s+FROM\s+patients\s+WHERE\s+ssn/i, description: 'HIPAA: Direct SSN query' },
+    { pattern: /^SELECT\s+.*\s+FROM\s+medical_records\s+WHERE\s+diagnosis/i, description: 'HIPAA: Direct diagnosis query' },
+    { pattern: /^SELECT\s+.*\s+FROM\s+phi\s+WHERE/i, description: 'HIPAA: PHI access without audit' },
+    { pattern: /^DROP\s+(TABLE|DATABASE)\s+\w*patient/i, description: 'HIPAA: Cannot drop patient tables' },
+];
+/** SOX compliance rules */
+exports.SOX_RULES = [
+    { pattern: /^DELETE\s+FROM\s+.*\s+WHERE\s+.*\s+<\s+NOW/i, description: 'SOX: Cannot delete old records' },
+    { pattern: /^DROP\s+(TABLE|DATABASE)\s+\w*financial/i, description: 'SOX: Cannot drop financial tables' },
+    { pattern: /^TRUNCATE\s+.*\s+financial/i, description: 'SOX: Cannot truncate financial tables' },
+];
+/** NIST CSF rules */
+exports.NIST_CSF_RULES = [
+    { pattern: /^DROP\s+(TABLE|DATABASE)/i, description: 'NIST: Block DROP operations' },
+    { pattern: /^DELETE\s+FROM\s+\w+\s*$/i, description: 'NIST: Block bulk DELETE' },
+    { pattern: /^GRANT\s+/i, description: 'NIST: Require approval for GRANT' },
+    { pattern: /^REVOKE\s+/i, description: 'NIST: Require approval for REVOKE' },
+];
+/** Default dangerous patterns for general use */
+const DEFAULT_DANGEROUS_PATTERNS = [
+    ...exports.FIREWALL_RULES.DESTRUCTIVE,
+    ...exports.FIREWALL_RULES.CODE_EXECUTION,
+    ...exports.FIREWALL_RULES.FILE_OPERATIONS,
+    { pattern: /^xp_cmdshell/i, description: 'xp_cmdshell (SQL Server)' },
+    { pattern: /^load_file\s*\(/i, description: 'LOAD_FILE()' },
+    { pattern: /^into\s+outfile/i, description: 'INTO OUTFILE' },
+    { pattern: /^grant\s+/i, description: 'GRANT' },
+    { pattern: /^revoke\s+/i, description: 'REVOKE' },
+];
+// ==================== Database-Specific Rules ====================
+/** PostgreSQL-specific dangerous patterns */
+exports.POSTGRESQL_RULES = [
+    { pattern: /^DROP\s+IF\s+EXISTS\s+(TABLE|DATABASE|SCHEMA)/i, description: 'PostgreSQL: DROP IF EXISTS' },
+    { pattern: /^DROP\s+OWNED\s+BY/i, description: 'PostgreSQL: DROP OWNED BY' },
+    { pattern: /^DROP\s+ROLE/i, description: 'PostgreSQL: DROP ROLE' },
+    { pattern: /^DROP\s+CONVERSION/i, description: 'PostgreSQL: DROP CONVERSION' },
+    { pattern: /^DROP\s+LANGUAGE/i, description: 'PostgreSQL: DROP LANGUAGE' },
+    { pattern: /^DROP\s+EXTENSION/i, description: 'PostgreSQL: DROP EXTENSION' },
+    { pattern: /^CREATE\s+LANGUAGE/i, description: 'PostgreSQL: CREATE LANGUAGE' },
+    { pattern: /^CREATE\s+OR\s+REPLACE\s+(FUNCTION|PROCEDURE)/i, description: 'PostgreSQL: CREATE OR REPLACE' },
+    { pattern: /^ALTER\s+DEFAULT\s+PRIVILEGES/i, description: 'PostgreSQL: ALTER DEFAULT PRIVILEGES' },
+    { pattern: /^COPY\s+/i, description: 'PostgreSQL: COPY command' },
+    { pattern: /^pg_read_file/i, description: 'PostgreSQL: pg_read_file()' },
+    { pattern: /^pg_write_file/i, description: 'PostgreSQL: pg_write_file()' },
+    { pattern: /^pg_execute_server_program/i, description: 'PostgreSQL: pg_execute_server_program' },
+    { pattern: /^lo_import/i, description: 'PostgreSQL: lo_import()' },
+    { pattern: /^lo_export/i, description: 'PostgreSQL: lo_export()' },
+    { pattern: /^SET\s+session\s+authorization/i, description: 'PostgreSQL: SET SESSION AUTHORIZATION' },
+    { pattern: /^RESET\s+(session\s+)?authorization/i, description: 'PostgreSQL: RESET AUTHORIZATION' },
+];
+/** MySQL-specific dangerous patterns */
+exports.MYSQL_RULES = [
+    { pattern: /^DROP\s+IF\s+EXISTS/i, description: 'MySQL: DROP IF EXISTS' },
+    { pattern: /^DROP\s+PROCEDURE/i, description: 'MySQL: DROP PROCEDURE' },
+    { pattern: /^DROP\s+FUNCTION/i, description: 'MySQL: DROP FUNCTION' },
+    { pattern: /^DROP\s+TRIGGER/i, description: 'MySQL: DROP TRIGGER' },
+    { pattern: /^CREATE\s+PROCEDURE/i, description: 'MySQL: CREATE PROCEDURE' },
+    { pattern: /^CREATE\s+FUNCTION/i, description: 'MySQL: CREATE FUNCTION' },
+    { pattern: /^CREATE\s+TRIGGER/i, description: 'MySQL: CREATE TRIGGER' },
+    { pattern: /^HANDLER\s+\w+\s+OPEN/i, description: 'MySQL: HANDLER OPEN' },
+    { pattern: /^LOAD\s+DATA\s+INFILE/i, description: 'MySQL: LOAD DATA INFILE' },
+    { pattern: /^SELECT\s+.*\s+INTO\s+OUTFILE/i, description: 'MySQL: SELECT INTO OUTFILE' },
+    { pattern: /^SET\s+GLOBAL\s+\w+/i, description: 'MySQL: SET GLOBAL' },
+    { pattern: /^SET\s+@@global\./i, description: 'MySQL: SET @@global' },
+    { pattern: /^KILL\s+(CONNECTION|QUERY)?/i, description: 'MySQL: KILL' },
+    { pattern: /^SHUTDOWN/i, description: 'MySQL: SHUTDOWN' },
+    { pattern: /^BINLOG\s+/i, description: 'MySQL: BINLOG' },
+    { pattern: /^SHOW\s+BINLOG/i, description: 'MySQL: SHOW BINLOG' },
+];
+/** MariaDB-specific dangerous patterns */
+exports.MARIADB_RULES = [
+    ...exports.MYSQL_RULES,
+    { pattern: /^CREATE\s+OR\s+REPLACE\s+VIEW/i, description: 'MariaDB: CREATE OR REPLACE VIEW' },
+    { pattern: /^CREATE\s+EVENT/i, description: 'MariaDB: CREATE EVENT' },
+    { pattern: /^DROP\s+EVENT/i, description: 'MariaDB: DROP EVENT' },
+    { pattern: /^SET\s+GLOBAL\s+sql_mode/i, description: 'MariaDB: SET GLOBAL sql_mode' },
+    { pattern: /^SET\s+@@session\.\w+/i, description: 'MariaDB: SET SESSION' },
+];
+/** Microsoft SQL Server-specific dangerous patterns */
+exports.MSSQL_RULES = [
+    { pattern: /^DROP\s+IF\s+EXISTS/i, description: 'MSSQL: DROP IF EXISTS' },
+    { pattern: /^DROP\s+PROCEDURE/i, description: 'MSSQL: DROP PROCEDURE' },
+    { pattern: /^DROP\s+FUNCTION/i, description: 'MSSQL: DROP FUNCTION' },
+    { pattern: /^DROP\s+TRIGGER/i, description: 'MSSQL: DROP TRIGGER' },
+    { pattern: /^CREATE\s+PROCEDURE/i, description: 'MSSQL: CREATE PROCEDURE' },
+    { pattern: /^CREATE\s+FUNCTION/i, description: 'MSSQL: CREATE FUNCTION' },
+    { pattern: /^CREATE\s+TRIGGER/i, description: 'MSSQL: CREATE TRIGGER' },
+    { pattern: /^xp_cmdshell/i, description: 'MSSQL: xp_cmdshell' },
+    { pattern: /^sp_executesql/i, description: 'MSSQL: sp_executesql' },
+    { pattern: /^sp_addjob/i, description: 'MSSQL: sp_addjob' },
+    { pattern: /^sp_oacreate/i, description: 'MSSQL: sp_oacreate' },
+    { pattern: /^sp_oamethod/i, description: 'MSSQL: sp_oamethod' },
+    { pattern: /^OPENROWSET/i, description: 'MSSQL: OPENROWSET' },
+    { pattern: /^OPENDATASOURCE/i, description: 'MSSQL: OPENDATASOURCE' },
+    { pattern: /^BACKUP\s+LOG/i, description: 'MSSQL: BACKUP LOG' },
+    { pattern: /^RESTORE\s+LOG/i, description: 'MSSQL: RESTORE LOG' },
+    { pattern: /^ALTER\s+LOGIN/i, description: 'MSSQL: ALTER LOGIN' },
+    { pattern: /^CREATE\s+LOGIN/i, description: 'MSSQL: CREATE LOGIN' },
+    { pattern: /^DROP\s+LOGIN/i, description: 'MSSQL: DROP LOGIN' },
+    { pattern: /^EXEC\s+at\s+\w+/i, description: 'MSSQL: Linked server execution' },
+    { pattern: /^EXEC\s+sp_executesql/i, description: 'MSSQL: sp_executesql' },
+];
+/** Oracle-specific dangerous patterns */
+exports.ORACLE_RULES = [
+    { pattern: /^DROP\s+(TABLE|DATABASE|SCHEMA)\s+\w+/i, description: 'Oracle: DROP object' },
+    { pattern: /^DROP\s+(PROCEDURE|FUNCTION|PACKAGE|TRIGGER|VIEW|SYNONYM)/i, description: 'Oracle: DROP object' },
+    { pattern: /^CREATE\s+(OR\s+REPLACE\s+)?(PROCEDURE|FUNCTION|PACKAGE|TRIGGER|VIEW)/i, description: 'Oracle: CREATE object' },
+    { pattern: /^DROP\s+USER\s+CASCADE/i, description: 'Oracle: DROP USER CASCADE' },
+    { pattern: /^DROP\s+INDEX/i, description: 'Oracle: DROP INDEX' },
+    { pattern: /^GRANT\s+\w+\s+TO\s+\w+/i, description: 'Oracle: GRANT' },
+    { pattern: /^REVOKE\s+\w+\s+FROM\s+\w+/i, description: 'Oracle: REVOKE' },
+    { pattern: /^BEGIN\s+.*\s+EXECUTE\s+IMMEDIATE/i, description: 'Oracle: EXECUTE IMMEDIATE' },
+    { pattern: /^SELECT\s+ANY\s+TABLE/i, description: 'Oracle: SELECT ANY TABLE' },
+    { pattern: /^SELECT\s+INTO\s+\w+\s+FROM\s+v\$/i, description: 'Oracle: V$ tables access' },
+    { pattern: /^DBMS_JAVA/i, description: 'Oracle: DBMS_JAVA' },
+    { pattern: /^DBMS_SCHEDULER/i, description: 'Oracle: DBMS_SCHEDULER' },
+    { pattern: /^DBMS_OUTPUT/i, description: 'Oracle: DBMS_OUTPUT' },
+    { pattern: /^UTL_FILE/i, description: 'Oracle: UTL_FILE' },
+    { pattern: /^UTL_HTTP/i, description: 'Oracle: UTL_HTTP' },
+    { pattern: /^DBMS_XMLGEN/i, description: 'Oracle: DBMS_XMLGEN' },
+    { pattern: /^CREATE\s+PROFILE/i, description: 'Oracle: CREATE PROFILE' },
+    { pattern: /^ALTER\s+PROFILE/i, description: 'Oracle: ALTER PROFILE' },
+    { pattern: /^DROP\s+PROFILE/i, description: 'Oracle: DROP PROFILE' },
+];
+/** SQLite-specific dangerous patterns */
+exports.SQLITE_RULES = [
+    { pattern: /^DROP\s+(TABLE|DATABASE|INDEX|TRIGGER|VIEW)\s+\w+/i, description: 'SQLite: DROP object' },
+    { pattern: /^DETACH\s+DATABASE/i, description: 'SQLite: DETACH DATABASE' },
+    { pattern: /^ATTACH\s+DATABASE/i, description: 'SQLite: ATTACH DATABASE' },
+    { pattern: /\.mode\s+\w+/i, description: 'SQLite: .mode command' },
+    { pattern: /\.import\s+/i, description: 'SQLite: .import command' },
+    { pattern: /\.dump\s+/i, description: 'SQLite: .dump command' },
+];
+/** All database-specific rules */
+exports.DATABASE_RULES = {
+    postgresql: exports.POSTGRESQL_RULES,
+    mysql: exports.MYSQL_RULES,
+    mariadb: exports.MARIADB_RULES,
+    mssql: exports.MSSQL_RULES,
+    oracle: exports.ORACLE_RULES,
+    sqlite: exports.SQLITE_RULES,
+};
+// ==================== Query Firewall Class ====================
+class QueryFirewall {
+    constructor(prorm, options = {}) {
+        this.allowRules = [];
+        this.blockRules = [];
+        this.blockedHistory = [];
+        this.queryLog = [];
+        this.originalQuery = null;
+        this.isActive = false;
+        this.prorm = prorm;
+        this.options = {
+            mode: options.mode ?? 'allowlist',
+            blockDangerousByDefault: options.blockDangerousByDefault ?? true,
+            onBlock: options.onBlock ?? (() => { }),
+            onAllow: options.onAllow ?? (() => { }),
+            maxHistory: options.maxHistory ?? 1000,
+            logAllQueries: options.logAllQueries ?? false,
+            caseInsensitive: options.caseInsensitive ?? true,
+            rules: options.rules ?? [],
+            frameworks: options.frameworks ?? [],
+        };
+        // Initialize with default rules
+        this.initializeRules();
+    }
+    /**
+     * Create a new firewall instance (factory method)
+     */
+    static create(prorm, options) {
+        const instance = new QueryFirewall(prorm, options);
+        QueryFirewall.instances.set(prorm, instance);
+        return instance;
+    }
+    /**
+     * Get existing instance for a Prorm instance
+     */
+    static getInstance(prorm) {
+        return QueryFirewall.instances.get(prorm);
+    }
+    /**
+     * Initialize default rules
+     */
+    initializeRules() {
+        // Add dangerous patterns if configured
+        if (this.options.blockDangerousByDefault) {
+            for (const rule of DEFAULT_DANGEROUS_PATTERNS) {
+                this.blockRules.push({
+                    id: `default-block-${this.blockRules.length}`,
+                    type: 'block',
+                    pattern: rule.pattern,
+                    description: rule.description,
+                    createdAt: new Date(),
+                });
+            }
+        }
+        // Add OWASP SQL injection patterns
+        if (this.options.frameworks.includes('OWASP') || this.options.blockDangerousByDefault) {
+            for (const pattern of exports.OWASP_SQL_INJECTION_PATTERNS) {
+                this.blockRules.push({
+                    id: `owasp-sql-injection-${this.blockRules.length}`,
+                    type: 'block',
+                    pattern,
+                    description: 'OWASP SQL Injection pattern',
+                    createdAt: new Date(),
+                });
+            }
+        }
+        // CIS Benchmarks - require explicit allow for data modification
+        if (this.options.frameworks.includes('CIS')) {
+            // Add strict block rules for CIS compliance
+            this.blockRules.push({
+                id: 'cis-drop-all',
+                type: 'block',
+                pattern: /^DROP\s+(TABLE|DATABASE)/i,
+                description: 'CIS: Block DROP DATABASE/TABLE',
+                createdAt: new Date(),
+            });
+        }
+        // Add custom rules
+        for (const rule of this.options.rules) {
+            if (rule.type === 'allow') {
+                this.allow(rule.pattern, rule.description);
+            }
+            else {
+                this.block(rule.pattern, rule.description);
+            }
+        }
+    }
+    /**
+     * Add an allowed pattern
+     */
+    allow(pattern, description) {
+        const rule = {
+            id: `allow-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+            type: 'allow',
+            pattern,
+            description,
+            createdAt: new Date(),
+        };
+        this.allowRules.push(rule);
+        return rule;
+    }
+    /**
+     * Add a blocked pattern
+     */
+    block(pattern, description) {
+        const rule = {
+            id: `block-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+            type: 'block',
+            pattern,
+            description,
+            createdAt: new Date(),
+        };
+        this.blockRules.push(rule);
+        return rule;
+    }
+    /**
+     * Remove a rule by ID
+     */
+    removeRule(ruleId) {
+        const allowIndex = this.allowRules.findIndex(r => r.id === ruleId);
+        if (allowIndex !== -1) {
+            this.allowRules.splice(allowIndex, 1);
+            return true;
+        }
+        const blockIndex = this.blockRules.findIndex(r => r.id === ruleId);
+        if (blockIndex !== -1) {
+            this.blockRules.splice(blockIndex, 1);
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Check if a query is allowed
+     */
+    checkQuery(sql) {
+        const analysis = this.analyzeQuery(sql);
+        // Apply firewall mode logic
+        let allowed = true;
+        let reason;
+        let matchedRule;
+        // Block rules (populated by blockDangerousByDefault / explicit addBlockRule calls)
+        // are a safety net that applies regardless of mode - including 'allowlist' mode.
+        // Previously this check only ran for 'blocklist'/'strict', so 'allowlist' mode
+        // with zero configured allow rules (the out-of-the-box default) silently allowed
+        // every query, dangerous or not.
+        const matchedBlock = this.blockRules.find(rule => this.matchPattern(sql, rule.pattern));
+        if (matchedBlock) {
+            allowed = false;
+            reason = `Query matches blocked pattern: ${matchedBlock.description || matchedBlock.pattern}`;
+            matchedRule = matchedBlock.id;
+        }
+        if (allowed && (this.options.mode === 'allowlist' || this.options.mode === 'strict')) {
+            // In allowlist/strict mode, an explicitly-configured allowlist means the query
+            // must match at least one allow rule. With zero allow rules configured, fail
+            // closed (deny) rather than silently allowing everything - a firewall that
+            // allows all traffic when unconfigured isn't a firewall.
+            const matchesAllow = this.allowRules.some(rule => this.matchPattern(sql, rule.pattern));
+            if (!matchesAllow) {
+                allowed = false;
+                reason =
+                    this.allowRules.length > 0
+                        ? 'Query does not match any allowed pattern'
+                        : 'No allow rules configured - denying by default (fail closed)';
+                matchedRule = this.options.mode === 'strict' ? 'strict-allow' : 'allowlist';
+            }
+        }
+        // Update analysis result
+        analysis.allowed = allowed;
+        analysis.reason = reason;
+        analysis.matchedRule = matchedRule;
+        // Handle blocked query
+        if (!allowed) {
+            const blocked = {
+                id: `blocked-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+                timestamp: new Date(),
+                query: sql,
+                reason: reason || 'Query blocked',
+                matchedRule: matchedRule || 'unknown',
+                operation: analysis.operation,
+            };
+            this.blockedHistory.push(blocked);
+            // Trim history
+            if (this.blockedHistory.length > this.options.maxHistory) {
+                this.blockedHistory = this.blockedHistory.slice(-this.options.maxHistory);
+            }
+            // Callback
+            this.options.onBlock(blocked);
+        }
+        else {
+            // Callback for allowed query
+            this.options.onAllow(analysis);
+        }
+        // Log if enabled
+        if (this.options.logAllQueries) {
+            this.queryLog.push(analysis);
+            if (this.queryLog.length > this.options.maxHistory) {
+                this.queryLog = this.queryLog.slice(-this.options.maxHistory);
+            }
+        }
+        return analysis;
+    }
+    /**
+     * Analyze a query without applying firewall rules
+     */
+    analyzeQuery(sql) {
+        const upperQuery = sql.toUpperCase();
+        let operation = 'UNKNOWN';
+        if (upperQuery.includes('SELECT'))
+            operation = 'SELECT';
+        else if (upperQuery.includes('INSERT'))
+            operation = 'INSERT';
+        else if (upperQuery.includes('UPDATE'))
+            operation = 'UPDATE';
+        else if (upperQuery.includes('DELETE'))
+            operation = 'DELETE';
+        else if (upperQuery.includes('DROP'))
+            operation = 'DROP';
+        else if (upperQuery.includes('TRUNCATE'))
+            operation = 'TRUNCATE';
+        else if (upperQuery.includes('ALTER'))
+            operation = 'ALTER';
+        else if (upperQuery.includes('CREATE'))
+            operation = 'CREATE';
+        else if (upperQuery.includes('EXEC') || upperQuery.includes('CALL'))
+            operation = 'EXECUTE';
+        // Extract table names
+        const tableMatches = sql.match(/(?:from|into|update|table)\s+`?(\w+)`?/gi) || [];
+        const tables = tableMatches
+            .map(m => m.replace(/`/g, '').split(' ').pop() || '')
+            .filter(Boolean);
+        // Check for sensitive data patterns
+        const sensitivePatterns = [
+            { name: 'SSN', pattern: /\b\d{3}-\d{2}-\d{4}\b/ },
+            { name: 'Credit Card', pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/ },
+            { name: 'Email', pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/ },
+        ];
+        const containsSensitiveData = sensitivePatterns.some(s => s.pattern.test(sql));
+        // Calculate risk score
+        let riskScore = 0;
+        if (operation === 'DROP' || operation === 'TRUNCATE')
+            riskScore += 80;
+        if (operation === 'DELETE')
+            riskScore += 50;
+        if (operation === 'UPDATE')
+            riskScore += 30;
+        if (containsSensitiveData)
+            riskScore += 20;
+        if (sql.length > 1000)
+            riskScore += 10;
+        // Check for SQL injection patterns
+        for (const pattern of exports.OWASP_SQL_INJECTION_PATTERNS) {
+            if (pattern.test(sql)) {
+                riskScore += 50;
+                break;
+            }
+        }
+        return {
+            query: sql,
+            allowed: true,
+            operation,
+            tables,
+            containsSensitiveData,
+            riskScore,
+        };
+    }
+    /**
+     * Match a pattern against a query
+     */
+    matchPattern(query, pattern) {
+        try {
+            if (pattern instanceof RegExp) {
+                return this.options.caseInsensitive
+                    ? pattern.test(query)
+                    : new RegExp(pattern.source, pattern.flags.replace('i', '') + (this.options.caseInsensitive ? 'i' : '')).test(query);
+            }
+            // Convert string to regex
+            const flags = this.options.caseInsensitive ? 'i' : '';
+            const regex = new RegExp(pattern, flags);
+            return regex.test(query);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Get blocked query history
+     */
+    getBlockedHistory(options) {
+        let filtered = [...this.blockedHistory];
+        if (options?.since) {
+            filtered = filtered.filter(b => b.timestamp >= options.since);
+        }
+        if (options?.operation) {
+            filtered = filtered.filter(b => b.operation === options.operation);
+        }
+        if (options?.limit) {
+            filtered = filtered.slice(-options.limit);
+        }
+        return filtered;
+    }
+    /**
+     * Get query log (if logging enabled)
+     */
+    getQueryLog(limit) {
+        const log = [...this.queryLog];
+        return limit ? log.slice(-limit) : log;
+    }
+    /**
+     * Get all rules
+     */
+    getRules() {
+        return {
+            allowRules: [...this.allowRules],
+            blockRules: [...this.blockRules],
+        };
+    }
+    /**
+     * Get statistics
+     */
+    getStats() {
+        const blockedByOperation = {
+            SELECT: 0,
+            INSERT: 0,
+            UPDATE: 0,
+            DELETE: 0,
+            DROP: 0,
+            TRUNCATE: 0,
+            ALTER: 0,
+            CREATE: 0,
+            EXECUTE: 0,
+            UNKNOWN: 0,
+        };
+        for (const blocked of this.blockedHistory) {
+            blockedByOperation[blocked.operation]++;
+        }
+        return {
+            totalBlocked: this.blockedHistory.length,
+            totalAllowed: this.queryLog.filter(q => q.allowed).length,
+            blockedByOperation,
+            allowRulesCount: this.allowRules.length,
+            blockRulesCount: this.blockRules.length,
+            isActive: this.isActive,
+        };
+    }
+    /**
+     * Apply CIS Benchmarks rules
+     */
+    applyCisRules() {
+        for (const rule of exports.CIS_BENCHMARK_RULES) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply PCI DSS rules
+     */
+    applyPciRules() {
+        for (const rule of exports.PCI_DSS_RULES) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply HIPAA rules
+     */
+    applyHipaaRules() {
+        for (const rule of exports.HIPAA_RULES) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply SOX rules
+     */
+    applySoxRules() {
+        for (const rule of exports.SOX_RULES) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply NIST CSF rules
+     */
+    applyNistRules() {
+        for (const rule of exports.NIST_CSF_RULES) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply OWASP SQL Injection patterns
+     */
+    applyOwaspRules() {
+        for (const pattern of exports.OWASP_SQL_INJECTION_PATTERNS) {
+            this.block(pattern, 'OWASP SQL Injection pattern');
+        }
+    }
+    /**
+     * Apply all destructive operation rules
+     */
+    applyDestructiveRules() {
+        for (const rule of exports.FIREWALL_RULES.DESTRUCTIVE) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all schema modification rules
+     */
+    applySchemaRules() {
+        for (const rule of exports.FIREWALL_RULES.SCHEMA_MODIFICATION) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all permission rules
+     */
+    applyPermissionRules() {
+        for (const rule of exports.FIREWALL_RULES.PERMISSIONS) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all file operation rules
+     */
+    applyFileRules() {
+        for (const rule of exports.FIREWALL_RULES.FILE_OPERATIONS) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all information gathering rules
+     */
+    applyInfoGatheringRules() {
+        for (const rule of exports.FIREWALL_RULES.INFORMATION_GATHERING) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all code execution rules
+     */
+    applyCodeExecutionRules() {
+        for (const rule of exports.FIREWALL_RULES.CODE_EXECUTION) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all transaction control rules
+     */
+    applyTransactionRules() {
+        for (const rule of exports.FIREWALL_RULES.TRANSACTION_CONTROL) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all remote operation rules
+     */
+    applyRemoteOperationRules() {
+        for (const rule of exports.FIREWALL_RULES.REMOTE_OPERATIONS) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all crypto operation rules
+     */
+    applyCryptoRules() {
+        for (const rule of exports.FIREWALL_RULES.CRYPTO_OPERATIONS) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply all backup operation rules
+     */
+    applyBackupRules() {
+        for (const rule of exports.FIREWALL_RULES.BACKUP_OPERATIONS) {
+            this.block(rule.pattern, rule.description);
+        }
+    }
+    /**
+     * Apply database-specific rules
+     * @param database - 'postgresql' | 'mysql' | 'mariadb' | 'mssql' | 'oracle' | 'sqlite'
+     */
+    applyDatabaseRules(database) {
+        const rules = exports.DATABASE_RULES[database];
+        if (rules) {
+            for (const rule of rules) {
+                this.block(rule.pattern, `${database.toUpperCase()}: ${rule.description}`);
+            }
+        }
+    }
+    /**
+     * Apply all predefined security rules
+     */
+    applyAllSecurityRules() {
+        this.applyDestructiveRules();
+        this.applySchemaRules();
+        this.applyPermissionRules();
+        this.applyFileRules();
+        this.applyInfoGatheringRules();
+        this.applyCodeExecutionRules();
+        this.applyTransactionRules();
+        this.applyRemoteOperationRules();
+        this.applyCryptoRules();
+        this.applyBackupRules();
+        this.applyOwaspRules();
+    }
+    /**
+     * Apply predefined compliance framework rules
+     * @param framework - 'CIS', 'PCI', 'HIPAA', 'SOX', 'NIST', 'OWASP'
+     */
+    applyFrameworkRules(framework) {
+        switch (framework) {
+            case 'CIS':
+                this.applyCisRules();
+                break;
+            case 'PCI':
+                this.applyPciRules();
+                break;
+            case 'HIPAA':
+                this.applyHipaaRules();
+                break;
+            case 'SOX':
+                this.applySoxRules();
+                break;
+            case 'NIST':
+                this.applyNistRules();
+                break;
+            case 'OWASP':
+                this.applyOwaspRules();
+                break;
+        }
+    }
+    /**
+     * Start the firewall - intercept queries
+     */
+    start() {
+        if (this.isActive)
+            return;
+        this.isActive = true;
+        this.originalQuery = this.prorm.query;
+        this.prorm.query = async (...args) => {
+            const query = typeof args[0] === 'string' ? args[0] : args[0]?.sql ?? '';
+            if (query.trim()) {
+                const analysis = this.checkQuery(query);
+                if (!analysis.allowed) {
+                    throw new Error(`Query blocked by firewall: ${analysis.reason}`);
+                }
+            }
+            return this.originalQuery.apply(this.prorm, args);
+        };
+    }
+    /**
+     * Stop the firewall - restore original query method
+     */
+    stop() {
+        if (!this.isActive)
+            return;
+        this.isActive = false;
+        if (this.originalQuery) {
+            this.prorm.query = this.originalQuery;
+            this.originalQuery = null;
+        }
+    }
+    /**
+     * Check if firewall is active
+     */
+    isFirewallActive() {
+        return this.isActive;
+    }
+    /**
+     * Clear blocked history
+     */
+    clearHistory() {
+        this.blockedHistory = [];
+    }
+    /**
+     * Clear query log
+     */
+    clearLog() {
+        this.queryLog = [];
+    }
+    /**
+     * Export rules for audit purposes
+     */
+    exportRules() {
+        return JSON.stringify({
+            allowRules: this.allowRules.map(r => ({
+                ...r,
+                pattern: r.pattern instanceof RegExp ? r.pattern.source : r.pattern,
+            })),
+            blockRules: this.blockRules.map(r => ({
+                ...r,
+                pattern: r.pattern instanceof RegExp ? r.pattern.source : r.pattern,
+            })),
+        }, null, 2);
+    }
+    /**
+     * Import rules from JSON
+     */
+    importRules(json) {
+        const data = JSON.parse(json);
+        if (data.allowRules) {
+            for (const rule of data.allowRules) {
+                this.allow(rule.pattern instanceof RegExp ? rule.pattern.source : rule.pattern, rule.description);
+            }
+        }
+        if (data.blockRules) {
+            for (const rule of data.blockRules) {
+                this.block(rule.pattern instanceof RegExp ? rule.pattern.source : rule.pattern, rule.description);
+            }
+        }
+    }
+}
+exports.QueryFirewall = QueryFirewall;
+QueryFirewall.instances = new Map();
+// ==================== Static Helper Functions ====================
+/**
+ * Analyze a query for security issues (static method)
+ */
+function analyzeQuerySecurity(query) {
+    const detectedPatterns = [];
+    // Check SQL injection patterns
+    for (const pattern of exports.OWASP_SQL_INJECTION_PATTERNS) {
+        if (pattern.test(query)) {
+            detectedPatterns.push(`SQL_INJECTION:${pattern.source}`);
+        }
+    }
+    // Check for dangerous operations
+    let isDangerousOperation = false;
+    const upperQuery = query.toUpperCase();
+    if (/^DROP\s+/i.test(upperQuery) || /^TRUNCATE/i.test(upperQuery)) {
+        isDangerousOperation = true;
+        detectedPatterns.push('DANGEROUS_OPERATION:DROP_OR_TRUNCATE');
+    }
+    if (/^DELETE\s+FROM\s+\w+\s*$/i.test(upperQuery)) {
+        isDangerousOperation = true;
+        detectedPatterns.push('DANGEROUS_OPERATION:DELETE_ALL');
+    }
+    // Determine risk level
+    let riskLevel = 'low';
+    if (detectedPatterns.some(p => p.startsWith('SQL_INJECTION'))) {
+        riskLevel = 'critical';
+    }
+    else if (detectedPatterns.some(p => p.startsWith('DANGEROUS_OPERATION'))) {
+        riskLevel = 'high';
+    }
+    else if (isDangerousOperation) {
+        riskLevel = 'medium';
+    }
+    return {
+        isSQLInjection: detectedPatterns.some(p => p.startsWith('SQL_INJECTION')),
+        isDangerousOperation,
+        riskLevel,
+        detectedPatterns,
+    };
+}
+/**
+ * Get recommended firewall rules for compliance frameworks
+ */
+function getRecommendedRules(frameworks) {
+    const rules = [];
+    // OWASP recommendations
+    if (frameworks.includes('OWASP')) {
+        rules.push({ type: 'block', pattern: "('|(\\'))", description: 'OWASP: Quote escaping' }, { type: 'block', pattern: '(union\\s+select)', description: 'OWASP: UNION SELECT' }, { type: 'block', pattern: '(--)', description: 'OWASP: Comment injection' });
+    }
+    // CIS Benchmarks
+    if (frameworks.includes('CIS')) {
+        rules.push({ type: 'block', pattern: '^DROP\\s+DATABASE', description: 'CIS: Block DROP DATABASE' }, { type: 'block', pattern: '^DROP\\s+TABLE', description: 'CIS: Block DROP TABLE' }, { type: 'allow', pattern: '^SELECT', description: 'CIS: Allow SELECT queries' });
+    }
+    // GDPR specific
+    if (frameworks.includes('GDPR')) {
+        rules.push({ type: 'block', pattern: '(select\\s+.*\\s+from\\s+users)', description: 'GDPR: Limit user data queries' });
+    }
+    return rules;
+}
+// ==================== Class Decorators ====================
+/** Metadata key for firewall rules on classes */
+const FIREWALL_RULES_KEY = Symbol('__orm_firewall_rules__');
+const FIREWALL_DATABASE_KEY = Symbol('__orm_firewall_database__');
+/**
+ * Decorator to apply firewall rules to a model class
+ *
+ * @example
+ * // Block destructive operations and file operations on a model
+ * @FirewallRules({
+ *   blockDestructive: true,
+ *   blockFileOperations: true,
+ * })
+ * class SensitiveData extends Model { ... }
+ *
+ * // Apply database-specific rules
+ * @FirewallRules({
+ *   database: 'postgresql',
+ *   blockCodeExecution: true,
+ * })
+ * class UserDefinedFunction extends Model { ... }
+ *
+ * // Custom rules
+ * @FirewallRules({
+ *   rules: [
+ *     { pattern: /^SELECT\s+FROM\s+logs/i, description: 'Block log access' },
+ *   ],
+ * })
+ * class AuditLog extends Model { ... }
+ */
+function FirewallRules(options = {}) {
+    return function (target) {
+        const rules = [];
+        // Apply database-specific rules
+        if (options.database) {
+            rules.push(`database:${options.database}`);
+            target[FIREWALL_DATABASE_KEY] = options.database;
+        }
+        // Apply category rules
+        if (options.blockDestructive) {
+            rules.push('DESTRUCTIVE');
+        }
+        if (options.blockSchemaModification) {
+            rules.push('SCHEMA_MODIFICATION');
+        }
+        if (options.blockPermissions) {
+            rules.push('PERMISSIONS');
+        }
+        if (options.blockFileOperations) {
+            rules.push('FILE_OPERATIONS');
+        }
+        if (options.blockInfoGathering) {
+            rules.push('INFORMATION_GATHERING');
+        }
+        if (options.blockCodeExecution) {
+            rules.push('CODE_EXECUTION');
+        }
+        if (options.blockTransactions) {
+            rules.push('TRANSACTION_CONTROL');
+        }
+        if (options.blockRemoteOperations) {
+            rules.push('REMOTE_OPERATIONS');
+        }
+        // Store custom rules
+        if (options.rules && options.rules.length > 0) {
+            rules.push('custom');
+            target[FIREWALL_RULES_KEY] = options.rules;
+        }
+        target[FIREWALL_RULES_KEY] = rules;
+    };
+}
+/**
+ * Decorator for PostgreSQL-specific firewall rules
+ *
+ * @example
+ * @PostgreSQLFirewall()
+ * class PostgresSensitive extends Model { ... }
+ */
+function PostgreSQLFirewall() {
+    return FirewallRules({ database: 'postgresql' });
+}
+/**
+ * Decorator for MySQL-specific firewall rules
+ *
+ * @example
+ * @MySQLFirewall()
+ * class MySQLSensitive extends Model { ... }
+ */
+function MySQLFirewall() {
+    return FirewallRules({ database: 'mysql' });
+}
+/**
+ * Decorator for MariaDB-specific firewall rules
+ *
+ * @example
+ * @MariaDBFirewall()
+ * class MariaDBSensitive extends Model { ... }
+ */
+function MariaDBFirewall() {
+    return FirewallRules({ database: 'mariadb' });
+}
+/**
+ * Decorator for SQL Server-specific firewall rules
+ *
+ * @example
+ * @MSSQLFirewall()
+ * class MSSQLSensitive extends Model { ... }
+ */
+function MSSQLFirewall() {
+    return FirewallRules({ database: 'mssql' });
+}
+/**
+ * Decorator for Oracle-specific firewall rules
+ *
+ * @example
+ * @OracleFirewall()
+ * class OracleSensitive extends Model { ... }
+ */
+function OracleFirewall() {
+    return FirewallRules({ database: 'oracle' });
+}
+/**
+ * Decorator for SQLite-specific firewall rules
+ *
+ * @example
+ * @SQLiteFirewall()
+ * class SQLiteSensitive extends Model { ... }
+ */
+function SQLiteFirewall() {
+    return FirewallRules({ database: 'sqlite' });
+}
+/**
+ * Apply firewall rules from a decorated model to a firewall instance
+ */
+function applyFirewallRulesToModel(model, firewall) {
+    const rules = model[FIREWALL_RULES_KEY];
+    const database = model[FIREWALL_DATABASE_KEY];
+    if (!rules && !database)
+        return;
+    // Apply database-specific rules
+    if (database && exports.DATABASE_RULES[database]) {
+        for (const rule of exports.DATABASE_RULES[database]) {
+            firewall.block(rule.pattern, `${database.toUpperCase()}: ${rule.description}`);
+        }
+    }
+    // Apply category rules
+    if (rules && rules.includes('DESTRUCTIVE')) {
+        firewall.applyDestructiveRules();
+    }
+    if (rules && rules.includes('SCHEMA_MODIFICATION')) {
+        firewall.applySchemaRules();
+    }
+    if (rules && rules.includes('PERMISSIONS')) {
+        firewall.applyPermissionRules();
+    }
+    if (rules && rules.includes('FILE_OPERATIONS')) {
+        firewall.applyFileRules();
+    }
+    if (rules && rules.includes('INFORMATION_GATHERING')) {
+        firewall.applyInfoGatheringRules();
+    }
+    if (rules && rules.includes('CODE_EXECUTION')) {
+        firewall.applyCodeExecutionRules?.(); // Need to add this method
+    }
+    if (rules && rules.includes('TRANSACTION_CONTROL')) {
+        firewall.applyTransactionRules?.(); // Need to add this method
+    }
+    if (rules && rules.includes('REMOTE_OPERATIONS')) {
+        firewall.applyRemoteOperationRules?.(); // Need to add this method
+    }
+    // Apply custom rules
+    const customRules = model[FIREWALL_RULES_KEY];
+    if (Array.isArray(customRules)) {
+        for (const rule of customRules) {
+            if (rule.pattern) {
+                firewall.block(rule.pattern, rule.description);
+            }
+        }
+    }
+}