ts-prorm-orm 1.1.0

package/dist/compliance/security-decorator.js

@@ -0,0 +1,574 @@
+"use strict";
+/**
+ * Security Decorator
+ *
+ * A comprehensive decorator that applies multiple compliance controls to a model
+ * based on a list of security frameworks. Works with the 12 compliance classes.
+ *
+ * Usage:
+ *   @Security({
+ *     frameworks: ['GDPR', 'HIPAA', 'PCI_DSS'],
+ *     audit: true,
+ *     encrypt: ['ssn', 'creditCard'],
+ *     mask: { ssn: 'ssn', creditCard: 'card-last4' },
+ *     retention: { years: 7 },
+ *   })
+ *   class User extends Model { ... }
+ *
+ *   @Security({
+ *     frameworks: ['SOX', 'SEC_17A_4'],
+ *     immutable: true,
+ *   })
+ *   class FinancialRecord extends Model { ... }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FrameworkRequirements = exports.FrameworkCount = exports.FrameworkCategories = exports.AllFrameworks = exports.SecurityFramework = void 0;
+exports.isValidFramework = isValidFramework;
+exports.getFrameworkCategory = getFrameworkCategory;
+exports.getAllFrameworks = getAllFrameworks;
+exports.Security = Security;
+exports.setupSecurity = setupSecurity;
+exports.setupAllSecurity = setupAllSecurity;
+exports.Table = Table;
+exports.Database = Database;
+exports.getTableSecurity = getTableSecurity;
+exports.getDatabaseSecurity = getDatabaseSecurity;
+exports.getSecurityFrameworks = getSecurityFrameworks;
+exports.hasAudit = hasAudit;
+exports.isImmutableModel = isImmutableModel;
+const audit_trail_1 = require("./audit-trail");
+const field_encryption_1 = require("./field-encryption");
+const data_retention_1 = require("./data-retention");
+const data_masker_1 = require("./data-masker");
+const immutable_record_1 = require("./immutable-record");
+const row_level_security_1 = require("./row-level-security");
+const data_classifier_1 = require("./data-classifier");
+const data_lineage_1 = require("./data-lineage");
+const session_isolation_1 = require("./session-isolation");
+const worm_storage_1 = require("./worm-storage");
+const rate_limiter_1 = require("./rate-limiter");
+const cross_border_log_1 = require("./cross-border-log");
+// ==================== Framework Enum ====================
+/**
+ * All supported security/compliance frameworks.
+ * These map to the 218+ frameworks in docs/sec/SECURITY_COMPLIANCE.md
+ */
+exports.SecurityFramework = {
+    // === Privacy Regulations ===
+    GDPR: 'GDPR',
+    CCPA: 'CCPA',
+    CPRA: 'CPRA',
+    PIPEDA: 'PIPEDA',
+    LGPD: 'LGPD',
+    APPI: 'APPI',
+    PIPA: 'PIPA',
+    PIPL: 'PIPL',
+    DPDP: 'DPDP',
+    PDPA_THAILAND: 'PDPA_Thailand',
+    PDPA_SINGAPORE: 'PDPA_Singapore',
+    PDPA_PHILIPPINES: 'PDPA_Philippines',
+    PDPA_MALAYSIA: 'PDPA_Malaysia',
+    PDPA_INDONESIA: 'PDPA_Indonesia',
+    PDPA_VIETNAM: 'PDPA_Vietnam',
+    POPI: 'PoPI',
+    NDPR: 'NDPR',
+    KVKK: 'KVKK',
+    UK_GDPR: 'UK_GDPR',
+    // === Financial Regulations ===
+    PCI_DSS: 'PCI_DSS',
+    SOX: 'SOX',
+    GLBA: 'GLBA',
+    MIDIF_II: 'MiFID_II',
+    EMIR: 'EMIR',
+    BASEL_III: 'Basel_III',
+    DODD_FRANK: 'Dodd_Frank',
+    SEC_17A_4: 'SEC_17a_4',
+    FINRA: 'FINRA',
+    NYDFS: 'NYDFS',
+    DORA: 'DORA',
+    // === Healthcare ===
+    HIPAA: 'HIPAA',
+    HITRUST: 'HITRUST',
+    CFR_21_PART_11: '21_CFR_Part_11',
+    EU_ANNEX_11: 'EU_Annex_11',
+    ALCOA_PLUS: 'ALCOA+',
+    GAMP_5: 'GAMP_5',
+    ICH_E6_GCP: 'ICH_E6_GCP',
+    DISHA: 'DISHA',
+    // === Government / Defense ===
+    FEDRAMP: 'FedRAMP',
+    FISMA: 'FISMA',
+    NIST_800_53: 'NIST_SP_800_53',
+    NIST_800_171: 'NIST_SP_800_171',
+    NIST_CSF: 'NIST_CSF',
+    CMMC: 'CMMC',
+    DFARS: 'DFARS',
+    ITAR: 'ITAR',
+    CJIS: 'CJIS',
+    NERC_CIP: 'NERC_CIP',
+    // === Industry Standards ===
+    ISO_27001: 'ISO_27001',
+    ISO_27017: 'ISO_27017',
+    ISO_27018: 'ISO_27018',
+    ISO_27701: 'ISO_27701',
+    ISO_22301: 'ISO_22301',
+    SOC_2: 'SOC_2',
+    SOC_1: 'SOC_1',
+    CIS_CONTROLS: 'CIS_Controls',
+    OWASP_TOP_10: 'OWASP_Top_10',
+    // === Cloud & International ===
+    CLOUD_ACT: 'CLOUD_Act',
+    SCHREMS_II: 'Schrems_II',
+    ESSENTIAL_EIGHT: 'Essential_Eight',
+    IT_GRUNDSCHUTZ: 'IT_Grundschutz',
+};
+// ==================== Framework Map / Set ====================
+/**
+ * Set of all valid security framework names.
+ * Use for validation: `if (AllFrameworks.has(myFramework)) { ... }`
+ */
+exports.AllFrameworks = new Set(Object.values(exports.SecurityFramework));
+/**
+ * Map of framework category to framework names.
+ * Useful for UI dropdowns or grouped validation.
+ */
+exports.FrameworkCategories = {
+    'Privacy Regulations': [
+        exports.SecurityFramework.GDPR,
+        exports.SecurityFramework.CCPA,
+        exports.SecurityFramework.CPRA,
+        exports.SecurityFramework.PIPEDA,
+        exports.SecurityFramework.LGPD,
+        exports.SecurityFramework.APPI,
+        exports.SecurityFramework.PIPA,
+        exports.SecurityFramework.PIPL,
+        exports.SecurityFramework.DPDP,
+        exports.SecurityFramework.PDPA_THAILAND,
+        exports.SecurityFramework.PDPA_SINGAPORE,
+        exports.SecurityFramework.PDPA_PHILIPPINES,
+        exports.SecurityFramework.PDPA_MALAYSIA,
+        exports.SecurityFramework.PDPA_INDONESIA,
+        exports.SecurityFramework.PDPA_VIETNAM,
+        exports.SecurityFramework.POPI,
+        exports.SecurityFramework.NDPR,
+        exports.SecurityFramework.KVKK,
+        exports.SecurityFramework.UK_GDPR,
+    ],
+    'Financial Regulations': [
+        exports.SecurityFramework.PCI_DSS,
+        exports.SecurityFramework.SOX,
+        exports.SecurityFramework.GLBA,
+        exports.SecurityFramework.MIDIF_II,
+        exports.SecurityFramework.EMIR,
+        exports.SecurityFramework.BASEL_III,
+        exports.SecurityFramework.DODD_FRANK,
+        exports.SecurityFramework.SEC_17A_4,
+        exports.SecurityFramework.FINRA,
+        exports.SecurityFramework.NYDFS,
+        exports.SecurityFramework.DORA,
+    ],
+    'Healthcare': [
+        exports.SecurityFramework.HIPAA,
+        exports.SecurityFramework.HITRUST,
+        exports.SecurityFramework.CFR_21_PART_11,
+        exports.SecurityFramework.EU_ANNEX_11,
+        exports.SecurityFramework.ALCOA_PLUS,
+        exports.SecurityFramework.GAMP_5,
+        exports.SecurityFramework.ICH_E6_GCP,
+        exports.SecurityFramework.DISHA,
+    ],
+    'Government / Defense': [
+        exports.SecurityFramework.FEDRAMP,
+        exports.SecurityFramework.FISMA,
+        exports.SecurityFramework.NIST_800_53,
+        exports.SecurityFramework.NIST_800_171,
+        exports.SecurityFramework.NIST_CSF,
+        exports.SecurityFramework.CMMC,
+        exports.SecurityFramework.DFARS,
+        exports.SecurityFramework.ITAR,
+        exports.SecurityFramework.CJIS,
+        exports.SecurityFramework.NERC_CIP,
+    ],
+    'Industry Standards': [
+        exports.SecurityFramework.ISO_27001,
+        exports.SecurityFramework.ISO_27017,
+        exports.SecurityFramework.ISO_27018,
+        exports.SecurityFramework.ISO_27701,
+        exports.SecurityFramework.ISO_22301,
+        exports.SecurityFramework.SOC_2,
+        exports.SecurityFramework.SOC_1,
+        exports.SecurityFramework.CIS_CONTROLS,
+        exports.SecurityFramework.OWASP_TOP_10,
+    ],
+    'Cloud & International': [
+        exports.SecurityFramework.CLOUD_ACT,
+        exports.SecurityFramework.SCHREMS_II,
+        exports.SecurityFramework.ESSENTIAL_EIGHT,
+        exports.SecurityFramework.IT_GRUNDSCHUTZ,
+    ],
+};
+/**
+ * Validate that a framework name is valid.
+ *
+ * @param framework - Framework name to validate
+ * @returns true if valid, false otherwise
+ */
+function isValidFramework(framework) {
+    return exports.AllFrameworks.has(framework);
+}
+/**
+ * Get the category for a specific framework.
+ */
+function getFrameworkCategory(framework) {
+    for (const [category, frameworks] of Object.entries(exports.FrameworkCategories)) {
+        if (frameworks.includes(framework)) {
+            return category;
+        }
+    }
+    return undefined;
+}
+/**
+ * Get all frameworks as an array.
+ */
+function getAllFrameworks() {
+    return Array.from(exports.AllFrameworks);
+}
+/**
+ * Get framework count.
+ */
+exports.FrameworkCount = exports.AllFrameworks.size; // 80 frameworks
+/**
+ * Map of framework to its required security controls.
+ * Used internally to determine which controls to apply.
+ */
+exports.FrameworkRequirements = {
+    // GDPR - comprehensive
+    [exports.SecurityFramework.GDPR]: { audit: true, encryption: true, retention: true, masking: true, consent: true, rls: true, pseudonymize: true, classification: true, tls: true, lineage: true },
+    [exports.SecurityFramework.CCPA]: { audit: true, encryption: true, retention: true, masking: true, consent: true, rls: true },
+    [exports.SecurityFramework.CPRA]: { audit: true, encryption: true, retention: true, masking: true, consent: true, rls: true },
+    [exports.SecurityFramework.PIPEDA]: { audit: true, encryption: true, retention: true, consent: true, rls: true },
+    [exports.SecurityFramework.LGPD]: { audit: true, encryption: true, retention: true, consent: true, rls: true },
+    [exports.SecurityFramework.APPI]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PIPA]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PIPL]: { audit: true, encryption: true, retention: true, classification: true, tls: true },
+    [exports.SecurityFramework.DPDP]: { audit: true, encryption: true, retention: true, consent: true, rls: true },
+    // Financial
+    [exports.SecurityFramework.PCI_DSS]: { audit: true, encryption: true, masking: true, tls: true },
+    [exports.SecurityFramework.SOX]: { audit: true, immutable: true, retention: true, lineage: true, worm: true },
+    [exports.SecurityFramework.GLBA]: { audit: true, encryption: true, masking: true },
+    [exports.SecurityFramework.MIDIF_II]: { audit: true, retention: true },
+    [exports.SecurityFramework.EMIR]: { audit: true, retention: true },
+    [exports.SecurityFramework.BASEL_III]: { audit: true, retention: true, lineage: true },
+    [exports.SecurityFramework.DODD_FRANK]: { audit: true, retention: true },
+    [exports.SecurityFramework.SEC_17A_4]: { audit: true, immutable: true, retention: true, worm: true },
+    [exports.SecurityFramework.FINRA]: { audit: true, retention: true },
+    [exports.SecurityFramework.NYDFS]: { audit: true, encryption: true, tls: true },
+    [exports.SecurityFramework.DORA]: { audit: true, encryption: true, retention: true, rls: true, worm: true },
+    // Healthcare
+    [exports.SecurityFramework.HIPAA]: { audit: true, encryption: true, masking: true, rls: true, classification: true, lineage: true },
+    [exports.SecurityFramework.HITRUST]: { audit: true, encryption: true, masking: true, rls: true, classification: true },
+    [exports.SecurityFramework.CFR_21_PART_11]: { audit: true, immutable: true },
+    [exports.SecurityFramework.EU_ANNEX_11]: { audit: true, immutable: true },
+    [exports.SecurityFramework.ALCOA_PLUS]: { audit: true, immutable: true },
+    [exports.SecurityFramework.GAMP_5]: { audit: true, immutable: true },
+    [exports.SecurityFramework.ICH_E6_GCP]: { audit: true, immutable: true },
+    [exports.SecurityFramework.DISHA]: { encryption: true, classification: true },
+    // Government/Defense
+    [exports.SecurityFramework.FEDRAMP]: { encryption: true, tls: true, classification: true, sessionIsolation: true },
+    [exports.SecurityFramework.FISMA]: { audit: true, encryption: true, tls: true },
+    [exports.SecurityFramework.NIST_800_53]: { audit: true, encryption: true, rls: true, classification: true },
+    [exports.SecurityFramework.NIST_800_171]: { audit: true, encryption: true, rls: true },
+    [exports.SecurityFramework.NIST_CSF]: { audit: true, encryption: true, retention: true, classification: true, breachDetection: true },
+    [exports.SecurityFramework.CMMC]: { encryption: true, rls: true },
+    [exports.SecurityFramework.DFARS]: { encryption: true, rls: true },
+    [exports.SecurityFramework.ITAR]: { encryption: true, classification: true },
+    [exports.SecurityFramework.CJIS]: { audit: true, encryption: true, rls: true },
+    [exports.SecurityFramework.NERC_CIP]: { audit: true, encryption: true, rls: true },
+    // Industry Standards
+    [exports.SecurityFramework.ISO_27001]: { audit: true, encryption: true, rls: true, classification: true },
+    [exports.SecurityFramework.ISO_27017]: { encryption: true, tls: true, sessionIsolation: true },
+    [exports.SecurityFramework.ISO_27018]: { encryption: true, classification: true },
+    [exports.SecurityFramework.ISO_27701]: { classification: true, consent: true },
+    [exports.SecurityFramework.ISO_22301]: { retention: true },
+    [exports.SecurityFramework.SOC_2]: { audit: true, encryption: true, retention: true },
+    [exports.SecurityFramework.SOC_1]: { audit: true, retention: true },
+    [exports.SecurityFramework.CIS_CONTROLS]: {
+        audit: true,
+        encryption: true,
+        breachDetection: true,
+        rateLimit: true,
+        backupVerification: true,
+    },
+    [exports.SecurityFramework.OWASP_TOP_10]: { encryption: true, masking: true, rateLimit: true, queryFirewall: true },
+    // Cloud & International
+    [exports.SecurityFramework.CLOUD_ACT]: { encryption: true, classification: true },
+    [exports.SecurityFramework.SCHREMS_II]: { encryption: true, pseudonymize: true },
+    [exports.SecurityFramework.ESSENTIAL_EIGHT]: { encryption: true, rls: true },
+    [exports.SecurityFramework.IT_GRUNDSCHUTZ]: { audit: true, encryption: true, rls: true },
+    // Default for unknown frameworks
+    [exports.SecurityFramework.PDPA_THAILAND]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PDPA_SINGAPORE]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PDPA_PHILIPPINES]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PDPA_MALAYSIA]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PDPA_INDONESIA]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.PDPA_VIETNAM]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.POPI]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.NDPR]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.KVKK]: { audit: true, encryption: true, consent: true, rls: true },
+    [exports.SecurityFramework.UK_GDPR]: { audit: true, encryption: true, retention: true, masking: true, consent: true, rls: true, pseudonymize: true, classification: true, tls: true },
+};
+// ==================== Security Decorator ====================
+/**
+ * Apply security controls to a model based on specified frameworks.
+ *
+ * @param options - Security configuration
+ *
+ * @example
+ *   @Security({
+ *     frameworks: ['GDPR', 'HIPAA', 'PCI_DSS'],
+ *     audit: true,
+ *     encrypt: ['ssn', 'creditCard'],
+ *     mask: { ssn: 'ssn', creditCard: 'card-last4' },
+ *     retention: { years: 7 },
+ *     autoClassify: true,
+ *   })
+ *   class Patient extends Model { ... }
+ */
+function Security(options) {
+    return function (target) {
+        const frameworks = options.frameworks ?? [];
+        const requirements = new Set();
+        // Aggregate requirements from all frameworks
+        for (const fw of frameworks) {
+            const req = exports.FrameworkRequirements[fw];
+            if (req) {
+                Object.entries(req).forEach(([key, value]) => {
+                    if (value)
+                        requirements.add(key);
+                });
+            }
+        }
+        // Apply audit trail if needed
+        if (options.audit || requirements.has('audit')) {
+            // Audit will be applied at runtime via setup call
+            target.__security_audit = true;
+            target.__security_getUserId = options.getUserId;
+            target.__security_getIpAddress = options.getIpAddress;
+        }
+        // Apply field encryption
+        if (options.encrypt && options.encrypt.length > 0) {
+            for (const field of options.encrypt) {
+                (0, field_encryption_1.Encrypt)(field)(target);
+            }
+            target.__security_encrypted = options.encrypt;
+        }
+        // Apply field masking
+        if (options.mask) {
+            for (const [field, pattern] of Object.entries(options.mask)) {
+                (0, data_masker_1.Mask)(field, { pattern })(target);
+            }
+            target.__security_masked = Object.keys(options.mask);
+        }
+        // Apply retention policy
+        if (options.retention) {
+            target.__security_retention = options.retention;
+        }
+        // Apply immutability
+        // Note: hook registration is deferred to setupSecurity() because the model
+        // may not yet be attached to a Prorm instance at class-decoration time
+        // (addHook() requires Model.prorm to be set).
+        if (options.immutable || requirements.has('immutable')) {
+            target.__security_immutable = true;
+            target.__security_versioning = Boolean(options.versioning || requirements.has('immutable'));
+        }
+        // Apply RLS
+        if (options.rls) {
+            (0, row_level_security_1.apply)(target, options.rls);
+            target.__security_rls = true;
+        }
+        // Apply classification
+        if (options.classify) {
+            for (const [field, category] of Object.entries(options.classify)) {
+                (0, data_classifier_1.FieldClassification)(field, category)(target);
+            }
+        }
+        if (options.autoClassify || requirements.has('classification')) {
+            (0, data_classifier_1.autoDiscover)(target);
+        }
+        // Apply data lineage tracking
+        if (options.lineage || requirements.has('lineage')) {
+            (0, data_lineage_1.LineageTrack)()(target);
+            target.__security_lineage = true;
+        }
+        // Apply breach detection
+        if (options.breachDetection || requirements.has('breachDetection')) {
+            target.__security_breach_detection = true;
+        }
+        // Apply session isolation
+        if (options.sessionIsolation || requirements.has('sessionIsolation')) {
+            (0, session_isolation_1.TenantIsolation)({ tenantId: options.tenantIdField ?? 'tenantId' })(target);
+            target.__security_session_isolation = true;
+        }
+        // Apply WORM storage
+        if (options.worm || requirements.has('worm')) {
+            (0, worm_storage_1.WORM)({ retentionPeriod: options.retention ?? { years: 7 }, tamperEvident: true })(target);
+            target.__security_worm = true;
+        }
+        // Apply rate limiting
+        if (options.rateLimit || requirements.has('rateLimit')) {
+            (0, rate_limiter_1.RateLimit)({})(target);
+            target.__security_rate_limit = true;
+        }
+        // Apply sensitive data discovery
+        if (options.sensitiveDataDiscovery || requirements.has('sensitiveDataDiscovery')) {
+            target.__security_sensitive_data_discovery = true;
+        }
+        // Apply cross-border transfer logging
+        if (options.crossBorderLog || requirements.has('crossBorderLog')) {
+            cross_border_log_1.CrossBorderLog.enable(null, target);
+            target.__security_cross_border_log = true;
+        }
+        // Apply consent versioning
+        if (options.consentVersioning || requirements.has('consentVersioning')) {
+            target.__security_consent_versioning = true;
+        }
+        // Apply DSAR workflow
+        if (options.dsar || requirements.has('dsar')) {
+            target.__security_dsar = true;
+        }
+        // Apply privacy impact assessment
+        if (options.pia || requirements.has('pia')) {
+            target.__security_pia = true;
+        }
+        // Apply backup verification
+        if (options.backupVerification || requirements.has('backupVerification')) {
+            target.__security_backup_verification = true;
+        }
+        // Apply query firewall
+        if (options.queryFirewall || requirements.has('queryFirewall')) {
+            target.__security_query_firewall = true;
+        }
+        // Store frameworks for reference
+        target.__security_frameworks = frameworks;
+        target.__security_options = options;
+    };
+}
+// ==================== Setup Functions ====================
+/**
+ * Apply all security hooks to a model after it's been defined.
+ * Call this after Model.init() or prorm.define().
+ *
+ * @param Model - The model class
+ * @param prorm - The Prorm instance (required for audit)
+ */
+function setupSecurity(Model, prorm) {
+    // Apply encryption hooks
+    const encrypted = Model.__security_encrypted;
+    if (encrypted && encrypted.length > 0) {
+        (0, field_encryption_1.applyEncryptionHooks)(Model);
+    }
+    // Apply masking hooks
+    const masked = Model.__security_masked;
+    if (masked && masked.length > 0) {
+        (0, data_masker_1.applyHooks)(Model);
+    }
+    // Apply retention policy
+    const retention = Model.__security_retention;
+    if (retention) {
+        data_retention_1.DataRetentionPolicy.set(Model, { maxAge: retention });
+    }
+    // Setup audit if enabled
+    const auditEnabled = Model.__security_audit;
+    if (auditEnabled && prorm) {
+        const getUserId = Model.__security_getUserId;
+        const getIpAddress = Model.__security_getIpAddress;
+        audit_trail_1.ComplianceAuditTrail.enable(prorm, Model, {
+            getUserId,
+            getIpAddress,
+        });
+    }
+    // Apply immutability (deferred from the Security decorator since the model
+    // needs to be attached to a Prorm instance before hooks can be registered)
+    const immutable = Model.__security_immutable;
+    if (immutable) {
+        (0, immutable_record_1.makeImmutable)(Model);
+        if (Model.__security_versioning) {
+            (0, immutable_record_1.enableVersioning)(Model);
+        }
+    }
+}
+/**
+ * Apply security to all models in a Prorm instance.
+ */
+function setupAllSecurity(prorm) {
+    const models = prorm.getModels?.() ?? [];
+    for (const [, Model] of models) {
+        setupSecurity(Model, prorm);
+    }
+}
+/**
+ * Apply table-level security metadata.
+ *
+ * @example
+ *   @Table({
+ *     schema: 'financial',
+ *     classification: 'CONFIDENTIAL',
+ *     rlsEnabled: true,
+ *   })
+ *   class Transaction extends Model { ... }
+ */
+function Table(options = {}) {
+    return function (target) {
+        target.__table_security = options;
+    };
+}
+/**
+ * Apply database-level security metadata.
+ *
+ * @example
+ *   @Database({
+ *     name: 'healthcare_db',
+ *     region: 'us-east-1',
+ *     classification: 'CONFIDENTIAL',
+ *     requireTLS: true,
+ *     defaultAudit: true,
+ *     allowedCountries: ['US'],
+ *   })
+ *   class HealthcareDB extends Model { ... }
+ */
+function Database(options) {
+    return function (target) {
+        target.__database_security = options;
+    };
+}
+// ==================== Getters ====================
+/**
+ * Get table security options from a model.
+ */
+function getTableSecurity(Model) {
+    return Model.__table_security;
+}
+/**
+ * Get database security options from a model.
+ */
+function getDatabaseSecurity(Model) {
+    return Model.__database_security;
+}
+/**
+ * Get the frameworks applied to a model.
+ */
+function getSecurityFrameworks(Model) {
+    return Model.__security_frameworks ?? [];
+}
+/**
+ * Check if a model has audit enabled.
+ */
+function hasAudit(Model) {
+    return !!Model.__security_audit;
+}
+/**
+ * Check if a model is immutable.
+ */
+function isImmutableModel(Model) {
+    return !!Model.__security_immutable;
+}