ts-prorm-orm 1.1.0

package/dist/compliance/security-monitor.js

@@ -0,0 +1,525 @@
+"use strict";
+/**
+ * MTAT - Monitoring and Threat Assessment Tool
+ *
+ * A comprehensive security monitoring system that:
+ * - Screens SQL logs for suspicious patterns
+ * - Flags security-relevant events
+ * - Monitors compliance violations (invalid data movement)
+ * - Tracks slow/invalid queries
+ * - Provides real-time alerts
+ *
+ * Usage:
+ *   // Initialize with the MTAT monitor
+ *   const monitor = new SecurityMonitor(prorm, {
+ *     frameworks: ['GDPR', 'HIPAA'],
+ *     alertLevel: 'high',
+ *     onAlert: (alert) => console.log('Security Alert:', alert),
+ *   });
+ *
+ *   // Start monitoring
+ *   await monitor.start();
+ *
+ *   // Query the dashboard
+ *   const stats = monitor.getStats();
+ *   const alerts = monitor.getAlerts();
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ComplianceSecurityMonitor = exports.SecurityMonitor = void 0;
+exports.getGlobalMonitor = getGlobalMonitor;
+exports.initSecurityMonitor = initSecurityMonitor;
+exports.analyzeQuerySecurity = analyzeQuerySecurity;
+// SQL Injection patterns
+const SQL_INJECTION_PATTERNS = [
+    /('\s*or\s*'1'\s*=\s*'1)/i,
+    /('\s*or\s*1\s*=\s*1)/i,
+    /(union\s+select)/i,
+    /(union\s+all\s+select)/i,
+    /(\bor\b.*\b=\b)/,
+    /(exec\s*\()/i,
+    /(execute\s*\()/i,
+    /(xp_cmdshell)/i,
+    /(load_file\s*\()/i,
+    /(into\s+outfile)/i,
+    /(sleep\s*\()/i,
+    /(waitfor\s+delay)/i,
+    /('\s*;\s*drop\s+table)/i,
+    /(;\s*drop\s+table)/i,
+    /(\/\*.*\*\/)/,
+    /(--\s*)/,
+    /(char\s*\(\s*\d+)/,
+    /(0x[0-9a-f]+)/i,
+    /(\bunion\b.*\bselect\b)/i,
+    /(\bselect\b.*\bfrom\b)/i,
+    /(having\s+.*\b=\b)/i,
+    /(\border\s+by\s+\d+)/i,
+];
+// Sensitive data patterns
+const PII_PATTERNS = {
+    email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+    ssn: /\b\d{3}-\d{2}-\d{4}\b/g,
+    phone: /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g,
+    creditCard: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g,
+    ipAddress: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
+};
+// High-risk operations
+const RISKY_OPERATIONS = [
+    'DROP TABLE',
+    'DROP DATABASE',
+    'TRUNCATE',
+    'DELETE FROM',
+    'ALTER TABLE',
+    'DROP COLUMN',
+    'DROP INDEX',
+];
+// ==================== Security Monitor Class ====================
+class SecurityMonitor {
+    constructor(prorm, options = {}) {
+        this.alerts = [];
+        this.queryCount = 0;
+        this.slowQueryCount = 0;
+        this.blockedCount = 0;
+        this.isRunning = false;
+        this.prorm = prorm;
+        this.options = {
+            frameworks: options.frameworks ?? [],
+            alertLevel: options.alertLevel ?? 'medium',
+            onAlert: options.onAlert ?? (() => { }),
+            detectSQLInjection: options.detectSQLInjection ?? true,
+            monitorSlowQueries: options.monitorSlowQueries ?? true,
+            slowQueryThreshold: options.slowQueryThreshold ?? 1000,
+            detectExfiltration: options.detectExfiltration ?? true,
+            detectComplianceViolations: options.detectComplianceViolations ?? true,
+            maxAlerts: options.maxAlerts ?? 1000,
+            rateLimitThreshold: options.rateLimitThreshold ?? 100,
+            detectAnomalies: options.detectAnomalies ?? true,
+            bulkOperationThreshold: options.bulkOperationThreshold ?? 100,
+        };
+        this.startTime = new Date();
+    }
+    /**
+     * Start monitoring queries
+     */
+    async start() {
+        if (this.isRunning)
+            return;
+        this.isRunning = true;
+        // Hook into Prorm query events
+        this.originalQuery = this.prorm.query;
+        this.prorm.query = async (...args) => {
+            const startTime = Date.now();
+            const query = typeof args[0] === 'string' ? args[0] : args[0]?.sql ?? '';
+            try {
+                const result = await this.originalQuery.apply(this.prorm, args);
+                const duration = Date.now() - startTime;
+                this.queryCount++;
+                this.analyzeQuery(query, duration);
+                return result;
+            }
+            catch (error) {
+                this.analyzeError(query, error);
+                throw error;
+            }
+        };
+        // Also hook into model operations via hooks
+        this.setupHooks();
+    }
+    /**
+     * Stop monitoring
+     */
+    stop() {
+        if (!this.isRunning)
+            return;
+        this.isRunning = false;
+        if (this.originalQuery) {
+            this.prorm.query = this.originalQuery;
+        }
+    }
+    /**
+     * Setup hooks for model-level monitoring
+     */
+    setupHooks() {
+        const models = this.prorm.getModels?.() ?? [];
+        for (const [, Model] of models) {
+            // Monitor bulk operations
+            Model.hook('beforeBulkCreate', 'mtat:bulkCreate', (instances) => {
+                if (instances.length > this.options.bulkOperationThreshold) {
+                    this.addAlert({
+                        severity: 'medium',
+                        category: 'bulk_operation',
+                        message: `Bulk create operation detected: ${instances.length} records`,
+                        details: { count: instances.length, model: Model.name },
+                    });
+                }
+            });
+            Model.hook('beforeBulkUpdate', 'mtat:bulkUpdate', (opts) => {
+                // Check if this looks like a dangerous bulk update
+                if (!opts.where || Object.keys(opts.where).length === 0) {
+                    this.addAlert({
+                        severity: 'critical',
+                        category: 'bulk_operation',
+                        message: 'Dangerous bulk update without where clause',
+                        details: { model: Model.name, attributes: opts.attributes },
+                        query: JSON.stringify(opts),
+                    });
+                }
+            });
+            Model.hook('beforeBulkDestroy', 'mtat:bulkDestroy', (opts) => {
+                if (!opts.where || Object.keys(opts.where).length === 0) {
+                    this.addAlert({
+                        severity: 'critical',
+                        category: 'data_exfiltration',
+                        message: 'Dangerous bulk delete without where clause',
+                        details: { model: Model.name },
+                        query: JSON.stringify(opts),
+                    });
+                }
+            });
+        }
+    }
+    /**
+     * Analyze a query for security issues
+     */
+    analyzeQuery(query, duration) {
+        const analysis = this.analyzeQueryInternal(query);
+        // SQL Injection detection
+        if (this.options.detectSQLInjection) {
+            for (const pattern of SQL_INJECTION_PATTERNS) {
+                if (pattern.test(query)) {
+                    this.addAlert({
+                        severity: 'critical',
+                        category: 'sql_injection',
+                        message: 'Potential SQL injection detected',
+                        details: { pattern: pattern.source, riskScore: analysis.riskScore },
+                        query,
+                    });
+                    this.blockedCount++;
+                    return;
+                }
+            }
+        }
+        // Slow query monitoring
+        if (this.options.monitorSlowQueries && duration > this.options.slowQueryThreshold) {
+            this.slowQueryCount++;
+            this.addAlert({
+                severity: 'medium',
+                category: 'slow_query',
+                message: `Slow query detected: ${duration}ms`,
+                details: { duration, threshold: this.options.slowQueryThreshold },
+                query,
+            });
+        }
+        // High-risk operations
+        for (const op of RISKY_OPERATIONS) {
+            if (query.toUpperCase().includes(op)) {
+                this.addAlert({
+                    severity: 'high',
+                    category: 'unauthorized_access',
+                    message: `High-risk operation: ${op}`,
+                    details: { operation: op },
+                    query,
+                });
+            }
+        }
+        // Data exfiltration detection
+        if (this.options.detectExfiltration && analysis.isBulkOperation) {
+            this.addAlert({
+                severity: 'medium',
+                category: 'data_exfiltration',
+                message: 'Potential data exfiltration: bulk SELECT operation',
+                details: { tables: analysis.tables },
+                query,
+            });
+        }
+        // Compliance violation detection
+        if (this.options.detectComplianceViolations && this.options.frameworks.length > 0) {
+            this.checkComplianceViolationDetection(query, analysis);
+        }
+    }
+    /**
+     * Analyze errors for security issues
+     */
+    analyzeError(query, error) {
+        const message = error?.message ?? '';
+        // Detect injection errors
+        if (message.includes('syntax error') || message.includes('SQL syntax')) {
+            this.addAlert({
+                severity: 'low',
+                category: 'invalid_query',
+                message: 'Invalid SQL query detected',
+                details: { error: message.substring(0, 100) },
+                query,
+            });
+        }
+        // Access denied patterns
+        if (message.includes('permission denied') || message.includes('access denied')) {
+            this.addAlert({
+                severity: 'high',
+                category: 'unauthorized_access',
+                message: 'Unauthorized access attempt',
+                details: { error: message.substring(0, 100) },
+                query,
+            });
+        }
+    }
+    /**
+     * Internal query analysis
+     */
+    analyzeQueryInternal(query) {
+        const upperQuery = query.toUpperCase();
+        let operation = 'UNKNOWN';
+        if (upperQuery.includes('SELECT'))
+            operation = 'SELECT';
+        else if (upperQuery.includes('INSERT'))
+            operation = 'INSERT';
+        else if (upperQuery.includes('UPDATE'))
+            operation = 'UPDATE';
+        else if (upperQuery.includes('DELETE'))
+            operation = 'DELETE';
+        else if (upperQuery.includes('DROP'))
+            operation = 'DROP';
+        else if (upperQuery.includes('TRUNCATE'))
+            operation = 'TRUNCATE';
+        else if (upperQuery.includes('ALTER'))
+            operation = 'ALTER';
+        // Extract table names (simple regex)
+        const tableMatches = query.match(/(?:from|into|update|table)\s+`?(\w+)`?/gi) || [];
+        const tables = tableMatches.map(m => m.replace(/`/g, '').split(' ').pop() || '');
+        // Check for PII in query
+        let involvesPII = false;
+        for (const pattern of Object.values(PII_PATTERNS)) {
+            if (pattern.test(query)) {
+                involvesPII = true;
+                break;
+            }
+        }
+        // Calculate risk score
+        let riskScore = 0;
+        if (operation === 'SELECT' && involvesPII)
+            riskScore += 30;
+        if (RISKY_OPERATIONS.some(op => upperQuery.includes(op)))
+            riskScore += 50;
+        if (query.length > 1000)
+            riskScore += 10;
+        return {
+            query,
+            tables,
+            operation,
+            isSensitive: involvesPII,
+            involvesPII,
+            isBulkOperation: false, // Determined by hook
+            riskScore,
+        };
+    }
+    /**
+     * Check for compliance violations
+     */
+    checkComplianceViolationDetection(query, analysis) {
+        const frameworks = this.options.frameworks;
+        // GDPR-specific checks
+        if (frameworks.includes('GDPR') || frameworks.includes('UK_GDPR')) {
+            // Check for unauthorized personal data access
+            if (analysis.involvesPII && analysis.operation === 'SELECT') {
+                this.addAlert({
+                    severity: 'medium',
+                    category: 'compliance_violation',
+                    message: 'GDPR: Personal data access detected',
+                    details: { framework: 'GDPR', dataType: 'PII' },
+                    query,
+                });
+            }
+        }
+        // HIPAA-specific checks
+        if (frameworks.includes('HIPAA')) {
+            // Check for PHI access
+            if (query.toLowerCase().includes('medical') ||
+                query.toLowerCase().includes('diagnosis') ||
+                query.toLowerCase().includes('prescription')) {
+                this.addAlert({
+                    severity: 'high',
+                    category: 'compliance_violation',
+                    message: 'HIPAA: Protected Health Information access',
+                    details: { framework: 'HIPAA', dataType: 'PHI' },
+                    query,
+                });
+            }
+        }
+        // PCI DSS checks
+        if (frameworks.includes('PCI_DSS')) {
+            if (query.toLowerCase().includes('credit') ||
+                query.toLowerCase().includes('card') ||
+                query.toLowerCase().includes('payment')) {
+                this.addAlert({
+                    severity: 'critical',
+                    category: 'compliance_violation',
+                    message: 'PCI DSS: Cardholder data access',
+                    details: { framework: 'PCI_DSS', dataType: 'PCI' },
+                    query,
+                });
+            }
+        }
+    }
+    /**
+     * Add an alert
+     */
+    addAlert(alert) {
+        const fullAlert = {
+            ...alert,
+            id: `alert-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+            timestamp: new Date(),
+        };
+        // Check severity threshold
+        const severityOrder = ['low', 'medium', 'high', 'critical'];
+        if (severityOrder.indexOf(fullAlert.severity) < severityOrder.indexOf(this.options.alertLevel)) {
+            return;
+        }
+        this.alerts.push(fullAlert);
+        // Trim old alerts
+        if (this.alerts.length > this.options.maxAlerts) {
+            this.alerts = this.alerts.slice(-this.options.maxAlerts);
+        }
+        // Callback
+        if (this.options.onAlert) {
+            this.options.onAlert(fullAlert);
+        }
+    }
+    // ==================== Public API ====================
+    /**
+     * Get current statistics
+     */
+    getStats() {
+        const alertsBySeverity = {
+            low: 0, medium: 0, high: 0, critical: 0,
+        };
+        const alertsByCategory = {
+            sql_injection: 0,
+            data_exfiltration: 0,
+            unauthorized_access: 0,
+            compliance_violation: 0,
+            slow_query: 0,
+            invalid_query: 0,
+            anomaly: 0,
+            rate_limit: 0,
+            bulk_operation: 0,
+            sensitive_access: 0,
+        };
+        for (const alert of this.alerts) {
+            alertsBySeverity[alert.severity]++;
+            alertsByCategory[alert.category]++;
+        }
+        return {
+            uptime: Date.now() - this.startTime.getTime(),
+            totalQueries: this.queryCount,
+            slowQueries: this.slowQueryCount,
+            blockedQueries: this.blockedCount,
+            totalAlerts: this.alerts.length,
+            alertsBySeverity,
+            alertsByCategory,
+        };
+    }
+    /**
+     * Get all alerts
+     */
+    getAlerts(options) {
+        let filtered = [...this.alerts];
+        if (options?.severity) {
+            filtered = filtered.filter(a => a.severity === options.severity);
+        }
+        if (options?.category) {
+            filtered = filtered.filter(a => a.category === options.category);
+        }
+        if (options?.limit) {
+            filtered = filtered.slice(-options.limit);
+        }
+        return filtered;
+    }
+    /**
+     * Get critical alerts
+     */
+    getCriticalAlerts() {
+        return this.getAlerts({ severity: 'critical' });
+    }
+    /**
+     * Clear all alerts
+     */
+    clearAlerts() {
+        this.alerts = [];
+    }
+    /**
+     * Check if running
+     */
+    isActive() {
+        return this.isRunning;
+    }
+    /**
+     * Manual alert trigger (for custom security checks)
+     */
+    alert(options) {
+        this.addAlert(options);
+    }
+}
+exports.SecurityMonitor = SecurityMonitor;
+// ==================== Static Factory ====================
+let globalMonitor = null;
+/**
+ * Create or get the global security monitor singleton
+ */
+function getGlobalMonitor() {
+    return globalMonitor;
+}
+/**
+ * Initialize the global security monitor
+ */
+function initSecurityMonitor(prorm, options) {
+    globalMonitor = new SecurityMonitor(prorm, options);
+    return globalMonitor;
+}
+/**
+ * Quick security check for a query (static method)
+ */
+function analyzeQuerySecurity(query) {
+    const detectedPatterns = [];
+    // Check SQL injection patterns
+    for (const pattern of SQL_INJECTION_PATTERNS) {
+        if (pattern.test(query)) {
+            detectedPatterns.push(`SQL_INJECTION:${pattern.source}`);
+        }
+    }
+    // Check for sensitive data
+    let isSensitive = false;
+    for (const [name, pattern] of Object.entries(PII_PATTERNS)) {
+        if (pattern.test(query)) {
+            detectedPatterns.push(`SENSITIVE:${name}`);
+            isSensitive = true;
+        }
+    }
+    // Determine risk level
+    let riskLevel = 'low';
+    if (detectedPatterns.some(p => p.startsWith('SQL_INJECTION'))) {
+        riskLevel = 'critical';
+    }
+    else if (detectedPatterns.length > 0) {
+        riskLevel = 'high';
+    }
+    else if (isSensitive) {
+        riskLevel = 'medium';
+    }
+    return {
+        isSQLInjection: detectedPatterns.some(p => p.startsWith('SQL_INJECTION')),
+        isSensitive,
+        riskLevel,
+        detectedPatterns,
+    };
+}
+// ==================== Compliance Integration ====================
+/**
+ * MTAT with Compliance Integration
+ * Extends the basic monitor with framework-specific rules
+ */
+class ComplianceSecurityMonitor extends SecurityMonitor {
+    constructor(prorm, options = {}) {
+        super(prorm, options);
+        // Additional setup for compliance-specific monitoring
+    }
+}
+exports.ComplianceSecurityMonitor = ComplianceSecurityMonitor;