ts-prorm-orm 1.1.0

package/dist/compliance/session-isolation.js

@@ -0,0 +1,472 @@
+"use strict";
+/**
+ * SessionIsolation
+ *
+ * Provides multi-tenant data isolation using AsyncLocalStorage for automatic
+ * tenant context propagation. Implements tenant-specific encryption keys,
+ * session management, and tenant-aware audit logging.
+ *
+ * Covers compliance frameworks including:
+ *   ISO 27017, FedRAMP, CPRA, GDPR, HIPAA, SOC 2, NIST SP 800-53, and more.
+ *
+ * Usage:
+ *   // At app startup, initialize session isolation:
+ *   SessionIsolation.init({ sessionTimeout: 30 * 60 * 1000 });
+ *
+ *   // Register tenant encryption keys:
+ *   SessionIsolation.registerTenantKey('tenant-123', 'encryption-key-32-bytes');
+ *
+ *   // In your authentication middleware:
+ *   SessionIsolation.setTenant({
+ *     tenantId: 'tenant-123',
+ *     sessionId: 'session-abc',
+ *     userId: 'user-456',
+ *     roles: ['admin']
+ *   });
+ *
+ *   // Run operations in a specific tenant context:
+ *   const result = SessionIsolation.runInTenant('tenant-123', () => {
+ *     return db.User.findAll();
+ *   });
+ *
+ *   // Use the decorator on models:
+ *   @TenantIsolation({ tenantId: 'tenantId', auditEnabled: true })
+ *   class Document extends Model { ... }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantIsolationManager = exports.SessionIsolation = void 0;
+exports.TenantIsolation = TenantIsolation;
+exports.getTenantIsolationOptions = getTenantIsolationOptions;
+exports.sessionIsolationMiddleware = sessionIsolationMiddleware;
+exports.getTenantAuditMetadata = getTenantAuditMetadata;
+const async_hooks_1 = require("async_hooks");
+const operators_1 = require("../models/operators");
+// ==================== Symbol Keys for Metadata ====================
+const TENANT_CONTEXT_KEY = Symbol('tenantContext');
+const SESSION_ISOLATION_DATA = Symbol('sessionIsolationData');
+// ==================== In-Memory Storage ====================
+class InMemorySessionStore {
+    constructor() {
+        this.sessions = new Map();
+    }
+    async get(sessionId) {
+        return this.sessions.get(sessionId) ?? null;
+    }
+    async set(sessionId, info) {
+        this.sessions.set(sessionId, info);
+    }
+    async delete(sessionId) {
+        this.sessions.delete(sessionId);
+    }
+    async getByTenant(tenantId) {
+        return [...this.sessions.values()].filter((s) => s.tenantId === tenantId);
+    }
+    async getByUser(userId) {
+        return [...this.sessions.values()].filter((s) => s.userId === userId);
+    }
+    async cleanup(expiredBefore) {
+        let count = 0;
+        for (const [id, session] of this.sessions) {
+            if (session.expiresAt < expiredBefore) {
+                this.sessions.delete(id);
+                count++;
+            }
+        }
+        return count;
+    }
+}
+class InMemoryKeyStore {
+    constructor() {
+        this.keys = new Map();
+    }
+    async get(tenantId) {
+        return this.keys.get(tenantId) ?? null;
+    }
+    async set(tenantId, key) {
+        this.keys.set(tenantId, key);
+    }
+    async delete(tenantId) {
+        this.keys.delete(tenantId);
+    }
+    async getAll() {
+        return [...this.keys.values()];
+    }
+}
+// ==================== AsyncLocalStorage ====================
+const tenantContextStore = new async_hooks_1.AsyncLocalStorage();
+// Global state
+let isInitialized = false;
+let options = {};
+let sessionStore;
+let keyStore;
+let cleanupTimer = null;
+// ==================== SessionIsolation Class ====================
+class SessionIsolation {
+    /**
+     * Initialize session isolation. Call once at application startup.
+     *
+     * @param opts - Configuration options
+     */
+    static init(opts = {}) {
+        if (isInitialized) {
+            console.warn('[SessionIsolation] Already initialized. Call reset() first to reinitialize.');
+            return;
+        }
+        options = {
+            sessionTimeout: 30 * 60 * 1000, // 30 minutes
+            maxSessionsPerTenant: undefined,
+            maxSessionsPerUser: 5,
+            autoCleanup: true,
+            cleanupInterval: 5 * 60 * 1000, // 5 minutes
+            auditEnabled: true,
+            ...opts,
+        };
+        // Initialize stores
+        sessionStore = options.sessionStore ?? new InMemorySessionStore();
+        keyStore = options.keyStore ?? new InMemoryKeyStore();
+        // Start cleanup timer
+        if (options.autoCleanup) {
+            cleanupTimer = setInterval(() => {
+                SessionIsolation.cleanupExpiredSessions().catch((err) => {
+                    console.error('[SessionIsolation] Cleanup error:', err);
+                });
+            }, options.cleanupInterval);
+        }
+        isInitialized = true;
+    }
+    /**
+     * Reset the session isolation system. Useful for testing.
+     */
+    static reset() {
+        if (cleanupTimer) {
+            clearInterval(cleanupTimer);
+            cleanupTimer = null;
+        }
+        isInitialized = false;
+        options = {};
+    }
+    /**
+     * Set the current tenant context for this request/operation.
+     *
+     * @param ctx - The tenant context
+     */
+    static setTenant(ctx) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        // enterWith() propagates the context for the remainder of the current
+        // synchronous execution and any asynchronous operations chained from
+        // it, without requiring the caller to wrap downstream work in a
+        // callback. For strict per-request isolation under concurrent load,
+        // prefer runInTenant() or sessionIsolationMiddleware(), which wrap the
+        // actual downstream work in tenantContextStore.run() directly.
+        tenantContextStore.enterWith(ctx);
+    }
+    /**
+     * Get the current tenant context.
+     *
+     * @returns The current tenant context, or undefined if not set
+     */
+    static getTenant() {
+        return tenantContextStore.getStore();
+    }
+    /**
+     * Clear the current tenant context.
+     */
+    static clearTenant() {
+        tenantContextStore.enterWith(undefined);
+    }
+    /**
+     * Run a function within a specific tenant context.
+     *
+     * @param tenantId - The tenant ID to run in
+     * @param fn - The function to execute
+     * @returns The result of the function
+     */
+    static runInTenant(tenantId, fn) {
+        const ctx = {
+            tenantId,
+            sessionId: `isolated-${Date.now()}`,
+        };
+        return tenantContextStore.run(ctx, fn);
+    }
+    /**
+     * Register an encryption key for a tenant.
+     *
+     * @param tenantId - The tenant ID
+     * @param key - The encryption key (32 bytes recommended for AES-256)
+     * @param keyVersion - Optional key version for rotation
+     */
+    static async registerTenantKey(tenantId, key, keyVersion) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        const tenantKey = {
+            tenantId,
+            key,
+            keyVersion,
+            createdAt: new Date(),
+        };
+        await keyStore.set(tenantId, tenantKey);
+    }
+    /**
+     * Get the encryption key for a tenant.
+     *
+     * @param tenantId - The tenant ID
+     * @returns The tenant key, or undefined if not found
+     */
+    static async getTenantKey(tenantId) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        return (await keyStore.get(tenantId)) ?? undefined;
+    }
+    /**
+     * Validate a session.
+     *
+     * @param sessionId - The session ID to validate
+     * @returns SessionInfo if valid, null if invalid/expired
+     */
+    static async validateSession(sessionId) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        const session = await sessionStore.get(sessionId);
+        if (!session) {
+            return null;
+        }
+        // Check if expired
+        if (new Date() > session.expiresAt) {
+            await sessionStore.delete(sessionId);
+            return null;
+        }
+        // Check if inactive
+        if (!session.isActive) {
+            return null;
+        }
+        // Update last activity
+        session.lastActivityAt = new Date();
+        await sessionStore.set(sessionId, session);
+        return session;
+    }
+    /**
+     * Manually expire a session.
+     *
+     * @param sessionId - The session ID to expire
+     */
+    static async expireSession(sessionId) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        await sessionStore.delete(sessionId);
+    }
+    /**
+     * Create a new session for a tenant.
+     *
+     * @param tenantId - The tenant ID
+     * @param userId - The user ID
+     * @param options - Additional session options
+     * @returns The created session info
+     */
+    static async createSession(tenantId, userId, options) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        const sessionId = `session-${tenantId}-${userId}-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
+        const now = new Date();
+        const expiresAt = options?.customExpiresAt ?? new Date(now.getTime() + SessionIsolation.getSessionTimeout());
+        const sessionInfo = {
+            sessionId,
+            tenantId,
+            userId,
+            createdAt: now,
+            expiresAt,
+            lastActivityAt: now,
+            isActive: true,
+            ipAddress: options?.ipAddress,
+            userAgent: options?.userAgent,
+        };
+        await sessionStore.set(sessionId, sessionInfo);
+        return sessionInfo;
+    }
+    /**
+     * Get all active sessions for a tenant.
+     *
+     * @param tenantId - The tenant ID
+     * @returns Array of session info
+     */
+    static async getTenantSessions(tenantId) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        return sessionStore.getByTenant(tenantId);
+    }
+    /**
+     * Get all active sessions for a user.
+     *
+     * @param userId - The user ID
+     * @returns Array of session info
+     */
+    static async getUserSessions(userId) {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        return sessionStore.getByUser(userId);
+    }
+    /**
+     * Clean up all expired sessions.
+     *
+     * @returns Number of sessions cleaned up
+     */
+    static async cleanupExpiredSessions() {
+        if (!isInitialized) {
+            throw new Error('[SessionIsolation] Not initialized. Call init() first.');
+        }
+        const expiredBefore = new Date();
+        return sessionStore.cleanup(expiredBefore);
+    }
+    /**
+     * Get the current session timeout value.
+     *
+     * @returns Timeout in milliseconds
+     */
+    static getSessionTimeout() {
+        return options.sessionTimeout ?? 30 * 60 * 1000;
+    }
+    /**
+     * Check if session isolation is initialized.
+     *
+     * @returns True if initialized
+     */
+    static isReady() {
+        return isInitialized;
+    }
+}
+exports.SessionIsolation = SessionIsolation;
+// ==================== Decorator ====================
+/**
+ * Decorator to apply tenant isolation to a model.
+ *
+ *   @TenantIsolation({ tenantId: 'tenantId', auditEnabled: true })
+ *   class Document extends Model {
+ *     tenantId: string;
+ *     title: string;
+ *   }
+ *
+ * @param options - Tenant isolation options
+ */
+function TenantIsolation(options) {
+    return function (target) {
+        // Store decorator metadata on the model
+        Reflect.defineMetadata(TENANT_CONTEXT_KEY, options, target);
+        // Add tenant context to query hooks if model has beforeFind
+        if (target.prototype?.beforeFind) {
+            target.addHook('beforeFind', 'orm:tenantFilter', (opts) => {
+                const ctx = SessionIsolation.getTenant();
+                if (!ctx)
+                    return;
+                // Add tenant filter to where clause
+                const tenantField = options.tenantId;
+                if (tenantField && ctx.tenantId) {
+                    opts.where = opts.where
+                        ? { [operators_1.Op.and]: [opts.where, { [tenantField]: ctx.tenantId }] }
+                        : { [tenantField]: ctx.tenantId };
+                }
+                // Add role check if required
+                if (options.requiredRoles?.length) {
+                    const userRoles = ctx.roles ?? [];
+                    const hasRequiredRole = options.requiredRoles.some((r) => userRoles.includes(r));
+                    if (!hasRequiredRole) {
+                        throw new Error(`Access denied. Required roles: ${options.requiredRoles.join(', ')}`);
+                    }
+                }
+            });
+        }
+    };
+}
+/**
+ * Get tenant isolation options from a decorated model.
+ *
+ * @param model - The model class
+ * @returns The decorator options, or undefined if not decorated
+ */
+function getTenantIsolationOptions(model) {
+    return Reflect.getMetadata(TENANT_CONTEXT_KEY, model);
+}
+// ==================== Middleware Integration ====================
+/**
+ * Express/Koa middleware to automatically set tenant context from request.
+ *
+ *   app.use(authMiddleware);           // sets req.user
+ *   app.use(sessionIsolationMiddleware);
+ *
+ * @param options - Middleware options
+ */
+function sessionIsolationMiddleware(req, res, next) {
+    if (!isInitialized) {
+        console.warn('[SessionIsolation] Not initialized. Call init() first.');
+        next();
+        return;
+    }
+    // Try to get tenant info from request (e.g., from auth middleware)
+    const tenantId = req.tenantId ?? req.user?.tenantId ?? req.headers['x-tenant-id'];
+    const sessionId = req.sessionId ?? req.headers['x-session-id'];
+    const userId = req.user?.id ?? req.userId;
+    if (tenantId) {
+        const ctx = {
+            tenantId,
+            sessionId,
+            userId,
+            roles: req.user?.roles ?? [],
+            metadata: {
+                ipAddress: req.ip ?? req.connection?.remoteAddress,
+                userAgent: req.headers['user-agent'],
+            },
+        };
+        // Wrap the downstream middleware/handler chain in the ALS context so
+        // the tenant context actually propagates to whatever `next()`
+        // triggers (including further async work), rather than being
+        // set-and-discarded before the real request handling runs.
+        tenantContextStore.run(ctx, next);
+        return;
+    }
+    next();
+}
+/**
+ * Get tenant-aware audit metadata for the current context.
+ * Use this to include tenant information in audit logs.
+ *
+ * @returns Audit metadata object
+ */
+function getTenantAuditMetadata() {
+    const ctx = SessionIsolation.getTenant();
+    if (!ctx) {
+        return {};
+    }
+    return {
+        tenantId: ctx.tenantId,
+        sessionId: ctx.sessionId,
+        userId: ctx.userId,
+        roles: ctx.roles,
+        timestamp: new Date().toISOString(),
+    };
+}
+// ==================== Class Export ====================
+exports.TenantIsolationManager = {
+    init: SessionIsolation.init,
+    reset: SessionIsolation.reset,
+    setTenant: SessionIsolation.setTenant,
+    getTenant: SessionIsolation.getTenant,
+    clearTenant: SessionIsolation.clearTenant,
+    runInTenant: SessionIsolation.runInTenant,
+    registerTenantKey: SessionIsolation.registerTenantKey,
+    getTenantKey: SessionIsolation.getTenantKey,
+    validateSession: SessionIsolation.validateSession,
+    expireSession: SessionIsolation.expireSession,
+    createSession: SessionIsolation.createSession,
+    getTenantSessions: SessionIsolation.getTenantSessions,
+    getUserSessions: SessionIsolation.getUserSessions,
+    cleanupExpiredSessions: SessionIsolation.cleanupExpiredSessions,
+    getSessionTimeout: SessionIsolation.getSessionTimeout,
+    isReady: SessionIsolation.isReady,
+};

package/dist/compliance/tls-enforcer.js

@@ -0,0 +1,108 @@
+"use strict";
+/**
+ * TLSEnforcer
+ *
+ * Validates and enforces TLS/SSL on database connections at startup.
+ * Throws a descriptive error if the connection is not encrypted,
+ * preventing insecure deployments from reaching production.
+ *
+ * Covers ~54 compliance frameworks including:
+ *   GDPR Art 32, HIPAA, PCI DSS, NIST SP 800-53, FedRAMP, SOC 2,
+ *   ISO 27001, NYDFS 23 NYCRR 500, HITRUST, NIS2, DORA, and more.
+ *
+ * Usage:
+ *   const prorm = new Prorm({ ... });
+ *   TLSEnforcer.enforce(prorm);                       // strict
+ *   TLSEnforcer.enforce(prorm, { mode: 'warn' });     // log only
+ *   TLSEnforcer.enforce(prorm, { allowLocal: true }); // skip for localhost
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TLSEnforcer = void 0;
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
+function isLocalHost(host) {
+    return LOCAL_HOSTS.has((host ?? '').toLowerCase());
+}
+function extractConnectionOptions(prorm) {
+    const opts = prorm?.options ?? prorm?.config ?? {};
+    return {
+        dialect: opts.dialect ?? 'unknown',
+        host: opts.host,
+        dialectOptions: opts.dialectOptions ?? {},
+    };
+}
+/**
+ * Determine whether the connection options specify TLS/SSL.
+ */
+function hasTLSConfigured(dialect, dialectOptions) {
+    // PostgreSQL / MariaDB / MySQL: ssl option in dialectOptions
+    if (dialectOptions?.ssl)
+        return true;
+    // MSSQL: encrypt in dialectOptions.options
+    if (dialectOptions?.options?.encrypt === true)
+        return true;
+    return false;
+}
+class TLSEnforcer {
+    /**
+     * Enforce TLS on the given Prorm instance.
+     * Call immediately after constructing the Prorm instance.
+     *
+     * @param prorm - The Prorm instance to inspect
+     * @param options   - Enforcement mode and options
+     */
+    static enforce(prorm, options = {}) {
+        const { mode = 'strict', allowLocal = false, logger = console.warn } = options;
+        if (mode === 'off')
+            return;
+        const { dialect, host, dialectOptions } = extractConnectionOptions(prorm);
+        if (allowLocal && isLocalHost(host))
+            return;
+        const tlsOk = hasTLSConfigured(dialect, dialectOptions);
+        if (!tlsOk) {
+            const message = `[TLSEnforcer] Database connection to "${host ?? 'unknown'}" (dialect: ${dialect}) ` +
+                `does not have SSL/TLS configured. ` +
+                `Set dialectOptions.ssl (PostgreSQL/MySQL/MariaDB) or dialectOptions.options.encrypt=true (MSSQL). ` +
+                `This is required by GDPR Art 32, HIPAA §164.312(e), PCI DSS Req 4, and many other frameworks.`;
+            if (mode === 'strict') {
+                throw new Error(message);
+            }
+            else {
+                logger(message);
+            }
+        }
+    }
+    /**
+     * Return recommended SSL dialectOptions for a given dialect.
+     * Use this as a starting point when configuring your connection.
+     */
+    static recommendedOptions(dialect, options = {}) {
+        const { rejectUnauthorized = true, ca } = options;
+        switch (dialect) {
+            case 'postgres':
+                return {
+                    ssl: {
+                        require: true,
+                        rejectUnauthorized,
+                        ...(ca ? { ca } : {}),
+                    },
+                };
+            case 'mysql':
+            case 'mariadb':
+                return {
+                    ssl: {
+                        require: true,
+                        rejectUnauthorized,
+                        ...(ca ? { ca } : {}),
+                    },
+                };
+            case 'mssql':
+                return {
+                    options: {
+                        encrypt: true,
+                        trustServerCertificate: !rejectUnauthorized,
+                    },
+                };
+        }
+    }
+}
+exports.TLSEnforcer = TLSEnforcer;