ts-prorm-orm 1.1.0

package/dist/compliance/breach-detector.js

@@ -0,0 +1,505 @@
+"use strict";
+/**
+ * BreachDetector
+ *
+ * A comprehensive breach detection and monitoring system for identifying
+ * unusual access patterns, mass exports, failed authentication attempts,
+ * and suspicious query patterns.
+ *
+ * Required for compliance with:
+ *   - NIST CSF (PR.AC-1, PR.AC-2, PR.DS-5)
+ *   - CIS Controls (CIS 3.4, 8.2, 8.5)
+ *   - MITRE ATT&CK (TA0001, TA0009, TA0010)
+ *
+ * Usage:
+ *   // Initialize breach detection
+ *   const detector = BreachDetector.create(prorm, {
+ *     alertCallback: (alert) => securityTeam.notify(alert),
+ *     massExportThreshold: 1000,
+ *     rateLimitWindow: 60000,
+ *     rateLimitMax: 100,
+ *   });
+ *
+ *   // Start monitoring
+ *   await detector.start();
+ *
+ *   // Query alerts and stats
+ *   const alerts = detector.getAlerts();
+ *   const stats = detector.getStats();
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BreachDetector = void 0;
+exports.getGlobalBreachDetector = getGlobalBreachDetector;
+exports.initBreachDetector = initBreachDetector;
+// ==================== Suspicious Query Patterns ====================
+const SUSPICIOUS_PATTERNS = [
+    /(\bunion\b.*\bselect\b)/i,
+    /(\bselect\b.*\bfrom\b.*\bwhere\b)/i,
+    /(exec\s*\()/i,
+    /(execute\s*\()/i,
+    /(load_file\s*\()/i,
+    /(into\s+outfile)/i,
+    /(concat\s*\()/i,
+    /(substring\s*\()/i,
+    /(sleep\s*\()/i,
+    /(waitfor\s+delay)/i,
+    /(0x[0-9a-f]+)/i,
+    /(\bor\b.*\b1\s*=\s*1)/i,
+    /('\s*or\s*'1'\s*=\s*'1)/i,
+    /(\/\*.*\*\/)/,
+    /(--\s*)/,
+    /(char\s*\(\s*\d+)/,
+];
+// ==================== BreachDetector Class ====================
+class BreachDetector {
+    constructor(prorm, options) {
+        this.alerts = [];
+        this.isRunning = false;
+        this.originalQuery = null;
+        this.queryTimestamps = new Map();
+        this.failedAuthAttempts = new Map();
+        this.accessPatterns = new Map();
+        this.stats = {
+            totalQueries: 0,
+            massExportAlerts: 0,
+            failedAuthAlerts: 0,
+            rateLimitAlerts: 0,
+            unusualTimeAlerts: 0,
+            suspiciousPatternAlerts: 0,
+            bulkDownloadAlerts: 0,
+        };
+        this.prorm = prorm;
+        this.options = {
+            alertCallback: options.alertCallback ?? (() => { }),
+            massExportThreshold: options.massExportThreshold ?? 1000,
+            rateLimitWindow: options.rateLimitWindow ?? 60000,
+            rateLimitMax: options.rateLimitMax ?? 100,
+            failedAuthThreshold: options.failedAuthThreshold ?? 5,
+            failedAuthWindow: options.failedAuthWindow ?? 300000,
+            detectUnusualAccessTime: options.detectUnusualAccessTime ?? true,
+            allowedHours: options.allowedHours ?? [8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18],
+            detectSuspiciousPatterns: options.detectSuspiciousPatterns ?? true,
+            maxAlerts: options.maxAlerts ?? 1000,
+            minAlertSeverity: options.minAlertSeverity ?? 'medium',
+            customPatterns: options.customPatterns ?? [],
+            trackByUser: options.trackByUser ?? true,
+            trackByIP: options.trackByIP ?? true,
+        };
+        this.startTime = new Date();
+    }
+    // ==================== Factory Method ====================
+    /**
+     * Create a new BreachDetector instance
+     */
+    static create(prorm, options = {}) {
+        return new BreachDetector(prorm, options);
+    }
+    // ==================== Lifecycle ====================
+    /**
+     * Start monitoring queries for breaches
+     */
+    async start() {
+        if (this.isRunning)
+            return;
+        this.isRunning = true;
+        // Hook into Prorm query method
+        this.originalQuery = this.prorm.query;
+        this.prorm.query = async (...args) => {
+            const startTime = Date.now();
+            const query = typeof args[0] === 'string' ? args[0] : args[0]?.sql ?? '';
+            const queryOptions = args[1];
+            try {
+                const result = await this.originalQuery.apply(this.prorm, args);
+                const duration = Date.now() - startTime;
+                this.stats.totalQueries++;
+                this.analyzeQuery(query, queryOptions, duration, result?.length ?? result?.rows?.length ?? 0);
+                return result;
+            }
+            catch (error) {
+                this.analyzeError(query, queryOptions, error);
+                throw error;
+            }
+        };
+        // Setup model hooks for bulk operations
+        this.setupBulkOperationHooks();
+    }
+    /**
+     * Stop monitoring
+     */
+    stop() {
+        if (!this.isRunning)
+            return;
+        this.isRunning = false;
+        if (this.originalQuery) {
+            this.prorm.query = this.originalQuery;
+            this.originalQuery = null;
+        }
+    }
+    /**
+     * Setup hooks for bulk operation monitoring
+     */
+    setupBulkOperationHooks() {
+        const models = this.prorm.getModels?.() ?? [];
+        for (const [, Model] of models) {
+            // Monitor bulk create operations
+            Model.hook('beforeBulkCreate', 'breachDetector:bulkCreate', (instances) => {
+                this.checkBulkOperation(instances.length, Model.name, 'create');
+            });
+            // Monitor bulk update operations
+            Model.hook('beforeBulkUpdate', 'breachDetector:bulkUpdate', (opts) => {
+                const count = opts.limit ?? 'all';
+                this.checkBulkOperation(typeof count === 'number' ? count : 1000, Model.name, 'update');
+            });
+            // Monitor bulk destroy operations
+            Model.hook('beforeBulkDestroy', 'breachDetector:bulkDestroy', (opts) => {
+                this.checkBulkOperation(opts.limit ?? 1000, Model.name, 'delete');
+            });
+        }
+    }
+    // ==================== Analysis Methods ====================
+    /**
+     * Analyze a query for breach patterns
+     */
+    analyzeQuery(query, queryOptions, duration, recordsAffected) {
+        const userId = queryOptions?.__userId;
+        const ipAddress = queryOptions?.__ipAddress;
+        // Check for mass export
+        if (recordsAffected > this.options.massExportThreshold) {
+            this.addAlert({
+                severity: 'high',
+                category: 'mass_export',
+                message: `Mass export detected: ${recordsAffected} records exported in single query`,
+                details: {
+                    recordsAffected,
+                    threshold: this.options.massExportThreshold,
+                    duration,
+                },
+                userId,
+                ipAddress,
+                query,
+            });
+            this.stats.massExportAlerts++;
+        }
+        // Check for bulk download
+        if (query.toUpperCase().includes('SELECT') && recordsAffected > 100) {
+            this.addAlert({
+                severity: 'medium',
+                category: 'bulk_download',
+                message: `Bulk download detected: ${recordsAffected} records requested`,
+                details: {
+                    recordsAffected,
+                    duration,
+                },
+                userId,
+                ipAddress,
+                query,
+            });
+            this.stats.bulkDownloadAlerts++;
+        }
+        // Rate limiting per user/IP
+        this.checkRateLimit(userId, ipAddress);
+        // Unusual access time detection
+        if (this.options.detectUnusualAccessTime) {
+            this.checkUnusualAccessTime(userId, ipAddress);
+        }
+        // Suspicious query pattern detection
+        if (this.options.detectSuspiciousPatterns) {
+            this.checkSuspiciousPatterns(query, userId, ipAddress);
+        }
+    }
+    /**
+     * Analyze errors for security events
+     */
+    analyzeError(query, queryOptions, error) {
+        const userId = queryOptions?.__userId;
+        const ipAddress = queryOptions?.__ipAddress;
+        const message = error?.message ?? '';
+        // Detect failed authentication
+        if (message.includes('authentication') ||
+            message.includes('login') ||
+            message.includes('password') ||
+            message.includes('credential')) {
+            this.trackFailedAuth(userId, ipAddress);
+        }
+        // Access denied patterns
+        if (message.includes('permission denied') || message.includes('access denied')) {
+            this.addAlert({
+                severity: 'high',
+                category: 'failed_auth',
+                message: 'Access denied detected',
+                details: { error: message.substring(0, 200) },
+                userId,
+                ipAddress,
+                query,
+            });
+            this.stats.failedAuthAlerts++;
+        }
+    }
+    /**
+     * Check for bulk operations
+     */
+    checkBulkOperation(count, modelName, operation) {
+        if (count > this.options.massExportThreshold) {
+            this.addAlert({
+                severity: 'high',
+                category: 'mass_export',
+                message: `Bulk ${operation} operation detected on ${modelName}: ${count} records`,
+                details: {
+                    count,
+                    model: modelName,
+                    operation,
+                    threshold: this.options.massExportThreshold,
+                },
+            });
+            this.stats.massExportAlerts++;
+        }
+    }
+    /**
+     * Check rate limiting
+     */
+    checkRateLimit(userId, ipAddress) {
+        const key = this.getIdentifierKey(userId, ipAddress);
+        const now = Date.now();
+        let records = this.queryTimestamps.get(key) ?? [];
+        const windowStart = now - this.options.rateLimitWindow;
+        // Filter to current window
+        records = records.filter(r => r.timestamp > windowStart);
+        if (records.length >= this.options.rateLimitMax) {
+            this.addAlert({
+                severity: 'critical',
+                category: 'rate_limit_exceeded',
+                message: `Rate limit exceeded for ${key}: ${records.length} queries in ${this.options.rateLimitWindow}ms`,
+                details: {
+                    queryCount: records.length,
+                    windowMs: this.options.rateLimitWindow,
+                    maxAllowed: this.options.rateLimitMax,
+                },
+                userId,
+                ipAddress,
+            });
+            this.stats.rateLimitAlerts++;
+        }
+        // Add current query
+        records.push({ timestamp: now, count: 1, userId, ipAddress });
+        this.queryTimestamps.set(key, records);
+    }
+    /**
+     * Check for unusual access time
+     */
+    checkUnusualAccessTime(userId, ipAddress) {
+        const hour = new Date().getHours();
+        if (!this.options.allowedHours.includes(hour)) {
+            this.addAlert({
+                severity: 'medium',
+                category: 'unusual_access_time',
+                message: `Unusual access time detected: ${hour}:00 hours`,
+                details: {
+                    hour,
+                    allowedHours: this.options.allowedHours,
+                },
+                userId,
+                ipAddress,
+            });
+            this.stats.unusualTimeAlerts++;
+        }
+    }
+    /**
+     * Check for suspicious query patterns
+     */
+    checkSuspiciousPatterns(query, userId, ipAddress) {
+        const allPatterns = [...SUSPICIOUS_PATTERNS, ...this.options.customPatterns];
+        for (const pattern of allPatterns) {
+            if (pattern.test(query)) {
+                this.addAlert({
+                    severity: 'high',
+                    category: 'suspicious_query_pattern',
+                    message: `Suspicious query pattern detected: ${pattern.source}`,
+                    details: {
+                        pattern: pattern.source,
+                    },
+                    userId,
+                    ipAddress,
+                    query,
+                });
+                this.stats.suspiciousPatternAlerts++;
+                break;
+            }
+        }
+    }
+    /**
+     * Track failed authentication attempts
+     */
+    trackFailedAuth(userId, ipAddress) {
+        const key = this.getIdentifierKey(userId, ipAddress);
+        const now = Date.now();
+        const windowStart = now - this.options.failedAuthWindow;
+        let attempts = this.failedAuthAttempts.get(key) ?? [];
+        attempts = attempts.filter(t => t > windowStart);
+        if (attempts.length >= this.options.failedAuthThreshold) {
+            this.addAlert({
+                severity: 'critical',
+                category: 'failed_auth',
+                message: `Multiple failed authentication attempts: ${attempts.length} attempts`,
+                details: {
+                    attemptCount: attempts.length,
+                    windowMs: this.options.failedAuthWindow,
+                    threshold: this.options.failedAuthThreshold,
+                },
+                userId,
+                ipAddress,
+            });
+            this.stats.failedAuthAlerts++;
+        }
+        attempts.push(now);
+        this.failedAuthAttempts.set(key, attempts);
+    }
+    /**
+     * Get identifier key for rate limiting
+     */
+    getIdentifierKey(userId, ipAddress) {
+        if (userId && this.options.trackByUser)
+            return `user:${userId}`;
+        if (ipAddress && this.options.trackByIP)
+            return `ip:${ipAddress}`;
+        return 'anonymous';
+    }
+    // ==================== Alert Management ====================
+    /**
+     * Add an alert
+     */
+    addAlert(alert) {
+        const fullAlert = {
+            ...alert,
+            id: `breach-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+            timestamp: new Date(),
+        };
+        this.alerts.push(fullAlert);
+        // Trim old alerts
+        if (this.alerts.length > this.options.maxAlerts) {
+            this.alerts = this.alerts.slice(-this.options.maxAlerts);
+        }
+        // Trigger callback if severity meets threshold
+        if (this.shouldTriggerCallback(fullAlert.severity)) {
+            this.options.alertCallback(fullAlert);
+        }
+    }
+    /**
+     * Check if alert severity meets callback threshold
+     */
+    shouldTriggerCallback(severity) {
+        const severityOrder = ['low', 'medium', 'high', 'critical'];
+        return severityOrder.indexOf(severity) >= severityOrder.indexOf(this.options.minAlertSeverity);
+    }
+    // ==================== Public API ====================
+    /**
+     * Get all breach alerts
+     */
+    getAlerts(options) {
+        let filtered = [...this.alerts];
+        if (options?.severity) {
+            filtered = filtered.filter(a => a.severity === options.severity);
+        }
+        if (options?.category) {
+            filtered = filtered.filter(a => a.category === options.category);
+        }
+        if (options?.limit) {
+            filtered = filtered.slice(-options.limit);
+        }
+        return filtered;
+    }
+    /**
+     * Get detection statistics
+     */
+    getStats() {
+        const alertsBySeverity = {
+            low: 0,
+            medium: 0,
+            high: 0,
+            critical: 0,
+        };
+        const alertsByCategory = {
+            mass_export: 0,
+            failed_auth: 0,
+            unusual_access_time: 0,
+            rate_limit_exceeded: 0,
+            suspicious_query_pattern: 0,
+            bulk_download: 0,
+        };
+        for (const alert of this.alerts) {
+            alertsBySeverity[alert.severity]++;
+            alertsByCategory[alert.category]++;
+        }
+        return {
+            uptime: Date.now() - this.startTime.getTime(),
+            totalQueries: this.stats.totalQueries,
+            totalAlerts: this.alerts.length,
+            massExportAlerts: this.stats.massExportAlerts,
+            failedAuthAlerts: this.stats.failedAuthAlerts,
+            rateLimitAlerts: this.stats.rateLimitAlerts,
+            unusualTimeAlerts: this.stats.unusualTimeAlerts,
+            suspiciousPatternAlerts: this.stats.suspiciousPatternAlerts,
+            bulkDownloadAlerts: this.stats.bulkDownloadAlerts,
+            alertsBySeverity,
+            alertsByCategory,
+        };
+    }
+    /**
+     * Clear all alerts
+     */
+    clearAlerts() {
+        this.alerts = [];
+    }
+    /**
+     * Check if monitoring is active
+     */
+    isActive() {
+        return this.isRunning;
+    }
+    /**
+     * Manually trigger an alert (for custom checks)
+     */
+    alert(options) {
+        this.addAlert(options);
+    }
+    /**
+     * Record a query execution (for external tracking)
+     */
+    recordQuery(userId, ipAddress, recordsAffected) {
+        this.stats.totalQueries++;
+        const key = this.getIdentifierKey(userId, ipAddress);
+        this.checkRateLimit(userId, ipAddress);
+        if (recordsAffected && recordsAffected > this.options.massExportThreshold) {
+            this.addAlert({
+                severity: 'high',
+                category: 'mass_export',
+                message: `Mass export detected: ${recordsAffected} records`,
+                details: { recordsAffected, threshold: this.options.massExportThreshold },
+                userId,
+                ipAddress,
+            });
+            this.stats.massExportAlerts++;
+        }
+    }
+    /**
+     * Record authentication failure
+     */
+    recordAuthFailure(userId, ipAddress) {
+        this.trackFailedAuth(userId, ipAddress);
+    }
+}
+exports.BreachDetector = BreachDetector;
+// ==================== Global Instance ====================
+let globalDetector = null;
+/**
+ * Get the global BreachDetector instance
+ */
+function getGlobalBreachDetector() {
+    return globalDetector;
+}
+/**
+ * Initialize the global BreachDetector instance
+ */
+function initBreachDetector(prorm, options) {
+    globalDetector = BreachDetector.create(prorm, options);
+    return globalDetector;
+}