whale-code 6.5.7 → 6.5.9

package/dist/server/handlers/enrichment.js

@@ -1,6 +1,4 @@
-// server/handlers/enrichment.ts — Customer enrichment, breach checking, and data protection CRUD
-// Integrates with PDL (Person Enrichment), Bright Data (LinkedIn), HIBP (Breach Check),
-// DeHashed, and xonPlus (real-time breach monitoring).
+// server/handlers/enrichment.ts — Customer enrichment via PDL and Bright Data LinkedIn.
 // All external API keys are fetched via decrypt_secret RPC from encrypted store secrets.
 
 // ---- Helpers ----
@@ -264,270 +262,6 @@ export async function handleEnrichment(sb, args, storeId) {
         }
       }
 
-    // ---- CHECK_XONPLUS: xonPlus real-time breach monitoring ----
-    case "check_xonplus":
-      {
-        const customerId = args.customer_id;
-        const email = args.email;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        if (!email) return {
-          success: false,
-          error: "email is required"
-        };
-        const apiKey = await getSecret(sb, "xonplus_api_key", sid);
-        if (!apiKey) return {
-          success: false,
-          error: "xonPlus API key not configured. Add 'xonplus_api_key' to store secrets."
-        };
-        try {
-          const resp = await fetch(`https://api.xposedornot.com/v1/check-email/${encodeURIComponent(email)}`, {
-            method: "GET",
-            headers: {
-              "x-api-key": apiKey,
-              Accept: "application/json"
-            }
-          });
-          if (!resp.ok) {
-            const text = await resp.text().catch(() => "");
-            if (resp.status === 404) {
-              return {
-                success: true,
-                data: {
-                  email,
-                  total_breaches: 0,
-                  breaches: []
-                }
-              };
-            }
-            return {
-              success: false,
-              error: `xonPlus API error ${resp.status}: ${text.substring(0, 500)}`
-            };
-          }
-          const xonData = await resp.json();
-          const breaches = xonData.breaches || xonData.ExposedBreaches?.breaches_details || [];
-
-          // Store each breach record
-          const inserted = [];
-          for (const breach of breaches) {
-            const record = {
-              customer_id: customerId,
-              store_id: sid,
-              breach_name: breach.breach || breach.name || "unknown",
-              breach_domain: breach.domain || null,
-              breach_date: breach.xposed_date || breach.date || null,
-              data_classes: breach.xposed_data ? breach.xposed_data.split(",").map(s => s.trim()) : null,
-              breach_source: "xonplus",
-              raw_data: breach,
-              discovered_at: nowISO(),
-              created_at: nowISO()
-            };
-
-            // Deduplicate by customer_id + breach_name + breach_source
-            const {
-              data: existing
-            } = await sb.from("customer_breach_records").select("id").eq("customer_id", customerId).eq("breach_name", record.breach_name).eq("breach_source", "xonplus").maybeSingle();
-            if (!existing) {
-              const {
-                data,
-                error
-              } = await sb.from("customer_breach_records").insert(record).select().single();
-              if (!error && data) inserted.push(data);
-            }
-          }
-          return {
-            success: true,
-            data: {
-              email,
-              total_breaches: breaches.length,
-              new_breaches: inserted.length,
-              risk_metrics: xonData.BreachMetrics || null,
-              breaches: inserted.length > 0 ? inserted : breaches
-            }
-          };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return {
-            success: false,
-            error: `xonPlus breach check failed: ${msg}`
-          };
-        }
-      }
-
-    // ---- CHECK_BREACHES: HIBP Breach Check ----
-    case "check_breaches":
-      {
-        const customerId = args.customer_id;
-        const email = args.email;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        if (!email) return {
-          success: false,
-          error: "email is required"
-        };
-        const apiKey = await getSecret(sb, "hibp_api_key", sid);
-        if (!apiKey) return {
-          success: false,
-          error: "HIBP API key not configured. Add 'hibp_api_key' to store secrets."
-        };
-        try {
-          const resp = await fetch(`https://haveibeenpwned.com/api/v3/breachedaccount/${encodeURIComponent(email)}?truncateResponse=false`, {
-            method: "GET",
-            headers: {
-              "hibp-api-key": apiKey,
-              "User-Agent": "WhaleTools-DataProtection",
-              Accept: "application/json"
-            }
-          });
-          let breaches = [];
-          if (resp.status === 404) {
-            // No breaches found — that's good
-            breaches = [];
-          } else if (!resp.ok) {
-            const text = await resp.text().catch(() => "");
-            return {
-              success: false,
-              error: `HIBP API error ${resp.status}: ${text.substring(0, 500)}`
-            };
-          } else {
-            breaches = await resp.json();
-          }
-
-          // Store each breach record
-          const inserted = [];
-          for (const breach of breaches) {
-            const record = {
-              customer_id: customerId,
-              store_id: sid,
-              breach_name: breach.Name,
-              breach_domain: breach.Domain,
-              breach_date: breach.BreachDate,
-              data_classes: breach.DataClasses,
-              description: breach.Description,
-              is_verified: breach.IsVerified,
-              breach_source: "hibp",
-              discovered_at: nowISO(),
-              created_at: nowISO()
-            };
-
-            // Upsert by customer_id + breach_name to avoid duplicates
-            const {
-              data: existing
-            } = await sb.from("customer_breach_records").select("id").eq("customer_id", customerId).eq("breach_name", breach.Name).maybeSingle();
-            if (!existing) {
-              const {
-                data,
-                error
-              } = await sb.from("customer_breach_records").insert(record).select().single();
-              if (!error && data) inserted.push(data);
-            }
-          }
-          return {
-            success: true,
-            data: {
-              email,
-              total_breaches: breaches.length,
-              new_breaches: inserted.length,
-              breaches: inserted.length > 0 ? inserted : breaches
-            }
-          };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return {
-            success: false,
-            error: `HIBP breach check failed: ${msg}`
-          };
-        }
-      }
-
-    // ---- CHECK_DEHASHED: DeHashed credential exposure search ----
-    case "check_dehashed":
-      {
-        const customerId = args.customer_id;
-        const email = args.email;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        if (!email) return {
-          success: false,
-          error: "email is required"
-        };
-        const apiKey = await getSecret(sb, "dehashed_api_key", sid);
-        if (!apiKey) return {
-          success: false,
-          error: "DeHashed API key not configured. Add 'dehashed_api_key' to store secrets."
-        };
-        try {
-          const resp = await fetch("https://api.dehashed.com/v2/search", {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "DeHashed-Api-Key": apiKey
-            },
-            body: JSON.stringify({
-              query: `email:"${email}"`,
-              page: 1,
-              size: 100,
-              wildcard: false,
-              regex: false,
-              de_dupe: true
-            })
-          });
-          if (!resp.ok) {
-            const text = await resp.text().catch(() => "");
-            return {
-              success: false,
-              error: `DeHashed API error ${resp.status}: ${text.substring(0, 500)}`
-            };
-          }
-          const result = await resp.json();
-          const entries = result.entries || [];
-
-          // Store each as a breach record with source=dehashed
-          const inserted = [];
-          for (const entry of entries) {
-            const record = {
-              customer_id: customerId,
-              store_id: sid,
-              breach_name: entry.database_name || "unknown",
-              breach_domain: entry.domain || null,
-              breach_date: entry.obtained_date || null,
-              data_classes: entry.type ? [entry.type] : null,
-              breach_source: "dehashed",
-              raw_data: entry,
-              discovered_at: nowISO(),
-              created_at: nowISO()
-            };
-            const {
-              data,
-              error
-            } = await sb.from("customer_breach_records").insert(record).select().single();
-            if (!error && data) inserted.push(data);
-          }
-          return {
-            success: true,
-            data: {
-              email,
-              total_results: entries.length,
-              stored: inserted.length,
-              entries: inserted
-            }
-          };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          return {
-            success: false,
-            error: `DeHashed check failed: ${msg}`
-          };
-        }
-      }
-
     // ---- GET_ENRICHMENT: Read enrichment profiles ----
     case "get_enrichment":
       {
@@ -557,364 +291,10 @@ export async function handleEnrichment(sb, args, storeId) {
           }
         };
       }
-
-    // ---- GET_BREACHES: Read breach records ----
-    case "get_breaches":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        let q = sb.from("customer_breach_records").select("*").eq("customer_id", customerId).eq("store_id", sid).order("discovered_at", {
-          ascending: false
-        });
-        if (args.source) q = q.eq("breach_source", args.source);
-        const limit = args.limit || 50;
-        q = q.limit(limit);
-        const {
-          data,
-          error
-        } = await q;
-        return error ? {
-          success: false,
-          error: error.message
-        } : {
-          success: true,
-          data: {
-            count: data?.length,
-            records: data
-          }
-        };
-      }
-
-    // ---- GET_EXPOSURES: Read broker exposures ----
-    case "get_exposures":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        let q = sb.from("customer_exposures").select("*").eq("customer_id", customerId).eq("store_id", sid).order("first_seen_at", {
-          ascending: false
-        });
-        if (args.status) q = q.eq("status", args.status);
-        if (args.source_name || args.broker) q = q.eq("source_name", args.source_name || args.broker);
-        const limit = args.limit || 50;
-        q = q.limit(limit);
-        const {
-          data,
-          error
-        } = await q;
-        return error ? {
-          success: false,
-          error: error.message
-        } : {
-          success: true,
-          data: {
-            count: data?.length,
-            records: data
-          }
-        };
-      }
-
-    // ---- GET_REMOVAL_STATUS: Read removal requests ----
-    case "get_removal_status":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        let q = sb.from("customer_removal_requests").select("*").eq("customer_id", customerId).eq("store_id", sid).order("created_at", {
-          ascending: false
-        });
-        if (args.status) q = q.eq("status", args.status);
-        const limit = args.limit || 50;
-        q = q.limit(limit);
-        const {
-          data,
-          error
-        } = await q;
-        return error ? {
-          success: false,
-          error: error.message
-        } : {
-          success: true,
-          data: {
-            count: data?.length,
-            records: data
-          }
-        };
-      }
-
-    // ---- GET_RISK_SCORE: Read latest risk score ----
-    case "get_risk_score":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        const {
-          data,
-          error
-        } = await sb.from("customer_risk_scores").select("*").eq("customer_id", customerId).eq("store_id", sid).order("calculated_at", {
-          ascending: false
-        }).limit(1).maybeSingle();
-        return error ? {
-          success: false,
-          error: error.message
-        } : {
-          success: true,
-          data
-        };
-      }
-
-    // ---- STORE_SCAN_RESULTS: Insert scan results ----
-    case "store_scan_results":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        const record = {
-          customer_id: customerId,
-          store_id: sid,
-          scan_type: args.scan_type || "discovery",
-          scan_data: args.scan_data || {},
-          broker_count: args.broker_count ?? 0,
-          exposure_count: args.exposure_count ?? 0,
-          status: args.status || "completed",
-          created_at: nowISO()
-        };
-        if (args.scan_id) record.scan_id = args.scan_id;
-        if (args.file_path) record.file_path = args.file_path;
-        const {
-          data,
-          error
-        } = await sb.from("customer_scan_results").insert(record).select().single();
-        return error ? {
-          success: false,
-          error: `Failed to store scan results: ${error.message}`
-        } : {
-          success: true,
-          data
-        };
-      }
-
-    // ---- STORE_EXPOSURE: Insert a broker exposure ----
-    case "store_exposure":
-      {
-        const customerId = args.customer_id;
-        const sourceName = args.source_name || args.broker;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        if (!sourceName) return {
-          success: false,
-          error: "source_name is required"
-        };
-
-        // Check for existing exposure to avoid duplicates
-        const {
-          data: existing
-        } = await sb.from("customer_exposures").select("id").eq("customer_id", customerId).eq("store_id", sid).eq("source_name", sourceName).maybeSingle();
-        if (existing) {
-          // Update existing record
-          const updates = {};
-          if (args.source_url) updates.source_url = args.source_url;
-          if (args.data_types_exposed) updates.data_types_exposed = args.data_types_exposed;
-          if (args.status) updates.status = args.status;
-          const {
-            data,
-            error
-          } = await sb.from("customer_exposures").update(updates).eq("id", existing.id).select().single();
-          return error ? {
-            success: false,
-            error: `Failed to update exposure: ${error.message}`
-          } : {
-            success: true,
-            data: {
-              ...data,
-              _note: "Updated existing exposure record"
-            }
-          };
-        }
-        const record = {
-          customer_id: customerId,
-          store_id: sid,
-          source_name: sourceName,
-          source_type: args.source_type || "data_broker",
-          status: args.status || "found",
-          first_seen_at: nowISO(),
-          created_at: nowISO()
-        };
-        if (args.source_url) record.source_url = args.source_url;
-        if (args.data_types_exposed) record.data_types_exposed = args.data_types_exposed;
-        if (args.scan_id) record.scan_id = args.scan_id;
-        const {
-          data,
-          error
-        } = await sb.from("customer_exposures").insert(record).select().single();
-        return error ? {
-          success: false,
-          error: `Failed to store exposure: ${error.message}`
-        } : {
-          success: true,
-          data
-        };
-      }
-
-    // ---- UPDATE_EXPOSURE_STATUS: Update exposure status ----
-    case "update_exposure_status":
-      {
-        const exposureId = args.exposure_id;
-        if (!exposureId) return {
-          success: false,
-          error: "exposure_id is required"
-        };
-        const updates = {};
-        if (args.status) updates.status = args.status;
-        if (args.status === "removed") {
-          updates.removed_at = nowISO();
-        }
-        const {
-          data,
-          error
-        } = await sb.from("customer_exposures").update(updates).eq("id", exposureId).eq("store_id", sid).select().single();
-        return error ? {
-          success: false,
-          error: `Failed to update exposure: ${error.message}`
-        } : {
-          success: true,
-          data
-        };
-      }
-
-    // ---- STORE_REMOVAL_REQUEST: Insert a removal request ----
-    case "store_removal_request":
-      {
-        const customerId = args.customer_id;
-        const brokerName = args.broker_name || args.source_name || args.broker;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-        if (!brokerName) return {
-          success: false,
-          error: "source_name is required"
-        };
-        const record = {
-          customer_id: customerId,
-          store_id: sid,
-          broker_name: brokerName,
-          removal_method: args.removal_method || args.method || "manual",
-          status: args.status || "pending",
-          created_at: nowISO(),
-          updated_at: nowISO()
-        };
-        if (args.exposure_id) record.exposure_id = args.exposure_id;
-        if (args.request_data) record.request_data = args.request_data;
-        if (args.submitted_at) record.submitted_at = args.submitted_at;
-        if (args.confirmation_id) record.confirmation_id = args.confirmation_id;
-        const {
-          data,
-          error
-        } = await sb.from("customer_removal_requests").insert(record).select().single();
-        return error ? {
-          success: false,
-          error: `Failed to store removal request: ${error.message}`
-        } : {
-          success: true,
-          data
-        };
-      }
-
-    // ---- CALCULATE_RISK_SCORE: Compute and store a risk score ----
-    case "calculate_risk_score":
-      {
-        const customerId = args.customer_id;
-        if (!customerId) return {
-          success: false,
-          error: "customer_id is required"
-        };
-
-        // Gather data for risk calculation
-        const [exposuresResult, breachesResult, removalsResult] = await Promise.all([sb.from("customer_exposures").select("id, source_name, status").eq("customer_id", customerId).eq("store_id", sid), sb.from("customer_breach_records").select("id, breach_name, data_classes, is_verified").eq("customer_id", customerId).eq("store_id", sid), sb.from("customer_removal_requests").select("id, status, broker_name").eq("customer_id", customerId).eq("store_id", sid)]);
-        const exposures = exposuresResult.data || [];
-        const breaches = breachesResult.data || [];
-        const removals = removalsResult.data || [];
-
-        // Score calculation:
-        // - Each active exposure: +10 points
-        // - Each removed exposure: -5 points (still contributes slightly)
-        // - Each breach: +15 points
-        // - Each sensitive breach: +25 points (instead of 15)
-        // - Each verified breach: +5 bonus
-        // - Each completed removal: -8 points
-        // - Base floor: 0, cap: 100
-
-        let score = 0;
-
-        // Exposure scoring
-        const activeExposures = exposures.filter(e => e.status !== "removed");
-        const removedExposures = exposures.filter(e => e.status === "removed");
-        score += activeExposures.length * 10;
-        score += removedExposures.length * 2;
-
-        // Breach scoring
-        for (const breach of breaches) {
-          score += 15;
-          if (breach.is_verified) {
-            score += 5;
-          }
-        }
-
-        // Removal credit
-        const completedRemovals = removals.filter(r => r.status === "completed" || r.status === "confirmed");
-        score -= completedRemovals.length * 8;
-
-        // Clamp to 0-100
-        score = Math.max(0, Math.min(100, score));
-
-        // Determine risk level
-        let riskLevel;
-        if (score >= 75) riskLevel = "critical";else if (score >= 50) riskLevel = "high";else if (score >= 25) riskLevel = "medium";else riskLevel = "low";
-        const riskRecord = {
-          customer_id: customerId,
-          store_id: sid,
-          overall_score: score,
-          risk_level: riskLevel,
-          factors: {
-            active_exposures: activeExposures.length,
-            removed_exposures: removedExposures.length,
-            total_breaches: breaches.length,
-            completed_removals: completedRemovals.length,
-            pending_removals: removals.filter(r => r.status === "pending").length
-          },
-          calculated_at: nowISO(),
-          created_at: nowISO()
-        };
-        const {
-          data,
-          error
-        } = await sb.from("customer_risk_scores").insert(riskRecord).select().single();
-        return error ? {
-          success: false,
-          error: `Failed to store risk score: ${error.message}`
-        } : {
-          success: true,
-          data
-        };
-      }
     default:
       return {
         success: false,
-        error: `Unknown enrichment action: ${action}. Valid: enrich_person, enrich_linkedin, check_breaches, check_dehashed, check_xonplus, get_enrichment, get_breaches, get_exposures, get_removal_status, get_risk_score, store_scan_results, store_exposure, update_exposure_status, store_removal_request, calculate_risk_score`
+        error: `Unknown enrichment action: ${action}. Valid: enrich_person, enrich_linkedin, get_enrichment`
       };
   }
 }