xypriss 1.0.1 → 1.1.0

package/dist/esm/mods/security/src/core/password/password-core.js

@@ -0,0 +1,292 @@
+import { SecureRandom } from '../random/random-core.js';
+import '../random/random-types.js';
+import 'crypto';
+import '../random/random-sources.js';
+import 'nehonix-uri-processor';
+import '../../utils/memory/index.js';
+import '../../types.js';
+import '../hash/hash-core.js';
+import '../hash/hash-types.js';
+import '../hash/hash-security.js';
+import '../hash/hash-advanced.js';
+import '../../algorithms/hash-algorithms.js';
+import 'argon2';
+import 'child_process';
+import { secureWipe } from '../../components/secure-memory.js';
+import 'https';
+import '../../components/runtime-verification.js';
+import '../../components/tamper-evident-logging.js';
+import { PasswordAlgorithm, PasswordSecurityLevel } from './password-types.js';
+import { PasswordAlgorithms } from './password-algorithms.js';
+import { PasswordSecurity } from './password-security.js';
+import { PasswordMigration } from './password-migration.js';
+import { PasswordGenerator } from './password-generator.js';
+import { PasswordUtils } from './password-utils.js';
+
+/**
+ * PasswordManager - Core Password Management Class
+ *
+ * A modular, military-grade password management system
+ * Short name: PasswordManager (instead of SecurePasswordManager)
+ */
+/**
+ * @author Supper Coder
+ *  PasswordManager
+ *
+ * Main class for secure password management with modular architecture
+ */
+class PasswordManager {
+    constructor(config) {
+        this.config = {
+            defaultAlgorithm: PasswordAlgorithm.ARGON2ID,
+            defaultSecurityLevel: PasswordSecurityLevel.HIGH,
+            timingSafeVerification: true,
+            secureMemoryWipe: true,
+            enableMigration: true,
+            ...config,
+        };
+        // Initialize modular components
+        this.algorithms = new PasswordAlgorithms(this.config);
+        this.security = new PasswordSecurity(this.config);
+        this.migration = new PasswordMigration(this.config);
+        this.generator = new PasswordGenerator(this.config);
+        this.utils = new PasswordUtils(this.config);
+    }
+    /**
+     * Get singleton instance
+     */
+    static getInstance(config) {
+        if (!PasswordManager.instance) {
+            PasswordManager.instance = new PasswordManager(config);
+        }
+        return PasswordManager.instance;
+    }
+    /**
+     * Create a new instance (for multiple configurations)
+     */
+    static create(config) {
+        return new PasswordManager(config);
+    }
+    /**
+     * Hash a password with advanced security
+     */
+    async hash(password, options = {}) {
+        // Input validation
+        if (!password || password.length === 0) {
+            throw new Error("Password cannot be empty");
+        }
+        const opts = this.mergeOptions(options);
+        try {
+            // Apply pepper if configured
+            const processedPassword = this.applyPepper(password);
+            // Generate salt
+            const salt = SecureRandom.generateSalt(opts.saltLength);
+            // Hash using selected algorithm
+            const hash = await this.algorithms.hash(processedPassword, salt, opts);
+            // Create metadata
+            const metadata = this.createMetadata(opts);
+            // Combine hash with metadata
+            const result = this.utils.combineHashWithMetadata(hash, salt, metadata);
+            // Encrypt if encryption key is available
+            if (this.config.encryptionKey &&
+                opts.securityLevel !== PasswordSecurityLevel.STANDARD) {
+                return await this.utils.encryptPasswordHash(result, this.config.encryptionKey);
+            }
+            return result;
+        }
+        finally {
+            // Secure cleanup
+            if (opts.secureWipe) {
+                secureWipe(Buffer.from(password));
+            }
+        }
+    }
+    /**
+     * Verify a password against a hash
+     */
+    async verify(password, hash) {
+        const startTime = Date.now();
+        try {
+            // Decrypt hash if needed
+            let actualHash = hash;
+            if (this.config.encryptionKey && this.utils.isEncryptedHash(hash)) {
+                actualHash = await this.utils.decryptPasswordHash(hash, this.config.encryptionKey);
+            }
+            // Parse metadata
+            const { hash: extractedHash, salt, metadata, } = this.utils.parseHashWithMetadata(actualHash);
+            // Apply pepper if configured
+            const processedPassword = this.applyPepper(password);
+            // Verify using the same algorithm
+            const isValid = await this.algorithms.verify(processedPassword, extractedHash, salt, metadata);
+            const timeTaken = Date.now() - startTime;
+            // Check if rehashing is needed
+            const needsRehash = this.shouldRehash(metadata);
+            // Generate recommendations
+            const recommendations = this.generateRecommendations(metadata, timeTaken);
+            return {
+                isValid,
+                needsRehash,
+                securityLevel: metadata.securityLevel,
+                algorithm: metadata.algorithm,
+                timeTaken,
+                recommendations,
+            };
+        }
+        catch (error) {
+            // Timing-safe error handling
+            if (this.config.timingSafeVerification) {
+                await this.constantTimeDelay();
+            }
+            return {
+                isValid: false,
+                securityLevel: PasswordSecurityLevel.STANDARD,
+                algorithm: PasswordAlgorithm.PBKDF2_SHA512,
+                timeTaken: Date.now() - startTime,
+                recommendations: ["Password verification failed"],
+            };
+        }
+    }
+    /**
+     * Generate a secure password
+     */
+    generatePassword(options = {}) {
+        return this.generator.generate(options);
+    }
+    /**
+     * Analyze password strength
+     */
+    analyzeStrength(password) {
+        return this.security.analyzeStrength(password);
+    }
+    /**
+     * Migrate from bcrypt or other systems
+     */
+    async migrate(password, oldHash, options = {}) {
+        return this.migration.fromBcrypt(password, oldHash, options);
+    }
+    /**
+     * Validate password against policy
+     */
+    validatePolicy(password) {
+        return this.security.validatePolicy(password);
+    }
+    /**
+     * Rehash password with updated security
+     */
+    async rehash(password, oldHash, newOptions = {}) {
+        // First verify the old password
+        const verification = await this.verify(password, oldHash);
+        if (!verification.isValid) {
+            return { newHash: oldHash, upgraded: false };
+        }
+        // Create new hash with enhanced options
+        const enhancedOptions = {
+            ...this.config,
+            algorithm: PasswordAlgorithm.ARGON2ID,
+            securityLevel: PasswordSecurityLevel.MAXIMUM,
+            ...newOptions,
+        };
+        const newHash = await this.hash(password, enhancedOptions);
+        return { newHash, upgraded: true };
+    }
+    /**
+     * Audit password security
+     */
+    async auditSecurity(hashes) {
+        return this.security.auditPasswords(hashes);
+    }
+    /**
+     * Configure global settings
+     */
+    configure(config) {
+        this.config = { ...this.config, ...config };
+        // Update modular components
+        this.algorithms.updateConfig(this.config);
+        this.security.updateConfig(this.config);
+        this.migration.updateConfig(this.config);
+        this.generator.updateConfig(this.config);
+        this.utils.updateConfig(this.config);
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    // ===== PRIVATE HELPER METHODS =====
+    mergeOptions(options) {
+        return {
+            algorithm: this.config.defaultAlgorithm,
+            securityLevel: this.config.defaultSecurityLevel,
+            iterations: 100000,
+            memorySize: 65536, // 64MB
+            parallelism: 4,
+            saltLength: 32,
+            quantumResistant: false,
+            timingSafe: this.config.timingSafeVerification,
+            secureWipe: this.config.secureMemoryWipe,
+            ...options,
+        };
+    }
+    applyPepper(password) {
+        return this.config.globalPepper
+            ? password + this.config.globalPepper
+            : password;
+    }
+    createMetadata(options) {
+        return {
+            algorithm: options.algorithm,
+            securityLevel: options.securityLevel,
+            iterations: options.iterations,
+            memorySize: options.memorySize,
+            parallelism: options.parallelism,
+            saltLength: options.saltLength,
+            hasEncryption: !!this.config.encryptionKey,
+            hasPepper: !!this.config.globalPepper,
+            timestamp: Date.now(),
+            version: "2.0.0",
+        };
+    }
+    shouldRehash(metadata) {
+        // Check if algorithm is outdated
+        if (metadata.algorithm === PasswordAlgorithm.PBKDF2_SHA512 &&
+            metadata.iterations < 100000) {
+            return true;
+        }
+        // Check if security level is below current default
+        if (metadata.securityLevel === PasswordSecurityLevel.STANDARD &&
+            this.config.defaultSecurityLevel !== PasswordSecurityLevel.STANDARD) {
+            return true;
+        }
+        // Check age (if policy specifies max age)
+        if (this.config.policy?.maxAge) {
+            const ageInDays = (Date.now() - metadata.timestamp) / (1000 * 60 * 60 * 24);
+            if (ageInDays > this.config.policy.maxAge) {
+                return true;
+            }
+        }
+        return false;
+    }
+    generateRecommendations(metadata, timeTaken) {
+        const recommendations = [];
+        if (this.shouldRehash(metadata)) {
+            recommendations.push("Consider upgrading password hash");
+        }
+        if (timeTaken > 1000) {
+            recommendations.push("Verification time is high, consider optimizing");
+        }
+        if (!metadata.hasEncryption &&
+            metadata.securityLevel === PasswordSecurityLevel.MILITARY) {
+            recommendations.push("Consider enabling encryption for military-grade security");
+        }
+        return recommendations;
+    }
+    async constantTimeDelay() {
+        // Add a small random delay to prevent timing attacks
+        const delay = 50 + Math.floor(Math.random() * 100);
+        await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+}
+
+export { PasswordManager };
+//# sourceMappingURL=password-core.js.map

package/dist/esm/mods/security/src/core/password/password-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-core.js","sources":["../../../../../../../mods/security/src/core/password/password-core.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;AAKG;AAoBH;;;;;AAKG;MACU,eAAe,CAAA;AASxB,IAAA,WAAA,CAAoB,MAAuC,EAAA;QACvD,IAAI,CAAC,MAAM,GAAG;YACV,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ;YAC5C,oBAAoB,EAAE,qBAAqB,CAAC,IAAI;AAChD,YAAA,sBAAsB,EAAE,IAAI;AAC5B,YAAA,gBAAgB,EAAE,IAAI;AACtB,YAAA,eAAe,EAAE,IAAI;AACrB,YAAA,GAAG,MAAM;SACZ,CAAC;;QAGF,IAAI,CAAC,UAAU,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KAC/C;AAED;;AAEG;IACI,OAAO,WAAW,CACrB,MAAuC,EAAA;AAEvC,QAAA,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE;YAC3B,eAAe,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;SAC1D;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC;KACnC;AAED;;AAEG;IACI,OAAO,MAAM,CAChB,MAAuC,EAAA;AAEvC,QAAA,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;KACtC;AAED;;AAEG;AACI,IAAA,MAAM,IAAI,CACb,QAAgB,EAChB,UAA+B,EAAE,EAAA;;QAGjC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;AACpC,YAAA,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;SAC/C;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAExC,QAAA,IAAI;;YAEA,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;;YAGrD,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,UAAW,CAAC,CAAC;;AAGzD,YAAA,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CACnC,iBAAiB,EACjB,IAAI,EACJ,IAAI,CACP,CAAC;;YAGF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;;AAG3C,YAAA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAC7C,IAAI,EACJ,IAAI,EACJ,QAAQ,CACX,CAAC;;AAGF,YAAA,IACI,IAAI,CAAC,MAAM,CAAC,aAAa;AACzB,gBAAA,IAAI,CAAC,aAAa,KAAK,qBAAqB,CAAC,QAAQ,EACvD;AACE,gBAAA,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CACvC,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,aAAa,CAC5B,CAAC;aACL;AAED,YAAA,OAAO,MAAM,CAAC;SACjB;gBAAS;;AAEN,YAAA,IAAI,IAAI,CAAC,UAAU,EAAE;gBACjB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;aACrC;SACJ;KACJ;AAED;;AAEG;AACI,IAAA,MAAM,MAAM,CACf,QAAgB,EAChB,IAAY,EAAA;AAEZ,QAAA,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B,QAAA,IAAI;;YAEA,IAAI,UAAU,GAAG,IAAI,CAAC;AACtB,YAAA,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE;AAC/D,gBAAA,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAC7C,IAAI,EACJ,IAAI,CAAC,MAAM,CAAC,aAAa,CAC5B,CAAC;aACL;;AAGD,YAAA,MAAM,EACF,IAAI,EAAE,aAAa,EACnB,IAAI,EACJ,QAAQ,GACX,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;;YAGjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;;AAGrD,YAAA,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CACxC,iBAAiB,EACjB,aAAa,EACb,IAAI,EACJ,QAAQ,CACX,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;;YAGzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;;YAGhD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAChD,QAAQ,EACR,SAAS,CACZ,CAAC;YAEF,OAAO;gBACH,OAAO;gBACP,WAAW;gBACX,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS;gBACT,eAAe;aAClB,CAAC;SACL;QAAC,OAAO,KAAK,EAAE;;AAEZ,YAAA,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;AACpC,gBAAA,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;aAClC;YAED,OAAO;AACH,gBAAA,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,qBAAqB,CAAC,QAAQ;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,aAAa;AAC1C,gBAAA,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,eAAe,EAAE,CAAC,8BAA8B,CAAC;aACpD,CAAC;SACL;KACJ;AAED;;AAEG;IACI,gBAAgB,CAAC,UAAe,EAAE,EAAA;QACrC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC3C;AAED;;AAEG;AACI,IAAA,eAAe,CAAC,QAAgB,EAAA;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;KAClD;AAED;;AAEG;IACI,MAAM,OAAO,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAe,EAAE,EAAA;AACrE,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;KAChE;AAED;;AAEG;AACI,IAAA,cAAc,CAAC,QAAgB,EAAA;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;KACjD;AAED;;AAEG;IACI,MAAM,MAAM,CACf,QAAgB,EAChB,OAAe,EACf,aAAkC,EAAE,EAAA;;QAGpC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE1D,QAAA,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;YACvB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAChD;;AAGD,QAAA,MAAM,eAAe,GAAG;YACpB,GAAG,IAAI,CAAC,MAAM;YACd,SAAS,EAAE,iBAAiB,CAAC,QAAQ;YACrC,aAAa,EAAE,qBAAqB,CAAC,OAAO;AAC5C,YAAA,GAAG,UAAU;SAChB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAE3D,QAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACtC;AAED;;AAEG;IACI,MAAM,aAAa,CAAC,MAAgB,EAAA;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;KAC/C;AAED;;AAEG;AACI,IAAA,SAAS,CAAC,MAAsC,EAAA;AACnD,QAAA,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;;QAG5C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KACxC;AAED;;AAEG;IACI,SAAS,GAAA;AACZ,QAAA,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;KAC7B;;AAIO,IAAA,YAAY,CAAC,OAA4B,EAAA;QAC7C,OAAO;AACH,YAAA,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;AACvC,YAAA,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;AAC/C,YAAA,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,KAAK;AACjB,YAAA,WAAW,EAAE,CAAC;AACd,YAAA,UAAU,EAAE,EAAE;AACd,YAAA,gBAAgB,EAAE,KAAK;AACvB,YAAA,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB;AAC9C,YAAA,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;AACxC,YAAA,GAAG,OAAO;SACb,CAAC;KACL;AAEO,IAAA,WAAW,CAAC,QAAgB,EAAA;AAChC,QAAA,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY;AAC3B,cAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY;cACnC,QAAQ,CAAC;KAClB;AAEO,IAAA,cAAc,CAAC,OAA4B,EAAA;QAC/C,OAAO;YACH,SAAS,EAAE,OAAO,CAAC,SAAU;YAC7B,aAAa,EAAE,OAAO,CAAC,aAAc;YACrC,UAAU,EAAE,OAAO,CAAC,UAAW;YAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAW;AAC/B,YAAA,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa;AAC1C,YAAA,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;AACrC,YAAA,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;AACrB,YAAA,OAAO,EAAE,OAAO;SACnB,CAAC;KACL;AAEO,IAAA,YAAY,CAAC,QAA8B,EAAA;;AAE/C,QAAA,IACI,QAAQ,CAAC,SAAS,KAAK,iBAAiB,CAAC,aAAa;AACtD,YAAA,QAAQ,CAAC,UAAU,GAAG,MAAM,EAC9B;AACE,YAAA,OAAO,IAAI,CAAC;SACf;;AAGD,QAAA,IACI,QAAQ,CAAC,aAAa,KAAK,qBAAqB,CAAC,QAAQ;YACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,KAAK,qBAAqB,CAAC,QAAQ,EACrE;AACE,YAAA,OAAO,IAAI,CAAC;SACf;;QAGD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE;YAC5B,MAAM,SAAS,GACX,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,IAAI,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;AACvC,gBAAA,OAAO,IAAI,CAAC;aACf;SACJ;AAED,QAAA,OAAO,KAAK,CAAC;KAChB;IAEO,uBAAuB,CAC3B,QAA8B,EAC9B,SAAiB,EAAA;QAEjB,MAAM,eAAe,GAAa,EAAE,CAAC;AAErC,QAAA,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;AAC7B,YAAA,eAAe,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;SAC5D;AAED,QAAA,IAAI,SAAS,GAAG,IAAI,EAAE;AAClB,YAAA,eAAe,CAAC,IAAI,CAChB,gDAAgD,CACnD,CAAC;SACL;QAED,IACI,CAAC,QAAQ,CAAC,aAAa;AACvB,YAAA,QAAQ,CAAC,aAAa,KAAK,qBAAqB,CAAC,QAAQ,EAC3D;AACE,YAAA,eAAe,CAAC,IAAI,CAChB,0DAA0D,CAC7D,CAAC;SACL;AAED,QAAA,OAAO,eAAe,CAAC;KAC1B;AAEO,IAAA,MAAM,iBAAiB,GAAA;;AAE3B,QAAA,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;AACnD,QAAA,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;KAC9D;AACJ;;;;"}

package/dist/esm/mods/security/src/core/password/password-generator.js

@@ -0,0 +1,363 @@
+import { SecureRandom } from '../random/random-core.js';
+import '../random/random-types.js';
+import 'crypto';
+import '../random/random-sources.js';
+import 'nehonix-uri-processor';
+import '../../utils/memory/index.js';
+import '../../types.js';
+import { PasswordSecurity } from './password-security.js';
+import { SWLIST } from './swlist.js';
+
+/**
+ * 🔐 Password Generator Module
+ *
+ * Secure password generation with customizable requirements
+ */
+/**
+ * Secure password generation
+ */
+class PasswordGenerator {
+    constructor(config) {
+        this.config = config;
+        this.security = new PasswordSecurity(config);
+    }
+    /**
+     * Update configuration
+     */
+    updateConfig(config) {
+        this.config = config;
+        this.security.updateConfig(config);
+    }
+    /**
+     * Generate a secure password
+     */
+    generate(options = {}) {
+        const opts = this.mergeOptions(options);
+        let attempts = 0;
+        const maxAttempts = 100;
+        while (attempts < maxAttempts) {
+            const password = this.generatePassword(opts);
+            const strength = this.security.analyzeStrength(password);
+            if (strength.score >= opts.minStrengthScore) {
+                return {
+                    password,
+                    strength,
+                    metadata: {
+                        generatedAt: Date.now(),
+                        algorithm: "xypriss-secure-random",
+                        entropy: strength.entropy,
+                    },
+                };
+            }
+            attempts++;
+        }
+        throw new Error("Unable to generate password meeting strength requirements");
+    }
+    /**
+     * Generate multiple passwords
+     */
+    generateBatch(count, options = {}) {
+        if (count <= 0 || count > 1000) {
+            throw new Error("Count must be between 1 and 1000");
+        }
+        const results = [];
+        for (let i = 0; i < count; i++) {
+            results.push(this.generate(options));
+        }
+        return results;
+    }
+    /**
+     * Generate passphrase (word-based password)
+     */
+    generatePassphrase(options = {}) {
+        const opts = {
+            wordCount: 4,
+            separator: "-",
+            includeNumbers: true,
+            includeSymbols: false,
+            minStrengthScore: 70,
+            ...options,
+        };
+        // Comprehensive EFF word list for maximum security (2048 words for 11 bits of entropy per word)
+        const words = this.getSecureWordList();
+        let attempts = 0;
+        const maxAttempts = 50;
+        while (attempts < maxAttempts) {
+            const selectedWords = [];
+            // Use cryptographically secure random selection with no duplicates
+            const usedIndices = new Set();
+            for (let i = 0; i < opts.wordCount; i++) {
+                let randomIndex;
+                let wordAttempts = 0;
+                // Ensure no duplicate words in the passphrase
+                do {
+                    randomIndex = SecureRandom.getSecureRandomInt(0, words.length - 1);
+                    wordAttempts++;
+                } while (usedIndices.has(randomIndex) && wordAttempts < 50);
+                usedIndices.add(randomIndex);
+                selectedWords.push(words[randomIndex]);
+            }
+            // Randomly capitalize some words for additional entropy
+            const capitalizedWords = selectedWords.map((word) => {
+                if (SecureRandom.getSecureRandomBoolean()) {
+                    return word.charAt(0).toUpperCase() + word.slice(1);
+                }
+                return word;
+            });
+            let passphrase = capitalizedWords.join(opts.separator);
+            // Add numbers if requested (use larger range for better entropy)
+            if (opts.includeNumbers) {
+                const number = SecureRandom.getSecureRandomInt(100, 9999);
+                passphrase += opts.separator + number;
+            }
+            // Add symbols if requested (use more diverse symbols)
+            if (opts.includeSymbols) {
+                const symbols = "!@#$%^&*()_+-=[]{}|;:,.<>?";
+                const symbolCount = SecureRandom.getSecureRandomInt(1, 3);
+                let symbolString = "";
+                for (let i = 0; i < symbolCount; i++) {
+                    const randomSymbol = symbols[SecureRandom.getSecureRandomInt(0, symbols.length - 1)];
+                    symbolString += randomSymbol;
+                }
+                passphrase += symbolString;
+            }
+            const strength = this.security.analyzeStrength(passphrase);
+            // Calculate theoretical entropy for passphrase
+            const wordEntropy = opts.wordCount * Math.log2(words.length);
+            const numberEntropy = opts.includeNumbers ? Math.log2(9900) : 0; // 100-9999 range
+            const symbolEntropy = opts.includeSymbols
+                ? Math.log2(26 * 26 * 26)
+                : 0; // Up to 3 symbols
+            const totalEntropy = wordEntropy + numberEntropy + symbolEntropy;
+            if (strength.score >= opts.minStrengthScore && totalEntropy >= 50) {
+                return {
+                    password: passphrase,
+                    strength: {
+                        ...strength,
+                        entropy: Math.max(strength.entropy, totalEntropy),
+                    },
+                    metadata: {
+                        generatedAt: Date.now(),
+                        algorithm: "xypriss-passphrase-eff",
+                        entropy: totalEntropy,
+                    },
+                };
+            }
+            attempts++;
+        }
+        throw new Error("Unable to generate passphrase meeting strength requirements after maximum attempts");
+    }
+    /**
+     * Generate PIN (numeric password)
+     */
+    generatePIN(length = 6) {
+        if (length < 4 || length > 20) {
+            throw new Error("PIN length must be between 4 and 20");
+        }
+        let pin = "";
+        for (let i = 0; i < length; i++) {
+            pin += SecureRandom.getSecureRandomInt(0, 9).toString();
+        }
+        // Ensure PIN doesn't have obvious patterns
+        if (this.hasObviousPattern(pin)) {
+            return this.generatePIN(length); // Retry
+        }
+        return pin;
+    }
+    /**
+     * Generate memorable password (pronounceable)
+     */
+    generateMemorable(options = {}) {
+        const opts = {
+            length: 12,
+            includeNumbers: true,
+            includeSymbols: false,
+            minStrengthScore: 60,
+            ...options,
+        };
+        // Consonants and vowels for pronounceable passwords
+        const consonants = "bcdfghjklmnpqrstvwxyz";
+        const vowels = "aeiou";
+        const numbers = "0123456789";
+        const symbols = "!@#$%^&*";
+        let attempts = 0;
+        const maxAttempts = 50;
+        while (attempts < maxAttempts) {
+            let password = "";
+            let useConsonant = true;
+            // Generate base pronounceable part
+            for (let i = 0; i < opts.length - 2; i++) {
+                if (useConsonant) {
+                    password +=
+                        consonants[SecureRandom.getSecureRandomInt(0, consonants.length - 1)];
+                }
+                else {
+                    password +=
+                        vowels[SecureRandom.getSecureRandomInt(0, vowels.length - 1)];
+                }
+                useConsonant = !useConsonant;
+            }
+            // Add numbers if requested
+            if (opts.includeNumbers) {
+                password +=
+                    numbers[SecureRandom.getSecureRandomInt(0, numbers.length - 1)];
+            }
+            // Add symbols if requested
+            if (opts.includeSymbols) {
+                password +=
+                    symbols[SecureRandom.getSecureRandomInt(0, symbols.length - 1)];
+            }
+            // Capitalize some letters randomly
+            password = password
+                .split("")
+                .map((char) => {
+                if (char.match(/[a-z]/) &&
+                    SecureRandom.getSecureRandomBoolean()) {
+                    return char.toUpperCase();
+                }
+                return char;
+            })
+                .join("");
+            const strength = this.security.analyzeStrength(password);
+            if (strength.score >= opts.minStrengthScore) {
+                return {
+                    password,
+                    strength,
+                    metadata: {
+                        generatedAt: Date.now(),
+                        algorithm: "xypriss-memorable",
+                        entropy: strength.entropy,
+                    },
+                };
+            }
+            attempts++;
+        }
+        throw new Error("Unable to generate memorable password meeting strength requirements");
+    }
+    // ===== PRIVATE HELPER METHODS =====
+    mergeOptions(options) {
+        return {
+            length: 16,
+            includeUppercase: true,
+            includeLowercase: true,
+            includeNumbers: true,
+            includeSymbols: true,
+            excludeSimilar: true,
+            minStrengthScore: 80,
+            customCharset: "",
+            excludeChars: "",
+            requireAll: true,
+            ...options,
+        };
+    }
+    generatePassword(options) {
+        let charset = "";
+        // Build character set
+        if (options.customCharset) {
+            charset = options.customCharset;
+        }
+        else {
+            if (options.includeUppercase) {
+                charset += options.excludeSimilar
+                    ? "ABCDEFGHJKLMNPQRSTUVWXYZ"
+                    : "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+            }
+            if (options.includeLowercase) {
+                charset += options.excludeSimilar
+                    ? "abcdefghjkmnpqrstuvwxyz"
+                    : "abcdefghijklmnopqrstuvwxyz";
+            }
+            if (options.includeNumbers) {
+                charset += options.excludeSimilar ? "23456789" : "0123456789";
+            }
+            if (options.includeSymbols) {
+                charset += "!@#$%^&*()_+-=[]{}|;:,.<>?";
+            }
+        }
+        // Remove excluded characters
+        if (options.excludeChars) {
+            for (const char of options.excludeChars) {
+                charset = charset.replace(new RegExp(char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g"), "");
+            }
+        }
+        if (charset.length === 0) {
+            throw new Error("No valid characters available for password generation");
+        }
+        // Generate password
+        let password = "";
+        for (let i = 0; i < options.length; i++) {
+            const randomIndex = SecureRandom.getSecureRandomInt(0, charset.length - 1);
+            password += charset[randomIndex];
+        }
+        // Ensure all required character types are present if requireAll is true
+        if (options.requireAll && !options.customCharset) {
+            password = this.ensureAllCharacterTypes(password, options);
+        }
+        return password;
+    }
+    ensureAllCharacterTypes(password, options) {
+        const chars = password.split("");
+        if (options.includeUppercase && !/[A-Z]/.test(password)) {
+            const upperChars = options.excludeSimilar
+                ? "ABCDEFGHJKLMNPQRSTUVWXYZ"
+                : "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+            const randomIndex = SecureRandom.getSecureRandomInt(0, chars.length - 1);
+            chars[randomIndex] =
+                upperChars[SecureRandom.getSecureRandomInt(0, upperChars.length - 1)];
+        }
+        if (options.includeLowercase && !/[a-z]/.test(password)) {
+            const lowerChars = options.excludeSimilar
+                ? "abcdefghjkmnpqrstuvwxyz"
+                : "abcdefghijklmnopqrstuvwxyz";
+            const randomIndex = SecureRandom.getSecureRandomInt(0, chars.length - 1);
+            chars[randomIndex] =
+                lowerChars[SecureRandom.getSecureRandomInt(0, lowerChars.length - 1)];
+        }
+        if (options.includeNumbers && !/[0-9]/.test(password)) {
+            const numberChars = options.excludeSimilar
+                ? "23456789"
+                : "0123456789";
+            const randomIndex = SecureRandom.getSecureRandomInt(0, chars.length - 1);
+            chars[randomIndex] =
+                numberChars[SecureRandom.getSecureRandomInt(0, numberChars.length - 1)];
+        }
+        if (options.includeSymbols && !/[^A-Za-z0-9]/.test(password)) {
+            const symbolChars = "!@#$%^&*()_+-=[]{}|;:,.<>?";
+            const randomIndex = SecureRandom.getSecureRandomInt(0, chars.length - 1);
+            chars[randomIndex] =
+                symbolChars[SecureRandom.getSecureRandomInt(0, symbolChars.length - 1)];
+        }
+        return chars.join("");
+    }
+    hasObviousPattern(pin) {
+        // Check for sequential numbers
+        for (let i = 0; i < pin.length - 2; i++) {
+            const a = parseInt(pin[i]);
+            const b = parseInt(pin[i + 1]);
+            const c = parseInt(pin[i + 2]);
+            if (b === a + 1 && c === b + 1)
+                return true;
+            if (b === a - 1 && c === b - 1)
+                return true;
+        }
+        // Check for repeated digits
+        if (/(\d)\1{2,}/.test(pin))
+            return true;
+        // Check for common patterns
+        const commonPatterns = ["1234", "4321", "1111", "0000", "1212"];
+        return commonPatterns.some((pattern) => pin.includes(pattern));
+    }
+    /**
+     * Returns a comprehensive word list for secure passphrase generation
+     * Based on EFF's long wordlist for maximum security (2048 words = 11 bits entropy per word)
+     */
+    getSecureWordList() {
+        // EFF Long Wordlist - 2048 carefully selected words
+        // Each word provides 11 bits of entropy (2^11 = 2048)
+        // Words are 3-9 characters, easy to type, and memorable
+        return SWLIST;
+    }
+}
+
+export { PasswordGenerator };
+//# sourceMappingURL=password-generator.js.map