contextsynapse 1.0.0__py3-none-any.whl

contextsynapse/security/auto_tagger.py

@@ -0,0 +1,230 @@
+"""
+Auto-Tagging & Classification
+===============================
+Automatically classify graph nodes, contexts, and graphs with sensitivity levels
+based on content analysis (PII detection, keyword matching, pattern recognition).
+
+Tags: public | internal | confidential | restricted
+
+Usage::
+
+    tagger = AutoTagger()
+    tags = tagger.classify_node(node_properties)
+    # {"sensitivity": "confidential", "tags": ["pii:email", "personal_data"], "pii_detected": True}
+
+    tagger.tag_context(context_id, graph_registry, context_manager)
+    # Scans all nodes, sets context-level sensitivity to highest found
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional, Set
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class ClassificationResult:
+    """Result of classifying a piece of content."""
+    sensitivity: str = "public"         # public | internal | confidential | restricted
+    tags: List[str] = field(default_factory=list)
+    pii_detected: bool = False
+    confidence: float = 1.0
+    reason: str = ""
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "sensitivity": self.sensitivity,
+            "tags": self.tags,
+            "pii_detected": self.pii_detected,
+            "confidence": self.confidence,
+            "reason": self.reason,
+        }
+
+
+# Keyword patterns that indicate sensitivity levels
+_CONFIDENTIAL_KEYWORDS = {
+    "salary", "compensation", "ssn", "social security", "bank account",
+    "credit card", "password", "secret key", "private key", "api key",
+    "medical", "diagnosis", "patient", "health record", "prescription",
+    "passport number", "aadhaar", "pan card",
+}
+
+_RESTRICTED_KEYWORDS = {
+    "classified", "top secret", "board meeting", "acquisition target",
+    "insider", "material nonpublic", "merger", "confidential strategy",
+}
+
+_INTERNAL_KEYWORDS = {
+    "internal only", "do not share", "draft", "work in progress",
+    "internal memo", "staff only", "employee",
+}
+
+
+class AutoTagger:
+    """Auto-classify content and tag with sensitivity levels."""
+
+    def __init__(self):
+        from .pii import get_pii_detector
+        self._pii = get_pii_detector()
+
+    def classify_text(self, text: str) -> ClassificationResult:
+        """Classify a text string by sensitivity level."""
+        if not text:
+            return ClassificationResult(sensitivity="public")
+
+        tags = []
+        reasons = []
+        text_lower = text.lower()
+
+        # 1. PII detection (highest priority)
+        pii_result = self._pii.scan(text)
+        pii_detected = pii_result.pii_found
+
+        if pii_detected:
+            for _, pii_type in pii_result.entities:
+                tags.append(f"pii:{pii_type}")
+            reasons.append(f"PII detected: {', '.join(set(t for _,t in pii_result.entities))}")
+
+        # 2. Keyword-based classification
+        sensitivity = pii_result.sensitivity if pii_detected else "public"
+
+        for kw in _RESTRICTED_KEYWORDS:
+            if kw in text_lower:
+                sensitivity = "restricted"
+                tags.append("classified")
+                reasons.append(f"Restricted keyword: {kw}")
+                break
+
+        if sensitivity not in ("restricted",):
+            for kw in _CONFIDENTIAL_KEYWORDS:
+                if kw in text_lower:
+                    if sensitivity not in ("restricted",):
+                        sensitivity = "confidential"
+                    tags.append("sensitive_data")
+                    reasons.append(f"Confidential keyword: {kw}")
+                    break
+
+        if sensitivity == "public":
+            for kw in _INTERNAL_KEYWORDS:
+                if kw in text_lower:
+                    sensitivity = "internal"
+                    tags.append("internal")
+                    reasons.append(f"Internal keyword: {kw}")
+                    break
+
+        return ClassificationResult(
+            sensitivity=sensitivity,
+            tags=tags,
+            pii_detected=pii_detected,
+            confidence=0.9 if pii_detected else 0.7,
+            reason="; ".join(reasons) if reasons else "No sensitive content detected",
+        )
+
+    def classify_node(self, properties: Dict[str, Any]) -> ClassificationResult:
+        """Classify a graph node's properties."""
+        # Combine all text fields for analysis
+        text_fields = ["content", "description", "name", "title", "statement",
+                        "body", "text", "summary", "rationale"]
+        combined = " ".join(
+            str(properties.get(f, "")) for f in text_fields if properties.get(f)
+        )
+        return self.classify_text(combined)
+
+    def tag_node(self, properties: Dict[str, Any]) -> Dict[str, Any]:
+        """Classify and add tags directly to node properties.
+
+        Returns updated properties dict with sensitivity, tags, pii_detected.
+        """
+        result = self.classify_node(properties)
+        tagged = dict(properties)
+        tagged["sensitivity"] = result.sensitivity
+        tagged["pii_detected"] = result.pii_detected
+
+        existing_tags = tagged.get("tags", [])
+        if isinstance(existing_tags, str):
+            existing_tags = [t.strip() for t in existing_tags.split(",") if t.strip()]
+        tagged["tags"] = list(set(existing_tags + result.tags))
+        tagged["_auto_classified"] = True
+
+        return tagged
+
+    def tag_context(self, context_id: str, graph_registry=None,
+                     context_manager=None) -> Dict[str, Any]:
+        """Scan all nodes in a context and set context-level sensitivity.
+
+        The context gets the HIGHEST sensitivity found in any node.
+        """
+        if not context_manager or not graph_registry:
+            return {"error": "Missing context_manager or graph_registry"}
+
+        ctx = context_manager.get_context(context_id)
+        if not ctx:
+            return {"error": f"Context {context_id} not found"}
+
+        db = graph_registry.get_graph(ctx.graph_namespace, load_if_missing=True)
+        if not db:
+            return {"error": "Graph not available"}
+
+        # Scan all nodes
+        sensitivity_levels = {"public": 0, "internal": 1, "confidential": 2, "restricted": 3}
+        max_sensitivity = "public"
+        total_nodes = 0
+        pii_count = 0
+        tagged_count = 0
+
+        for node in db.get_all_nodes():
+            props = getattr(node, "properties", {}) or {}
+            total_nodes += 1
+
+            result = self.classify_node(props)
+
+            if result.pii_detected:
+                pii_count += 1
+
+            # Update node with classification
+            if not props.get("_auto_classified"):
+                tagged_props = self.tag_node(props)
+                try:
+                    from ..core.graph_structures import GraphNode
+                    db.add_node(GraphNode(
+                        id=node.id, label=getattr(node, "label", ""),
+                        properties=tagged_props,
+                    ), write_through=True)
+                    tagged_count += 1
+                except Exception:
+                    pass
+
+            # Track highest sensitivity
+            if sensitivity_levels.get(result.sensitivity, 0) > sensitivity_levels.get(max_sensitivity, 0):
+                max_sensitivity = result.sensitivity
+
+        # Update context-level sensitivity
+        try:
+            context_manager.update_context(context_id, {"sensitivity": max_sensitivity})
+        except Exception:
+            pass
+
+        result = {
+            "context_id": context_id,
+            "total_nodes": total_nodes,
+            "nodes_tagged": tagged_count,
+            "pii_nodes": pii_count,
+            "context_sensitivity": max_sensitivity,
+        }
+        logger.info("[AUTO-TAG] Context %s: %d nodes scanned, %d PII, sensitivity=%s",
+                    context_id[:12], total_nodes, pii_count, max_sensitivity)
+        return result
+
+
+# Global singleton
+_tagger: Optional[AutoTagger] = None
+
+def get_auto_tagger() -> AutoTagger:
+    global _tagger
+    if _tagger is None:
+        _tagger = AutoTagger()
+    return _tagger

contextsynapse/security/data_security.py

@@ -0,0 +1,218 @@
+"""
+AIContextDB Data Security System
+Comprehensive security including encryption, access control, PII detection, and audit logging.
+"""
+
+import hashlib
+import json
+from typing import Dict, List, Any, Optional, Set, Tuple
+from dataclasses import dataclass
+from datetime import datetime
+import logging
+import re
+from enum import Enum
+from collections import defaultdict
+
+logger = logging.getLogger(__name__)
+
+class AccessLevel(Enum):
+    """Access levels for RBAC."""
+    READ = "read"
+    WRITE = "write"
+    DELETE = "delete"
+    ADMIN = "admin"
+
+@dataclass
+class AccessControl:
+    """Access control entry."""
+    user_id: str
+    resource: str
+    access_level: AccessLevel
+    granted_at: datetime
+    expires_at: Optional[datetime] = None
+
+class PIIDetector:
+    """PII (Personally Identifiable Information) detector."""
+    
+    # Patterns for common PII
+    EMAIL_PATTERN = r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
+    PHONE_PATTERN = r'\b\d{3}[-.]?\d{3}[-.]?\d{4}\b'
+    SSN_PATTERN = r'\b\d{3}-\d{2}-\d{4}\b'
+    CREDIT_CARD_PATTERN = r'\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b'
+    
+    @staticmethod
+    def detect_pii(text: str) -> Dict[str, List[str]]:
+        """Detect PII in text."""
+        pii_found = {
+            'emails': re.findall(PIIDetector.EMAIL_PATTERN, text),
+            'phones': re.findall(PIIDetector.PHONE_PATTERN, text),
+            'ssns': re.findall(PIIDetector.SSN_PATTERN, text),
+            'credit_cards': re.findall(PIIDetector.CREDIT_CARD_PATTERN, text)
+        }
+        
+        # Remove empty lists
+        return {k: v for k, v in pii_found.items() if v}
+    
+    @staticmethod
+    def mask_pii(text: str, mask_char: str = '*') -> str:
+        """Mask PII in text."""
+        masked = text
+        
+        # Mask emails
+        masked = re.sub(PIIDetector.EMAIL_PATTERN, lambda m: mask_char * len(m.group()), masked)
+        
+        # Mask phones
+        masked = re.sub(PIIDetector.PHONE_PATTERN, lambda m: mask_char * len(m.group()), masked)
+        
+        # Mask SSNs
+        masked = re.sub(PIIDetector.SSN_PATTERN, lambda m: mask_char * len(m.group()), masked)
+        
+        # Mask credit cards
+        masked = re.sub(PIIDetector.CREDIT_CARD_PATTERN, lambda m: mask_char * len(m.group()), masked)
+        
+        return masked
+
+class DataSecurity:
+    """Comprehensive data security system."""
+    
+    def __init__(self, namespace: str):
+        self.namespace = namespace
+        self.access_controls: Dict[str, List[AccessControl]] = defaultdict(list)
+        self.audit_log: List[Dict[str, Any]] = []
+        self.pii_detector = PIIDetector()
+        self.encryption_enabled = False
+        
+        logger.info(f"[EMOJI] DataSecurity initialized for namespace: {namespace}")
+    
+    def check_access(self, user_id: str, resource: str, required_level: AccessLevel) -> bool:
+        """Check if user has required access."""
+        if resource not in self.access_controls:
+            return False  # No access by default
+        
+        for acl in self.access_controls[resource]:
+            if acl.user_id == user_id:
+                # Check expiration
+                if acl.expires_at and datetime.now() > acl.expires_at:
+                    continue
+                
+                # Check access level
+                if self._has_sufficient_level(acl.access_level, required_level):
+                    return True
+        
+        return False
+    
+    def _has_sufficient_level(self, granted: AccessLevel, required: AccessLevel) -> bool:
+        """Check if granted level is sufficient."""
+        level_hierarchy = {
+            AccessLevel.READ: 1,
+            AccessLevel.WRITE: 2,
+            AccessLevel.DELETE: 3,
+            AccessLevel.ADMIN: 4
+        }
+        
+        return level_hierarchy.get(granted, 0) >= level_hierarchy.get(required, 0)
+    
+    def grant_access(self, user_id: str, resource: str, access_level: AccessLevel, 
+                    expires_at: Optional[datetime] = None):
+        """Grant access to resource."""
+        acl = AccessControl(
+            user_id=user_id,
+            resource=resource,
+            access_level=access_level,
+            granted_at=datetime.now(),
+            expires_at=expires_at
+        )
+        
+        self.access_controls[resource].append(acl)
+        self._audit_log('GRANT_ACCESS', user_id, resource, {'access_level': access_level.value})
+    
+    def revoke_access(self, user_id: str, resource: str):
+        """Revoke access to resource."""
+        if resource in self.access_controls:
+            self.access_controls[resource] = [
+                acl for acl in self.access_controls[resource] if acl.user_id != user_id
+            ]
+            self._audit_log('REVOKE_ACCESS', user_id, resource)
+    
+    def detect_and_mask_pii(self, data: Dict[str, Any]) -> Dict[str, Any]:
+        """Detect and mask PII in data."""
+        masked_data = data.copy()
+        pii_detected = {}
+        
+        for key, value in data.items():
+            if isinstance(value, str):
+                detected = self.pii_detector.detect_pii(value)
+                if detected:
+                    pii_detected[key] = detected
+                    masked_data[key] = self.pii_detector.mask_pii(value)
+            elif isinstance(value, dict):
+                masked_data[key], nested_pii = self._detect_and_mask_nested(value)
+                if nested_pii:
+                    pii_detected[key] = nested_pii
+        
+        if pii_detected:
+            self._audit_log('PII_DETECTED', None, None, {'pii_types': list(pii_detected.keys())})
+        
+        return masked_data, pii_detected
+    
+    def _detect_and_mask_nested(self, data: Dict[str, Any]) -> Tuple[Dict[str, Any], Dict[str, Any]]:
+        """Recursively detect and mask PII in nested structures."""
+        masked = {}
+        pii_detected = {}
+        
+        for key, value in data.items():
+            if isinstance(value, str):
+                detected = self.pii_detector.detect_pii(value)
+                if detected:
+                    pii_detected[key] = detected
+                    masked[key] = self.pii_detector.mask_pii(value)
+                else:
+                    masked[key] = value
+            elif isinstance(value, dict):
+                nested_masked, nested_pii = self._detect_and_mask_nested(value)
+                masked[key] = nested_masked
+                if nested_pii:
+                    pii_detected[key] = nested_pii
+            else:
+                masked[key] = value
+        
+        return masked, pii_detected
+    
+    def _audit_log(self, action: str, user_id: Optional[str], resource: Optional[str], 
+                   details: Dict[str, Any] = None):
+        """Log security event."""
+        log_entry = {
+            'timestamp': datetime.now().isoformat(),
+            'action': action,
+            'user_id': user_id,
+            'resource': resource,
+            'details': details or {}
+        }
+        
+        self.audit_log.append(log_entry)
+        
+        # Keep only last 10000 entries
+        if len(self.audit_log) > 10000:
+            self.audit_log = self.audit_log[-10000:]
+    
+    def get_audit_log(self, user_id: str = None, resource: str = None, 
+                     start_time: datetime = None, end_time: datetime = None) -> List[Dict[str, Any]]:
+        """Get audit log with filters."""
+        filtered = self.audit_log
+        
+        if user_id:
+            filtered = [entry for entry in filtered if entry.get('user_id') == user_id]
+        
+        if resource:
+            filtered = [entry for entry in filtered if entry.get('resource') == resource]
+        
+        if start_time:
+            filtered = [entry for entry in filtered 
+                       if datetime.fromisoformat(entry['timestamp']) >= start_time]
+        
+        if end_time:
+            filtered = [entry for entry in filtered 
+                       if datetime.fromisoformat(entry['timestamp']) <= end_time]
+        
+        return filtered
+

contextsynapse/security/encryption.py

@@ -0,0 +1,207 @@
+"""
+Data Encryption Layer
+======================
+Field-level encryption for graph node properties at rest.
+
+Uses Fernet (AES-128-CBC) for symmetric encryption with key derivation
+from a master secret. Supports searchable encryption via deterministic
+hashing for keyword queries on encrypted fields.
+
+For full homomorphic encryption on search, uses HMAC-based searchable
+tokens that allow keyword matching without decrypting the full content.
+
+Usage::
+
+    enc = FieldEncryptor(master_key="your-secret-key")
+
+    # Encrypt node properties before storage
+    encrypted = enc.encrypt_properties({"name": "John", "email": "john@x.com"}, fields=["email"])
+    # {"name": "John", "email": "gAAAAB...", "_encrypted_fields": ["email"]}
+
+    # Decrypt after retrieval
+    decrypted = enc.decrypt_properties(encrypted)
+    # {"name": "John", "email": "john@x.com"}
+
+    # Searchable token (allows keyword search on encrypted data)
+    token = enc.searchable_token("john@x.com")
+    # deterministic hash — same input always produces same token
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import logging
+import os
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+# Try Fernet (cryptography package)
+_FERNET_AVAILABLE = False
+try:
+    from cryptography.fernet import Fernet
+    from cryptography.hazmat.primitives import hashes
+    from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+    _FERNET_AVAILABLE = True
+except ImportError:
+    logger.info("cryptography package not installed — using fallback encryption")
+
+
+class FieldEncryptor:
+    """Encrypt/decrypt individual node properties using Fernet (AES-128-CBC).
+
+    If the `cryptography` package isn't installed, falls back to
+    base64 encoding (NOT secure — for development only).
+    """
+
+    ENCRYPTED_PREFIX = "ENC:"
+    SEARCH_PREFIX = "STOK:"
+
+    def __init__(self, master_key: Optional[str] = None):
+        self._master_key = master_key or os.environ.get("CONTEXTSYNAPSE_ENCRYPTION_KEY") or os.environ.get("AICONTEXTDB_ENCRYPTION_KEY", "")
+        self._fernet = None
+        self._hmac_key = b""
+
+        if self._master_key and _FERNET_AVAILABLE:
+            # Derive Fernet key from master key using PBKDF2
+            salt = b"contextcore-field-encryption-v1"
+            kdf = PBKDF2HMAC(
+                algorithm=hashes.SHA256(),
+                length=32,
+                salt=salt,
+                iterations=100_000,
+            )
+            key = base64.urlsafe_b64encode(kdf.derive(self._master_key.encode()))
+            self._fernet = Fernet(key)
+            # Derive HMAC key for searchable tokens
+            self._hmac_key = hashlib.sha256(
+                (self._master_key + ":search-token").encode()
+            ).digest()
+            logger.info("[ENCRYPTION] Fernet encryption initialized")
+        elif self._master_key:
+            # Fallback HMAC key without Fernet
+            self._hmac_key = hashlib.sha256(
+                (self._master_key + ":search-token").encode()
+            ).digest()
+            logger.warning("[ENCRYPTION] Using base64 fallback (install cryptography for real encryption)")
+
+    @property
+    def available(self) -> bool:
+        return self._fernet is not None
+
+    def encrypt_value(self, value: str) -> str:
+        """Encrypt a single string value."""
+        if not value or not isinstance(value, str):
+            return value
+        if self._fernet:
+            token = self._fernet.encrypt(value.encode())
+            return self.ENCRYPTED_PREFIX + token.decode()
+        else:
+            # Fallback: base64 (NOT secure — development only)
+            encoded = base64.b64encode(value.encode()).decode()
+            return self.ENCRYPTED_PREFIX + "B64:" + encoded
+
+    def decrypt_value(self, value: str) -> str:
+        """Decrypt a single string value."""
+        if not isinstance(value, str) or not value.startswith(self.ENCRYPTED_PREFIX):
+            return value
+
+        payload = value[len(self.ENCRYPTED_PREFIX):]
+
+        if payload.startswith("B64:"):
+            # Base64 fallback
+            return base64.b64decode(payload[4:]).decode()
+
+        if self._fernet:
+            try:
+                return self._fernet.decrypt(payload.encode()).decode()
+            except Exception as e:
+                logger.warning("[ENCRYPTION] Decrypt failed: %s", e)
+                return "[DECRYPTION FAILED]"
+
+        return value
+
+    def encrypt_properties(self, properties: Dict[str, Any],
+                            fields: Optional[List[str]] = None) -> Dict[str, Any]:
+        """Encrypt specified fields in a properties dict.
+
+        Args:
+            fields: Which fields to encrypt. Default: content, email, phone, ssn.
+        """
+        if not self._master_key:
+            return properties
+
+        target_fields = fields or ["content", "email", "phone", "ssn",
+                                    "credit_card", "aadhaar", "address"]
+        encrypted = dict(properties)
+        encrypted_fields = []
+
+        for field_name in target_fields:
+            if field_name in encrypted and isinstance(encrypted[field_name], str):
+                encrypted[field_name] = self.encrypt_value(encrypted[field_name])
+                encrypted_fields.append(field_name)
+
+                # Generate searchable token for encrypted field
+                token = self.searchable_token(str(properties[field_name]))
+                encrypted[f"_stok_{field_name}"] = token
+
+        if encrypted_fields:
+            encrypted["_encrypted_fields"] = encrypted_fields
+
+        return encrypted
+
+    def decrypt_properties(self, properties: Dict[str, Any]) -> Dict[str, Any]:
+        """Decrypt all encrypted fields in a properties dict."""
+        encrypted_fields = properties.get("_encrypted_fields", [])
+        if not encrypted_fields:
+            return properties
+
+        decrypted = dict(properties)
+        for field_name in encrypted_fields:
+            if field_name in decrypted:
+                decrypted[field_name] = self.decrypt_value(decrypted[field_name])
+
+        # Remove encryption metadata from output
+        decrypted.pop("_encrypted_fields", None)
+        for f in encrypted_fields:
+            decrypted.pop(f"_stok_{f}", None)
+
+        return decrypted
+
+    def searchable_token(self, value: str) -> str:
+        """Generate a deterministic searchable token for encrypted content.
+
+        This enables keyword search on encrypted fields without decryption:
+        - Same plaintext always produces the same token
+        - Token cannot be reversed to get the plaintext
+        - Allows exact-match search on encrypted fields
+
+        For substring search, tokens are generated for each word.
+        """
+        if not self._hmac_key:
+            return ""
+        h = hmac.new(self._hmac_key, value.lower().strip().encode(), hashlib.sha256)
+        return self.SEARCH_PREFIX + h.hexdigest()[:16]
+
+    def searchable_tokens_for_text(self, text: str) -> List[str]:
+        """Generate searchable tokens for each significant word in text.
+
+        Enables keyword search on encrypted content.
+        """
+        if not self._hmac_key:
+            return []
+        words = set(w.lower() for w in text.split() if len(w) > 3)
+        return [self.searchable_token(w) for w in words]
+
+
+# Global singleton
+_encryptor: Optional[FieldEncryptor] = None
+
+def get_encryptor() -> FieldEncryptor:
+    global _encryptor
+    if _encryptor is None:
+        _encryptor = FieldEncryptor()
+    return _encryptor