Security Model¶

// Input validation
import { z } from 'zod';

// User input validation schema
const UserInputSchema = z.object({
  email: z.string().email("Invalid email format"),
  name: z.string().min(1).max(255),
  password: z.string()
    .min(8, "Password must be at least 8 characters")
    .regex(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!#$%^&*])(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$/),
    "Password must contain at least one uppercase letter, one lowercase letter, one number, and one special character"),
  role: z.enum(['super_admin', 'admin', 'class="hljs">admin</span>', 'auditor', 'customer', 'viewer']),
});

class InputValidator {
  static validateUserInput(data: any): UserInput {
    return UserInputSchema.parse(data);
  }

  static sanitizeInput(data: string): string {
    // Basic XSS protection
    return data
      .replace(/<script\b[^<]*>/gi, '')
      .replace(/<iframe\b[^<]*>/gi, '')
      .replace(/<object\b[^<]*>/gi, '')
      .replace(/<embed\b[^<]*>/gi, '')
      .trim();
  }

  static validateEmail(email: string): boolean {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+\.[^\s@]+$/;
    return emailRegex.test(email);
  }

  static validatePassword(password: string): boolean {
    const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!#$%^&*])(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$/;
    return passwordRegex.test(password);
  }
}

// Session configuration
interface SessionConfig {
  secret: string;
  maxAge: number;
  secure: boolean;
  httpOnly: boolean;
  sameSite: 'strict' | 'lax' | 'none';
  domain?: string;
  path?: string;
}

class SessionManager {
  private config: SessionConfig;

  constructor(config: SessionConfig) {
    this.config = config;
  }

  createSession(user: User): SessionData {
    return {
      id: crypto.randomUUID(),
      userId: user.id,
      email: user.email,
      name: user.name,
      role: user.role,
      permissions: this.getUserPermissions(user),
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + this.config.maxAge * 1000),
      lastAccessedAt: new Date(),
    };
  }

  async validateSession(sessionData: SessionData): Promise<boolean> {
    // Check if session exists
    const session = await this.getSession(sessionData.id);

    if (!session) {
      return false;
    }

    // Check if session is expired
    if (this.isExpired(session)) {
      return false;
    }

    // Check if user is still valid
    const user = await UserService.findById(sessionData.userId);
    if (!user || user.status !== 'active') {
      return false;
    }

    // Update last accessed time
    await this.updateLastAccessed(sessionData.id);

    return true;
  }

  private async getSession(sessionId: string): Promise<SessionData | null> {
    // Get session from cache or database
    return await CacheService.get(`session:${sessionId}`);
  }

  private isExpired(session: SessionData): boolean {
    return Date.now() > session.expiresAt;
  }

  private async updateLastAccessed(sessionId: string): Promise<void> {
    const session = await this.getSession(sessionId);
    if (session) {
      session.lastAccessedAt = new Date();
      await CacheService.set(`session:${sessionId}`, session);
    }
  }

  private getUserPermissions(user: User): string[] {
    // Get user permissions based on role
    switch (user.role) {
      case 'super_admin':
        return ['*'];
      case 'admin':
        return ['read', 'write', 'delete', 'user_management'];
      case 'manager':
        return ['read', 'write', 'project_management', 'team_management'];
      case 'auditor':
        return ['read', 'audit', 'reporting'];
      case 'customer':
        return ['read', 'write', 'own_data'];
      case 'viewer':
        return ['read'];
      default:
        return [];
    }
  }
}

// Encryption service
import crypto from 'crypto';

class EncryptionService {
  private algorithm = 'aes-256-gcm';
  private keyLength = 32;
  private ivLength = 16;
  private tagLength = 16;

  private key: Buffer;

  constructor(key: string) {
    this.key = Buffer.from(key, 'hex');
  }

  encrypt(data: string): EncryptedData {
    const iv = crypto.randomBytes(this.ivLength);
    const cipher = crypto.createCipher(this.algorithm, this.key, iv, null);

    let encrypted = cipher.update(data, 'utf8');
    encrypted = cipher.final();

    const tag = crypto.randomBytes(this.tagLength);

    return {
      encrypted: Buffer.concat([encrypted, iv, tag]).toString('base64'),
      iv: iv.toString('hex'),
      tag: tag.toString('hex'),
    };
  }

  decrypt(encryptedData: string): string {
    const parts = encryptedData.split(':');
    const iv = Buffer.from(parts[1], 'hex');
    const tag = Buffer.from(parts[2], 'hex');
    const encrypted = Buffer.from(parts[0], 'base64');

    const cipher = crypto.createDecipher(this.algorithm, this.key, iv, tag);

    const decrypted = cipher.setAuthTag(tag);
    const decryptedData = cipher.update(encrypted, null);

    return decryptedData.toString('utf8');
  }

  generateKey(): string {
    return crypto.randomBytes(this.keyLength).toString('hex');
  }

  rotateKey(): void {
    this.key = this.generateKey();
  }
}

interface EncryptedData {
  encrypted: string;
  iv: string;
  tag: string;
}

// Data classification
enum DataClassification {
  PUBLIC = 'public',
  INTERNAL = 'internal',
  CONFIDENTIAL = 'confidential',
  RESTRICTED = 'restricted'
}

interface DataClassificationRule {
  classification: DataClassification;
  retentionPeriod: number; // days
  encryptionRequired: boolean;
  accessControl: string[];
  loggingRequired: boolean;
  auditRequired: boolean;
}

class DataClassificationService {
  private rules: Map<string, DataClassificationRule> = new Map();

  constructor() {
    this.initializeRules();
  }

  private initializeRules(): void {
    // Initialize classification rules
    this.rules.set('public', {
      classification: DataClassification.PUBLIC,
      retentionPeriod: 365,
      encryptionRequired: false,
      accessControl: ['everyone'],
      loggingRequired: false,
      auditRequired: false,
    });

    this.rules.set('internal', {
      classification: DataClassification.INTERNAL,
      retentionPeriod: 730,
      encryptionRequired: false,
      accessControl: ['employees'],
      loggingRequired: true,
      auditRequired: false,
    });

    this.rules.set('confidential', {
      classification: DataClassification.CONFIDENTIAL,
      retentionPeriod: 1825, // 5 years
      encryptionRequired: true,
      accessControl: ['authorized'],
      loggingRequired: true,
      auditRequired: true,
    });

    this.rules.set('restricted', {
      classification: DataClassification.RESTRICTED,
      retentionPeriod: 3650, // 10 years
      encryptionRequired: true,
      accessControl: ['admin', 'security'],
      loggingRequired: true,
      auditRequired: true,
    });
  }

  classifyData(data: any): DataClassification {
    // Classify data based on content and context
    if (this.isPublicData(data)) {
      return DataClassification.PUBLIC;
    }

    if (this.isInternalData(data)) {
      return DataClassification.INTERNAL;
    }

    if (this.isConfidentialData(data)) {
      return DataClassification.CONFIDENTIAL;
    }

    if (this.isRestrictedData(data)) {
      return DataClassification.RESTRICTED;
    }

    return DataClassification.INTERNAL;
  }

  getRetentionPeriod(classification: DataClassification): number {
    const rule = this.rules.get(classification);
    return rule?.retentionPeriod || 365;
  }

  isEncryptionRequired(classification: DataClassification): boolean {
    const rule = this.rules.get(classification);
    return rule?.encryptionRequired || false;
  }

  getAccessControl(classification: DataClassification): string[] {
    const rule = this.rules.get(classification);
    return rule?.accessControl || [];
  }

  isLoggingRequired(classification: DataClassification): boolean {
    const rule = this.rules.get(classification);
    return rule?.loggingRequired || false;
  }

  isAuditRequired(classification: DataClassification): boolean {
    const rule = this.rules.get(classification);
    return rule?.auditRequired || false;
  }

  private isPublicData(data: any): boolean {
    // Check if data is public
    return (
      !this.containsSensitiveData(data) &&
      !this.containsPersonalData(data) &&
      !this.containsFinancialData(data)
    );
  }

  private isInternalData(data: any): boolean {
    // Check if data is internal
    return (
      this.containsInternalData(data) &&
      !this.containsSensitiveData(data) &&
      !this.containsPersonalData(data) &&
      !this.containsFinancialData(data)
    );
  }

  private isConfidentialData(data: any): boolean {
    // Check if data is confidential
    return (
      this.containsSensitiveData(data) ||
      this.containsPersonalData(data) ||
      this.containsFinancialData(data)
    );
  }

  private isRestrictedData(data: any): boolean {
    // Check if data is restricted
    return (
      this.containsHighlySensitiveData(data) ||
      this.containsLegalData(data) ||
      this.containsHealthData(data)
    );
  }

  private containsSensitiveData(data: any): boolean {
    // Check for sensitive data patterns
    const sensitivePatterns = [
      /password/i,
      /secret/i,
      /token/i,
      /key/i,
      /credential/i,
      /auth/i,
      /login/i,
    ];

    return sensitivePatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  private containsPersonalData(data: any): boolean {
    // Check for personal data patterns
    const personalPatterns = [
      /email/i,
      /phone/i,
      /address/i,
      /ssn/i,
      /passport/i,
      /driver_license/i,
      /medical/i,
      /health/i,
    ];

    return personalPatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  private containsFinancialData(data: any): boolean {
    // Check for financial data patterns
    const financialPatterns = [
      /credit_card/i,
      /bank_account/i,
      /routing_number/i,
      /account_number/i,
      /transaction/i,
      /payment/i,
    ];

    return financialPatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  private containsInternalData(data: any): boolean {
    // Check for internal data patterns
    const internalPatterns = [
      /internal/i,
      /employee/i,
      /staff/i,
      /team/i,
      /project/i,
      /internal_data/i,
    ];

    return internalPatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  containsHighlySensitiveData(data: any): boolean {
    // Check for highly sensitive data patterns
    const highlySensitivePatterns = [
      /social_security_number/i,
      /medical_record/i,
      /legal_document/i,
      /trade_secret/i,
      /proprietary/i,
    ];

    return highlySensitivePatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  containsLegalData(data: any): boolean {
    // Check for legal data patterns
    const legalPatterns = [
      /legal/i,
      /attorney/i,
      /contract/i,
      /lawsuit/i,
      /court/i,
      /regulation/i,
    ];

    return legalPatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }

  containsHealthData(data: any): boolean {
    // Check for health data patterns
    const healthPatterns = [
      /medical_history/i,
      /diagnosis/i,
      /treatment/i,
      /medication/i,
      /health_record/i,
    ];

    return healthPatterns.some(pattern => pattern.test(JSON.stringify(data)));
  }
}

// MFA configuration
interface MFAConfig {
  enabled: boolean;
  methods: MFA_Method[];
  backupMethods: MFA_Method[];
  gracePeriod: number;
  enforcement: MFA_Enforcement;
}

enum MFA_Method {
  TOTP = 'totp';
  SMS = 'sms';
  EMAIL = 'email';
  BACKUP = 'backup';
}

enum MFA_Enforcement {
  OPTIONAL = 'optional';
  REQUIRED = 'required';
  STRICT = 'strict';
}

class MFAService {
  private config: MFAConfig;

  constructor(config: MFAConfig) {
    this.config = config;
  }

  async enableMFA(user: User, method: MFA_Method): Promise<MFA_Secret> {
    const secret = this.generateSecret(method);

    // Store MFA secret
    await MFASecretService.create(user.id, method, secret);

    // Update user MFA status
    await UserService.updateMFA(user.id, {
      enabled: true,
      methods: [method],
      backupMethods: this.config.backupMethods,
      enabledAt: new Date(),
    });

    return secret;
  }

  async verifyMFA(user: User, method: MFA_Method, code: string): Promise<boolean> {
    const secret = await MFASecretService.getLatest(user.id, method);

    if (!secret) {
      return false;
    }

    const isValid = this.verifyCode(secret, code);

    if (isValid) {
      // Update last used timestamp
      await MFASecretService.updateLastUsed(secret.id);
    }

    return isValid;
  }

  private generateSecret(method: MFA_Method): MFA_Secret {
    switch (method) {
      case MFA_Method.TOTP:
        return this.generateTOTPSecret();
      case MFA_Method.SMS:
        return this.generateSMSSecret();
      case MFA_Method.EMAIL:
        return this.generateEmailSecret();
      case MFA_Method.BACKUP:
        return this.generateBackupSecret();
      default:
        throw new Error(`Unsupported MFA method: ${method}`);
    }
  }

  private generateTOTPSecret(): MFA_Secret {
    const secret = speakeasy.generateSecret({
      name: 'Studio Platform',
      issuer: 'studio-platform',
      label: 'MFA Secret',
      algorithm: 'sha256',
      digits: 6,
      period: 30,
    });

    return {
      secret: secret.base32,
      backup: secret.base32,
      method: MFA_Method.TOTP,
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + 30 * 24 * 60 * 1000),
      lastUsedAt: null,
    };
  }

  private generateSMSSecret(): MFA_Secret {
    const secret = Math.random().toString().slice(2, 8);

    return {
      secret: secret,
      backup: secret,
      method: MFA_Method.SMS,
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + 5 * 60 * 1000),
      lastUsedAt: null,
    };
  }

  private generateEmailSecret(): MFA_Secret {
    const secret = crypto.randomBytes(32).toString('hex');

    return {
      secret: secret,
      backup: secret,
      method: MFA_Method.EMAIL,
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + 10 * 60 * 1000),
      lastUsedAt: null,
    };
  }

  private generateBackupSecret(): MFA_Secret {
    const secret = crypto.randomBytes(32).toString('hex');

    return {
      secret: secret,
      backup: secret,
      method: MFA_Method.BACKUP,
      createdAt: new Date(),
      expiresAt: new Date(Date.now() + 30 * 24 * 60 * 1000),
      lastUsedAt: null,
    };
  }

  verifyCode(secret: MFA_Secret, code: string): boolean {
    const expectedCode = this.generateCode(secret);
    return code === expectedCode;
  }

  private generateCode(secret: MFA_Secret): string {
    // Generate verification code based on secret
    return speakeasy.totp({
      secret: secret.secret,
      encoding: 'base32',
      label: 'Studio Platform',
      time: Math.floor(Date.now() / 1000 / 30),
    });
  }
}

interface MFA_Secret {
  secret: string;
  backup: string;
  method: MFA_Method;
  createdAt: Date;
  expiresAt: Date;
  lastUsedAt: Date | null;
}

// OAuth 2.0 flow
class OAuth2Service {
  async getAuthorizationUrl(provider: string, state: string): Promise<string> {
    const config = this.getProviderConfig(provider);

    const params = new URLSearchParams({
      response_type: 'code',
      client_id: config.client_id,
      redirect_uri: config.redirect_uri,
      scope: config.scopes.join(' '),
      state: state,
    });

    return `${config.authorization_url}?${params}`;
  }

  async exchangeCodeForToken(provider: string, code: string, state: string): Promise<TokenResponse> {
    const config = this.getProviderConfig(provider);

    const tokenResponse = await fetch(config.token_url, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        code: code,
        client_id: config.client_id,
        client_secret: config.client_secret,
        redirect_uri: config.redirect_uri,
        state: state,
      }),
    });

    return tokenResponse.json();
  }

  async refreshAccessToken(provider: string, refreshToken: string): Promise<TokenResponse> {
    const config = this.getProviderConfig(provider);

    const tokenResponse = await fetch(config.token_url, {
      method: 'POST',
      headers: {
        'Content-Type': 'interface"application/x-www-form-urlencoded',
      },
      body: new URLSearchParams({
        grant_type: 'refresh_token',
        refresh_token: refreshToken,
        client_id: config.client_id,
        client_secret: config.client_secret,
      }),
    });

    return tokenResponse.json();
  }

  private getProviderConfig(provider: string): OAuth2Config {
    const configs = {
      google: {
        authorization_url: 'https://accounts.google.com/o/oauth2/v2/auth',
        token_url: 'https://oauth2.googleapis.com/token',
        client_id: process.env.GOOGLE_CLIENT_ID,
        client_secret: process.env.GOOGLE_CLIENT_SECRET,
        redirect_uri: process.env.GOOGLE_REDIRECT_URI,
        scopes: ['https://www.googleapis.com/auth/drive', 'https://www.googleapis.com/auth/calendar'],
      },
      microsoft: {
        authorization_url: `https://login.microsoftonline.com/${process.env.MICROSOFT_TENANT_ID}/oauth2/v2.0/authorize`,
        token_url: `https://login.microsoftonline.com/${process.env.MICROSOFT_TENANT_ID}/oauth2/v2.0/token`,
        client_id: process.env.MICROSOFT_CLIENT_ID,
        client_secret: process.env.MICROSOFT_CLIENT_SECRET,
        redirect_uri: process.env.MICROSOFT_REDIRECT_URI,
        scopes: ['https://graph.microsoft.com/Files.ReadWrite', 'https://graph.microsoft.com/Calendars.ReadWrite'],
      },
    };

    const config = configs[provider];
    if (!config) {
      throw new Error(`OAuth2 provider not found: ${provider}`);
    }

    return config;
  }
}

interface TokenResponse {
  access_token: string;
  token_type: string;
  expires_in: number;
  refresh_token: string;
  scope: string;
  id_token?: string;
}

// RBAC implementation
interface Role {
  id: string;
  name: string;
  description: string;
  permissions: Permission[];
  created_at: Date;
  updated_at: Date;
}

interface Permission {
  id: string;
  name: string;
  description: string;
  resource: string;
  action: string;
  created_at: Date;
  updated_at: Date;
}

class RBACService {
  private roles: Map<string, Role> = new Map();
  private permissions: Map<string, Permission> = new Map();

  async createRole(roleData: Partial<Role>): Promise<Role> {
    const role: Role = {
      id: crypto.randomUUID(),
      name: roleData.name,
      description: roleData.description,
      permissions: roleData.permissions || [],
      created_at: new Date(),
      updated_at: new Date(),
    };

    this.roles.set(role.id, role);
    return role;
  }

  async createPermission(permissionData: Partial<Permission>): Promise<Permission> {
    const permission: Permission = {
      id: crypto.randomUUID(),
      name: permissionData.name,
      description: permissionData.description,
      resource: permissionData.resource,
      action: permissionData.action,
      created_at: new Date(),
      updated_at: new Date(),
    };

    this.permissions.set(permission.id, permission);
    return permission;
  }

  async assignRoleToUser(userId: string, roleId: string): Promise<void> {
    await UserRole.create({
      userId,
      roleId,
      assignedAt: new Date(),
    });
  }

  async getUserRoles(userId: Promise<Role[]> {
    const userRoles = await UserRole.findAll({
      where: { userId },
      include: [Role],
    });

    return userRoles.map(ur => ur.role);
  }

  async hasPermission(userId: string, resource: string, action: string): Promise<boolean> {
    const userRoles = await this.getUserRoles(userId);

    for (const role of userRoles) {
      const roleDetails = this.roles.get(role.id);

      if (roleDetails) {
        const hasPermission = roleDetails.permissions.some(
          permission =>
            permission.resource === resource && permission.action === action
        );

        if (hasPermission) {
          return true;
        }
      }
    }

    return false;
  }

  async hasAnyPermission(userId: string, resource: string, actions: string[]): Promise<boolean> {
    const userRoles = await this.getUserRoles(userId);

    for (const role of userRoles) {
      const roleDetails = this.roles.get(role.id);

      if (roleDetails) {
        const hasAnyPermission = roleDetails.permissions.some(
          permission =>
            permission.resource === resource &&
            actions.includes(permission.action)
        );

        if (hasAnyPermission) {
          return true;
        }
      }
    }

    return false;
  }