Security Fundamentals

{
  "vulnerabilities": {
    "injection": {
      "description": "SQL, NoSQL, OS, LDAP injection",
      "mitigation": [
        "Use parameterized queries",
        "Input validation",
        "Escape special characters"
      ]
    },
    "broken_authentication": {
      "description": "Authentication and session management flaws",
      "mitigation": [
        "Strong password policies",
        "Multi-factor authentication",
        "Secure session management"
      ]
    },
    "sensitive_data_exposure": {
      "description": "Insufficient protection of sensitive data",
      "mitigation": [
        "Encryption at rest and in transit",
        "Proper key management",
        "Data classification"
      ]
    }
  }
}

interface AccessPolicy {
    resource: string;
    action: string;
    conditions?: Condition[];
}

interface Condition {
    type: 'time' | 'ip' | 'role' | 'mfa';
    value: any;
}

class AccessControl {
    private policies: Map;

    constructor() {
        this.policies = new Map();
    }

    addPolicy(user: string, policy: AccessPolicy) {
        if (!this.policies.has(user)) {
            this.policies.set(user, []);
        }
        this.policies.get(user)?.push(policy);
    }

    async checkAccess(
        user: string,
        resource: string,
        action: string,
        context: any
    ): Promise {
        const userPolicies = this.policies.get(user) || [];
        
        for (const policy of userPolicies) {
            if (policy.resource === resource && 
                policy.action === action &&
                await this.checkConditions(policy.conditions, context)) {
                return true;
            }
        }
        
        return false;
    }

    private async checkConditions(
        conditions?: Condition[],
        context?: any
    ): Promise {
        if (!conditions) return true;
        
        for (const condition of conditions) {
            switch (condition.type) {
                case 'time':
                    if (!this.checkTimeCondition(condition.value)) {
                        return false;
                    }
                    break;
                case 'ip':
                    if (!this.checkIPCondition(condition.value, context.ip)) {
                        return false;
                    }
                    break;
                case 'role':
                    if (!context.roles.includes(condition.value)) {
                        return false;
                    }
                    break;
                case 'mfa':
                    if (!await this.checkMFACondition(context.user)) {
                        return false;
                    }
                    break;
            }
        }
        
        return true;
    }
}

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

class DataEncryption {
    private algorithm: string;
    private key: Buffer;

    constructor(key: Buffer) {
        this.algorithm = 'aes-256-gcm';
        this.key = key;
    }

    encrypt(data: string): {
        encrypted: Buffer,
        iv: Buffer,
        authTag: Buffer
    } {
        const iv = randomBytes(16);
        const cipher = createCipheriv(this.algorithm, this.key, iv);
        
        let encrypted = cipher.update(data, 'utf8');
        encrypted = Buffer.concat([encrypted, cipher.final()]);
        
        return {
            encrypted,
            iv,
            authTag: cipher.getAuthTag()
        };
    }

    decrypt(
        encrypted: Buffer,
        iv: Buffer,
        authTag: Buffer
    ): string {
        const decipher = createDecipheriv(this.algorithm, this.key, iv);
        decipher.setAuthTag(authTag);
        
        let decrypted = decipher.update(encrypted);
        decrypted = Buffer.concat([decrypted, decipher.final()]);
        
        return decrypted.toString('utf8');
    }
}