safetynet/packages/core/broker-audit.cjs

'use strict';
const {z}=require('zod');
const {FileFactsSchema}=require('./transfer-facts.cjs');
const {RequestFactsSchema}=require('./request-transfer-facts.cjs');
const BROKER_REASONS=Object.freeze(['broker-approved','broker-policy-block','broker-inspection-fault','broker-authority-expired','broker-audit-failed','broker-connect-denied','broker-auth-denied','broker-framing-block','broker-size-block','broker-request-aborted','broker-request-timeout','broker-upstream-failed','broker-response-invalid','broker-scan-timeout','broker-download-approved','broker-download-policy-block','broker-download-inspection-block']);
const BrokerFactsSchema=z.object({requestId:z.string().uuid(),connectionId:z.string().uuid().optional(),phase:z.enum(['connect.block','request.authorized','request.block','request.fault','forward.fault','response.scanned','response.block']),reason:z.enum(BROKER_REASONS),authorizedEventId:z.string().uuid().optional()}).strict();
const phaseReasons=Object.freeze({
  'connect.block':['broker-connect-denied','broker-auth-denied','broker-framing-block','broker-authority-expired','broker-audit-failed','broker-request-timeout','broker-size-block','broker-request-aborted'],
  'request.authorized':['broker-approved'],
  'request.block':['broker-scan-timeout','broker-policy-block','broker-authority-expired','broker-framing-block','broker-size-block','broker-request-aborted','broker-request-timeout'],
  'request.fault':['broker-inspection-fault','broker-audit-failed'],
  'response.scanned':['broker-download-approved'],
  'response.block':['broker-download-policy-block','broker-download-inspection-block'],
  'forward.fault':['broker-scan-timeout','broker-upstream-failed','broker-response-invalid','broker-request-aborted','broker-request-timeout','broker-authority-expired','broker-audit-failed']
});
function validateBrokerSemantics(event,context){
  if(!event.broker)return;
  const value=event.broker;
  const download=event.kind==='download.scan'||event.kind==='download.block',linked=value.phase==='forward.fault'||value.phase.startsWith('response.');
  const expectedKind=value.phase==='request.authorized'?'upload.authorized':value.phase==='response.scanned'?'download.scan':value.phase==='response.block'?'download.block':'upload.block';
  if(download?(!event.file||event.request||!value.phase.startsWith('response.')):(!event.request||event.file||value.phase.startsWith('response.')))context.addIssue({code:'custom',path:['broker'],message:'Broker transfer facts rejected'});
  if(event.kind!==expectedKind||!phaseReasons[value.phase].includes(value.reason)||linked&&!value.authorizedEventId||!linked&&value.authorizedEventId||value.authorizedEventId===event.eventId){
    context.addIssue({code:'custom',path:['broker'],message:'Broker lifecycle semantics rejected'});
  }
}
const BrokerAuditEventSchema=z.object({eventId:z.string().uuid(),kind:z.enum(['upload.authorized','upload.block','download.scan','download.block']),ruleId:z.string().min(1).max(100),policyVersion:z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),host:z.string().max(253).optional(),request:RequestFactsSchema.optional(),file:FileFactsSchema.optional(),broker:BrokerFactsSchema.optional(),traceId:z.string().regex(/^[a-f0-9]{32}$/).optional(),spanId:z.string().regex(/^[a-f0-9]{16}$/).optional()}).strict().superRefine((event,context)=>{validateBrokerSemantics(event,context);const download=event.kind.startsWith('download.');if(download?(!event.file||event.request):(!event.request||event.file))context.addIssue({code:'custom',message:'Exclusive transfer facts required'});});
module.exports={BrokerAuditEventSchema,BrokerFactsSchema,BROKER_REASONS,validateBrokerSemantics};