WDP Part 11: Security Considerations

┌─────────────────────────────────────────┐
│ 1. Prevention (Do not include PII)      │
│ 2. Detection (Sanitize before output)   │
│ 3. Mitigation (Redact in logs)          │
│ 4. Monitoring (Alert on violations)     │
└─────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────┐
│  CATALOG (Static, Distributed, Cached)                   │
│  REQUIRED: NO PII EVER                                   │
│  - Message templates with {{field}} placeholders         │
│  - PII placeholders use {{pii/field}} syntax             │
│  - Generic descriptions and hints                        │
│  - No hardcoded personal information                     │
└──────────────────────────────────────────────────────────┘
                          ▼
┌──────────────────────────────────────────────────────────┐
│  RUNTIME RESPONSE (Dynamic, Ephemeral)                   │
│  REQUIRED: PII ONLY IN pii.data FIELD                    │
│  - Regular fields in `f` object                          │
│  - PII fields in `pii.data` object                       │
│  - Referenced via {{pii/field}} in templates             │
│  - Access control enforced at render time                │
└──────────────────────────────────────────────────────────┘

// Catalog:
{
  "xY9Kp": {
    "code": "E.Auth.Login.001",
    "message": "Invalid credentials for user {{user_id}}",
    "description": "Authentication failed due to incorrect credentials",
    "hints": ["Verify your password", "Check if account is locked"]
  }
}

// Runtime (opaque ID only, no PII):
{
  "xY9Kp": {
    "f": {
      "user_id": "usr_8d7f9a2b"  // Correct: Opaque identifier (not PII)
    }
  }
}

// Catalog (PII placeholder):
{
  "Ay75d": {
    "code": "E.Auth.Token.001",
    "message": "Token for {{pii/email}} expired at {{timestamp}}",
    "description": "Your session has expired. Please log in again."
  }
}

// Runtime (PII in pii.data field):
{
  "Ay75d": {
    "f": {
      "timestamp": "2024-01-15T10:30:00Z"  // Correct: Non-PII in f
    },
    "pii": {
      "v": 1,
      "data": {
        "email": "john@example.com"  // Correct: PII in pii.data
      }
    }
  }
}

// Rendered (with PII access):
// "Token for john@example.com expired at 2024-01-15T10:30:00Z"

// Rendered (without PII access):
// "Token for [REDACTED] expired at 2024-01-15T10:30:00Z"

// Incorrect: Catalog with hardcoded PII (NEVER DO THIS):
{
  "xY9Kp": {
    "code": "E.Auth.Login.001",
    "message": "Invalid credentials for user john.doe@example.com",  // Violation: Hardcoded PII
    "description": "Contact support at +1-555-0100",  // Violation: Phone number
    "hints": ["Email admin@company.com for password reset"]  // Violation: Email
  }
}

// Incorrect: Runtime with PII in wrong field:
{
  "xY9Kp": {
    "f": {
      "email": "john.doe@example.com",  // Violation: PII in f field (should be in pii.data)
      "password": "secret123"  // CRITICAL VIOLATION: NEVER include passwords anywhere!
    }
  }
}

// Incorrect: Using wrong placeholder syntax:
{
  "message": "Login failed for {{email}}",  // Violation: Should be {{pii/email}}
  "f": {"email": "john@example.com"}  // Violation: And shouldn't be in f at all
}

// Incorrect: PII in ctx field:
{
  "ctx": {
    "v": 1,
    "user": {
      "email": "john@example.com"  // Violation: PII in ctx (should be in pii.data)
    }
  }
}

// Incorrect: PII in catalog
{
  "diags": {
    "xY9Kp": {
      "code": "E.Auth.Login.001",
      "message": "Login failed for john.doe@example.com",  // Violation: Hardcoded email
      "description": "User John Doe from IP 192.168.1.100 failed authentication",  // Violation: Name + IP
      "hints": [
        "Contact John at +1-555-0100",  // Violation: Name + phone
        "Your session ID is abc123xyz"  // Violation: Session data
      ],
      "tags": ["user:john-doe", "email:john@example.com"],  // Violation: PII in tags
      "docs_url": "https://docs.example.com/users/john-doe/auth"  // Violation: Username in URL
    }
  }
}

// Correct: No PII in catalog
{
  "diags": {
    "xY9Kp": {
      "code": "E.Auth.Login.001",
      "message": "Authentication failed for user {{user_id}}",  // Correct: Placeholder
      "description": "Login attempt failed due to invalid credentials",  // Correct: Generic
      "hints": [
        "Verify your password is correct",  // Correct: Generic help
        "Check if your account is locked"  // Correct: No personal info
      ],
      "tags": ["auth", "login", "security"],  // Correct: Technical tags
      "docs_url": "https://docs.example.com/auth/troubleshooting"  // Correct: Generic URL
    }
  }
}

// Incorrect: PII in code components
"E.Auth.JohnDoe.001"           // Username in Component
"E.JohnDoeService.Token.001"   // Username in Component
"E.Auth.JohnDoeToken.001"      // Username in Primary
"E.Auth.Token.JOHN_DOE_001"    // Username in Sequence

// Correct: Generic code components
"E.Auth.User.001"              // Generic Component
"E.UserService.Token.001"      // Generic Component
"E.Auth.Token.001"             // Generic Primary
"E.Auth.Token.EXPIRED"         // Generic Sequence name

function sanitizeStackTrace(stack: string): string {
  return stack
    .replace(/\/home\/[^\/]+\//g, '/home/USER/')  // Remove username
    .replace(/C:\\Users\\[^\\]+\\/g, 'C:\\Users\\USER\\')  // Windows
    .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, '[EMAIL]')  // Emails
    .replace(/\b\d{3}-\d{2}-\d{4}\b/g, '[SSN]')  // SSN
    .slice(0, 2000);  // Limit length
}

| Vector          | Risk | Example | Mitigation |
|-----------------|------|---------|------------|
| Log Messages    | HIGH | logger.info('User john@example.com logged in') | Use user_id |
| Structured Logs | HIGH | {user: {email: "..."}} | Sanitize before logging |
| Metrics Tags    | MEDIUM | user:john-doe | Use hashed IDs |
| Trace IDs       | SAFE | trace_abc123 | Safe if opaque |

{
  "success": false,
  "error": "Authentication failed for john.doe@example.com",  // Violation: Message
  "user": {
    "email": "john.doe@example.com",  // Violation: Application data
    "phone": "+1-555-0100"  // Violation: Application data
  },
  "wd": {
    "xY9Kp": {
      "f": {
        "email": "john.doe@example.com",  // Violation: Diagnostic field
        "ip_address": "192.168.1.100",  // Violation: Diagnostic field
        "session_token": "abc123xyz"  // Violation: Diagnostic field
      }
    }
  }
}

{
  "h": "Ay75d",
  "f": {
    "timestamp": "2024-01-15T10:30:00Z",
    "count": 42
  },
  "pii": {
    "v": 1,
    "data": {
      "email": "john@example.com",
      "ip": "192.168.1.1"
    }
  }
}

// Incorrect:
const diagnostic = {
  compactId: "aG8eT",
  fields: {
    email: "alice@example.com",
    name: "Alice Johnson"
  }
};

// Correct:
const diagnostic = {
  compactId: "aG8eT",
  fields: {
    user_id: "usr_9k3m2n1p",
    field: "email"
  }
};

const PII_PATTERNS = {
  email: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/,
  phone: /\b(\+\d{1,3}[- ]?)?\(?\d{3}\)?[- ]?\d{3}[- ]?\d{4}\b/,
  ssn: /\b\d{3}-\d{2}-\d{4}\b/,
  credit_card: /\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/,
  ip_address: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
  jwt: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/
};

function containsPII(text: string): boolean {
  return Object.values(PII_PATTERNS).some(pattern => pattern.test(text));
}

{
  "Ay75d": {
    "code": "E.AUTH.TOKEN.001",
    "message": "Token for {{pii/email}} expired at {{timestamp}}",
    "description": "Your session has expired.",
    "contains_pii": true,
    "pii_fields": ["email"],
    "requires_pii_access": true
  }
}

Catalog Files (Static Content)
[ ] No hardcoded PII in messages
[ ] PII uses {{pii/field}} placeholder syntax
[ ] Regular fields use {{field}} syntax
[ ] contains_pii: true metadata present when using {{pii/...}}

Diagnostic Codes (Structure)
[ ] Component name does not contain PII
[ ] Primary name does not contain PII
[ ] Sequence does not contain PII

Runtime Fields (Wire Format)
[ ] PII data is in pii.data field ONLY
[ ] Non-PII data is in f field
[ ] No PII in ctx field
[ ] No PII in st (stack trace) field

{
  "E.Auth.Token.001": {
    "message": "Invalid token: {{token}}",
    "fields": ["token"]
  }
}

// Runtime:
{
  "xY9Kp": {
    "f": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
  }
}

{
  "E.Auth.Token.001": {
    "message": "Token validation failed",
    "fields": []
  }
}

// Runtime:
{
  "xY9Kp": {}
}

{
  "E.Auth.Token.002": {
    "message": "Token expired at {{expired_at}}",
    "fields": ["expired_at"]
  }
}

// Runtime:
{
  "xY9Kp": {
    "f": {
      "expired_at": "2024-01-15T10:30:00Z"
    }
  }
}

{
  "message": "Query failed: SELECT * FROM users WHERE email='{{email}}' AND password_hash='{{hash}}'"
}

{
  "message": "Database query failed",
  "fields": []
}

{
  "message": "Database query failed on table {{table}}",
  "fields": ["table"]
}

// Runtime:
{
  "f": {
    "table": "users" // Table name OK, no data
  }
}

{
  "message": "File not found: /home/admin/.ssh/id_rsa"
}

{
  "message": "Configuration file not found: {{filename}}",
  "fields": ["filename"]
}

// Runtime:
{
  "f": {
    "filename": "config.json" // Relative path only
  }
}

{
  "diags": {
    "xY9Kp": {
      "code": "E.Payment.Process.001",
      "message": "Payment failed for order {{order_id}}",
      "fields": ["order_id"],
      "field_security": {
        "order_id": {
          "sensitive": false,
          "redact_in_logs": false
        }
      }
    },
    "mN3Yr": {
      "code": "E.Payment.Card.002",
      "message": "Card validation failed",
      "fields": ["last4"],
      "field_security": {
        "last4": {
          "sensitive": true,
          "redact_in_logs": true,
          "max_log_level": "warn"
        }
      }
    }
  }
}

interface FieldSecurityPolicy {
  sensitive: boolean;
  redact_in_logs: boolean;
  redaction_strategy: 'hash' | 'mask' | 'remove';
  allowed_contexts: ('api' | 'logs' | 'monitoring')[];
}

function sanitizeField(
  value: any,
  policy: FieldSecurityPolicy,
  context: string
): any {
  if (!policy.sensitive) {
    return value;
  }
  
  if (!policy.allowed_contexts.includes(context)) {
    return '[REDACTED]';
  }
  
  switch (policy.redaction_strategy) {
    case 'hash':
      return hashValue(value);
    case 'mask':
      return maskValue(value);
    case 'remove':
      return undefined;
    default:
      return value;
  }
}

const FIELD_LIMITS = {
  max_string_length: 1000,
  max_array_length: 100,
  max_object_depth: 3,
  max_total_size: 10 * 1024 // 10KB
};

function validateFieldSize(fields: Record<string, any>): void {
  const json = JSON.stringify(fields);
  
  if (json.length > FIELD_LIMITS.max_total_size) {
    throw new Error('Diagnostic fields exceed size limit');
  }
  
  // Additional validation...
}

function sanitizeForLogs(value: string): string {
  return value
    // Remove control characters, but keep \t, \n, \r for now
    .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
    // Replace newlines and tabs with a space
    .replace(/[\r\n\t]/g, ' ')
    .trim()
    .slice(0, 500); // Max length
}

// Usage:
logger.error(`Validation failed`, {
  diagnostic: "E.Validation.Field.001",
  field: sanitizeForLogs(userInput)
});

<script 
  src="https://cdn.example.com/wdp/catalog-v1.0.0.json"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"
></script>

openssl dgst -sha384 -binary catalog.json | openssl base64 -A

{
  "version": "1.0.0",
  "generated": "2024-01-15T10:30:00Z",
  "diags": { /* ... */ },
  "signature": {
    "algorithm": "RS256",
    "public_key_url": "https://example.com/wdp/public-key.pem",
    "signature": "MEUCIQDx..."
  }
}

async function verifyCatalog(catalog: any): Promise<boolean> {
  const { signature, ...content } = catalog;
  const publicKey = await fetchPublicKey(signature.public_key_url);
  
  return verifySignature(
    JSON.stringify(content),
    signature.signature,
    publicKey,
    signature.algorithm
  );
}

GET /api/wdp/catalog-internal.json HTTP/1.1
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

async function serveCatalog(req: Request): Promise<Response> {
  const user = await authenticate(req);
  
  if (!user.hasRole('admin')) {
    // Return public catalog only
    return sendFile('catalog-public.json');
  }
  
  // Return full catalog with internal diagnostics
  return sendFile('catalog-internal.json');
}

{
  "diags": {
    "xY9Kp": {
      "code": "E.Input.Validation.001",
      "message": "Invalid value: {{value}}",
      "fields": ["value"]
    }
  }
}

function displayDiagnostic(diagnostic: ExpandedDiagnostic): string {
  // Always escape user-provided values
  const escaped = escapeHtml(diagnostic.message);
  return escaped;
}

function escapeHtml(text: string): string {
  return text
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#039;");
}

// Enforce HTTPS in production
if (process.env.NODE_ENV === 'production') {
  if (req.protocol !== 'https') {
    return res.redirect(301, `https://${req.hostname}${req.url}`);
  }
}

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

const trustedCertificates = [
  '-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----'
];

async function fetchCatalogSecure(url: string): Promise<Catalog> {
  const response = await fetch(url, {
    // Verify certificate
    agent: new https.Agent({
      ca: trustedCertificates
    })
  });
  
  return response.json();
}

const rateLimiter = new RateLimiter({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // Max 100 diagnostics per minute per IP
  message: {
    "C.RateLimit.Exceeded.001": {
      "f": {
        "retry_after": "60"
      }
    }
  }
});

app.use('/api/diagnostics', rateLimiter);

class SecureLogger {
  private sanitize(message: string, fields: Record<string, any>): void {
    // Check for PII
    if (containsPII(message)) {
      throw new Error('PII detected in log message');
    }
    
    // Redact sensitive fields
    const sanitized = { ...fields };
    for (const [key, value] of Object.entries(sanitized)) {
      if (SENSITIVE_FIELD_NAMES.includes(key)) {
        sanitized[key] = '[REDACTED]';
      }
    }
    
    return sanitized;
  }
  
  error(message: string, fields?: Record<string, any>): void {
    const sanitized = this.sanitize(message, fields || {});
    console.error(message, sanitized);
  }
}

interface LogRetentionPolicy {
  severity: string;
  retention_days: number;
  archive_after_days: number;
  purge_pii: boolean;
}

const RETENTION_POLICIES: Record<string, LogRetentionPolicy> = {
  'E': { retention_days: 90, archive_after_days: 30, purge_pii: true },
  'W': { retention_days: 60, archive_after_days: 30, purge_pii: true },
  'C': { retention_days: 365, archive_after_days: 90, purge_pii: false },
  'I': { retention_days: 30, archive_after_days: 7, purge_pii: true }
};

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

class EncryptedLogStorage {
  private algorithm = 'aes-256-gcm';
  private key: Buffer;
  
  constructor(encryptionKey: string) {
    this.key = Buffer.from(encryptionKey, 'hex');
  }
  
  encrypt(data: string): { encrypted: string; iv: string; tag: string } {
    const iv = randomBytes(16);
    const cipher = createCipheriv(this.algorithm, this.key, iv);
    
    let encrypted = cipher.update(data, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    
    const tag = cipher.getAuthTag();
    
    return {
      encrypted,
      iv: iv.toString('hex'),
      tag: tag.toString('hex')
    };
  }
}

interface AuditLog {
  timestamp: string;
  user_id?: string;
  ip_address?: string;
  diagnostic_code: string;
  compact_id: string;
  severity: string;
  action: string;
  result: 'success' | 'failure';
}

function logSecurityEvent(diagnostic: Diagnostic, context: AuditContext): void {
  if (SECURITY_DIAGNOSTICS.includes(diagnostic.code)) {
    auditLogger.log({
      timestamp: new Date().toISOString(),
      user_id: context.userId,
      ip_address: hashIP(context.ipAddress), // Hash IP for privacy
      diagnostic_code: diagnostic.code,
      compact_id: diagnostic.compactId,
      severity: diagnostic.severity,
      action: context.action,
      result: context.result
    });
  }
}

enum VisibilityLevel {
  PUBLIC = 0,      // User-facing diagnostics
  INTERNAL = 1,    // Internal team only
  CONFIDENTIAL = 2, // Security team only
  RESTRICTED = 3   // Admin only
}

interface DiagnosticMetadata {
  code: string;
  visibility: VisibilityLevel;
  requires_role?: string[];
}

function filterDiagnosticsByRole(
  diagnostics: Diagnostic[],
  userRole: string
): Diagnostic[] {
  const roleLevel = ROLE_LEVELS[userRole] || 0;
  
  return diagnostics.filter(diag => {
    const metadata = DIAGNOSTIC_METADATA[diag.code];
    return metadata.visibility <= roleLevel;
  });
}

// Usage:
app.get('/api/diagnostics', authenticate, (req, res) => {
  const allDiagnostics = getDiagnostics();
  const filtered = filterDiagnosticsByRole(allDiagnostics, req.user.role);
  res.json({ diagnostics: filtered });
});

function generateDiagnostic(
  code: string,
  context: 'api' | 'internal' | 'monitoring'
): Diagnostic {
  const base = DIAGNOSTICS[code];
  
  switch (context) {
    case 'api':
      // Minimal details for external API
      return {
        code: base.code,
        compact_id: base.compact_id,
        message: base.message_public,
        severity: base.severity
      };
      
    case 'internal':
      // Full details for internal use
      return {
        code: base.code,
        compact_id: base.compact_id,
        message: base.message_internal,
        severity: base.severity,
        description: base.description,
        hints: base.hints,
        stack_trace: base.stack_trace
      };
      
    case 'monitoring':
      // Metrics-focused
      return {
        code: base.code,
        compact_id: base.compact_id,
        severity: base.severity,
        tags: base.tags,
        metrics: base.metrics
      };
  }
}

{
  "C.Security.Breach.001": {
    "code": "C.Security.Breach.001",
    "severity": "C",
    "message": "Unauthorized access attempt detected",
    "description": "Multiple failed authentication attempts from {{ip_hash}}",
    "fields": ["ip_hash"],
    "security_level": "critical",
    "alert_team": "security",
    "requires_investigation": true
  }
}

interface SecurityIncident {
  diagnostic_code: string;
  compact_id: string;
  severity: 'C' | 'E' | 'W';
  timestamp: string;
  source_ip_hash: string;
  user_id_hash?: string;
  attack_vector: string;
  automated_response: boolean;
}

async function handleSecurityDiagnostic(
  diagnostic: Diagnostic,
  context: RequestContext
): Promise<void> {
  if (diagnostic.severity === 'C') {
    // Create incident
    const incident: SecurityIncident = {
      diagnostic_code: diagnostic.code,
      compact_id: diagnostic.compact_id,
      severity: diagnostic.severity,
      timestamp: new Date().toISOString(),
      source_ip_hash: hashIP(context.ip),
      attack_vector: classifyAttack(diagnostic),
      automated_response: true
    };
    
    // Alert security team
    await alertSecurityTeam(incident);
    
    // Take automated action
    if (shouldBlockIP(incident)) {
      await blockIP(context.ip, '1h');
    }
  }
}

// WDP Configuration
const wdpConfig = {
  security: {
    // PII Detection
    pii_detection: {
      enabled: true,
      mode: 'strict', // 'strict' | 'moderate' | 'disabled'
      patterns: [...DEFAULT_PII_PATTERNS, ...CUSTOM_PATTERNS],
      on_violation: 'throw' // 'throw' | 'redact' | 'warn'
    },
    
    // Field Sanitization
    field_sanitization: {
      enabled: true,
      max_field_length: 1000,
      max_fields: 50,
      sanitize_html: true,
      sanitize_sql: true
    },
    
    // Logging
    logging: {
      redact_sensitive_fields: true,
      sensitive_field_patterns: [/password/i, /token/i, /secret/i],
      log_level: 'info',
      include_stack_trace: process.env.NODE_ENV !== 'production'
    },
    
    // Transport
    transport: {
      require_https: process.env.NODE_ENV === 'production',
      enforce_cors: true
    }
  }
}

[ ] PII Separation: All PII is in pii.data or redacted
[ ] Sanitization: Logs are free of secrets and PII
[ ] Access Control: Diagnostic API enforces roles
[ ] Transport: HTTPS enforced for all traffic
[ ] Integrity: Catalogs use SRI and signing
[ ] Validation: Input fields sanitized securely
[ ] Compliance: Legal team reviewed data handling
[ ] Audit: Security events are logged to audit trail