mcp-quiz-server/dist/config/security-config.js

🧠 AI-Powered Quiz Management via Model Context Protocol (MCP) - Create, manage, and take quizzes directly from VS Code, Claude, and other AI agents.

"use strict";
/**
 * @fileoverview Security Configuration - Centralized Security Settings
 * @version 1.0.0
 * @since 2025-08-03
 * @lastUpdated 2025-08-03
 * @module SecurityConfig
 * @description Centralized configuration for sandbox, authentication, and security features
 * @contributors GitHub Copilot
 * @requirements SECURITY_001 (Configurable Security), SECURITY_002 (Sandbox Control)
 * @testCoverage Security configuration validation tests
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.securityConfig = exports.defaultSecurityConfig = exports.SecurityMode = void 0;
exports.loadSecurityConfig = loadSecurityConfig;
exports.validateSecurityConfig = validateSecurityConfig;
exports.getSecurityConfigSummary = getSecurityConfigSummary;
/**
 * Security mode levels
 */
var SecurityMode;
(function (SecurityMode) {
    SecurityMode["DISABLED"] = "disabled";
    SecurityMode["BASIC"] = "basic";
    SecurityMode["STANDARD"] = "standard";
    SecurityMode["STRICT"] = "strict";
    SecurityMode["PARANOID"] = "paranoid";
})(SecurityMode || (exports.SecurityMode = SecurityMode = {}));
/**
 * Security mode configurations
 */
const SECURITY_MODES = {
    [SecurityMode.DISABLED]: {
        enabled: false,
        enableResourceMonitoring: false,
        enableAuditLogging: false,
    },
    [SecurityMode.BASIC]: {
        enabled: true,
        defaultResourceLimits: {
            maxCpuTime: 30000, // 30 seconds
            maxMemory: 100 * 1024 * 1024, // 100MB
            maxExecutionTime: 60000, // 1 minute
            maxFileOps: 100,
            maxNetworkRequests: 10,
        },
        defaultCapabilities: {
            allowDatabase: true,
            allowFileSystem: false,
            allowNetwork: false,
            allowSubprocess: false,
            allowedPaths: [],
            allowedHosts: [],
        },
        enableResourceMonitoring: true,
        enableAuditLogging: true,
        blockAfterViolations: 10,
        blockDurationMs: 300000, // 5 minutes
    },
    [SecurityMode.STANDARD]: {
        enabled: true,
        defaultResourceLimits: {
            maxCpuTime: 10000, // 10 seconds
            maxMemory: 50 * 1024 * 1024, // 50MB
            maxExecutionTime: 30000, // 30 seconds
            maxFileOps: 50,
            maxNetworkRequests: 5,
        },
        defaultCapabilities: {
            allowDatabase: true,
            allowFileSystem: false,
            allowNetwork: false,
            allowSubprocess: false,
            allowedPaths: ['/tmp'],
            allowedHosts: ['localhost', '127.0.0.1'],
        },
        enableResourceMonitoring: true,
        enableAuditLogging: true,
        blockAfterViolations: 5,
        blockDurationMs: 600000, // 10 minutes
    },
    [SecurityMode.STRICT]: {
        enabled: true,
        defaultResourceLimits: {
            maxCpuTime: 5000, // 5 seconds
            maxMemory: 25 * 1024 * 1024, // 25MB
            maxExecutionTime: 15000, // 15 seconds
            maxFileOps: 20,
            maxNetworkRequests: 2,
        },
        defaultCapabilities: {
            allowDatabase: true,
            allowFileSystem: false,
            allowNetwork: false,
            allowSubprocess: false,
            allowedPaths: [],
            allowedHosts: [],
        },
        enableResourceMonitoring: true,
        enableAuditLogging: true,
        blockAfterViolations: 3,
        blockDurationMs: 900000, // 15 minutes
    },
    [SecurityMode.PARANOID]: {
        enabled: true,
        defaultResourceLimits: {
            maxCpuTime: 2000, // 2 seconds
            maxMemory: 10 * 1024 * 1024, // 10MB
            maxExecutionTime: 5000, // 5 seconds
            maxFileOps: 5,
            maxNetworkRequests: 1,
        },
        defaultCapabilities: {
            allowDatabase: false, // Even database access restricted
            allowFileSystem: false,
            allowNetwork: false,
            allowSubprocess: false,
            allowedPaths: [],
            allowedHosts: [],
        },
        enableResourceMonitoring: true,
        enableAuditLogging: true,
        blockAfterViolations: 1,
        blockDurationMs: 1800000, // 30 minutes
    },
};
/**
 * Load security configuration from environment variables
 */
function loadSecurityConfig() {
    const securityMode = process.env.SECURITY_MODE || SecurityMode.STANDARD;
    const environment = process.env.NODE_ENV || 'development';
    // Base sandbox configuration from security mode
    const baseSandboxConfig = SECURITY_MODES[securityMode];
    const config = {
        sandbox: {
            mode: securityMode,
            ...baseSandboxConfig,
            // Environment-specific overrides
            enabled: process.env.ENABLE_SANDBOXING === 'true' || baseSandboxConfig.enabled || false,
            enableResourceMonitoring: process.env.ENABLE_RESOURCE_MONITORING === 'true' ||
                baseSandboxConfig.enableResourceMonitoring ||
                false,
            enableAuditLogging: process.env.ENABLE_AUDIT_LOGGING === 'true' ||
                baseSandboxConfig.enableAuditLogging ||
                false,
        },
        authentication: {
            enabled: process.env.ENABLE_AUTHENTICATION === 'true' || environment === 'production',
            requireAuthForTools: process.env.REQUIRE_AUTH_FOR_TOOLS === 'true' || environment === 'production',
            jwtSecret: process.env.JWT_SECRET || 'default-dev-secret-change-in-production',
            jwtIssuer: process.env.JWT_ISSUER || 'mcp-quiz-server',
            accessTokenExpiryMinutes: parseInt(process.env.ACCESS_TOKEN_EXPIRY_MINUTES || '60'),
            refreshTokenExpiryDays: parseInt(process.env.REFRESH_TOKEN_EXPIRY_DAYS || '7'),
        },
        monitoring: {
            enabled: process.env.ENABLE_SECURITY_MONITORING === 'true' || environment !== 'development',
            realTimeAlerts: process.env.ENABLE_REALTIME_ALERTS === 'true' || environment === 'production',
            violationThreshold: parseInt(process.env.VIOLATION_THRESHOLD || '5'),
            alertWebhookUrl: process.env.SECURITY_ALERT_WEBHOOK_URL,
            logLevel: process.env.SECURITY_LOG_LEVEL || 'info',
        },
        environment,
    };
    return config;
}
/**
 * Validate security configuration
 */
function validateSecurityConfig(config) {
    const errors = [];
    // Validate sandbox config
    if (config.sandbox.enabled) {
        if (!config.sandbox.defaultResourceLimits) {
            errors.push('Sandbox enabled but no resource limits defined');
        }
        if (config.sandbox.blockAfterViolations < 1) {
            errors.push('Block after violations must be at least 1');
        }
        if (config.sandbox.blockDurationMs < 60000) {
            errors.push('Block duration must be at least 1 minute');
        }
    }
    // Validate auth config
    if (config.authentication.enabled) {
        if (!config.authentication.jwtSecret ||
            config.authentication.jwtSecret === 'default-dev-secret-change-in-production') {
            if (config.environment === 'production') {
                errors.push('Production environment requires custom JWT secret');
            }
        }
        if (config.authentication.accessTokenExpiryMinutes < 1) {
            errors.push('Access token expiry must be at least 1 minute');
        }
    }
    // Validate monitoring config
    if (config.monitoring.enabled &&
        config.monitoring.realTimeAlerts &&
        !config.monitoring.alertWebhookUrl) {
        errors.push('Real-time alerts enabled but no webhook URL provided');
    }
    return {
        valid: errors.length === 0,
        errors,
    };
}
/**
 * Get security config summary for logging
 */
function getSecurityConfigSummary(config) {
    return (`Security Config: ${config.sandbox.mode.toUpperCase()} mode, ` +
        `Sandbox: ${config.sandbox.enabled ? 'ON' : 'OFF'}, ` +
        `Auth: ${config.authentication.enabled ? 'ON' : 'OFF'}, ` +
        `Monitoring: ${config.monitoring.enabled ? 'ON' : 'OFF'}, ` +
        `Environment: ${config.environment.toUpperCase()}`);
}
/**
 * Default security configuration
 */
exports.defaultSecurityConfig = loadSecurityConfig();
/**
 * Export security configuration instance
 */
exports.securityConfig = exports.defaultSecurityConfig;