boc/EOS/operation-canonicalizer.mjs

#!/usr/bin/env node
// ═══════════════════════════════════════════════════════════════════════════
// Operation Canonicalization Layer
// Översätter olika uttryck och verktyg till kanoniska operationer
// ═══════════════════════════════════════════════════════════════════════════

/**
 * Kanoniska operationer
 * 
 * Dessa är de enda operationer som EOS känner till.
 * Alla inputs måste mappas till en av dessa.
 */
const CANONICAL_OPERATIONS = {
  REMOTE_PRODUCTION_ACCESS: {
    id: 'REMOTE_PRODUCTION_ACCESS',
    description: 'Fjärråtkomst till produktionsmiljö',
    policy: 'POL-SEC-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    id: 'MODIFY_PERSISTENT_PRODUCTION_DATA',
    description: 'Förändring av persistent data i produktion',
    policy: 'POL-DAT-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    id: 'MODIFY_PRODUCTION_INFRASTRUCTURE',
    description: 'Förändring av produktionsinfrastruktur',
    policy: 'POL-INFRA-001',
    severity: 'CRITICAL',
    allowed: false
  },
  PRODUCTION_RELEASE: {
    id: 'PRODUCTION_RELEASE',
    description: 'Publicering av kod till produktion',
    policy: 'POL-DEP-001',
    severity: 'CRITICAL',
    allowed: false
  },
  EXPOSE_OR_CREATE_SECRET: {
    id: 'EXPOSE_OR_CREATE_SECRET',
    description: 'Exponering eller skapande av hemligheter',
    policy: 'POL-SEC-002',
    severity: 'CRITICAL',
    allowed: false
  },
  READ_PRODUCTION_DATA: {
    id: 'READ_PRODUCTION_DATA',
    description: 'Läsning av produktionsdata',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  OBSERVE_INFRASTRUCTURE: {
    id: 'OBSERVE_INFRASTRUCTURE',
    description: 'Observation av infrastruktur',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  DEVELOPMENT_TASK: {
    id: 'DEVELOPMENT_TASK',
    description: 'Utvecklingsuppgift',
    policy: null,
    severity: 'LOW',
    allowed: true
  }
};

/**
 * Intent-mappningar
 * 
 * Dessa mappar olika uttryck, verktyg och kommandon till kanoniska operationer.
 * Varje mappning har en källa (varför matchade den?) och en konfidens.
 */
const INTENT_MAPPINGS = {
  // Fjärråtkomst
  REMOTE_PRODUCTION_ACCESS: {
    // Direkta kommandon
    commands: ['ssh', 'ssm', 'telnet', 'rdp', 'vnc'],
    // Verktyg
    tools: ['aws ssm', 'session-manager', 'bastion', 'jump-host'],
    // Nyckelord
    keywords: [
      'ssh', 'logga in', 'login', 'anslut', 'connect',
      'session', 'terminal', 'shell', 'kommandorad',
      'fjärr', 'remote', 'tunnel', 'port forward'
    ],
    // Kontext som indikerar produktionsåtkomst
    context: ['produktion', 'production', 'prod', 'live']
  },

  // Dataförändring
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    commands: ['UPDATE', 'DELETE', 'INSERT', 'ALTER', 'DROP', 'TRUNCATE'],
    tools: ['psql', 'mysql', 'mongo', 'redis-cli'],
    keywords: [
      'uppdatera', 'uppdatera', 'radera', 'ta bort',
      'infoga', 'lägg till', 'ändra', 'modifiera',
      'korrigera', 'fixa', 'justera', 'ändra data'
    ],
    context: ['produktion', 'production', 'prod', 'databas', 'database']
  },

  // Infrastrukturförändring
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    commands: ['terraform apply', 'aws ec2', 'aws iam', 'aws sg', 'kubectl apply'],
    tools: ['terraform', 'aws cli', 'cloudformation', 'pulumi'],
    keywords: [
      'skapa', 'create', 'ändra', 'modify', 'uppdatera', 'update',
      'ta bort', 'delete', 'konfigurera', 'configure',
      'security group', 'ec2', 'iam', 'alb', 'route53'
    ],
    context: ['produktion', 'production', 'prod', 'aws', 'infrastruktur']
  },

  // Release
  PRODUCTION_RELEASE: {
    commands: ['deploy', 'release', 'publish', 'push'],
    tools: ['kubectl', 'helm', 'docker', 'serverless'],
    keywords: [
      'deploy', 'release', 'publicera', 'pusha',
      'släpp', 'lansera', 'gå live'
    ],
    context: ['produktion', 'production', 'prod']
  },

  // Hemligheter
  EXPOSE_OR_CREATE_SECRET: {
    patterns: [
      /password\s*[:=]/i,
      /secret\s*[:=]/i,
      /token\s*[:=]/i,
      /api[_-]?key/i,
      /private[_-]?key/i
    ],
    keywords: [
      'lösenord', 'password', 'nyckel', 'key',
      'token', 'hemlig', 'secret', 'credential',
      'auth', 'autentisering'
    ],
    context: ['kod', 'code', 'config', 'konfiguration']
  }
};

/**
 * Klassificera en uppgift till en kanonisk operation
 * 
 * Returnerar: { operation, confidence, evidence }
 */
function canonicalizeOperation(task) {
  const description = (task.description || '').toLowerCase();
  const action = (task.action || '').toLowerCase();
  const type = (task.type || '').toLowerCase();
  
  const scores = {};
  
  // Kontrollera varje mappning
  for (const [operationId, mapping] of Object.entries(INTENT_MAPPINGS)) {
    let score = 0;
    const evidence = [];
    
    // Kontrollera kommandon
    if (mapping.commands) {
      for (const cmd of mapping.commands) {
        if (action === cmd.toLowerCase() || description.includes(cmd.toLowerCase())) {
          score += 5;
          evidence.push(`command:${cmd}`);
        }
      }
    }
    
    // Kontrollera verktyg
    if (mapping.tools) {
      for (const tool of mapping.tools) {
        if (description.includes(tool.toLowerCase())) {
          score += 4;
          evidence.push(`tool:${tool}`);
        }
      }
    }
    
    // Kontrollera nyckelord
    if (mapping.keywords) {
      for (const keyword of mapping.keywords) {
        if (description.includes(keyword.toLowerCase())) {
          score += 3;
          evidence.push(`keyword:${keyword}`);
        }
      }
    }
    
    // Kontrollera kontext
    if (mapping.context) {
      for (const ctx of mapping.context) {
        if (description.includes(ctx.toLowerCase()) || task.target === ctx) {
          score += 2;
          evidence.push(`context:${ctx}`);
        }
      }
    }
    
    // Kontrollera regex-mönster
    if (mapping.patterns) {
      for (const pattern of mapping.patterns) {
        if (pattern.test(description) || pattern.test(JSON.stringify(task.files || []))) {
          score += 5;
          evidence.push(`pattern:${pattern.source}`);
        }
      }
    }
    
    // Kontrollera filer (för secrets)
    if (task.files && operationId === 'EXPOSE_OR_CREATE_SECRET') {
      for (const file of task.files) {
        const content = (file.content || '').toLowerCase();
        for (const keyword of mapping.keywords || []) {
          if (content.includes(keyword.toLowerCase())) {
            score += 3;
            evidence.push(`file:${file.path}:${keyword}`);
          }
        }
      }
    }
    
    if (score > 0) {
      scores[operationId] = { score, evidence };
    }
  }
  
  // Hitta högst poäng
  let bestOperation = null;
  let bestScore = 0;
  
  for (const [opId, data] of Object.entries(scores)) {
    if (data.score > bestScore) {
      bestScore = data.score;
      bestOperation = opId;
    }
  }
  
  // Om ingen operation hittades, anta utvecklingsuppgift
  if (!bestOperation) {
    return {
      operation: CANONICAL_OPERATIONS.DEVELOPMENT_TASK,
      confidence: 0.5,
      evidence: ['default:development_task']
    };
  }
  
  const operation = CANONICAL_OPERATIONS[bestOperation];
  const confidence = Math.min(bestScore / 10, 1);
  
  return {
    operation,
    confidence,
    evidence: scores[bestOperation].evidence
  };
}

/**
 * Kontrollera om en operation är tillåten
 */
function checkOperationPolicy(canonicalResult) {
  const { operation, confidence, evidence } = canonicalResult;
  
  if (!operation) {
    return { passed: true };
  }
  
  // Tillåtna operationer
  if (operation.allowed) {
    return { passed: true, operation: operation.id };
  }
  
  // Blockerade operationer
  return {
    passed: false,
    policyId: operation.policy,
    rule: operation.id,
    reason: `${operation.description} är förbjudet. Policy: ${operation.policy}`,
    severity: operation.severity,
    action: 'STOP',
    evidence: {
      operation: operation.id,
      confidence,
      matchedEvidence: evidence
    }
  };
}

export { CANONICAL_OPERATIONS, INTENT_MAPPINGS, canonicalizeOperation, checkOperationPolicy };