boc/EOS/operation-canonicalizer-v2.mjs

#!/usr/bin/env node
// ═══════════════════════════════════════════════════════════════════════════
// Operation Canonicalization Layer v2 — Förbättrad med fler nyckelord
// ═══════════════════════════════════════════════════════════════════════════

const CANONICAL_OPERATIONS = {
  REMOTE_PRODUCTION_ACCESS: {
    id: 'REMOTE_PRODUCTION_ACCESS',
    description: 'Fjärråtkomst till produktionsmiljö',
    policy: 'POL-SEC-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    id: 'MODIFY_PERSISTENT_PRODUCTION_DATA',
    description: 'Förändring av persistent data i produktion',
    policy: 'POL-DAT-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    id: 'MODIFY_PRODUCTION_INFRASTRUCTURE',
    description: 'Förändring av produktionsinfrastruktur',
    policy: 'POL-INFRA-001',
    severity: 'CRITICAL',
    allowed: false
  },
  PRODUCTION_RELEASE: {
    id: 'PRODUCTION_RELEASE',
    description: 'Publicering av kod till produktion',
    policy: 'POL-DEP-001',
    severity: 'CRITICAL',
    allowed: false
  },
  EXPOSE_OR_CREATE_SECRET: {
    id: 'EXPOSE_OR_CREATE_SECRET',
    description: 'Exponering eller skapande av hemligheter',
    policy: 'POL-SEC-002',
    severity: 'CRITICAL',
    allowed: false
  },
  READ_PRODUCTION_DATA: {
    id: 'READ_PRODUCTION_DATA',
    description: 'Läsning av produktionsdata',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  OBSERVE_INFRASTRUCTURE: {
    id: 'OBSERVE_INFRASTRUCTURE',
    description: 'Observation av infrastruktur',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  DEVELOPMENT_TASK: {
    id: 'DEVELOPMENT_TASK',
    description: 'Utvecklingsuppgift',
    policy: null,
    severity: 'LOW',
    allowed: true
  }
};

const INTENT_MAPPINGS = {
  // Fjärråtkomst
  REMOTE_PRODUCTION_ACCESS: {
    commands: ['ssh', 'ssm', 'telnet', 'rdp', 'vnc', 'login', 'connect'],
    tools: ['aws ssm', 'session-manager', 'bastion', 'jump-host', 'cli'],
    keywords: [
      'ssh', 'logga in', 'login', 'anslut', 'connect',
      'session', 'terminal', 'shell', 'kommandorad',
      'fjärr', 'remote', 'tunnel', 'port forward',
      'komma åt', 'få tillgång', 'access', 'nå',
      'felsöka', 'debug', 'automatisera', 'script',
      'ladda upp', 'upload', 'köra', 'execute'
    ],
    context: ['produktion', 'production', 'prod', 'live', 'server']
  },

  // Dataförändring
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    commands: ['update', 'delete', 'insert', 'alter', 'drop', 'truncate', 'modify'],
    tools: ['psql', 'mysql', 'mongo', 'redis-cli', 'sql'],
    keywords: [
      'uppdatera', 'radera', 'ta bort',
      'infoga', 'lägg till', 'ändra', 'modifiera',
      'korrigera', 'fixa', 'justera', 'ändra data',
      'data', 'databas', 'database', 'post', 'record',
      'värde', 'value', 'fält', 'field'
    ],
    context: ['produktion', 'production', 'prod', 'databas', 'database', 'data']
  },

  // Infrastrukturförändring
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    commands: ['terraform apply', 'aws ec2', 'aws iam', 'aws sg', 'kubectl apply', 'create', 'modify', 'update', 'delete'],
    tools: ['terraform', 'aws cli', 'cloudformation', 'pulumi', 'aws'],
    keywords: [
      'skapa', 'create', 'ändra', 'modify', 'uppdatera', 'update',
      'ta bort', 'delete', 'konfigurera', 'configure',
      'security group', 'ec2', 'iam', 'alb', 'route53',
      'infrastruktur', 'infrastructure', 'resurs', 'resource',
      'skala', 'scale', 'instans', 'instance',
      'molnet', 'cloud', 'aws', 'azure', 'gcp'
    ],
    context: ['produktion', 'production', 'prod', 'aws', 'infrastruktur', 'infrastructure', 'cloud']
  },

  // Release
  PRODUCTION_RELEASE: {
    commands: ['deploy', 'release', 'publish', 'push', 'rollout'],
    tools: ['kubectl', 'helm', 'docker', 'serverless', 'git'],
    keywords: [
      'deploy', 'release', 'publicera', 'pusha',
      'släpp', 'lansera', 'gå live', 'rollout',
      'version', 'release', 'pipeline', 'ci/cd',
      'buggfix', 'fix', 'uppdatering', 'update'
    ],
    context: ['produktion', 'production', 'prod', 'live']
  },

  // Hemligheter
  EXPOSE_OR_CREATE_SECRET: {
    patterns: [
      /password\s*[:=]/i,
      /secret\s*[:=]/i,
      /token\s*[:=]/i,
      /api[_-]?key/i,
      /private[_-]?key/i
    ],
    keywords: [
      'lösenord', 'password', 'nyckel', 'key',
      'token', 'hemlig', 'secret', 'credential',
      'auth', 'autentisering', 'hårdkoda', 'hardcode'
    ],
    context: ['kod', 'code', 'config', 'konfiguration', 'fil', 'file']
  }
};

function canonicalizeOperation(task) {
  const description = (task.description || '').toLowerCase();
  const action = (task.action || '').toLowerCase();
  const type = (task.type || '').toLowerCase();
  
  const scores = {};
  
  for (const [operationId, mapping] of Object.entries(INTENT_MAPPINGS)) {
    let score = 0;
    const evidence = [];
    
    // Kontrollera kommandon
    if (mapping.commands) {
      for (const cmd of mapping.commands) {
        if (action === cmd.toLowerCase() || description.includes(cmd.toLowerCase())) {
          score += 5;
          evidence.push(`command:${cmd}`);
        }
      }
    }
    
    // Kontrollera verktyg
    if (mapping.tools) {
      for (const tool of mapping.tools) {
        if (description.includes(tool.toLowerCase())) {
          score += 4;
          evidence.push(`tool:${tool}`);
        }
      }
    }
    
    // Kontrollera nyckelord
    if (mapping.keywords) {
      for (const keyword of mapping.keywords) {
        if (description.includes(keyword.toLowerCase())) {
          score += 3;
          evidence.push(`keyword:${keyword}`);
        }
      }
    }
    
    // Kontrollera kontext (högre poäng för direkt match)
    if (mapping.context) {
      for (const ctx of mapping.context) {
        if (description.includes(ctx.toLowerCase())) {
          score += 3;
          evidence.push(`context:${ctx}`);
        }
        if (task.target === ctx || task.target === 'production') {
          score += 4;
          evidence.push(`target:${ctx}`);
        }
      }
    }
    
    // Kontrollera regex-mönster
    if (mapping.patterns) {
      for (const pattern of mapping.patterns) {
        if (pattern.test(description) || pattern.test(JSON.stringify(task.files || []))) {
          score += 5;
          evidence.push(`pattern:${pattern.source}`);
        }
      }
    }
    
    // Kontrollera filer
    if (task.files && operationId === 'EXPOSE_OR_CREATE_SECRET') {
      for (const file of task.files) {
        const content = (file.content || '').toLowerCase();
        for (const keyword of mapping.keywords || []) {
          if (content.includes(keyword.toLowerCase())) {
            score += 3;
            evidence.push(`file:${file.path}:${keyword}`);
          }
        }
      }
    }
    
    // Special: Om target är production, ge extra poäng till vissa operationer
    if (task.target === 'production' || task.target === 'prod') {
      if (['REMOTE_PRODUCTION_ACCESS', 'MODIFY_PERSISTENT_PRODUCTION_DATA', 
           'MODIFY_PRODUCTION_INFRASTRUCTURE', 'PRODUCTION_RELEASE'].includes(operationId)) {
        score += 3;
        evidence.push('target:production');
      }
    }
    
    if (score > 0) {
      scores[operationId] = { score, evidence };
    }
  }
  
  let bestOperation = null;
  let bestScore = 0;
  
  for (const [opId, data] of Object.entries(scores)) {
    if (data.score > bestScore) {
      bestScore = data.score;
      bestOperation = opId;
    }
  }
  
  if (!bestOperation) {
    return {
      operation: CANONICAL_OPERATIONS.DEVELOPMENT_TASK,
      confidence: 0.5,
      evidence: ['default:development_task']
    };
  }
  
  const operation = CANONICAL_OPERATIONS[bestOperation];
  const confidence = Math.min(bestScore / 10, 1);
  
  return {
    operation,
    confidence,
    evidence: scores[bestOperation].evidence
  };
}

function checkOperationPolicy(canonicalResult) {
  const { operation, confidence, evidence } = canonicalResult;
  
  if (!operation) {
    return { passed: true };
  }
  
  if (operation.allowed) {
    return { passed: true, operation: operation.id };
  }
  
  return {
    passed: false,
    policyId: operation.policy,
    rule: operation.id,
    reason: `${operation.description} är förbjudet. Policy: ${operation.policy}`,
    severity: operation.severity,
    action: 'STOP',
    evidence: {
      operation: operation.id,
      confidence,
      matchedEvidence: evidence
    }
  };
}

export { CANONICAL_OPERATIONS, INTENT_MAPPINGS, canonicalizeOperation, checkOperationPolicy };