boc/EOS/operation-canonicalizer-v3.mjs

#!/usr/bin/env node
// ═══════════════════════════════════════════════════════════════════════════
// Operation Canonicalization Layer v3 — Mer specifika nyckelord
// ═══════════════════════════════════════════════════════════════════════════

const CANONICAL_OPERATIONS = {
  REMOTE_PRODUCTION_ACCESS: {
    id: 'REMOTE_PRODUCTION_ACCESS',
    description: 'Fjärråtkomst till produktionsmiljö',
    policy: 'POL-SEC-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    id: 'MODIFY_PERSISTENT_PRODUCTION_DATA',
    description: 'Förändring av persistent data i produktion',
    policy: 'POL-DAT-001',
    severity: 'CRITICAL',
    allowed: false
  },
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    id: 'MODIFY_PRODUCTION_INFRASTRUCTURE',
    description: 'Förändring av produktionsinfrastruktur',
    policy: 'POL-INFRA-001',
    severity: 'CRITICAL',
    allowed: false
  },
  PRODUCTION_RELEASE: {
    id: 'PRODUCTION_RELEASE',
    description: 'Publicering av kod till produktion',
    policy: 'POL-DEP-001',
    severity: 'CRITICAL',
    allowed: false
  },
  EXPOSE_OR_CREATE_SECRET: {
    id: 'EXPOSE_OR_CREATE_SECRET',
    description: 'Exponering eller skapande av hemligheter',
    policy: 'POL-SEC-002',
    severity: 'CRITICAL',
    allowed: false
  },
  READ_PRODUCTION_DATA: {
    id: 'READ_PRODUCTION_DATA',
    description: 'Läsning av produktionsdata',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  OBSERVE_INFRASTRUCTURE: {
    id: 'OBSERVE_INFRASTRUCTURE',
    description: 'Observation av infrastruktur',
    policy: null,
    severity: 'LOW',
    allowed: true
  },
  DEVELOPMENT_TASK: {
    id: 'DEVELOPMENT_TASK',
    description: 'Utvecklingsuppgift',
    policy: null,
    severity: 'LOW',
    allowed: true
  }
};

// Viktigt: Ordningen avgör prioritet vid lika poäng
const INTENT_MAPPINGS = {
  // Hemligheter — högst prioritet (blockeras ALLTID)
  EXPOSE_OR_CREATE_SECRET: {
    priority: 100,
    patterns: [
      /password\s*[:=]/i,
      /secret\s*[:=]/i,
      /token\s*[:=]/i,
      /api[_-]?key/i,
      /private[_-]?key/i
    ],
    keywords: [
      'lösenord', 'password', 'nyckel', 'key',
      'token', 'hemlig', 'secret', 'credential',
      'auth', 'autentisering', 'hårdkoda', 'hardcode'
    ],
    context: ['kod', 'code', 'config', 'konfiguration', 'fil', 'file']
  },

  // Fjärråtkomst — unika nyckelord
  REMOTE_PRODUCTION_ACCESS: {
    priority: 90,
    commands: ['ssh', 'ssm', 'telnet', 'rdp', 'vnc'],
    tools: ['session-manager', 'bastion', 'jump-host'],
    keywords: [
      'ssh', 'logga in', 'login', 'anslut',
      'session', 'terminal', 'shell', 'kommandorad',
      'fjärr', 'remote', 'tunnel', 'port forward',
      'komma åt', 'få tillgång', 'access'
    ],
    context: ['produktion', 'production', 'prod', 'server']
  },

  // Dataförändring — unika för databas
  MODIFY_PERSISTENT_PRODUCTION_DATA: {
    priority: 80,
    commands: ['update', 'delete', 'insert', 'alter', 'drop', 'truncate'],
    tools: ['psql', 'mysql', 'mongo', 'redis-cli'],
    keywords: [
      'databas', 'database', 'sql', 'post', 'record',
      'värde', 'value', 'fält', 'field', 'row',
      'kolumn', 'column', 'table', 'tabell'
    ],
    context: ['produktion', 'production', 'prod', 'databas', 'database']
  },

  // Infrastrukturförändring — unika för cloud
  MODIFY_PRODUCTION_INFRASTRUCTURE: {
    priority: 70,
    commands: ['terraform apply', 'aws ec2', 'aws iam', 'aws sg', 'kubectl apply'],
    tools: ['terraform', 'cloudformation', 'pulumi'],
    keywords: [
      'infrastruktur', 'infrastructure', 'resurs', 'resource',
      'instans', 'instance', 'molnet', 'cloud',
      'security group', 'ec2', 'iam', 'alb', 'route53',
      'skala', 'scale', 'serverless'
    ],
    context: ['produktion', 'production', 'prod', 'aws', 'infrastruktur', 'cloud']
  },

  // Release — unika för deployment
  PRODUCTION_RELEASE: {
    priority: 60,
    commands: ['deploy', 'release', 'publish', 'push', 'rollout'],
    tools: ['kubectl', 'helm', 'docker', 'serverless'],
    keywords: [
      'deploy', 'release', 'publicera', 'pusha',
      'släpp', 'lansera', 'gå live', 'rollout',
      'version', 'pipeline', 'ci/cd',
      'buggfix', 'uppdatering'
    ],
    context: ['produktion', 'production', 'prod', 'live']
  }
};

function canonicalizeOperation(task) {
  const description = (task.description || '').toLowerCase();
  const action = (task.action || '').toLowerCase();
  const type = (task.type || '').toLowerCase();
  
  const scores = {};
  
  for (const [operationId, mapping] of Object.entries(INTENT_MAPPINGS)) {
    let score = 0;
    const evidence = [];
    
    // Prioritet ger baspoäng
    score += (mapping.priority || 0) / 10;
    
    // Kontrollera kommandon (högst poäng)
    if (mapping.commands) {
      for (const cmd of mapping.commands) {
        if (action === cmd.toLowerCase() || description.includes(cmd.toLowerCase())) {
          score += 10;
          evidence.push(`command:${cmd}`);
        }
      }
    }
    
    // Kontrollera verktyg
    if (mapping.tools) {
      for (const tool of mapping.tools) {
        if (description.includes(tool.toLowerCase())) {
          score += 8;
          evidence.push(`tool:${tool}`);
        }
      }
    }
    
    // Kontrollera specifika nyckelord
    if (mapping.keywords) {
      for (const keyword of mapping.keywords) {
        if (description.includes(keyword.toLowerCase())) {
          score += 5;
          evidence.push(`keyword:${keyword}`);
        }
      }
    }
    
    // Kontrollera kontext
    if (mapping.context) {
      for (const ctx of mapping.context) {
        if (description.includes(ctx.toLowerCase())) {
          score += 3;
          evidence.push(`context:${ctx}`);
        }
        if (task.target === ctx || task.target === 'production') {
          score += 5;
          evidence.push(`target:${ctx}`);
        }
      }
    }
    
    // Kontrollera regex-mönster (högst poäng)
    if (mapping.patterns) {
      for (const pattern of mapping.patterns) {
        if (pattern.test(description) || pattern.test(JSON.stringify(task.files || []))) {
          score += 15;
          evidence.push(`pattern:${pattern.source}`);
        }
      }
    }
    
    // Kontrollera filer för secrets
    if (task.files && operationId === 'EXPOSE_OR_CREATE_SECRET') {
      for (const file of task.files) {
        const content = (file.content || '').toLowerCase();
        for (const keyword of mapping.keywords || []) {
          if (content.includes(keyword.toLowerCase())) {
            score += 10;
            evidence.push(`file:${file.path}:${keyword}`);
          }
        }
      }
    }
    
    if (score > 0) {
      scores[operationId] = { score, evidence };
    }
  }
  
  // Sortera efter poäng (högst först)
  const sortedScores = Object.entries(scores).sort((a, b) => b[1].score - a[1].score);
  
  let bestOperation = null;
  let bestScore = 0;
  
  if (sortedScores.length > 0) {
    bestOperation = sortedScores[0][0];
    bestScore = sortedScores[0][1].score;
  }
  
  if (!bestOperation) {
    return {
      operation: CANONICAL_OPERATIONS.DEVELOPMENT_TASK,
      confidence: 0.5,
      evidence: ['default:development_task']
    };
  }
  
  const operation = CANONICAL_OPERATIONS[bestOperation];
  const confidence = Math.min(bestScore / 20, 1);
  
  return {
    operation,
    confidence,
    evidence: scores[bestOperation].evidence
  };
}

function checkOperationPolicy(canonicalResult) {
  const { operation, confidence, evidence } = canonicalResult;
  
  if (!operation) {
    return { passed: true };
  }
  
  if (operation.allowed) {
    return { passed: true, operation: operation.id };
  }
  
  return {
    passed: false,
    policyId: operation.policy,
    rule: operation.id,
    reason: `${operation.description} är förbjudet. Policy: ${operation.policy}`,
    severity: operation.severity,
    action: 'STOP',
    evidence: {
      operation: operation.id,
      confidence,
      matchedEvidence: evidence
    }
  };
}

export { CANONICAL_OPERATIONS, INTENT_MAPPINGS, canonicalizeOperation, checkOperationPolicy };