SovereignShield

// GDPR Art. 7 Consent Verification Middleware
export function verifyUserConsent(req, res, next) {
  const consentLog = req.user?.consentRecord;
  if (!consentLog || !consentLog.active || consentLog.revokedAt) {
    return res.status(403).json({ error: 'Explicit user consent required under GDPR Art. 7' });
  }
  req.consentTimestamp = consentLog.updatedAt;
  next();
}

// GDPR Art. 17 Right to Erasure - Node.js & Prisma ORM
import { PrismaClient } from '@prisma/client';

const prisma = new PrismaClient();

export async function executeRightToBeForgotten(userId: string) {
  return await prisma.$transaction(async (tx) => {
    // 1. Purge personal telemetry logs and session records
    await tx.telemetry.deleteMany({ where: { userId } });
    await tx.userSession.deleteMany({ where: { userId } });
    await tx.auditLog.deleteMany({ where: { userId } });

    // 2. Anonymize core user record in place to preserve transactional integrity
    const anonymizedUser = await tx.user.update({
      where: { id: userId },
      data: {
        email: `erased-${userId}@anonymized.gdpr`,
        name: 'ANONYMIZED_USER',
        phone: null,
        address: null,
        status: 'PURGED',
        deletedAt: new Date()
      }
    });

    return { status: 'Erased', userId: anonymizedUser.id, timestamp: new Date().toISOString() };
  });
}

// GDPR Art. 20 Data Dossier Export API
export async function generateUserDataDossier(userId) {
  const userData = await db('users').where({ id: userId }).first();
  const activity = await db('user_activity').where({ userId });
  return {
    schema: 'https://schema.org/Person',
    exportedAt: new Date().toISOString(),
    profile: userData,
    activityLogs: activity
  };
}

// GDPR Art. 37 DPO Routing & Compliance Verification
export const DPO_CONFIG = {
  dpoName: 'Chief Privacy Officer',
  contactEmail: '[email protected]',
  escalationSlaHours: 24,
  requiresDpaSignoff: true
};
export function getDpoContactCard() { return DPO_CONFIG; }

// GDPR Art. 33 Automated Breach Alarm Routine
export async function triggerBreachNotificationAlarm(eventDetails) {
  const payload = {
    severity: 'CRITICAL',
    breachTime: new Date().toISOString(),
    slaDeadline: new Date(Date.now() + 72 * 3600 * 1000).toISOString(),
    affectedRecords: eventDetails.recordCount
  };
  await sendAlertToDpa(payload);
}

// GDPR Art. 25 Client-Side AES-GCM Payload Sanitizer
export async function sanitizePayload(rawPayload, encryptionKey) {
  const encoder = new TextEncoder();
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, encryptionKey, encoder.encode(JSON.stringify(rawPayload)));
  return { cipherText: Array.from(new Uint8Array(encrypted)), iv: Array.from(iv) };
}

// HIPAA §164.312(a) Access Controls - React Session Timer & Auto-Logout
import React, { useEffect, useRef } from 'react';

interface SessionTimerProps {
  timeoutMs?: number; // HIPAA default: 15 minutes (900,000ms)
  onTimeout: () => void;
}

export const ReactSessionTimer: React.FC<SessionTimerProps> = ({
  timeoutMs = 900000,
  onTimeout
}) => {
  const timerRef = useRef<NodeJS.Timeout | null>(null);

  const resetTimer = () => {
    if (timerRef.current) clearTimeout(timerRef.current);
    timerRef.current = setTimeout(() => {
      sessionStorage.clear();
      localStorage.removeItem('authToken');
      onTimeout();
    }, timeoutMs);
  };

  useEffect(() => {
    const events = ['mousemove', 'keydown', 'click', 'scroll', 'touchstart'];
    events.forEach(evt => window.addEventListener(evt, resetTimer));
    resetTimer();

    return () => {
      if (timerRef.current) clearTimeout(timerRef.current);
      events.forEach(evt => window.removeEventListener(evt, resetTimer));
    };
  }, [timeoutMs, onTimeout]);

  return null;
};

# HIPAA §164.312(e) Transmission Security - NGINX Strict TLS 1.3 Server Configuration
server {
    listen 443 ssl http2;
    server_name phi.internal.hospital.org;

    ssl_certificate /etc/ssl/certs/phi-service.crt;
    ssl_certificate_key /etc/ssl/private/phi-service.key;

    # Mandatory TLS 1.3 Protocols & High-Strength Cipher Suites
    ssl_protocols TLSv1.3;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
    ssl_prefer_server_ciphers on;

    # HSTS & Security Headers for PHI in Transit
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
    }
}

// HIPAA §164.312(b) Immutable Read/Write Audit Logger
export async function logPhiAccessEvent({ actorId, action, targetPhiId }) {
  const logEntry = {
    timestamp: new Date().toISOString(),
    actorId,
    action,
    targetPhiId,
    signature: await cryptoSubtleSha256(`${actorId}:${action}:${targetPhiId}:${Date.now()}`)
  };
  await appendToAppendOnlyLogStore(logEntry);
}

// HIPAA §164.502(e) Vendor BAA Validation Guard
export function validateVendorBaaStatus(vendorMetadata) {
  if (!vendorMetadata.baaSigned || new Date(vendorMetadata.baaExpiration) < new Date()) {
    throw new Error(`Vendor ${vendorMetadata.name} does not hold an active Business Associate Agreement.`);
  }
  return true;
}

// HIPAA §164.308(a)(7) Encrypted Offline Snapshot Routine
export async function triggerOffsiteSnapshotBackup(databaseState) {
  const encryptedBackup = await encryptSnapshotWithKey(databaseState, process.env.HIPAA_BACKUP_KEY);
  await storeInRedundantStorageRegion(encryptedBackup);
  return { status: 'DISASTER_RECOVERY_READY', checksum: encryptedBackup.sha256 };
}

// HIPAA §164.308(a)(5) Workforce Training Verification API
export function checkStaffTrainingStatus(employeeRecord) {
  const oneYearAgo = new Date(Date.now() - 365 * 24 * 3600 * 1000);
  const lastTrained = new Date(employeeRecord.lastHipaaTrainingDate);
  return {
    isCompliant: lastTrained >= oneYearAgo,
    daysUntilRenewal: Math.ceil((lastTrained.getTime() + 365*24*3600*1000 - Date.now()) / (1000 * 3600 * 24))
  };
}

-- SOC 2 CC6.1 Postgres Row-Level Security (RLS) Policy
ALTER TABLE sensitive_user_data ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON sensitive_user_data
  FOR ALL TO application_role
  USING (tenant_id = current_setting('app.current_tenant_id'));

// SOC 2 CC6.6 TLS 1.3 Server Transport Guard
import https from 'https';
import tls from 'tls';
export const tlsOptions = {
  minVersion: 'TLSv1.3',
  ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256',
  honorCipherOrder: true
};

# SOC 2 CC7.1 CI/CD Dependency Security Audit
name: Dependency Scan
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run audit
        run: npm audit --audit-level=high

// ISO 27001 Annex A.5.15 Session Timeout Middleware
export function enforceSessionTimeout(req, res, next) {
  const lastActivity = req.session?.lastActivity;
  const now = Date.now();
  if (lastActivity && (now - lastActivity > 15 * 60 * 1000)) {
    req.session.destroy();
    return res.status(401).json({ error: 'Session expired due to inactivity' });
  }
  req.session.lastActivity = now;
  next();
}

// ISO 27001 Annex A.8.24 AES-GCM Key Derivative & Encrypt
export async function deriveKeyAndEncrypt(secret, plainText) {
  const enc = new TextEncoder();
  const keyMaterial = await crypto.subtle.importKey('raw', enc.encode(secret), 'PBKDF2', false, ['deriveKey']);
  const key = await crypto.subtle.deriveKey({ name: 'PBKDF2', salt: enc.encode('salt'), iterations: 100000, hash: 'SHA-256' }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const cipherText = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, enc.encode(plainText));
  return { cipherText, iv };
}

// ISO 27001 Annex A.8.12 Egress Data Leakage Sanitizer
export function sanitizeOutputDlp(payload) {
  const str = JSON.stringify(payload);
  const sanitized = str.replace(/\b\d{3}-\d{2}-\d{4}\b/g, '***-**-****')
                       .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, '[REDACTED_EMAIL]');
  return JSON.parse(sanitized);
}

// EU AI Act Art. 5 Prohibited AI Practice Middleware
export function blockProhibitedAiFeatures(req, res, next) {
  const { featureType, context } = req.body;
  const PROHIBITED = ['SOCIAL_SCORING', 'WORKPLACE_EMOTION_RECOGNITION', 'SUBLIMINAL_MANIPULATION'];
  if (PROHIBITED.includes(featureType)) {
    return res.status(403).json({ error: 'EU AI Act Art. 5 Prohibited AI Practice: Deployment blocked under EU Law' });
  }
  next();
}

// EU AI Act Art. 6 High-Risk AI Human-in-the-Loop & Audit Log
export async function evaluateHighRiskAiInference(modelInput, humanOperatorId) {
  if (!humanOperatorId) {
    throw new Error('EU AI Act Art. 14 Mandatory Human Oversight required for High-Risk AI inference');
  }
  const auditRecord = {
    timestamp: new Date().toISOString(),
    riskTier: 'HIGH_RISK',
    operator: humanOperatorId,
    inputHash: await crypto.subtle.digest('SHA-256', new TextEncoder().encode(JSON.stringify(modelInput)))
  };
  return auditRecord;
}

// EU AI Act Art. 50 Synthetic Content Watermark & Chatbot Disclosure
export function injectSyntheticContentMetadata(outputPayload) {
  return {
    ...outputPayload,
    _aiGenerated: true,
    _watermark: 'C2PA-MANIFEST-EU-AI-ACT-ART-50',
    _disclosure: 'This interaction/content was generated by an artificial intelligence system.'
  };
}

// EU AI Act & Shadow AI Egress API Gatekeeper
export function detectShadowAiEgress(outgoingUrl) {
  const APPROVED_AI_PROVIDERS = ['api.openai.com', 'api.anthropic.com', 'cloud.google.com/vertex-ai'];
  const urlObj = new URL(outgoingUrl);
  if (urlObj.hostname.includes('ai') && !APPROVED_AI_PROVIDERS.includes(urlObj.hostname)) {
    console.warn(`[SHADOW AI ALERT] Egress call to unvetted AI provider: ${urlObj.hostname}`);
    return false;
  }
  return true;
}