高安全架构设计

const crypto = require('crypto');

class SymmetricEncryption {
  constructor() {
    this.algorithm = 'aes-256-cbc';
    this.key = crypto.randomBytes(32);
    this.iv = crypto.randomBytes(16);
  }

  encrypt(plainText) {
    const cipher = crypto.createCipheriv(this.algorithm, this.key, this.iv);
    let encrypted = cipher.update(plainText, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    return { encrypted, iv: this.iv.toString('hex'), key: this.key.toString('hex') };
  }

  decrypt(encryptedData, keyHex, ivHex) {
    const decipher = crypto.createDecipheriv(
      this.algorithm,
      Buffer.from(keyHex, 'hex'),
      Buffer.from(ivHex, 'hex')
    );
    let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    return decrypted;
  }
}

class DataAccessControl {
  checkPermission(userId, resource, action, context = {}) {
    const permissions = this.permissions.get(`${userId}:${resource}`) || [];
    for (const perm of permissions) {
      if (perm.action === action || perm.action === 'admin') {
        if (this.checkConditions(perm.conditions, context)) {
          return { allowed: true };
        }
      }
    }
    return { allowed: false, reason: '权限不足' };
  }
}

class RateLimiter {
  constructor(threshold = 100) {
    this.requests = new Map();
    this.threshold = threshold; // 每秒最大请求数
  }

  middleware() {
    return (req, res, next) => {
      const ip = req.ip;
      const now = Date.now();
      const record = this.requests.get(ip) || { count: 0, start: now };

      if (now - record.start > 1000) {
        record.count = 0;
        record.start = now;
      }
      record.count++;
      this.requests.set(ip, record);

      if (record.count > this.threshold) {
        return res.status(429).json({ error: 'Too Many Requests' });
      }
      next();
    };
  }
}

const jwt = require('jsonwebtoken');

class JWTAuth {
  constructor(secret, expiresIn = '7d') {
    this.secret = secret;
    this.expiresIn = expiresIn;
  }

  generateToken(user) {
    return jwt.sign(
      { userId: user.id, role: user.role, type: 'access' },
      this.secret,
      { expiresIn: this.expiresIn }
    );
  }

  authenticate() {
    return (req, res, next) => {
      const token = req.headers.authorization?.replace('Bearer ', '');
      if (!token) return res.status(401).json({ error: 'Unauthorized' });

      try {
        req.user = jwt.verify(token, this.secret);
        next();
      } catch {
        res.status(401).json({ error: 'Token invalid or expired' });
      }
    };
  }
}

// 不安全 - 字符串拼接
const unsafe = `SELECT * FROM users WHERE name = '${input}'`;

// 安全 - 参数化查询
const safe = async (input) => {
  return db.query('SELECT * FROM users WHERE name = ?', [input]);
};

// HTML 转义
function escapeHtml(input) {
  const map = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#x27;' };
  return String(input).replace(/[&<>"']/g, c => map[c]);
}

// CSP 内容安全策略
res.setHeader('Content-Security-Policy',
  "default-src 'self'; script-src 'self'; frame-ancestors 'none'");

// 生成 Token
const token = crypto.createHmac('sha256', secret)
  .update(`${sessionId}:${Date.now()}`)
  .digest('hex');

// 验证中间件：仅检查 POST/PUT/DELETE/PATCH
// Token 来源：req.body._csrf || req.get('X-CSRF-Token')

const securityHeaders = (req, res, next) => {
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
  next();
};