secure_connection.h

Go to the documentation of this file.

// BSD 3-Clause License
// Copyright (c) 2025, 🍀☀🌕🌥 🌊
// See the LICENSE file in the project root for full license information.
 
#pragma once
 
#include "../database_types.h"
#include "../core/database_backend.h"
#include <string>
#include <vector>
#include <memory>
#include <unordered_map>
#include <chrono>
#include <mutex>
#include <functional>
#include <optional>
 
namespace database::security
{
    enum class encryption_type {
        none,
        tls,
        ssl,
        aes256
    };
 
    enum class authentication_method {
        password,
        certificate,
        kerberos,
        oauth2,
        jwt
    };
 
    struct security_credentials
    {
        std::string username;
        std::string password_hash;
        std::string certificate_path;
        std::string private_key_path;
        std::string ca_cert_path;
        authentication_method auth_method = authentication_method::password;
        encryption_type encryption = encryption_type::tls;
 
        // OAuth2/JWT specific
        std::string client_id;
        std::string client_secret;
        std::string token;
        std::chrono::system_clock::time_point token_expiry;
 
        // Additional security options
        bool verify_certificate = true;
        bool mutual_authentication = false;
        std::string allowed_ciphers;
    };
 
    struct audit_log_entry
    {
        std::chrono::system_clock::time_point timestamp;
        std::string user_id;
        std::string session_id;
        std::string operation;
        std::string table_name;
        std::string query_hash;
        bool success;
        std::string error_message;
        std::string client_ip;
        std::string user_agent;
    };
 
    class credential_manager
    {
    public:
        credential_manager() = default;
 
        // Credential management
        bool store_credentials(const std::string& connection_id, const security_credentials& credentials);
        std::optional<security_credentials> get_credentials(const std::string& connection_id) const;
        bool remove_credentials(const std::string& connection_id);
 
        // Encryption key management
        void set_master_key(const std::string& key);
        bool rotate_encryption_keys();
 
        // Password utilities
        std::string hash_password(const std::string& password) const;
        bool verify_password(const std::string& password, const std::string& hash) const;
 
    private:
        std::string encrypt_data(const std::string& data) const;
        std::string decrypt_data(const std::string& encrypted_data) const;
 
        mutable std::mutex credentials_mutex_;
        std::unordered_map<std::string, std::string> encrypted_credentials_;
        std::string master_key_;
    };
 
    class connection_security
    {
    public:
        connection_security(const security_credentials& credentials);
 
        // Connection security
        bool establish_secure_connection(const std::string& host, int port);
        bool verify_server_certificate(const std::string& certificate) const;
        bool perform_mutual_authentication();
 
        // TLS/SSL configuration
        bool configure_tls(const std::string& cert_file, const std::string& key_file, const std::string& ca_file);
        bool set_cipher_suite(const std::string& ciphers);
 
        // Connection string encryption
        std::string encrypt_connection_string(const std::string& connection_string) const;
        std::string decrypt_connection_string(const std::string& encrypted_string) const;
 
    private:
        security_credentials credentials_;
        bool tls_configured_ = false;
    };
 
    class query_security
    {
    public:
        // SQL injection prevention
        static bool is_query_safe(const std::string& query);
        static std::string sanitize_input(const std::string& input);
        static std::string escape_sql_string(const std::string& value);
 
        // Query pattern analysis
        static bool detect_suspicious_patterns(const std::string& query);
        static std::vector<std::string> extract_table_names(const std::string& query);
        static bool validate_table_access(const std::string& table, const std::string& operation, const std::string& user);
 
        // Prepared statement support
        static std::string convert_to_prepared_statement(const std::string& query, const std::vector<core::database_value>& parameters);
 
    private:
        static const std::vector<std::string> dangerous_keywords_;
        static const std::vector<std::string> injection_patterns_;
    };
 
    class access_control
    {
    public:
        enum class permission {
            select = 1,
            insert = 2,
            update = 4,
            delete_record = 8,
            create = 16,
            drop = 32,
            alter = 64,
            admin = 128
        };
 
        struct role {
            std::string name;
            std::vector<permission> permissions;
            std::vector<std::string> allowed_tables;
            std::vector<std::string> denied_tables;
            std::chrono::system_clock::time_point created_at;
            bool active = true;
        };
 
        struct user_session {
            std::string user_id;
            std::string session_id;
            std::vector<std::string> roles;
            std::chrono::system_clock::time_point login_time;
            std::chrono::system_clock::time_point last_activity;
            std::string client_ip;
            bool active = true;
        };
 
        access_control() = default;
 
 
        // Role management
        bool create_role(const role& new_role);
        bool assign_role_to_user(const std::string& user_id, const std::string& role_name);
        bool revoke_role_from_user(const std::string& user_id, const std::string& role_name);
        std::vector<role> get_user_roles(const std::string& user_id) const;
 
        // Permission checking
        bool check_permission(const std::string& user_id, const std::string& table,
                             const std::string& operation) const;
        bool check_table_access(const std::string& user_id, const std::string& table) const;
 
        // Session management
        std::string create_session(const std::string& user_id, const std::string& client_ip);
        bool validate_session(const std::string& session_id) const;
        bool terminate_session(const std::string& session_id);
        void cleanup_expired_sessions();
 
    private:
        mutable std::mutex access_mutex_;
        std::unordered_map<std::string, role> roles_;
        std::unordered_map<std::string, std::vector<std::string>> user_roles_;
        std::unordered_map<std::string, user_session> active_sessions_;
    };
 
    class audit_logger
    {
    public:
        audit_logger() = default;
 
        explicit audit_logger(const std::string& log_file_path);
 
        // Audit logging
        void log_database_access(const std::string& user_id, const std::string& session_id,
                                const std::string& operation, const std::string& table,
                                const std::string& query_hash, bool success,
                                const std::string& error_message = "");
 
        void log_authentication_event(const std::string& user_id, const std::string& client_ip,
                                     bool success, const std::string& method);
 
        void log_authorization_failure(const std::string& user_id, const std::string& operation,
                                     const std::string& table, const std::string& reason);
 
        // Audit retrieval
        std::vector<audit_log_entry> get_audit_logs(std::chrono::hours window) const;
        std::vector<audit_log_entry> get_user_audit_logs(const std::string& user_id,
                                                         std::chrono::hours window) const;
 
        // Security reporting
        std::string generate_security_report(std::chrono::hours window) const;
        std::vector<std::string> detect_suspicious_activity(std::chrono::hours window) const;
 
        // Log management
        void set_log_retention_period(std::chrono::hours retention);
        void cleanup_old_logs();
        bool export_logs_to_file(const std::string& filename) const;
 
    private:
        void persist_entry(const audit_log_entry& entry);
 
        mutable std::mutex audit_mutex_;
        std::vector<audit_log_entry> audit_logs_;
        std::chrono::hours retention_period_{24 * 30}; // 30 days
        std::string log_file_path_;
    };
 
    class security_monitor
    {
    public:
        enum class threat_level {
            low,
            medium,
            high,
            critical
        };
 
        struct security_alert {
            threat_level level;
            std::string type;
            std::string description;
            std::string user_id;
            std::string session_id;
            std::chrono::system_clock::time_point timestamp;
        };
 
        security_monitor() = default;
 
        // Threat detection
        void analyze_query_patterns(const std::string& user_id, const std::string& query);
        void detect_brute_force_attempts(const std::string& client_ip);
        void monitor_privilege_escalation(const std::string& user_id, const std::string& operation);
 
        // Alert management
        void register_security_handler(std::function<void(const security_alert&)> handler);
        std::vector<security_alert> get_recent_alerts(std::chrono::hours window) const;
 
        // Security metrics
        size_t get_failed_login_count(std::chrono::hours window) const;
        size_t get_suspicious_query_count(std::chrono::hours window) const;
        double calculate_security_score() const;
 
    private:
        void emit_security_alert(threat_level level, const std::string& type,
                                const std::string& description, const std::string& user_id = "");
 
        mutable std::mutex monitor_mutex_;
        std::vector<security_alert> security_alerts_;
        std::vector<std::function<void(const security_alert&)>> alert_handlers_;
 
        // Attack pattern tracking
        std::unordered_map<std::string, size_t> failed_login_attempts_;
        std::unordered_map<std::string, std::vector<std::string>> user_query_patterns_;
    };
 
    class encryption_manager
    {
    public:
        encryption_manager() = default;
 
        // Data encryption
        std::string encrypt_field_data(const std::string& data, const std::string& field_name) const;
        std::string decrypt_field_data(const std::string& encrypted_data, const std::string& field_name) const;
 
        // Key management
        bool generate_field_key(const std::string& field_name);
        bool rotate_field_key(const std::string& field_name);
        void set_master_encryption_key(const std::string& key);
 
        // Column-level encryption
        bool configure_encrypted_column(const std::string& table, const std::string& column,
                                       encryption_type type);
        bool is_column_encrypted(const std::string& table, const std::string& column) const;
 
    private:
        std::string derive_key(const std::string& field_name) const;
 
        mutable std::mutex encryption_mutex_;
        std::string master_key_;
        std::unordered_map<std::string, std::string> field_keys_;
        std::unordered_map<std::string, encryption_type> encrypted_columns_;
    };
 
    // Utility functions for permission checking
    inline access_control::permission operator|(access_control::permission a, access_control::permission b) {
        return static_cast<access_control::permission>(static_cast<int>(a) | static_cast<int>(b));
    }
 
    inline bool has_permission(access_control::permission permissions, access_control::permission check) {
        return (static_cast<int>(permissions) & static_cast<int>(check)) != 0;
    }
 
 
} // namespace database::security