recording+ + +`; + +fs.mkdirSync(reportDir, { recursive: true }); + +const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "webhook-redaction-demo-")); +const htmlPath = path.join(tempDir, "demo.html"); +const profileDir = path.join(tempDir, "profile"); +fs.writeFileSync(htmlPath, html, "utf8"); + +const stdout = execFileSync( + findBrowser(), + [ + "--headless=new", + "--disable-gpu", + "--disable-dev-shm-usage", + "--autoplay-policy=no-user-gesture-required", + "--run-all-compositor-stages-before-draw", + "--virtual-time-budget=7500", + `--user-data-dir=${profileDir}`, + "--dump-dom", + fileUrl(htmlPath) + ], + { encoding: "utf8", maxBuffer: 30 * 1024 * 1024 } +); + +const match = stdout.match(/data:video\/webm;base64,([A-Za-z0-9+/=]+)/); +if (!match) { + throw new Error(`Demo video generation failed. Browser output ended with: ${stdout.slice(-600)}`); +} + +fs.writeFileSync(outputPath, Buffer.from(match[1], "base64")); +console.log(`Generated ${path.relative(process.cwd(), outputPath)}`); diff --git a/webhook-payload-redaction-guard/demo.js b/webhook-payload-redaction-guard/demo.js new file mode 100644 index 00000000..97c3730c --- /dev/null +++ b/webhook-payload-redaction-guard/demo.js @@ -0,0 +1,18 @@ +const fs = require("fs"); +const path = require("path"); +const { project } = require("./sample-data"); +const { buildReviewPacket, renderMarkdownReport, renderSvgSummary } = require("./index"); + +const reportDir = path.join(__dirname, "reports"); +fs.mkdirSync(reportDir, { recursive: true }); + +const packet = buildReviewPacket(project); + +fs.writeFileSync(path.join(reportDir, "summary.json"), `${JSON.stringify(packet, null, 2)}\n`, "utf8"); +fs.writeFileSync(path.join(reportDir, "reviewer-packet.md"), renderMarkdownReport(packet), "utf8"); +fs.writeFileSync(path.join(reportDir, "summary.svg"), renderSvgSummary(packet), "utf8"); + +console.log(`Generated reports for ${packet.guard}`); +console.log(`Decision: ${packet.decision}`); +console.log(`Score: ${packet.score}`); +console.log(`Findings: ${packet.findings.length}`); diff --git a/webhook-payload-redaction-guard/index.js b/webhook-payload-redaction-guard/index.js new file mode 100644 index 00000000..157fa913 --- /dev/null +++ b/webhook-payload-redaction-guard/index.js @@ -0,0 +1,282 @@ +const SEVERITY_WEIGHTS = { + critical: 34, + high: 20, + medium: 10, + low: 4 +}; + +function addFinding(findings, severity, rule, message, action, refs = []) { + findings.push({ severity, rule, message, action, refs }); +} + +function isPlainObject(value) { + return value && typeof value === "object" && !Array.isArray(value); +} + +function walkObject(value, visitor, path = []) { + if (!isPlainObject(value) && !Array.isArray(value)) { + return; + } + const entries = Array.isArray(value) ? value.entries() : Object.entries(value); + for (const [key, child] of entries) { + const nextPath = path.concat(String(key)); + visitor(String(key), child, nextPath); + walkObject(child, visitor, nextPath); + } +} + +function pathString(path) { + return path.join("."); +} + +function evaluateEvent(event, project, findings) { + if (!project.policy.allowedEventTypes.includes(event.eventType)) { + addFinding( + findings, + "critical", + "webhook-event-type-not-allowlisted", + `${event.eventId} uses non-allowlisted event type ${event.eventType}.`, + "Block delivery until the event type is approved for the destination connector.", + [event.eventId, event.eventType] + ); + } + + for (const field of Object.keys(event)) { + if (!project.policy.allowedTopLevelFields.includes(field) && field !== "destination") { + addFinding( + findings, + "medium", + "webhook-top-level-field-not-allowlisted", + `${event.eventId} includes non-allowlisted top-level field ${field}.`, + "Drop non-contract fields before webhook delivery.", + [event.eventId, field] + ); + } + } + + if (!project.policy.allowedRegions.includes(event.destination.region)) { + addFinding( + findings, + "high", + "webhook-region-not-allowed", + `${event.eventId} targets region ${event.destination.region}.`, + "Hold delivery until data-residency routing is approved.", + [event.eventId, event.destination.region] + ); + } + + const signature = event.signature || {}; + for (const field of project.policy.requiredSignatureFields) { + if (!signature[field]) { + addFinding( + findings, + "high", + "webhook-signature-metadata-incomplete", + `${event.eventId} is missing signature field ${field}.`, + "Regenerate signed event metadata before delivery.", + [event.eventId, field] + ); + } + } + if (signature.algorithm && signature.algorithm !== "HMAC-SHA256") { + addFinding( + findings, + "critical", + "webhook-signature-algorithm-unsafe", + `${event.eventId} uses unsafe signature algorithm ${signature.algorithm}.`, + "Block delivery until a production signing algorithm is used.", + [event.eventId, signature.algorithm] + ); + } + + walkObject(event, (key, value, path) => { + if (project.policy.piiFieldNames.includes(key)) { + addFinding( + findings, + "critical", + "webhook-pii-field-present", + `${event.eventId} includes PII field ${pathString(path)}.`, + "Redact direct identifiers before institutional webhook delivery.", + [event.eventId, pathString(path)] + ); + } + if (project.policy.blockedProjectFields.includes(key)) { + addFinding( + findings, + "high", + "webhook-private-project-field-present", + `${event.eventId} includes private project field ${pathString(path)}.`, + "Remove private workspace fields from outbound payloads.", + [event.eventId, pathString(path)] + ); + } + if (typeof value === "string" && value.includes("storage.example/private")) { + addFinding( + findings, + "critical", + "webhook-private-storage-link-present", + `${event.eventId} exposes a private storage URL at ${pathString(path)}.`, + "Replace private URLs with DOI/metadata links or suppress the field.", + [event.eventId, pathString(path)] + ); + } + }); + + if (event.project && event.project.visibility !== "public" && event.destination.purpose === "public-metadata") { + addFinding( + findings, + "high", + "private-project-routed-to-public-metadata", + `${event.eventId} routes ${event.project.visibility} project metadata to a public destination.`, + "Hold delivery until the workspace visibility and payload purpose agree.", + [event.eventId, event.project.id] + ); + } + + if (event.dataset) { + if (!project.policy.publicDatasetAccess.includes(event.dataset.access)) { + addFinding( + findings, + "critical", + "webhook-dataset-access-not-public-safe", + `${event.eventId} includes dataset ${event.dataset.id} with access ${event.dataset.access}.`, + "Suppress dataset delivery or emit metadata-only redacted payload.", + [event.eventId, event.dataset.id, event.dataset.access] + ); + } + if (event.dataset.access === "embargoed-metadata-only" && event.dataset.downloadUrl) { + addFinding( + findings, + "high", + "embargoed-dataset-download-url-present", + `${event.eventId} includes a download URL for embargoed dataset ${event.dataset.id}.`, + "Remove download links while preserving DOI and metadata.", + [event.eventId, event.dataset.id] + ); + } + } +} + +function evaluateWebhookPayloads(project) { + const findings = []; + for (const event of project.outboundEvents) { + evaluateEvent(event, project, findings); + } + + const eventDecisions = project.outboundEvents.map((event) => { + const eventFindings = findings.filter((finding) => finding.refs.includes(event.eventId)); + const hasCritical = eventFindings.some((finding) => finding.severity === "critical"); + const hasHigh = eventFindings.some((finding) => finding.severity === "high"); + return { + eventId: event.eventId, + decision: hasCritical ? "block-delivery" : hasHigh ? "redact-and-review" : "deliver", + rules: eventFindings.map((finding) => finding.rule) + }; + }); + + const severitySummary = findings.reduce( + (summary, finding) => { + summary[finding.severity] += 1; + return summary; + }, + { critical: 0, high: 0, medium: 0, low: 0 } + ); + const score = Math.max(0, 100 - findings.reduce((sum, finding) => sum + SEVERITY_WEIGHTS[finding.severity], 0)); + + return { findings, eventDecisions, severitySummary, score }; +} + +function decisionFromEvaluation(evaluation) { + if (evaluation.severitySummary.critical > 0) { + return "block-unsafe-webhook-delivery"; + } + if (evaluation.severitySummary.high > 0 || evaluation.score < 75) { + return "redact-and-review-before-delivery"; + } + if (evaluation.score < 90) { + return "manual-webhook-payload-review"; + } + return "webhook-payload-ready"; +} + +function buildReviewPacket(project) { + const evaluation = evaluateWebhookPayloads(project); + return { + guard: "webhook-payload-redaction-guard", + issue: "SCIBASE-AI/SCIBASE.AI#19", + asOfDate: project.asOfDate, + decision: decisionFromEvaluation(evaluation), + score: evaluation.score, + severitySummary: evaluation.severitySummary, + findings: evaluation.findings, + eventDecisions: evaluation.eventDecisions, + safety: [ + "Synthetic webhook, project, dataset, review, and connector data only", + "No live webhook delivery, repository sync, LMS sync, identity, storage, or external provider calls", + "No private institutional payloads, credentials, secrets, real users, or live admin mutations" + ] + }; +} + +function renderMarkdownReport(packet) { + const lines = [ + "# Webhook Payload Redaction Guard", + "", + `Issue: ${packet.issue}`, + `Decision: ${packet.decision}`, + `Score: ${packet.score}`, + "", + "## Event Decisions", + "" + ]; + + for (const decision of packet.eventDecisions) { + lines.push(`- ${decision.eventId}: ${decision.decision}`); + if (decision.rules.length > 0) { + lines.push(` - Rules: ${decision.rules.join(", ")}`); + } + } + + lines.push("", "## Findings", ""); + for (const finding of packet.findings) { + lines.push(`- **${finding.severity} / ${finding.rule}**: ${finding.message}`); + lines.push(` - Action: ${finding.action}`); + lines.push(` - Refs: ${finding.refs.join(", ") || "none"}`); + } + + lines.push("", "## Safety", ""); + for (const item of packet.safety) { + lines.push(`- ${item}`); + } + + return `${lines.join("\n")}\n`; +} + +function renderSvgSummary(packet) { + const scoreWidth = Math.max(44, Math.min(760, packet.score * 7.6)); + return ` +`; +} + +module.exports = { + buildReviewPacket, + decisionFromEvaluation, + evaluateWebhookPayloads, + renderMarkdownReport, + renderSvgSummary +}; diff --git a/webhook-payload-redaction-guard/package.json b/webhook-payload-redaction-guard/package.json new file mode 100644 index 00000000..32c8cbec --- /dev/null +++ b/webhook-payload-redaction-guard/package.json @@ -0,0 +1,14 @@ +{ + "name": "webhook-payload-redaction-guard", + "version": "1.0.0", + "description": "Deterministic enterprise guard for webhook payload redaction and minimization.", + "main": "index.js", + "private": true, + "type": "commonjs", + "scripts": { + "check": "node --check index.js && node --check sample-data.js && node --check demo.js && node --check demo-video.js && node --check test.js", + "test": "node test.js", + "demo": "node demo.js", + "demo:video": "node demo-video.js" + } +} diff --git a/webhook-payload-redaction-guard/reports/demo.webm b/webhook-payload-redaction-guard/reports/demo.webm new file mode 100644 index 0000000000000000000000000000000000000000..6c4ca731d3a988f1dc51b5d60c650f0faa96b9cb GIT binary patch literal 80997 zcmeFYb#NZRk|+3mVrG`b%*+-uGs|LTi^*bUW{a7bS+ba!nVA{RZ{ED!nc3aDjkvgo z`(uC69o5;D)s>Z%m6;t~jU&31pDh&Z2NZhxd*1qi3ElZY3Hb-Qni$#$h5RLh{6Mgj zea(P?zW{z`Lzc~OYLjh`P%aNdmn=0^uJE({CxxL>W%ZXz_$Ngm+~oY1>X&Vg`pfxE zx&3cl0Ps7>dF4Nz^S_OMbdf{7R2zUOBp?zNC^8VlFY6mDZ0=xZW1=qj?-&2*xxA`$ z$q(rGCuFi`S8pfAC%_M=dg%uY4pP%oQ{dc=tnml!Y4Zp9rrhHP{D*A+91f4lkslz( z8ZOt|$?vaBv0A|2K
iKtI
zHJIx^-n5~`Se#?We~AAFu(x|=w6ghn|D*Y5%WSjXcGEFkviG!|iU#)f8I!Pk0Oscw
z*BFswllJa