69 lines
3.0 KiB
JavaScript
69 lines
3.0 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
// Vertical Slice: ALLA okontrollerade DB-förändringar blockeras (S-002) v3
|
||
|
|
// Inklusive insert, update, delete, alter, drop — alla skrivoperationer
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
|
||
|
|
import { AgentRuntimeV3 } from './agent-runtime-v3.mjs';
|
||
|
|
|
||
|
|
/**
|
||
|
|
* EOS Policy för ALLA skrivoperationer mot produktionsdatabas
|
||
|
|
* Blockerar: insert, update, delete, alter, drop, truncate, etc.
|
||
|
|
*/
|
||
|
|
function checkAllDBWritesPolicy(task) {
|
||
|
|
// Lista över alla skrivoperationer
|
||
|
|
const writeOperations = ['direct-sql', 'update', 'delete', 'insert', 'alter', 'drop', 'truncate', 'create'];
|
||
|
|
|
||
|
|
const isDatabaseOperation = task.type === 'database' ||
|
||
|
|
task.description?.toLowerCase().includes('databas') ||
|
||
|
|
task.description?.toLowerCase().includes('sql');
|
||
|
|
|
||
|
|
const isProduction = task.target === 'production' ||
|
||
|
|
task.description?.toLowerCase().includes('produktion');
|
||
|
|
|
||
|
|
const isWriteOperation = writeOperations.includes(task.action) ||
|
||
|
|
writeOperations.some(op =>
|
||
|
|
task.description?.toLowerCase().includes(op)
|
||
|
|
);
|
||
|
|
|
||
|
|
// Blockera även generella "ändringar" av databas
|
||
|
|
const isGenericDBChange = isDatabaseOperation &&
|
||
|
|
isProduction &&
|
||
|
|
(task.description?.toLowerCase().includes('ändra') ||
|
||
|
|
task.description?.toLowerCase().includes('radera') ||
|
||
|
|
task.description?.toLowerCase().includes('infoga') ||
|
||
|
|
task.description?.toLowerCase().includes('skapa'));
|
||
|
|
|
||
|
|
const hasApprovedPath = task.migration !== undefined ||
|
||
|
|
task.service !== undefined ||
|
||
|
|
task.approved === true;
|
||
|
|
|
||
|
|
if (isDatabaseOperation && isProduction && (isWriteOperation || isGenericDBChange) && !hasApprovedPath) {
|
||
|
|
return {
|
||
|
|
passed: false,
|
||
|
|
policyId: 'POL-DAT-001',
|
||
|
|
rule: 'no-direct-production-db-write',
|
||
|
|
reason: 'Alla okontrollerade förändringar av persistent data är förbjudna enligt EOS Policy POL-DAT-001. Använd godkänd migreringsprocess.',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
action: 'STOP',
|
||
|
|
evidence: {
|
||
|
|
type: task.type,
|
||
|
|
target: task.target,
|
||
|
|
action: task.action,
|
||
|
|
hasApprovedPath
|
||
|
|
}
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
return { passed: true };
|
||
|
|
}
|
||
|
|
|
||
|
|
class AgentRuntimeDBSliceV3 extends AgentRuntimeV3 {
|
||
|
|
constructor(task) {
|
||
|
|
super(task);
|
||
|
|
this.policies = [checkAllDBWritesPolicy];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
export { AgentRuntimeDBSliceV3, checkAllDBWritesPolicy };
|