Frameworks: `@Security`

import { Security, SecurityFramework, setupSecurity, setupAllSecurity } from 'ts-prorm-orm';

@Security({
  frameworks: [SecurityFramework.GDPR, SecurityFramework.HIPAA],
  audit: true,
  encrypt: ['ssn', 'diagnosis'],
  mask: { ssn: 'ssn', email: 'email' },
  retention: { years: 7 },
  autoClassify: true,
  getUserId: () => currentUser()?.id,
  getIpAddress: () => currentRequest()?.ip,
})
class Patient extends Model { /* … */ }

setupSecurity(Patient, prorm);   // or setupAllSecurity(prorm) once every model is registered

interface SecurityOptions {
  frameworks?: SecurityFramework[];

  audit?: boolean;                    // ComplianceAuditTrail on every create/update/destroy
  encrypt?: string[];                 // FieldEncryption on these columns
  mask?: Record<string, 'ssn' | 'card-last4' | 'card-first6' | 'email' | 'phone' | 'full'>;
  retention?: RetentionDuration;      // DataRetentionPolicy.set(Model, { maxAge })
  immutable?: boolean;                // ImmutableRecord.makeImmutable
  versioning?: boolean;               // …and enableVersioning
  rls?: (ctx: any) => { where?: Record<string, any> };   // RowLevelSecurity.apply
  classify?: Record<string, 'PII' | 'PHI' | 'PCI' | 'FINANCIAL' | 'HEALTH' | 'BIOMETRIC'>;
  autoClassify?: boolean;             // DataClassifier.autoDiscover by column name
  lineage?: boolean;                  // @LineageTrack
  sessionIsolation?: boolean;         // @TenantIsolation — with tenantIdField (default 'tenantId')
  tenantIdField?: string;
  worm?: boolean;                     // @WORM, retention from `retention` or 7 years
  rateLimit?: boolean;                // @RateLimit registration
  breachDetection?: boolean;          // flag only — see below
  crossBorderLog?: boolean;           // CrossBorderLog.enable
  sensitiveDataDiscovery?: boolean;   // flag only
  consentVersioning?: boolean;        // flag only
  dsar?: boolean;                     // flag only
  pia?: boolean;                      // flag only
  backupVerification?: boolean;       // flag only
  queryFirewall?: boolean;            // flag only

  getUserId?: () => string | number | undefined;   // for the audit trail
  getIpAddress?: () => string | undefined;
}

import {
  Model, Security, SecurityFramework, setupSecurity, securityWiring,
  configureFieldEncryption, TLSEnforcer, Prorm,
} from 'ts-prorm-orm';

declare const prorm: Prorm;

configureFieldEncryption(process.env.FIELD_KEY!);

@Security({
  frameworks: [SecurityFramework.PCI_DSS],
  encrypt: ['cardNumber'],
  mask: { cardNumber: 'card-last4' },
  onUnwired: 'throw',            // refuse to boot with a control that nothing enforces
})
class PaymentMethod extends Model {
  declare cardNumber: string;
}

TLSEnforcer.enforce(prorm, { mode: 'strict' });   // the part PCI needs that no decorator can do

try {
  setupSecurity(PaymentMethod, prorm);
} catch (err) {
  // onUnwired: 'throw' names each gap; here, `tls (implied by a framework)`
  console.error((err as Error).message);
}

securityWiring(PaymentMethod);
// { wired: ['encryption', 'masking', 'audit'], flagOnly: ['tls'], unwired: [ … ] }

[Security] PaymentMethod: 1 control(s) are recorded but not wired, so nothing enforces them:
  - tls (implied by a framework): nothing is wired; call TLSEnforcer.enforce(prorm) at startup and TLSEnforcer.verifyRuntime(prorm)
Set onUnwired: 'ignore' to silence this once you have wired them yourself.

import { TableSecurity, DatabaseSecurity } from 'ts-prorm-orm';

@DatabaseSecurity({
  name: 'clinical',
  region: 'eu-west-1',
  requireTLS: true,
  defaultClassification: 'CONFIDENTIAL',
  defaultAudit: true,
  defaultRetention: { years: 7 },
  allowedCountries: ['DE', 'FR'],
})
class ClinicalDatabase {}

@TableSecurity({ schema: 'phi', classification: 'SECRET', rlsEnabled: true, auditEnabled: true, dependsOn: ['patients'] })
@Security({ frameworks: [SecurityFramework.HIPAA] })
class Encounter extends Model { /* … */ }

import {
  getSecurityFrameworks, getTableSecurity, getDatabaseSecurity, hasAudit, isImmutableModel,
} from 'ts-prorm-orm';

getSecurityFrameworks(Patient);   // ['GDPR', 'HIPAA']
hasAudit(Patient);                // true
isImmutableModel(LedgerEntry);    // true
getTableSecurity(Encounter);      // { schema: 'phi', classification: 'SECRET', … }
getDatabaseSecurity(ClinicalDatabase);