Protecting data

import { Model, Classify, FieldClassification, getPIIFields, getPHIFields, isSensitive, autoDiscover } from 'ts-prorm-orm';

// Class decorators that name a column, not property decorators.
@Classify('CONFIDENTIAL')                      // the model as a whole
@FieldClassification('ssn', 'PII')
@FieldClassification('diagnosis', 'PHI')
@FieldClassification('cardNumber', 'PCI')
class Patient extends Model { /* … */ }

getPIIFields(Patient);          // ['ssn']
getPHIFields(Patient);          // ['diagnosis']
isSensitive(Patient, 'ssn');    // true
autoDiscover(Patient);          // tags by column NAME: ssn, email, dob, card…

import { SensitiveDataDiscovery } from 'ts-prorm-orm';

const found = SensitiveDataDiscovery.scan(Patient);
// [{ field: 'ssn', type: 'SSN', confidence: 0.95, method: 'column_name', recommendation: 'encrypt' }, …]

SensitiveDataDiscovery.scanAll(prorm);
SensitiveDataDiscovery.generateComplianceReport(prorm);   // every model, every finding, for the sheet
SensitiveDataDiscovery.autoProtect(Patient);               // apply the recommendations
SensitiveDataDiscovery.registerPattern({
  id: 'nhs', name: 'NHS number', type: 'NATIONAL_ID',
  pattern: /\b\d{3}\s?\d{3}\s?\d{4}\b/, columnNames: [/nhs/i],
  frameworks: ['GDPR'], recommendation: 'encrypt',
});

import { Model, configureFieldEncryption, Encrypt, applyEncryptionHooks, encryptValue, decryptValue } from 'ts-prorm-orm';

configureFieldEncryption(process.env.FIELD_KEY!);   // once, at startup

@Encrypt('ssn')             // a class decorator naming the column; or Encrypt('ssn')(Patient) without decorators
class Patient extends Model {
  declare ssn: string;
}
applyEncryptionHooks(Patient);

FieldEncryption.keyring({
  keys: [
    { id: '2025', key: process.env.FIELD_KEY_2025! },
    { id: '2026', passphrase: process.env.FIELD_PASS!, salt: process.env.FIELD_SALT! },
  ],
  active: '2026',
});

import { FieldEncryption, Op } from 'ts-prorm-orm';

declare const Patient: any;

FieldEncryption.keyring({
  keys: [
    { id: '2025', key: process.env.FIELD_KEY_2025! },
    { id: '2026', key: process.env.FIELD_KEY_2026! },
  ],
  active: '2026',
});

const stale = { ssn: { [Op.like]: 'enc:v2:2025:%' } };
for (;;) {
  const batch = await Patient.findAll({ where: stale, attributes: ['id', 'ssn'], limit: 500 });
  if (batch.length === 0) break;
  for (const row of batch) {
    // row.ssn is plain after afterFind; encrypt() writes enc:v2:2026:…
    await Patient.update({ ssn: FieldEncryption.encrypt(row.ssn) }, { where: { id: row.id } });
  }
}

import { Mask, applyMaskingHooks, mask, maskMany, maskValue } from 'ts-prorm-orm';

Mask('ssn', { pattern: 'ssn' })(Patient);
Mask('cardNumber', { pattern: 'card-last4' })(Patient);
Mask('email', { pattern: 'email' })(Patient);
applyMaskingHooks(Patient);            // wires an afterFind hook

mask(instance, 'support');             // one row, on demand, for one response
maskMany(rows, 'support');

import { PseudonymizationService, Pseudonymize, applyPseudonymizationHooks } from 'ts-prorm-orm';

PseudonymizationService.configure({
  secretKey: process.env.PSEUDO_KEY!,     // ≥ 32 bytes
  store: 'database',                      // or 'memory'
  model: TokenMap,                        // the mapping table, when store is 'database'
});

const token = await PseudonymizationService.tokenize('ada@example.com');
await PseudonymizationService.detokenize(token);    // 'ada@example.com', or null

Pseudonymize('email')(Patient);
applyPseudonymizationHooks(Patient, 'email');

import { RowLevelSecurity } from 'ts-prorm-orm';

RowLevelSecurity.apply(Order, (ctx) => ({ where: { tenantId: ctx.tenantId } }));
// Recommended: fail closed. A query on Order with no context throws.
RowLevelSecurity.registerHooks(prorm, { requireContext: true });

await RowLevelSecurity.runInContext({ tenantId: 'acme', userId: 'u1', role: 'member' }, async () => {
  await Order.findAll();       // WHERE tenantId = 'acme' merged into every query
  await Order.count();         // …and count, sum/min/max/avg, exists, update,
                               // destroy, restore, increment/decrement
  await Order.create({ total: 5 }); // tenantId stamped to 'acme'
});

// Trusted admin or batch work that genuinely needs every tenant:
await RowLevelSecurity.runWithoutRLS(() => Order.count());

app.use(RowLevelSecurity.middleware);   // Express: context from the request

import { TLSEnforcer } from 'ts-prorm-orm';

TLSEnforcer.enforce(prorm, { mode: 'strict', allowLocal: true });   // 'strict' | 'warn' | 'off'
TLSEnforcer.enforce(prorm, { minVersion: 'TLSv1.3' });               // require a protocol floor
TLSEnforcer.inspect(prorm);                                          // the findings, without throwing
await TLSEnforcer.verifyRuntime(prorm);                              // ask the server
TLSEnforcer.recommendedOptions('postgres');                          // the dialectOptions to set

import { QueryFirewall, FirewallModeEnum } from 'ts-prorm-orm';

const firewall = QueryFirewall.create(prorm, {
  mode: FirewallModeEnum.Blocklist,        // Allowlist | Blocklist | Strict
  frameworks: ['OWASP', 'CIS'],            // bundles applied at creation
  onBlock: (blocked) => log.warn(blocked),
});

firewall.applyFrameworkRules('PCI');       // CIS | PCI | HIPAA | SOX | NIST | OWASP, any time

firewall.block(/DROP\s+TABLE/i, 'no table drops from the app');
firewall.allow(/^SELECT/i);

firewall.checkQuery(sql);                  // analyse without running
firewall.getBlockedHistory();
firewall.getQueryLog(100);

import { Model, RateLimiter, RateLimit, initRateLimiter, checkRateLimit } from 'ts-prorm-orm';

initRateLimiter(prorm, {
  user:      { perMinute: 120, perHour: 2000 },
  anonymous: { perMinute: 20,  perHour: 200 },
  role:      { admin: { perMinute: 600, perHour: 10000 } },
  action: 'block',                          // or 'throttle' with throttleDelay
});

const verdict = checkRateLimit(userId, ip, '/export', role);   // { allowed, remaining, retryAfter }

// The decorator is typed for ModelStatic, so a plain `extends Model` class needs the call form:
class Export extends Model { /* … */ }
RateLimit({ perMinute: 10 })(Export as any);