387 lines
12 KiB
JavaScript
387 lines
12 KiB
JavaScript
|
#!/usr/bin/env node
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
// Evidence Resolver — Resonera över evidens, inte klassificera text
|
||
|
|
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Evidence Resolver
|
||
|
|
*
|
||
|
|
* Arkitektur:
|
||
|
|
* Text → Intent Extraction → Candidate Operations → Evidence Collection → Resolution → EOS
|
||
|
|
*
|
||
|
|
* Istället för att gissa rätt operation direkt, samlar vi in evidens och resonerar.
|
||
|
|
*/
|
||
|
|
|
||
|
|
// Kanoniska operationer med evidenskrav
|
||
|
|
const OPERATIONS = {
|
||
|
|
REMOTE_PRODUCTION_ACCESS: {
|
||
|
|
id: 'REMOTE_PRODUCTION_ACCESS',
|
||
|
|
description: 'Fjärråtkomst till produktionsmiljö',
|
||
|
|
policy: 'POL-SEC-001',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
allowed: false,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['targetEnvironment', 'accessMethod'],
|
||
|
|
optional: ['tools', 'credentials']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
MODIFY_PERSISTENT_PRODUCTION_DATA: {
|
||
|
|
id: 'MODIFY_PERSISTENT_PRODUCTION_DATA',
|
||
|
|
description: 'Förändring av persistent data i produktion',
|
||
|
|
policy: 'POL-DAT-001',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
allowed: false,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['targetEnvironment', 'dataOperation'],
|
||
|
|
optional: ['database', 'migration']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
MODIFY_PRODUCTION_INFRASTRUCTURE: {
|
||
|
|
id: 'MODIFY_PRODUCTION_INFRASTRUCTURE',
|
||
|
|
description: 'Förändring av produktionsinfrastruktur',
|
||
|
|
policy: 'POL-INFRA-001',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
allowed: false,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['targetEnvironment', 'infraOperation'],
|
||
|
|
optional: ['tool', 'resourceType']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
PRODUCTION_RELEASE: {
|
||
|
|
id: 'PRODUCTION_RELEASE',
|
||
|
|
description: 'Publicering av kod till produktion',
|
||
|
|
policy: 'POL-DEP-001',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
allowed: false,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['targetEnvironment', 'releaseOperation'],
|
||
|
|
optional: ['pipeline', 'artifact']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
EXPOSE_OR_CREATE_SECRET: {
|
||
|
|
id: 'EXPOSE_OR_CREATE_SECRET',
|
||
|
|
description: 'Exponering eller skapande av hemligheter',
|
||
|
|
policy: 'POL-SEC-002',
|
||
|
|
severity: 'CRITICAL',
|
||
|
|
allowed: false,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['secretPattern'],
|
||
|
|
optional: ['fileType', 'context']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
READ_PRODUCTION_DATA: {
|
||
|
|
id: 'READ_PRODUCTION_DATA',
|
||
|
|
description: 'Läsning av produktionsdata',
|
||
|
|
policy: null,
|
||
|
|
severity: 'LOW',
|
||
|
|
allowed: true,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['readOperation'],
|
||
|
|
optional: ['targetEnvironment']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
OBSERVE_INFRASTRUCTURE: {
|
||
|
|
id: 'OBSERVE_INFRASTRUCTURE',
|
||
|
|
description: 'Observation av infrastruktur',
|
||
|
|
policy: null,
|
||
|
|
severity: 'LOW',
|
||
|
|
allowed: true,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: ['observeOperation'],
|
||
|
|
optional: ['tool']
|
||
|
|
}
|
||
|
|
},
|
||
|
|
DEVELOPMENT_TASK: {
|
||
|
|
id: 'DEVELOPMENT_TASK',
|
||
|
|
description: 'Utvecklingsuppgift',
|
||
|
|
policy: null,
|
||
|
|
severity: 'LOW',
|
||
|
|
allowed: true,
|
||
|
|
evidenceRequirements: {
|
||
|
|
required: [],
|
||
|
|
optional: ['fileType', 'context']
|
||
|
|
}
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Intent Extraction — Hitta kandidatoperationer från text
|
||
|
|
*
|
||
|
|
* Returnerar: Lista av möjliga operationer med konfidens
|
||
|
|
*/
|
||
|
|
function extractIntents(task) {
|
||
|
|
const description = (task.description || '').toLowerCase();
|
||
|
|
const action = (task.action || '').toLowerCase();
|
||
|
|
const type = (task.type || '').toLowerCase();
|
||
|
|
|
||
|
|
const candidates = [];
|
||
|
|
|
||
|
|
// Enkel intent-extraction baserad på nyckelord
|
||
|
|
// Viktigt: Detta är bara första steget, inte slutgiltigt beslut
|
||
|
|
const intentSignals = {
|
||
|
|
REMOTE_PRODUCTION_ACCESS: {
|
||
|
|
signals: ['ssh', 'login', 'logga in', 'anslut', 'connect', 'session', 'shell', 'terminal', 'fjärr', 'remote'],
|
||
|
|
weight: 1.0
|
||
|
|
},
|
||
|
|
MODIFY_PERSISTENT_PRODUCTION_DATA: {
|
||
|
|
signals: ['databas', 'database', 'sql', 'update', 'delete', 'insert', 'data'],
|
||
|
|
weight: 1.0
|
||
|
|
},
|
||
|
|
MODIFY_PRODUCTION_INFRASTRUCTURE: {
|
||
|
|
signals: ['infrastruktur', 'infrastructure', 'terraform', 'aws', 'cloud', 'skala', 'scale'],
|
||
|
|
weight: 1.0
|
||
|
|
},
|
||
|
|
PRODUCTION_RELEASE: {
|
||
|
|
signals: ['deploy', 'release', 'publicera', 'släpp', 'lansera', 'pipeline'],
|
||
|
|
weight: 1.0
|
||
|
|
},
|
||
|
|
EXPOSE_OR_CREATE_SECRET: {
|
||
|
|
signals: ['password', 'secret', 'token', 'key', 'lösenord', 'nyckel', 'hemlig'],
|
||
|
|
weight: 1.5 // Högre vikt för secrets
|
||
|
|
}
|
||
|
|
};
|
||
|
|
|
||
|
|
for (const [opId, config] of Object.entries(intentSignals)) {
|
||
|
|
let score = 0;
|
||
|
|
const matchedSignals = [];
|
||
|
|
|
||
|
|
for (const signal of config.signals) {
|
||
|
|
if (description.includes(signal)) {
|
||
|
|
score += 1;
|
||
|
|
matchedSignals.push(signal);
|
||
|
|
}
|
||
|
|
if (action === signal) {
|
||
|
|
score += 2;
|
||
|
|
matchedSignals.push(`action:${signal}`);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (score > 0) {
|
||
|
|
candidates.push({
|
||
|
|
operation: opId,
|
||
|
|
confidence: Math.min(score * config.weight / 5, 1),
|
||
|
|
signals: matchedSignals,
|
||
|
|
source: 'intent_extraction'
|
||
|
|
});
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Sortera efter konfidens
|
||
|
|
candidates.sort((a, b) => b.confidence - a.confidence);
|
||
|
|
|
||
|
|
return candidates;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Evidence Collection — Samla in konkret evidens
|
||
|
|
*/
|
||
|
|
function collectEvidence(task, candidates) {
|
||
|
|
const evidence = {
|
||
|
|
targetEnvironment: null,
|
||
|
|
accessMethod: null,
|
||
|
|
dataOperation: null,
|
||
|
|
infraOperation: null,
|
||
|
|
releaseOperation: null,
|
||
|
|
secretPattern: null,
|
||
|
|
readOperation: null,
|
||
|
|
observeOperation: null,
|
||
|
|
fileType: null,
|
||
|
|
tools: [],
|
||
|
|
context: []
|
||
|
|
};
|
||
|
|
|
||
|
|
const description = (task.description || '').toLowerCase();
|
||
|
|
const action = (task.action || '').toLowerCase();
|
||
|
|
|
||
|
|
// Target Environment
|
||
|
|
if (task.target === 'production' || description.includes('produktion') || description.includes('production')) {
|
||
|
|
evidence.targetEnvironment = 'production';
|
||
|
|
} else if (task.target === 'staging' || description.includes('staging')) {
|
||
|
|
evidence.targetEnvironment = 'staging';
|
||
|
|
} else if (task.target === 'development' || description.includes('utveckling')) {
|
||
|
|
evidence.targetEnvironment = 'development';
|
||
|
|
}
|
||
|
|
|
||
|
|
// Access Method
|
||
|
|
if (['ssh', 'ssm', 'telnet', 'rdp'].includes(action)) {
|
||
|
|
evidence.accessMethod = action;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Data Operation
|
||
|
|
if (['update', 'delete', 'insert', 'alter', 'drop'].includes(action)) {
|
||
|
|
evidence.dataOperation = action;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Infra Operation
|
||
|
|
if (['create', 'modify', 'update', 'delete', 'configure'].includes(action)) {
|
||
|
|
evidence.infraOperation = action;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Release Operation
|
||
|
|
if (['deploy', 'release', 'publish', 'push'].includes(action)) {
|
||
|
|
evidence.releaseOperation = action;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Secret Pattern
|
||
|
|
if (task.files) {
|
||
|
|
for (const file of task.files) {
|
||
|
|
const content = file.content || '';
|
||
|
|
if (/password|secret|token|api_key|private_key/i.test(content)) {
|
||
|
|
evidence.secretPattern = 'hardcoded_secret';
|
||
|
|
evidence.fileType = file.path.split('.').pop();
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Read Operation
|
||
|
|
if (['read', 'select', 'show', 'display', 'visa'].includes(action) ||
|
||
|
|
description.includes('läs') || description.includes('visa')) {
|
||
|
|
evidence.readOperation = true;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Observe Operation
|
||
|
|
if (['inventory', 'plan', 'validate', 'health-check'].includes(action)) {
|
||
|
|
evidence.observeOperation = action;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Tools
|
||
|
|
if (description.includes('aws')) evidence.tools.push('aws');
|
||
|
|
if (description.includes('terraform')) evidence.tools.push('terraform');
|
||
|
|
if (description.includes('kubectl')) evidence.tools.push('kubectl');
|
||
|
|
if (description.includes('docker')) evidence.tools.push('docker');
|
||
|
|
|
||
|
|
// Context
|
||
|
|
if (description.includes('manuellt')) evidence.context.push('manual');
|
||
|
|
if (description.includes('direkt')) evidence.context.push('direct');
|
||
|
|
if (description.includes('temporär')) evidence.context.push('temporary');
|
||
|
|
|
||
|
|
return evidence;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Operation Resolution — Välj operation baserat på evidens
|
||
|
|
*/
|
||
|
|
function resolveOperation(candidates, evidence) {
|
||
|
|
// Om vi har stark evidens för en specifik operation, välj den
|
||
|
|
|
||
|
|
// Secrets har högsta prioritet om vi hittar mönster
|
||
|
|
if (evidence.secretPattern) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.EXPOSE_OR_CREATE_SECRET,
|
||
|
|
confidence: 0.95,
|
||
|
|
evidence: ['secretPattern', `fileType:${evidence.fileType}`],
|
||
|
|
reasoning: 'Hittade hårdkodad hemlighet i fil'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Produktionsåtkomst
|
||
|
|
if (evidence.targetEnvironment === 'production' && evidence.accessMethod) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.REMOTE_PRODUCTION_ACCESS,
|
||
|
|
confidence: 0.9,
|
||
|
|
evidence: ['targetEnvironment:production', `accessMethod:${evidence.accessMethod}`],
|
||
|
|
reasoning: 'Fjärråtkomst till produktion'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Dataförändring i produktion
|
||
|
|
if (evidence.targetEnvironment === 'production' && evidence.dataOperation) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.MODIFY_PERSISTENT_PRODUCTION_DATA,
|
||
|
|
confidence: 0.9,
|
||
|
|
evidence: ['targetEnvironment:production', `dataOperation:${evidence.dataOperation}`],
|
||
|
|
reasoning: 'Dataförändring i produktion'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Infrastrukturförändring i produktion
|
||
|
|
if (evidence.targetEnvironment === 'production' && evidence.infraOperation) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.MODIFY_PRODUCTION_INFRASTRUCTURE,
|
||
|
|
confidence: 0.9,
|
||
|
|
evidence: ['targetEnvironment:production', `infraOperation:${evidence.infraOperation}`],
|
||
|
|
reasoning: 'Infrastrukturförändring i produktion'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Release till produktion
|
||
|
|
if (evidence.targetEnvironment === 'production' && evidence.releaseOperation) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.PRODUCTION_RELEASE,
|
||
|
|
confidence: 0.9,
|
||
|
|
evidence: ['targetEnvironment:production', `releaseOperation:${evidence.releaseOperation}`],
|
||
|
|
reasoning: 'Release till produktion'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Läsning av data
|
||
|
|
if (evidence.readOperation) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.READ_PRODUCTION_DATA,
|
||
|
|
confidence: 0.7,
|
||
|
|
evidence: ['readOperation'],
|
||
|
|
reasoning: 'Läsuppgift'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Observation
|
||
|
|
if (evidence.observeOperation) {
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.OBSERVE_INFRASTRUCTURE,
|
||
|
|
confidence: 0.7,
|
||
|
|
evidence: ['observeOperation'],
|
||
|
|
reasoning: 'Observationsuppgift'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
// Om vi har kandidater från intent extraction, använd den bästa
|
||
|
|
if (candidates.length > 0) {
|
||
|
|
const bestCandidate = candidates[0];
|
||
|
|
const op = OPERATIONS[bestCandidate.operation];
|
||
|
|
|
||
|
|
if (op) {
|
||
|
|
return {
|
||
|
|
operation: op,
|
||
|
|
confidence: bestCandidate.confidence * 0.7, // Lägre konfidens utan direkt evidens
|
||
|
|
evidence: bestCandidate.signals,
|
||
|
|
reasoning: `Intent extraction: ${bestCandidate.signals.join(', ')}`
|
||
|
|
};
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Default: Utvecklingsuppgift
|
||
|
|
return {
|
||
|
|
operation: OPERATIONS.DEVELOPMENT_TASK,
|
||
|
|
confidence: 0.5,
|
||
|
|
evidence: ['default'],
|
||
|
|
reasoning: 'Ingen specifik operation identifierad, antar utvecklingsuppgift'
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Huvudfunktion: Kör hela resolution-flödet
|
||
|
|
*/
|
||
|
|
function resolve(task) {
|
||
|
|
// Steg 1: Intent Extraction
|
||
|
|
const candidates = extractIntents(task);
|
||
|
|
|
||
|
|
// Steg 2: Evidence Collection
|
||
|
|
const evidence = collectEvidence(task, candidates);
|
||
|
|
|
||
|
|
// Steg 3: Operation Resolution
|
||
|
|
const resolution = resolveOperation(candidates, evidence);
|
||
|
|
|
||
|
|
return {
|
||
|
|
candidates: candidates.slice(0, 3), // Topp 3 kandidater
|
||
|
|
evidence,
|
||
|
|
resolution,
|
||
|
|
trace: {
|
||
|
|
intentExtraction: candidates.length > 0 ? 'found_candidates' : 'no_candidates',
|
||
|
|
evidenceCollection: Object.keys(evidence).filter(k => evidence[k] !== null && evidence[k] !== false).length,
|
||
|
|
resolution: resolution.operation.id
|
||
|
|
}
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|
||
|
|
export { OPERATIONS, extractIntents, collectEvidence, resolveOperation, resolve };
|