Security & Credential Management

class CredentialStore {
  constructor({ secretsManager, encryptionKeyId }) {
    this.secretsManager = secretsManager;
    this.encryptionKeyId = encryptionKeyId;
  }

  async storeToken(customerId, token) {
    // 1. Encrypt with per-customer-derived key
    const customerKey = await this._deriveCustomerKey(customerId);
    const encrypted = await encrypt(token, customerKey);

    // 2. Store in secrets manager
    await this.secretsManager.put(`customer/${customerId}/vomo_token`, encrypted);

    // 3. Audit log
    await audit.log({
      event: 'token_stored',
      customer_id: customerId,
      actor: getCurrentActor(),
      timestamp: new Date(),
    });
  }

  async getToken(customerId, reason) {
    // Every access requires a reason — for audit trail
    if (!reason) throw new Error('Token access requires a reason');

    const encrypted = await this.secretsManager.get(`customer/${customerId}/vomo_token`);
    const customerKey = await this._deriveCustomerKey(customerId);
    const token = await decrypt(encrypted, customerKey);

    await audit.log({
      event: 'token_accessed',
      customer_id: customerId,
      actor: getCurrentActor(),
      reason,
      timestamp: new Date(),
    });

    return token;
  }
}

async function withVomoToken(customerId, reason, fn) {
  const token = await credentialStore.getToken(customerId, reason);
  try {
    return await fn(token);
  } finally {
    // Best-effort scrub — JavaScript doesn't give strong guarantees here
    // but the principle is to not keep tokens around longer than needed
    token.value = null;
  }
}

// Usage
await withVomoToken(customerId, 'polling_cycle', async (token) => {
  // Use the token here
  await pollUsers(customerId, token);
  // Token goes out of scope when the function returns
});

// ❌ Anti-pattern: caching decrypted tokens
const tokenCache = new Map();
async function getCachedToken(customerId) {
  if (tokenCache.has(customerId)) return tokenCache.get(customerId);
  const token = await credentialStore.getToken(customerId, 'polling');
  tokenCache.set(customerId, token); // Now in memory for the process lifetime
  return token;
}

class UserSyncWorker {
  constructor({ customerId }) {
    this.customerId = customerId;
  }

  async runOneCycle() {
    // Read-only operations
    const usersToken = await credentialStore.getToken(this.customerId, 'user_sync_read');
    const users = await listUsers(usersToken);
    // ...
  }

  async pushUpdate(externalUpdate) {
    // Write operation
    const writeToken = await credentialStore.getToken(this.customerId, 'user_sync_write');
    await upsertUser(writeToken, externalUpdate);
    // ...
  }
}

// Partner web UI form handler
app.post('/customer/onboarding/vomo-token', requireAuthenticatedCustomer, async (req, res) => {
  const customerId = req.session.customerId;
  const token = req.body.vomoToken;

  if (!token || typeof token !== 'string' || token.length < 20) {
    return res.status(400).json({ error: 'Invalid token format' });
  }

  // Test the token works
  const valid = await testVomoToken(token);
  if (!valid) {
    return res.status(400).json({ error: 'VOMO rejected this token' });
  }

  // Store securely
  await credentialStore.storeToken(customerId, token);

  // Don't echo the token back in the response
  res.json({ success: true });
});

async function sendRotationReminders() {
  const customers = await db.getCustomersWithStaleTokens(180); // 6 months
  for (const customer of customers) {
    await emailService.send({
      to: customer.adminEmail,
      template: 'token_rotation_reminder',
      data: { customerName: customer.name, daysSinceRotation: customer.daysSinceRotation },
    });
  }
}

// ❌ Anti-pattern: store everything
await db.upsertPerson({
  vomo_user_id: user.id,
  first_name: user.first_name,
  last_name: user.last_name,
  email: user.email,
  phone: user.phone,           // Do you need this?
  birthday: user.birthday,     // Or this?
  address: user.address,       // Or this?
  gender: user.gender,         // Or this?
  // ... all fields ...
});

// ✅ Better: store only what your workflows need
await db.upsertPerson({
  vomo_user_id: user.id,
  display_name: user.full_name,  // composite if you don't need first/last separately
  email: user.email,             // needed for join key
  // skip phone/birthday/address/gender if your workflows don't use them
});

async function deletePerson(customerId, partnerPersonId, reason) {
  // 1. Anonymize the canonical person record (keep ID; clear PII)
  await db.query(`
    UPDATE persons SET
      first_name = NULL,
      last_name = NULL,
      email = CONCAT('deleted-', partner_person_id, '@anonymized.local'),
      anonymized_at = NOW(),
      anonymization_reason = $3
    WHERE customer_id = $1 AND partner_person_id = $2
  `, [customerId, partnerPersonId, reason]);

  // 2. Delete from related tables that hold PII
  await db.query(`DELETE FROM ... WHERE partner_person_id = ...`);

  // 3. Audit log
  await audit.log({
    event: 'person_anonymized',
    customer_id: customerId,
    partner_person_id: partnerPersonId,
    reason,
    actor: getCurrentActor(),
  });
}

async function offboardCustomer(customerId) {
  const trace = generateTraceId();

  // 1. Disable polling and reconciliation immediately
  await db.upsert('sync_configs', {
    customer_id: customerId,
    enabled: false,
    offboarded_at: new Date(),
  });
  await jobScheduler.removeAllForCustomer(customerId);

  // 2. Revoke the token's use within the integration
  await credentialStore.deleteToken(customerId);

  // 3. Audit the offboarding
  await audit.log({
    event: 'customer_offboarded',
    customer_id: customerId,
    actor: getCurrentActor(),
    trace_id: trace,
  });

  // 4. Schedule data retention per agreement
  const retentionDays = await getRetentionPolicy(customerId);
  await jobScheduler.scheduleOneTime({
    type: 'final_data_deletion',
    customerId,
    delayDays: retentionDays,
    trace_id: trace,
  });

  // 5. Notify customer
  await emailService.send({
    to: customer.adminEmail,
    template: 'offboarding_confirmation',
    data: { customerId, retentionDays },
  });
}

async function finalDataDeletion(customerId, traceId) {
  // After the retention period, permanently delete
  await db.query(`DELETE FROM persons WHERE customer_id = $1`, [customerId]);
  await db.query(`DELETE FROM participations WHERE customer_id = $1`, [customerId]);
  await db.query(`DELETE FROM projects WHERE customer_id = $1`, [customerId]);
  // ... all customer-scoped tables ...

  // Log the final deletion (audit logs themselves are retained)
  await audit.log({
    event: 'final_data_deletion_complete',
    customer_id: customerId,
    trace_id: traceId,
  });
}

async function emergencyDisableCustomer(customerId, reason) {
  // Single command that:
  // 1. Disables polling
  // 2. Cancels in-flight jobs
  // 3. Marks token as compromised
  // 4. Alerts internal team
  // 5. Logs incident

  await db.upsert('sync_configs', {
    customer_id: customerId,
    enabled: false,
    emergency_disabled_at: new Date(),
    emergency_disabled_reason: reason,
  });

  await jobScheduler.cancelAllForCustomer(customerId);
  await credentialStore.markCompromised(customerId);

  await alertOps({
    severity: 'critical',
    customerId,
    type: 'emergency_disable',
    reason,
  });

  await audit.log({
    event: 'emergency_disable',
    customer_id: customerId,
    reason,
    actor: getCurrentActor(),
  });
}