الـ Threat Modeling بـ STRIDE: فكّر زي المهاجم قبل ما تكتب code

// stride.js: بيطلّع التهديدات من الـ model لوحده، وبيقيّمها
export const STRIDE = {
  S: ["Spoofing", "حد ينتحل شخصية", "Authentication"],
  T: ["Tampering", "حد يغيّر data", "Integrity"],
  R: ["Repudiation", "حد ينكر إنه عمل حاجة", "Non-repudiation"],
  I: ["Information disclosure", "data تتسرّب", "Confidentiality"],
  D: ["Denial of service", "الخدمة تقع", "Availability"],
  E: ["Elevation of privilege", "حد ياخد صلاحية مش بتاعته", "Authorization"],
};
// STRIDE-per-element: كل نوع بيتعرّض لأنهي تهديدات
export const PER_TYPE = { external: "SR", process: "STRIDE", store: "TID", flow: "TID" };

export function analyze(model) {
  const zoneOf = Object.fromEntries(model.elements.map((e) => [e.id, e.zone]));
  const byId = Object.fromEntries(model.elements.map((e) => [e.id, e]));
  const items = [
    ...model.elements,
    ...model.flows.map((f) => ({ ...f, type: "flow", name: `${f.from} → ${f.to} (${f.what})` })),
  ];
  const threats = [];
  for (const el of items) {
    // exposed: في الإنترنت، أو flow بيعدّي حدود ثقة
    const exposed = el.type === "flow" ? zoneOf[el.from] !== zoneOf[el.to] : el.zone === "internet";
    const touches = el.type === "flow" ? [byId[el.from], byId[el.to]] : [el];
    const sensitive = touches.some((x) => x.data?.some((d) => d === "pii" || d === "payments"));
    for (const letter of PER_TYPE[el.type]) {
      const key = `${el.id}:${letter}`;
      const likelihood = exposed ? 3 : 1;
      const impact = sensitive || letter === "E" ? 3 : 2;
      const status = model.mitigations[key] ? "mitigated" : model.accepted[key] ? "accepted" : "open";
      threats.push({
        key,
        element: el.name,
        category: STRIDE[letter][0],
        text: STRIDE[letter][1],
        risk: likelihood * impact,
        status,
        note: model.mitigations[key] ?? model.accepted[key] ?? "",
      });
    }
  }
  return threats.sort((a, b) => b.risk - a.risk || a.key.localeCompare(b.key));
}

// الـ CI gate: أي تهديد open و risk ستة أو أكتر ← فشل
export const gate = (threats, min = 6) => threats.filter((t) => t.status === "open" && t.risk >= min);

$ node test.js
✅ PER_TYPE صح 
✅ العدد: 2 + 6 + 3 + 3 + 3 + 3 = 20 20
✅ الـ keys بالشكل id:letter 
✅ flow بيعدّي حدود ← likelihood 3 
✅ flow جُوّه نفس الـ zone ← likelihood 1 
✅ store فيه pii ← impact 3 
✅ E دايمًا impact 3 
✅ external في الإنترنت ← likelihood 3 
✅ status: mitigated و accepted و open 
✅ note فيها الـ mitigation 
✅ مترتبين بالـ risk من الكبير 
✅ gate: open و risk ≥ 6 بس f1:D,f1:I,u:S

12/12 نجحوا

// model.js: الـ system بتاعنا كـ Data Flow Diagram: مين بيكلّم مين، وفين حدود الثقة
export const model = {
  name: "Baassma API",
  zones: { internet: "الإنترنت (مش موثوق)", app: "الـ app servers", data: "الـ databases" },
  elements: [
    { id: "user", type: "external", name: "متصفح المستخدم", zone: "internet" },
    { id: "stripe", type: "external", name: "Stripe webhooks", zone: "internet" },
    { id: "api", type: "process", name: "Express API", zone: "app" },
    { id: "worker", type: "process", name: "BullMQ worker", zone: "app" },
    { id: "pg", type: "store", name: "Postgres", zone: "data", data: ["pii", "payments"] },
    { id: "redis", type: "store", name: "Redis (sessions + queue)", zone: "data", data: ["sessions"] },
  ],
  flows: [
    { id: "f1", from: "user", to: "api", what: "login و API calls" },
    { id: "f2", from: "stripe", to: "api", what: "payment webhooks" },
    { id: "f3", from: "api", to: "pg", what: "SQL queries" },
    { id: "f4", from: "api", to: "redis", what: "sessions و jobs" },
    { id: "f5", from: "redis", to: "worker", what: "jobs" },
    { id: "f6", from: "worker", to: "pg", what: "تحديث الـ payments" },
  ],
  // key = "<id>:<حرف STRIDE>"
  mitigations: {
    "f1:T": "TLS 1.3 + HSTS (درس الـ headers)",
    "f1:I": "TLS + cookies Secure/HttpOnly",
    "f1:D": "rate limit + body size limit + timeouts",
    "f2:T": "HMAC signature على الـ body (درس الـ webhooks)",
    "f2:I": "TLS",
    "f2:D": "rate limit + queue بدل الشغل جُوّه الـ request",
    "api:S": "sessions + MFA + passkeys",
    "api:T": "zod validation + parameterized SQL",
    "api:R": "audit log لكل عملية حساسة",
    "api:I": "errors عامة + ما نرجّعش stack traces",
    "api:D": "event loop monitoring + bulkheads",
    "api:E": "ownership checks + policy واحدة (RBAC/ABAC)",
    "stripe:S": "التوقيع + timestamp ضد الـ replay",
    "user:S": "MFA + lockout",
    "pg:T": "least privilege role + backups",
    "pg:I": "encryption at rest + RLS + الـ PII في columns متشفّرة",
    "pg:D": "connection pool limits + statement_timeout",
    "f3:T": "TLS للـ database + parameterized queries",
    "f3:I": "TLS للـ database",
    "f6:T": "TLS للـ database",
    "f6:I": "TLS للـ database",
  },
  accepted: {
    "user:R": "المستخدم ممكن ينكر، والـ audit log بيقلّل ده. مقبول.",
    "redis:I": "شبكة داخلية + AUTH. هنراجعها Q3.",
  },
};

$ node main.js; echo "exit code: $?"
❌  9 f3:D      Denial of service       api → pg (SQL queries)             
✅  9 f3:I      Information disclosure  api → pg (SQL queries)             TLS للـ database
✅  9 f3:T      Tampering               api → pg (SQL queries)             TLS للـ database + parameterized queries
❌  9 f6:D      Denial of service       worker → pg (تحديث الـ payments)   
✅  9 f6:I      Information disclosure  worker → pg (تحديث الـ payments)   TLS للـ database
✅  9 f6:T      Tampering               worker → pg (تحديث الـ payments)   TLS للـ database
✅  6 f1:D      Denial of service       user → api (login و API calls)     rate limit + body size limit + timeouts
✅  6 f1:I      Information disclosure  user → api (login و API calls)     TLS + cookies Secure/HttpOnly
✅  6 f1:T      Tampering               user → api (login و API calls)     TLS 1.3 + HSTS (درس الـ headers)
✅  6 f2:D      Denial of service       stripe → api (payment webhooks)    rate limit + queue بدل الشغل جُوّه الـ r
✅  6 f2:I      Information disclosure  stripe → api (payment webhooks)    TLS
✅  6 f2:T      Tampering               stripe → api (payment webhooks)    HMAC signature على الـ body (درس 
…

// model.js: الـ system بتاعنا كـ Data Flow Diagram: مين بيكلّم مين، وفين حدود الثقة
export const model = {
  name: "Baassma API",
  zones: { internet: "الإنترنت (مش موثوق)", app: "الـ app servers", data: "الـ databases" },
  elements: [
    { id: "user", type: "external", name: "متصفح المستخدم", zone: "internet" },
    { id: "stripe", type: "external", name: "Stripe webhooks", zone: "internet" },
    { id: "api", type: "process", name: "Express API", zone: "app" },
    { id: "worker", type: "process", name: "BullMQ worker", zone: "app" },
    { id: "pg", type: "store", name: "Postgres", zone: "data", data: ["pii", "payments"] },
    { id: "redis", type: "store", name: "Redis (sessions + queue)", zone: "data", data: ["sessions"] },
  ],
  flows: [
    { id: "f1", from: "user", to: "api", what: "login و API calls" },
    { id: "f2", from: "stripe", to: "api", what: "payment webhooks" },
    { id: "f3", from: "api", to: "pg", what: "SQL queries" },
    { id: "f4", from: "api", to: "redis", what: "sessions و jobs" },
    { id: "f5", from: "redis", to: "worker", what: "jobs" },
    { id: "f6", from: "worker", to: "pg", what: "تحديث الـ payments" },
  ],
  // key = "<id>:<حرف STRIDE>"
  mitigations: {
    "f1:T": "TLS 1.3 + HSTS (درس الـ headers)",
    "f1:I": "TLS + cookies Secure/HttpOnly",
    "f1:D": "rate limit + body size limit + timeouts",
    "f2:T": "HMAC signature على الـ body (درس الـ webhooks)",
    "f2:I": "TLS",
    "f2:D": "rate limit + queue بدل الشغل جُوّه الـ request",
    "api:S": "sessions + MFA + passkeys",
    "api:T": "zod validation + parameterized SQL",
    "api:R": "audit log لكل عملية حساسة",
    "api:I": "errors عامة + ما نرجّعش stack traces",
    "api:D": "event loop monitoring + bulkheads",
    "api:E": "ownership checks + policy واحدة (RBAC/ABAC)",
    "stripe:S": "التوقيع + timestamp ضد الـ replay",
    "user:S": "MFA + lockout",
    "pg:T": "least privilege role + backups",
    "pg:I": "encryption at rest + RLS + الـ PII في columns متشفّرة",
    "pg:D": "connection pool limits + statement_timeout",
    "f3:T": "TLS للـ database + parameterized queries",
    "f3:I": "TLS للـ database",
    "f6:T": "TLS للـ database",
    "f6:I": "TLS للـ database",
    "f3:D": "pool max + statement_timeout",
    "f6:D": "pool منفصل للـ worker (bulkhead)",
    "f4:T": "TLS لـ Redis + ACL",
    "f4:I": "TLS لـ Redis + ACL",
    "f4:D": "maxmemory + noeviction للـ queue",
    "f5:T": "TLS لـ Redis + ACL للـ worker",
    "f5:I": "TLS لـ Redis + ACL للـ worker",
    "f5:D": "concurrency limit + dead letter queue",
    "stripe:R": "كل webhook بيتخزن بالـ event id (inbox)",
  },
  accepted: {
    "user:R": "المستخدم ممكن ينكر، والـ audit log بيقلّل ده. مقبول.",
    "redis:I": "شبكة داخلية + AUTH. هنراجعها Q3.",
  },
};

$ node main.js; echo "exit code: $?"
✅  9 f3:D      Denial of service       api → pg (SQL queries)             pool max + statement_timeout
✅  9 f3:I      Information disclosure  api → pg (SQL queries)             TLS للـ database
✅  9 f3:T      Tampering               api → pg (SQL queries)             TLS للـ database + parameterized queries
✅  9 f6:D      Denial of service       worker → pg (تحديث الـ payments)   pool منفصل للـ worker (bulkhead)
✅  9 f6:I      Information disclosure  worker → pg (تحديث الـ payments)   TLS للـ database
✅  9 f6:T      Tampering               worker → pg (تحديث الـ payments)   TLS للـ database
✅  6 f1:D      Denial of service       user → api (login و API calls)     rate limit + body size limit + timeouts
✅  6 f1:I      Information disclosure  user → api (login و API calls)     TLS + cookies Secure/HttpOnly
✅  6 f1:T      Tampering               user → api (login و API calls)     TLS 1.3 + HSTS (درس الـ headers)
✅  6 f2:D      Denial of service       stripe → api (payment webhooks)    rate limit + queue بدل الشغل جُوّه الـ r
✅  6 f2:I      Information disclosure  stripe → api (payment webhooks)    TLS
✅  6 f2:T      Tampering               stripe →
…

// main.js: التقرير اللي بيتعمل في كل PR بيغيّر الـ model
import { model } from "./model.js";
import { analyze, gate } from "./stride.js";

const threats = analyze(model);
const icon = { mitigated: "✅", accepted: "🟡", open: "❌" };
for (const t of threats)
  console.log(icon[t.status], String(t.risk).padStart(2), t.key.padEnd(9), t.category.padEnd(23), t.element.slice(0, 34).padEnd(34), t.note.slice(0, 40));

const count = (s) => threats.filter((t) => t.status === s).length;
console.log(`\n${threats.length} تهديد: ${count("mitigated")} متغطي، ${count("accepted")} مقبول، ${count("open")} مفتوح`);
const blockers = gate(threats);
if (blockers.length) {
  console.log(`🚫 ${blockers.length} تهديد عالي مفتوح:`, blockers.map((t) => t.key).join(" "));
  process.exit(1);
}
console.log("الـ gate عدّى");