admin / Synapse-Sonar

import crypto from "crypto";
import { getEnabledIntegration, IronNodeConfig } from "@/lib/integrations";
import { prisma } from "@/lib/prisma";
import { IntegrationProvider, RuleAction } from "@prisma/client";

/** Minimal CIDR membership test (IPv4) for the MVP rule engine. */
function ipInCidr(ip: string, cidr: string): boolean {
  if (cidr === "0.0.0.0/0") return true;
  const [range, bitsStr] = cidr.split("/");
  const bits = parseInt(bitsStr ?? "32", 10);
  const toInt = (addr: string) =>
    addr.split(".").reduce((acc, oct) => (acc << 8) + (parseInt(oct, 10) & 255), 0) >>> 0;
  const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
  return (toInt(ip) & mask) === (toInt(range) & mask);
}

export interface FlowDescriptor {
  sourceIp: string;
  destIp: string;
  port?: number | null;
}

/**
 * Zero-Trust evaluation. Walk the tenant baseline by priority; the first rule
 * whose CIDRs + port match decides. A matched DENY — or no matching ALLOW —
 * is a segmentation violation.
 */
export async function evaluateSegmentation(
  tenantId: string,
  flow: FlowDescriptor
): Promise<{ violation: boolean; ruleId?: string; reason: string }> {
  const rules = await prisma.segmentationRule.findMany({
    where: { tenantId },
    orderBy: { priority: "asc" },
  });

  for (const rule of rules) {
    const portMatches = rule.port == null || rule.port === flow.port;
    if (
      portMatches &&
      ipInCidr(flow.sourceIp, rule.sourceCidr) &&
      ipInCidr(flow.destIp, rule.destCidr)
    ) {
      if (rule.action === RuleAction.DENY) {
        return { violation: true, ruleId: rule.id, reason: "Matched DENY rule" };
      }
      return { violation: false, ruleId: rule.id, reason: "Matched ALLOW rule" };
    }
  }

  // Default-deny posture: if no baseline rule explicitly allows the flow, it drifts.
  return {
    violation: rules.length > 0,
    reason:
      rules.length > 0
        ? "No matching ALLOW rule (default-deny)"
        : "No baseline configured — flow permitted",
  };
}

/**
 * SOAR hand-off. If the Synapse IronNode integration is enabled, fire a signed
 * JSON payload to the configured webhook describing the violation. No-ops
 * silently when the integration toggle is Off.
 */
export async function dispatchIronNodeAlert(
  tenantId: string,
  payload: Record<string, unknown>
): Promise<{ dispatched: boolean }> {
  const cfg = await getEnabledIntegration<IronNodeConfig>(
    tenantId,
    IntegrationProvider.SYNAPSE_IRONNODE
  );
  if (!cfg) return { dispatched: false };

  const body = JSON.stringify({
    source: "synapse-sonar",
    emittedAt: new Date().toISOString(),
    ...payload,
  });

  // HMAC-SHA256 signature so IronNode can verify authenticity.
  const signature = crypto
    .createHmac("sha256", cfg.signingKey)
    .update(body)
    .digest("hex");

  try {
    await fetch(cfg.webhookUrl, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "X-Sonar-Signature": `sha256=${signature}`,
      },
      body,
    });
    return { dispatched: true };
  } catch {
    // Alert dispatch is best-effort; never let it break ingestion.
    return { dispatched: false };
  }
}