《互联网产品的 AI 架构·平台化与治理》9.1 提示与工具的风险登记

// file: src/gov/security-gov.ts
// tier: L2
// verify: node --test test/gov/security-gov.test.ts

/** 安全风险登记：提示注入、工具滥用、数据外泄、越权动作；金额无关，分数为整数。 */
export type RiskCategory = "prompt-injection" | "tool-misuse" | "data-exfiltration" | "unauthorized-action";
export type Impact = "low" | "medium" | "high" | "critical";
export type Likelihood = "rare" | "unlikely" | "possible" | "likely";
export type ControlMaturity = "planned" | "partial" | "effective";
export type RiskStatus = "open" | "mitigating" | "accepted" | "closed";
export type ResidualRating = "low" | "medium" | "high" | "critical";
export type ReviewState = "scheduled" | "due-soon" | "overdue" | "closed";

const IMPACT: Record<Impact, number> = { low: 1, medium: 2, high: 3, critical: 4 };
const LIKELIHOOD: Record<Likelihood, number> = { rare: 1, unlikely: 2, possible: 3, likely: 4 };
const MATURITY: Record<ControlMaturity, number> = { planned: 0, partial: 1, effective: 2 };
const CONTROL_CAP = 8;
const REVIEW_DAYS: Record<ResidualRating, number> = {
  critical: 30, high: 60, medium: 90, low: 180,
};
export const RISK_CATEGORIES: readonly RiskCategory[] = [
  "prompt-injection", "tool-misuse", "data-exfiltration", "unauthorized-action",
];

export interface RiskControl { id: string; description: string; maturity: ControlMaturity }
export interface RiskEntry {
  id: string; category: RiskCategory; title: string; impact: Impact; likelihood: Likelihood;
  controls: readonly RiskControl[]; owner: string; status: RiskStatus;
  /** 最近一次复查与下一次复查，均为 YYYY-MM-DD。 */
  lastReviewed: string; reviewDate: string;
}
export interface RiskAssessment {
  id: string; inherentScore: number; controlPoints: number; residualScore: number;
  residualRating: ResidualRating; reviewState: ReviewState; overdueDays: number; escalate: boolean;
}
export type RiskIssueCode = "duplicate-id" | "invalid-category" | "empty-owner" | "invalid-date"
  | "review-before-last" | "review-interval-exceeded" | "invalid-control";
export interface RiskIssue { id: string; code: RiskIssueCode; detail: string }

const DATE = /^\d{4}-\d{2}-\d{2}$/;

export function daysBetween(from: string, to: string): number {
  return Math.round((Date.parse(`${to}T00:00:00Z`) - Date.parse(`${from}T00:00:00Z`)) / 86_400_000);
}

export function reviewIntervalDays(rating: ResidualRating): number { return REVIEW_DAYS[rating]; }

export function rateResidual(score: number): ResidualRating {
  if (score >= 12) return "critical";
  if (score >= 8) return "high";
  if (score >= 4) return "medium";
  return "low";
}

/** 固有分 = 影响 × 可能性；控制分 planned 0 / partial 1 / effective 2，合计封顶 8。 */
export function assessRisk(entry: RiskEntry, today: string): RiskAssessment {
  const inherentScore = IMPACT[entry.impact] * LIKELIHOOD[entry.likelihood];
  const controlPoints = Math.min(
    CONTROL_CAP, entry.controls.reduce((sum, item) => sum + MATURITY[item.maturity], 0),
  );
  const residualScore = Math.max(1, inherentScore - controlPoints);
  const residualRating = rateResidual(residualScore);
  if (entry.status === "closed") {
    return {
      id: entry.id, inherentScore, controlPoints, residualScore, residualRating,
      reviewState: "closed", overdueDays: 0, escalate: false,
    };
  }
  const until = daysBetween(today, entry.reviewDate);
  const overdueDays = until < 0 ? -until : 0;
  const reviewState: ReviewState = until < 0 ? "overdue" : until <= 14 ? "due-soon" : "scheduled";
  const effective = entry.controls.some((item) => item.maturity === "effective");
  const escalate = residualRating === "critical"
    || (residualRating === "high" && !effective) || overdueDays > 0;
  return {
    id: entry.id, inherentScore, controlPoints, residualScore, residualRating,
    reviewState, overdueDays, escalate,
  };
}

/** 日期不可解析时只报 invalid-date，不继续做间隔比较。 */
export function validateRegister(entries: readonly RiskEntry[]): RiskIssue[] {
  const issues: RiskIssue[] = [];
  const seen = new Set<string>();
  for (const entry of entries) {
    if (seen.has(entry.id)) issues.push({ id: entry.id, code: "duplicate-id", detail: "id twice" });
    seen.add(entry.id);
    if (!RISK_CATEGORIES.includes(entry.category)) {
      issues.push({ id: entry.id, code: "invalid-category", detail: entry.category });
    }
    if (entry.owner.trim() === "") {
      issues.push({ id: entry.id, code: "empty-owner", detail: "owner empty" });
    }
    const dates = [entry.lastReviewed, entry.reviewDate];
    if (dates.some((date) => !DATE.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00Z`)))) {
      issues.push({ id: entry.id, code: "invalid-date", detail: dates.join(",") });
      continue;
    }
    const interval = daysBetween(entry.lastReviewed, entry.reviewDate);
    const allowed = reviewIntervalDays(assessRisk(entry, entry.lastReviewed).residualRating);
    if (interval <= 0) issues.push({ id: entry.id, code: "review-before-last", detail: `${interval}` });
    else if (interval > allowed) {
      issues.push({ id: entry.id, code: "review-interval-exceeded", detail: `${interval}>${allowed}` });
    }
    for (const control of entry.controls) {
      if (control.id.trim() === "" || control.description.trim() === "") {
        issues.push({ id: entry.id, code: "invalid-control", detail: control.id });
      }
    }
  }
  return issues;
}

export interface RegisterSummary {
  total: number; open: number; overdue: number; escalate: number;
  missingOwner: number; byRating: Record<ResidualRating, number>;
}

export function summarizeRegister(entries: readonly RiskEntry[], today: string): RegisterSummary {
  const byRating: Record<ResidualRating, number> = { low: 0, medium: 0, high: 0, critical: 0 };
  let open = 0; let overdue = 0; let escalate = 0; let missingOwner = 0;
  for (const entry of entries) {
    const item = assessRisk(entry, today);
    byRating[item.residualRating] += 1;
    if (entry.status !== "closed") open += 1;
    if (item.reviewState === "overdue") overdue += 1;
    if (item.escalate) escalate += 1;
    if (entry.owner.trim() === "") missingOwner += 1;
  }
  return { total: entries.length, open, overdue, escalate, missingOwner, byRating };
}

// file: src/gov/red-team-gov.ts
// tier: L2
// verify: node --test test/gov/security-gov.test.ts

import type { RiskCategory } from "./security-gov.ts";

/** 红队计划与滥用信号：用例按风险类别覆盖，通过率按用例权重计算。 */
export type Cadence = "monthly" | "quarterly" | "semiannual";
export type CaseExpectation = "block" | "detect";
export type CaseOutcome = "blocked" | "detected" | "bypassed" | "not-run";
export type CaseSeverity = "critical" | "high" | "medium";

export interface RedTeamCase {
  id: string; category: RiskCategory; severity: CaseSeverity;
  weight: number; expectation: CaseExpectation;
}
export interface RedTeamPlan {
  id: string; scope: readonly RiskCategory[]; cadence: Cadence; caseSetVersion: string;
  minPassRate: number; maxCriticalFailures: number; lastRun: string;
}
export interface CaseResult { caseId: string; outcome: CaseOutcome }
export interface RedTeamReport {
  planId: string; executed: number; passed: number; passRateBps: number;
  criticalFailures: number; uncovered: RiskCategory[];
  gate: "pass" | "fail"; reasons: string[]; nextRun: string; overdueDays: number;
}

const CADENCE_DAYS: Record<Cadence, number> = { monthly: 30, quarterly: 90, semiannual: 180 };

function addDays(date: string, days: number): string {
  return new Date(Date.parse(`${date}T00:00:00Z`) + days * 86_400_000)
    .toISOString().slice(0, 10);
}

/** 门禁同时看覆盖率、完整性、加权通过率、严重失败数与计划逾期，reasons 保留全部原因。 */
export function evaluateRedTeam(
  plan: RedTeamPlan, cases: readonly RedTeamCase[],
  results: readonly CaseResult[], today: string,
): RedTeamReport {
  const byId = new Map(cases.map((item) => [item.id, item]));
  const executedIds = new Set<string>();
  let passed = 0; let passedWeight = 0; let executedWeight = 0; let criticalFailures = 0;
  for (const result of results) {
    if (result.outcome === "not-run") continue;
    const item = byId.get(result.caseId);
    if (item === undefined || executedIds.has(item.id)) continue;
    executedIds.add(item.id);
    executedWeight += item.weight;
    const ok = item.expectation === "block"
      ? result.outcome === "blocked" : result.outcome === "detected";
    if (ok) {
      passed += 1;
      passedWeight += item.weight;
    } else if (item.severity === "critical") {
      criticalFailures += 1;
    }
  }
  const executed = executedIds.size;
  const passRateBps = executedWeight === 0
    ? 0 : Math.round((passedWeight / executedWeight) * 10_000);
  const uncovered = plan.scope.filter(
    (category) => !cases.some((item) => item.category === category),
  );
  const nextRun = addDays(plan.lastRun, CADENCE_DAYS[plan.cadence]);
  const overdueDays = Math.max(0, Math.round(
    (Date.parse(`${today}T00:00:00Z`) - Date.parse(`${nextRun}T00:00:00Z`)) / 86_400_000,
  ));
  const reasons: string[] = [];
  if (uncovered.length > 0) reasons.push(`uncovered:${uncovered.join(",")}`);
  if (executed < cases.length) reasons.push(`incomplete:${executed}/${cases.length}`);
  if (passRateBps < Math.round(plan.minPassRate * 10_000)) reasons.push(`pass-rate:${passRateBps}`);
  if (criticalFailures > plan.maxCriticalFailures) {
    reasons.push(`critical-failures:${criticalFailures}`);
  }
  if (overdueDays > 0) reasons.push(`overdue:${overdueDays}`);
  return {
    planId: plan.id, executed, passed, passRateBps, criticalFailures, uncovered,
    gate: reasons.length === 0 ? "pass" : "fail", reasons, nextRun, overdueDays,
  };
}

export type AbuseSignal =
  | "rate-spike" | "repeated-block" | "credential-sharing"
  | "probe-pattern" | "cost-anomaly";
export type AbuseAction = "monitor" | "throttle" | "suspend";

export interface AbuseRule { threshold: number; weight: number; action: AbuseAction }
export interface AbusePolicy {
  rules: Record<AbuseSignal, AbuseRule>; throttleAt: number; suspendAt: number;
}
export interface AbuseSample { tenantId: string; signal: AbuseSignal; observed: number }
export interface AbuseDecision {
  tenantId: string; triggered: AbuseSignal[]; score: number; action: AbuseAction | "none";
}

/** 每个信号独立比较阈值，命中后累加权重；动作取累计分对应的最高档。 */
export function evaluateAbuse(
  policy: AbusePolicy, samples: readonly AbuseSample[],
): AbuseDecision[] {
  const grouped = new Map<string, AbuseSample[]>();
  for (const sample of samples) {
    const list = grouped.get(sample.tenantId) ?? [];
    list.push(sample);
    grouped.set(sample.tenantId, list);
  }
  const decisions: AbuseDecision[] = [];
  for (const [tenantId, list] of grouped) {
    const triggered: AbuseSignal[] = [];
    let score = 0;
    for (const signal of Object.keys(policy.rules) as AbuseSignal[]) {
      const rule = policy.rules[signal];
      if (!list.some((item) => item.signal === signal && item.observed >= rule.threshold)) continue;
      triggered.push(signal);
      score += rule.weight;
    }
    const action: AbuseAction | "none" = score >= policy.suspendAt
      ? "suspend" : score >= policy.throttleAt ? "throttle" : score > 0 ? "monitor" : "none";
    decisions.push({ tenantId, triggered, score, action });
  }
  return decisions.sort((a, b) => b.score - a.score
    || (a.tenantId < b.tenantId ? -1 : a.tenantId > b.tenantId ? 1 : 0));
}