Feature: PII Encapsulation

[sephynox]

Overview

Adds encapsulation for transport of PII information. In footprint-kyc-anchor, instead of:

getPII(entityId: string, entityType: LegalEntityType, reason?: string): Promise<EntityPII>;

We can now do:

getPII(entityId: string, entityType: LegalEntityType, reason?: string): Promise<PIIStore>;

PIIStore (src/lib/utils/pii.ts)

• Prevents accidental PII logging/serialization (redacts toString(), toJSON(), util.inspect())
• setAttribute(name, value) - type-safe storage for known + external attributes
• toSensitiveAttribute(name, subjectKey) - encrypts and returns SensitiveAttribute
• run(get) - scoped callback with getter
• toCertificateBuilder(builder) - applies all known attributes to certificate
• PIIStore.fromCertificate(cert) - extracts attributes from existing certificate
• PIIError with codes: PII_ATTRIBUTE_NOT_FOUND, PII_KNOWN_ATTRIBUTE_EXPOSURE_DENIED

SensitiveAttribute (src/lib/sensitive-attribute.ts)

• Extracted from certificates.ts into dedicated module
• SensitiveAttributeBuilder.build() now returns SensitiveAttribute<T> directly
• set(name, value) - schema-aware encoding for known attributes
• set(bytes) - raw bytes for external attributes
• publicKey getter - returns encryption target public key
• toDER() - returns raw encrypted bytes
• isInstance() - static type guard

CertificateBuilder

• setSensitiveAttribute(name, attr) - accepts pre-built SensitiveAttribute instances

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rkeene]

Why is this using SensitiveAttribute if it never serializes the data to a buffer ?

[sephynox]

I am not sure what you mean? For known attributes it uses the builder. We can just not allow unknown attributes to be handled with toSensitiveAttribute unless you have a different idea.

[rkeene]

I mean the SensitiveAttribute mechanism is for encrypting data to be validated (via proof later), it doesn't really make sense to encrypt data and then never use the encrypted data...

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud