Secure Project Integration

This document outlines how the restructured secure_drupal modules integrate with the secure_project npm package.

Integration Overview

The secure_project npm package provides JavaScript/TypeScript implementations of security and compliance features that complement the Drupal modules in secure_drupal. The integration between these two codebases enables a cohesive security framework that spans both server-side (Drupal) and client-side (Node.js/JavaScript) environments.

Module-to-Package Mapping

The following table shows how the restructured Drupal modules map to components in the secure_project npm package:

Drupal Module	NPM Package Component	Integration Points
secure_compliance_suite	src/complianceFramework.ts	Compliance framework definitions and validation
secure_evidence	src/auditLogger.ts	Evidence collection and audit logging
secure_audit_tools	src/plugins/audit/*	Audit tools and task tracking
secure_hardening	src/securityAlert.ts	Security controls and hardening
secure_auth	src/adapters/*	Authentication adapters
secure_policy_bridge	src/policyEngine.ts	Policy enforcement and bridge
secure_sod	src/dataSeparation.ts	Separation of duties enforcement
secure_openapi_enforcer	src/plugins/policy/OpaPolicyEnginePlugin.ts	OpenAPI validation

Integration Mechanisms

The integration between Drupal modules and the npm package is facilitated through the following mechanisms:

1. Bridge Service

The bridge service provides a bidirectional communication channel between Drupal and the npm package. It allows:

• Drupal to invoke JavaScript functions in the npm package
• The npm package to send events and data back to Drupal
• Synchronization of configuration and policy data

2. Adapters

The adapter system in the npm package provides integration points for different platforms, including Drupal. The Drupal adapter (src/adapters/drupal.ts) is responsible for:

• Translating Drupal entities and events to the format expected by the npm package
• Applying security policies from the npm package to Drupal content
• Managing authentication and authorization between the two systems

3. Plugin System

Both the Drupal modules and the npm package use plugin systems that mirror each other. This allows:

• Plugins developed for one system to be easily ported to the other
• Consistent security enforcement across both systems
• Extension of functionality without modifying core code

Implementation Details

Secure Compliance Suite Integration

The secure_compliance_suite module integrates with the complianceFramework.ts component through:

• Shared compliance framework definitions
• Compliance validation hooks
• Policy enforcement integration

Example usage in npm package:

import [ComplianceFramework] from '@bluefly/secure-project';

// Create a compliance framework instance
const framework = new ComplianceFramework({
  name: 'FedRAMP',
  version: 'moderate',
  controls: ['AC-1', 'AC-2', 'AC-3']
});

// Validate compliance
const result = framework.validate(myEntity);

Secure Evidence Integration

The secure_evidence module integrates with the auditLogger.ts component through:

• Shared audit event definitions
• Evidence collection hooks
• Storage provider integration

Example usage in npm package:

import [AuditLogger] from '@bluefly/secure-project';

// Log an audit event
AuditLogger.log({
  action: 'entity_update',
  entityType: 'node',
  entityId: '123',
  user: 'admin',
  details: { before: { ... }, after: [...] }
});

Secure Policy Bridge Integration

The secure_policy_bridge module integrates with the policyEngine.ts component through:

• Policy definition sharing
• Policy enforcement hooks
• Decision point integration

Example usage in npm package:

import [PolicyEngine] from '@bluefly/secure-project';

// Check if an action is allowed
const isAllowed = PolicyEngine.check({
  subject: user,
  action: 'edit',
  resource: document,
  context: { environment: 'production' }
});

Integration Configuration

The integration between the Drupal modules and npm package is configured through:

1. Bridge Configuration File: ./secure_project/modules/secure_policy_bridge/config/bridge.json
2. Adapter Configuration: Set in both the Drupal module settings and npm package initialization
3. Plugin Registration: Plugins are registered in both systems with matching identifiers

Testing the Integration

To test the integration between the restructured Drupal modules and the npm package:

1. Start the bridge service:

   cd ./secure_project/bridge
   npm start

2. Run the integration tests:

   cd ./secure_project
   npm test -- -t "integration"

3. Verify the Drupal integration:

   drush secure-drupal:bridge-status

Conclusion

The restructuring of the secure_drupal modules improves the integration with the secure_project npm package by:

1. Creating clearer module boundaries that map directly to npm package components
2. Standardizing naming conventions across both codebases
3. Simplifying the bridge between PHP and JavaScript/TypeScript
4. Enabling more consistent security enforcement across both environments

This integration enables a comprehensive security framework that works seamlessly across server-side and client-side environments, providing enhanced security and compliance capabilities for Drupal applications.