Security Assert
A boot-time assertion that the posture a deployment believes it has is the posture it actually has. It reads the live modes rather than the configuration meant to produce them, so a vault that fell back to plaintext, a database that opened unencrypted or an audit chain that is not signing is caught before the process serves a request.
Every check is a policy the operator states and the framework verifies: the vault, database and audit-signing modes, NTP strictness, TLS and its minimum version, the CSP nonce, CSRF and rate-limit middleware, the Node major version, required and forbidden environment variables, the data directory's mode, and whether a DPI-terminating proxy is tolerated. Checks opt out individually, so a deployment that cannot meet one says so in the call rather than skipping the assertion.
It raises once with every failure rather than on the first, and each failure carries a code, so an operator fixes the whole list in one pass.
Nothing is written to the audit chain unless the call asks for it. Pass audit: true to use the framework chain, or an audit sink of your own, and the verdict is recorded whether it passed or failed. Left out, the assertion raises or returns and no record of it exists, so a deployment that needs "we asserted our posture at boot" to be an auditable claim has to turn it on.
b.security.assertProduction(opts?) #
{
vault: string, // default "wrapped"; false skips
dbAtRest: string, // default "encrypted"; false skips
auditSigning: string, // default "wrapped"; false skips
ntpStrict: boolean, // default on; false skips the check
minNodeMajor: number, // default 24
forbidNodeEnv: array, // default ["development", "dev", "test"]
allowDpiTrust: boolean, // default false; an installed anchor fails
requireTLS: boolean,
minTlsVersion: string, // e.g. "TLSv1.3"
requireCSPNonce: boolean,
requireCSRF: boolean,
requireRateLimit: boolean,
router: object, // the router the middleware checks read
protocol: string,
requireEnv: array, // variable names that must be set
forbidEnv: array, // variable names that must not be set
dataDir: string, // checked against maxDataDirMode
maxDataDirMode: number, // octal mode ceiling
forbidProxy: boolean,
extra: array, // functions returning a verdict
resolvers: object, // override how a live value is read
audit: object, // audit instance, or false to stay silent
}Verify the deployment's security posture and resolve when it holds. Each check reads the live value through a resolver rather than the config, so what is asserted is the state the process is actually in.
Seven checks run without being asked for, and each opts out individually. Three assert a mode: the vault is wrapped, the database is encrypted at rest, and audit signing is wrapped. Passing a different string asserts that value instead; false or null skips the check.
The other four are the production floor. ntpStrict fails when BLAMEJS_NTP_STRICT is 0 or false, unless ntpStrict: false. minNodeMajor defaults to 24. forbidNodeEnv defaults to rejecting development, dev and test, so a production assertion fails on a deployment still carrying a development NODE_ENV. An installed DPI-terminating trust anchor fails unless allowDpiTrust: true.
Everything else runs only when asked for.
Every failure is collected, so one call reports the whole list. It raises security-assert/assert-failed with one line per failure, and failures on the error carries the code and message of each. A boolean option given a non-boolean raises security-assert/bad-opt, because a typo there used to skip the check silently.
The outcome is emitted as system.security.assert.success or system.security.assert.failure with the failed codes, unless audit is false or absent. Pass an audit instance to record it somewhere other than the framework's own chain.
var b = require("@blamejs/core");
try {
await b.security.assertProduction({
requireTLS: true,
minTlsVersion: "TLSv1.3",
requireCSRF: true,
forbidEnv: ["BLAMEJS_ALLOW_PLAINTEXT_VAULT"],
});
} catch (e) {
e.code; // → "security-assert/assert-failed"
e.failures.map(function (f) { return f.code; });
}