Pillar 1. Security, Multi-Tenant Isolation & Anti-AbuseCopy Anchor Link

4 Domain Combo Suites (18+ Isolated Slices)
Enforcing zero data leakage across multi-tenant SaaS environments, cryptographically verifiable audit trails, anti-bot defenses, and Zalo OAuth verification.

📦 Package CatalogCopy Anchor Link

🔍 Deep-Dive: Architecture & SlicesCopy Anchor Link

1. @kido/tenant-guardCopy Anchor Link

Enterprise B2B applications must prevent cross-tenant data leaks. tenant-guard isolates tenants transparently using Node.js AsyncLocalStorage:

• src/tenant-context.ts: Zero-overhead context store providing TenantContextStore.getTenantId().
• src/rls-query-filter.ts & src/orm-cache-interceptor.ts: Automatically injects tenant filters into Prisma queries and prefixes Redis cache keys (tenant:{id}:{key}).
• src/team-rbac/: Attribute-based access control engine evaluating complex permission matrices.
• src/snapshot/ & src/sandbox/: Creates cryptographically verified database snapshots and powers safe public demo environments with sanitized data.

2. @kido/audit-trailCopy Anchor Link

Regulatory compliance (SOC2, ISO 27001, HIPAA) requires tamper-proof records of critical mutations:

• src/hash-chain.ts & src/merkle-tree.ts: Implements a cryptographic SHA-256 blockchain-style hash chain (currentHash = sha256(prevHash + timestamp + payload)). Any modification to past entries breaks verification immediately.
• src/api-audit/: High-performance HTTP middleware with PII auto-redaction for Hono and Express.

3. @kido/anti-spamCopy Anchor Link

Defends platforms against automated comment spam, fake purchase reviews, and duplicate promotional abuse:

• src/dedupe/: Fast 64-bit SimHash near-duplicate detector with Hamming distance matching. Detects paraphrased or slightly edited spam in < 0.1ms.
• src/heuristics.ts: Multi-signal scoring engine combining velocity checks, account age, and textual entropy.

4. @kido/zalo-mini-authCopy Anchor Link

Connects Vietnam market mini-apps to backend APIs with strict HMAC verification:

• Decodes encrypted phone tokens (phoneToken) into verified phone numbers.
• Computes appsecret_proof to prevent replay attacks and man-in-the-middle tampering.

💻 Code Example: Multi-Tenant Context & Hash-Chain AuditCopy Anchor Link

import { TenantContextStore } from '@kido/tenant-guard';
import { AuditTrailEngine } from '@kido/audit-trail';

const auditEngine = new AuditTrailEngine();

export async function updateUserRole(targetUserId: string, newRole: string) {
  const tenantId = TenantContextStore.getTenantId();
  if (!tenantId) throw new Error('Unauthenticated tenant context');

  // Perform database mutation...

  // Record tamper-proof audit entry
  const entry = await auditEngine.recordEntry({
    tenantId,
    actorId: 'admin_user_42',
    action: 'USER_ROLE_UPDATED',
    entityId: targetUserId,
    diff: { previousRole: 'MEMBER', newRole },
  });

  return { success: true, auditHash: entry.hash };
}