scryer 1.0.0 → 1.2.0

data/lib/scryer/ai_fix_suggester.rb

@@ -24,14 +24,29 @@ module Scryer
       # Enhances a single Finding in place and returns it. Any failure
       # (client raises, times out, returns nothing usable) is swallowed and
       # the finding's original suggested_fix is left as-is — an LLM call
-      # failing should never break a scan.
-      def enhance!(finding, client: Scryer.configuration.ai_client)
+      # failing should never break a scan. `on_error`, when given, is called
+      # with (finding, exception) right before it's swallowed — the failure
+      # still never propagates, but a caller that wants to surface *why* a
+      # finding fell through to manual review (a bad API key, a timeout, a
+      # malformed response) can. Without it, a failing client and "no
+      # ai_client configured at all" look identical from the outside.
+      #
+      # `root`, when given (and only for a Scryer::Finding — see
+      # FixVerifier), triggers a follow-up verification pass: re-read the
+      # actual file from disk, substitute the AI's suggested replacement for
+      # the one offending line, and re-run just this finding's own rule
+      # against the result. Sets finding.fix_verified to true/false/nil (see
+      # Finding#fix_verified) — never raises, same failure-swallowing
+      # philosophy as the AI call itself.
+      def enhance!(finding, client: Scryer.configuration.ai_client, root: nil, on_error: nil)
         return finding unless client
 
         reply = call_client(client, prompt_for(finding))
         finding.suggested_fix = reply.strip unless blank?(reply)
+        finding.fix_verified = FixVerifier.verify(finding: finding, root: root) if root
         finding
-      rescue StandardError
+      rescue StandardError => e
+        on_error&.call(finding, e)
         finding
       end
 
@@ -40,10 +55,14 @@ module Scryer
       # (network-bound work, same pattern as
       # DependencyAudit.vulnerable_gems) so a large finding count doesn't
       # mean one-request-at-a-time. No-op if no client is configured —
-      # callers don't need to check first.
-      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4)
+      # callers don't need to check first. Pass `root` (the project root
+      # `finding.file` is relative to) to also run fix verification — see
+      # `enhance!`; omit it to skip verification entirely (e.g. when the
+      # caller has no meaningful root, or doesn't want the extra re-parse
+      # work).
+      def enhance_result!(result, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         enhance_many!(result.security_findings + result.performance_findings + result.style_findings,
-                      client: client, concurrency: concurrency)
+                      client: client, concurrency: concurrency, root: root)
         result
       end
 
@@ -51,8 +70,9 @@ module Scryer
       # Scryer::DependencyAudit::Finding objects, which aren't attached to a
       # Scanner::Result. Works on any mix of Finding/DependencyAudit::Finding
       # (prompt_for below dispatches on which one it got). No-op if no client
-      # is configured.
-      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4)
+      # is configured. `root` is ignored for DependencyAudit::Finding objects
+      # (FixVerifier only handles rule-backed Finding — see its guard clause).
+      def enhance_many!(findings, client: Scryer.configuration.ai_client, concurrency: 4, root: nil)
         return findings unless client
 
         queue = Queue.new
@@ -68,7 +88,7 @@ module Scryer
               end
               break unless finding
 
-              enhance!(finding, client: client)
+              enhance!(finding, client: client, root: root)
             end
           end
         end
@@ -107,8 +127,14 @@ module Scryer
 
           Generic guidance for this rule: #{finding.suggested_fix}
 
-          Reply with a short explanation (1-3 sentences) followed by a before/after code
-          example using the actual snippet above. Do not restate the issue description.
+          Reply with a short explanation (1-3 sentences), then a fenced code block showing the
+          fix in context if that's useful, and finally — as the very last thing in your reply,
+          exactly once — a line reading "AFTER:" followed by a fenced code block containing ONLY
+          the corrected replacement for the single offending line shown above (line
+          #{finding.line}), nothing else in that block (no surrounding context lines, no
+          comments about the change). This exact "AFTER:" block is parsed automatically to
+          verify the fix actually resolves the finding, so it must be a valid, direct drop-in
+          replacement for that one line. Do not restate the issue description.
         PROMPT
       end
 

data/lib/scryer/ast.rb

@@ -91,6 +91,32 @@ module Scryer
       node[1] if node[0].is_a?(Symbol) && %i[@ident @const @kw @op].include?(node[0])
     end
 
+    # The full dotted name from a class/module's own name node — the second
+    # element of a `[:class, name_node, superclass, body]` sexp. A plain
+    # `class Foo` parses name_node as `[:const_ref, [:@const, "Foo", pos]]`;
+    # a namespaced `class Admin::PostsController` parses it as a
+    # `:const_path_ref` chain instead (verified via `Ripper.sexp` —
+    # `Api::V1::UsersController` nests two levels deep: `[:const_path_ref,
+    # [:const_path_ref, [:var_ref, [:@const,"Api"]], [:@const,"V1"]],
+    # [:@const,"UsersController"]]`). Several rules used to check only the
+    # `:const_ref` shape (`node[1][1]` via `ident_text`), so a namespaced
+    # controller's class name silently came back nil and the whole class was
+    # never examined — a real false-negative gap, not a minor edge case,
+    # given how common namespacing (admin areas, API versions) is in real
+    # Rails apps. Returns e.g. "Admin::PostsController" so a plain
+    # `.end_with?("Controller")` check still works the same either way.
+    def class_name(node)
+      if tagged?(node, :const_ref)
+        ident_text(node[1])
+      elsif tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+        node[1][1]
+      elsif tagged?(node, :const_path_ref)
+        left = class_name(node[1])
+        right = ident_text(node[2])
+        [left, right].compact.join("::")
+      end
+    end
+
     # Given a [:method_add_arg, call_node, args_node] or [:command, ident, args_node]
     # node, return the flattened list of top-level argument sexp nodes (best effort —
     # walks through the [:arg_paren, [:args_add_block, [args...], block]] wrapping).

data/lib/scryer/authorization_watcher.rb

@@ -0,0 +1,156 @@
+module Scryer
+  # Runtime companion to the static `idor`/`missing_authorization`/
+  # `missing_policy_scope` rules — those can only ever say "no call to a
+  # known authorization method is visible anywhere in this controller's
+  # source," which is exactly as wrong as it sounds whenever the real check
+  # happens somewhere the static AST walk can't see (a shared base
+  # controller, a concern, a class-level macro whose effect isn't visible by
+  # name). This watcher answers a narrower but much more reliable question
+  # instead: for *this actual request*, did Pundit's `authorize`/
+  # `policy_scope` or CanCanCan's `authorize!` genuinely get called?
+  #
+  # How: both libraries already track this themselves, for their own
+  # `verify_authorized`/`check_authorization` after_action helpers —
+  # `Pundit::Authorization#pundit_policy_authorized?`/`#pundit_policy_scoped?`
+  # (public API, `@_pundit_policy_authorized`/`@_pundit_policy_scoped` under
+  # the hood) and CanCanCan's `@_authorized` ivar (set by `authorize!` and by
+  # `skip_authorization_check`; verified by reading both gems' actual source,
+  # `pundit-2.5.2/lib/pundit/authorization.rb` and
+  # `cancancan-3.6.1/lib/cancan/controller_additions.rb` — not guessed). This
+  # class registers one more `after_action`, alongside those, that checks the
+  # same flags and reports when a write action completed with neither set.
+  #
+  # Deliberately Pundit/CanCanCan-only, same scope as the static rules this
+  # complements: with neither gem loaded, `enable!` still runs but every
+  # request is silently skipped (see `authorization_library_present?`) — an
+  # app with fully custom, non-object-level authorization (a single
+  # `before_action :require_admin!`, say) gets no findings and no false
+  # positives here, rather than a flood of "unauthorized" reports for a
+  # pattern this watcher has no way to recognize as intentional.
+  #
+  # Deliberately narrower than "check every action": only create/update/
+  # destroy (or any POST/PUT/PATCH/DELETE), matching MissingAuthorizationRule
+  # exactly — and only requests that actually completed (status < 400).
+  # Read-scoping gaps (an unscoped `index` — see MissingPolicyScopeRule) are
+  # NOT covered here; verifying "was the returned data correctly scoped" at
+  # runtime, rather than "was a method called," is a materially different
+  # and harder check this class doesn't attempt.
+  class AuthorizationWatcher
+    Finding = Struct.new(:kind, :message, :controller, :action, :method, :path, :suggested_fix, keyword_init: true) do
+      def to_h
+        super.transform_keys(&:to_s)
+      end
+    end
+
+    WRITE_ACTIONS = %w[create update destroy].freeze
+    WRITE_METHODS = %w[POST PUT PATCH DELETE].freeze
+
+    class << self
+      # Turns the watcher on for the life of the process. Idempotent — safe
+      # to call more than once (later calls are no-ops). No Rack middleware
+      # to install, unlike QueryWatcher: a Rails controller instance is
+      # already fresh per request, so there's no shared/leaking state to
+      # scope — the `after_action` below just runs once per completed
+      # action.
+      def enable!(logger: nil)
+        return if @enabled
+
+        @logger = logger || default_logger
+        @findings = []
+        @enabled = true
+
+        # Covers both API-only and normal Rails apps without special-casing
+        # either: ActionController::Base and ActionController::API are
+        # sibling classes (neither inherits from the other — verified via
+        # `ActionController::API.ancestors.include?(ActionController::Base)
+        # #=> false`), but Rails' own actionpack source calls
+        # `ActiveSupport.run_load_hooks(:action_controller, self)` from
+        # *both* action_controller/base.rb and action_controller/api.rb, so
+        # this block runs once per base class and `install_hook` ends up
+        # registering the after_action on both. Confirmed with a real
+        # ActionController::API + Pundit integration test, not assumed.
+        ActiveSupport.on_load(:action_controller) { Scryer::AuthorizationWatcher.send(:install_hook, self) }
+      end
+
+      def enabled?
+        !!@enabled
+      end
+
+      # Every finding recorded so far this process — inspect, log, or feed
+      # into your own alerting. Not reset automatically; call `clear!`
+      # yourself (e.g. between test examples, or on a timer) if you don't
+      # want it growing for the life of a long-running process.
+      def findings
+        @findings ||= []
+      end
+
+      def clear!
+        @findings = []
+      end
+
+      private
+
+      def default_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          require "logger"
+          Logger.new($stdout)
+        end
+      end
+
+      def install_hook(base)
+        base.after_action { |controller| Scryer::AuthorizationWatcher.send(:check, controller) }
+      end
+
+      def check(controller)
+        return unless authorization_library_present?
+
+        action = controller.action_name.to_s
+        request = controller.request
+        return unless WRITE_ACTIONS.include?(action) || WRITE_METHODS.include?(request.method)
+
+        status = controller.response&.status
+        return unless status && status < 400 # already rejected/errored — nothing to report
+        return if authorization_evidence?(controller)
+
+        finding = Finding.new(
+          kind: "runtime_missing_authorization",
+          message: "#{controller.class}##{action} completed a #{request.method} request " \
+                    "(status #{status}) with no authorization check actually invoked during it " \
+                    "(checked Pundit's authorize/policy_scope and CanCanCan's authorize!/" \
+                    "skip_authorization_check — neither fired).",
+          controller: controller.class.name,
+          action: action,
+          method: request.method,
+          path: request.path,
+          suggested_fix: "Add an authorization check to this action — Pundit's `authorize`/" \
+                          "`policy_scope`, or CanCanCan's `authorize!`/`load_and_authorize_resource` " \
+                          "— or call `skip_authorization`/`skip_authorization_check` explicitly if " \
+                          "this action is deliberately open to any authenticated (or anonymous) user."
+        )
+        findings << finding
+        @logger.warn("[Scryer::AuthorizationWatcher] #{finding.message}")
+      end
+
+      def authorization_library_present?
+        defined?(::Pundit::Authorization) || defined?(::CanCan::ControllerAdditions)
+      end
+
+      def authorization_evidence?(controller)
+        pundit_authorized?(controller) || cancancan_authorized?(controller)
+      end
+
+      def pundit_authorized?(controller)
+        return false unless controller.respond_to?(:pundit_policy_authorized?, true)
+
+        controller.send(:pundit_policy_authorized?) ||
+          (controller.respond_to?(:pundit_policy_scoped?, true) && controller.send(:pundit_policy_scoped?))
+      end
+
+      def cancancan_authorized?(controller)
+        controller.instance_variable_defined?(:@_authorized)
+      end
+    end
+  end
+end

data/lib/scryer/baseline.rb

@@ -0,0 +1,75 @@
+require "digest"
+require "json"
+require "set"
+
+module Scryer
+  # Baseline mode: `scryer --save-baseline FILE` snapshots the current scan's
+  # findings as a set of stable fingerprints; a later `scryer --baseline
+  # FILE` scan diffs against that snapshot and reports only *new* findings
+  # (plus how many were fixed since), instead of the same full list a legacy
+  # codebase would otherwise reproduce on every single run. This is what
+  # makes adopting Scryer on an app with real pre-existing security debt
+  # practical: gate CI on new issues only, and burn down the rest on its own
+  # schedule, instead of being forced to either fix everything on day one or
+  # turn the gate off entirely.
+  #
+  # Fingerprints are deliberately NOT tied to line number — SHA256 of
+  # (identifying fields + the offending source text/advisory), not
+  # file:line. A finding whose line shifts because of an unrelated edit
+  # earlier in the same file would otherwise look simultaneously "new" and
+  # "fixed" on every unrelated commit, which would make baseline mode
+  # useless noise instead of a real signal.
+  module Baseline
+    module_function
+
+    # `f` is a finding hash (Finding#to_h or DependencyAudit::Finding#to_h)
+    # — distinguished by "rule_id" (rule-based: security/performance/style)
+    # vs. "kind" (dependency findings, which have no rule_id at all).
+    def fingerprint(f)
+      basis =
+        if f["rule_id"]
+          [f["rule_id"], f["file"], f["code_snippet"].to_s.strip]
+        else
+          [f["kind"], f["gem_name"], f["advisory_id"], f["installed_version"]].compact
+        end
+
+      Digest::SHA256.hexdigest(basis.join("|"))[0, 16]
+    end
+
+    def fingerprints(findings)
+      findings.map { |f| fingerprint(f) }
+    end
+
+    def save(path, findings)
+      data = {
+        "scryer_version" => Scryer::VERSION,
+        "created_at" => Time.now.utc.iso8601,
+        "fingerprints" => fingerprints(findings).uniq
+      }
+      File.write(path, JSON.pretty_generate(data))
+    end
+
+    LoadError = Class.new(StandardError)
+
+    def load(path)
+      raise LoadError, "baseline file not found: #{path}" unless File.exist?(path)
+
+      data = JSON.parse(File.read(path))
+      Set.new(Array(data["fingerprints"]))
+    rescue JSON::ParserError => e
+      raise LoadError, "invalid baseline file #{path}: #{e.message}"
+    end
+
+    # Splits `findings` into [new_findings, fixed_count] against a baseline
+    # Set of fingerprints. `new_findings` is what the rest of the pipeline
+    # should treat as "the" findings from this point on (reports, exit code,
+    # top_risks, everything) — `fixed_count` is purely informational
+    # (present in the baseline, absent from this scan).
+    def diff(findings, baseline_fingerprints)
+      current = fingerprints(findings)
+      new_findings = findings.each_with_index.reject { |_, i| baseline_fingerprints.include?(current[i]) }.map(&:first)
+      fixed_count = (baseline_fingerprints - current.to_set).size
+      [new_findings, fixed_count]
+    end
+  end
+end