0xray 4.0.11 → 4.0.13

package/dist/enforcement/validators/security-validators.d.ts

@@ -1,52 +0,0 @@
-/**
- * Security Validators
- *
- * Security-related validators extracted from rule-enforcer.ts during Phase 3 refactoring.
- * These validators enforce security best practices and input validation requirements.
- *
- * @module validators/security-validators
- */
-import { BaseValidator } from "./base-validator.js";
-import { RuleValidationContext, RuleValidationResult } from "../types.js";
-/**
- * Validates input validation patterns in code.
- * Checks for proper input validation, sanitization, and parameter validation.
- *
- * @example
- * ```typescript
- * const validator = new InputValidationValidator();
- * const result = await validator.validate({
- *   newCode: 'function processUser(req) { return req.body.name; }',
- *   operation: 'write'
- * });
- * // result.passed === false (missing validation)
- * ```
- */
-export declare class InputValidationValidator extends BaseValidator {
-    readonly id = "input-validation-validator";
-    readonly ruleId = "input-validation";
-    readonly category: "security";
-    readonly severity: "blocking";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}
-/**
- * Validates security by design principles.
- * Checks for security architecture patterns, input sanitization, and vulnerability prevention.
- *
- * @example
- * ```typescript
- * const validator = new SecurityByDesignValidator();
- * const result = await validator.validate({
- *   newCode: 'app.post("/api", (req, res) => { db.query(req.body.sql); })',
- *   operation: 'write'
- * });
- * // result.passed === false (SQL injection risk)
- * ```
- */
-export declare class SecurityByDesignValidator extends BaseValidator {
-    readonly id = "security-by-design-validator";
-    readonly ruleId = "security-by-design";
-    readonly category: "security";
-    readonly severity: "blocking";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}

package/dist/enforcement/validators/security-validators.js

@@ -1,219 +0,0 @@
-/**
- * Security Validators
- *
- * Security-related validators extracted from rule-enforcer.ts during Phase 3 refactoring.
- * These validators enforce security best practices and input validation requirements.
- *
- * @module validators/security-validators
- */
-import { BaseValidator } from "./base-validator.js";
-/**
- * Validates input validation patterns in code.
- * Checks for proper input validation, sanitization, and parameter validation.
- *
- * @example
- * ```typescript
- * const validator = new InputValidationValidator();
- * const result = await validator.validate({
- *   newCode: 'function processUser(req) { return req.body.name; }',
- *   operation: 'write'
- * });
- * // result.passed === false (missing validation)
- * ```
- */
-export class InputValidationValidator extends BaseValidator {
-    id = "input-validation-validator";
-    ruleId = "input-validation";
-    category = "security";
-    severity = "blocking";
-    async validate(context) {
-        const { newCode, operation } = context;
-        if (!newCode || operation !== "write") {
-            return {
-                passed: true,
-                message: "No code to validate for input validation",
-            };
-        }
-        // Allow internal utility functions to skip validation
-        if (newCode.includes("internal") ||
-            newCode.includes("utility") ||
-            newCode.includes("helper")) {
-            return {
-                passed: true,
-                message: "Internal utility functions may skip validation",
-            };
-        }
-        // For input validation in general functions, be more lenient
-        // Only flag obvious user input patterns without validation
-        // Note: "input" alone (as function param) shouldn't trigger this - only HTTP request inputs
-        const hasUserInput = newCode.includes("req.body") ||
-            newCode.includes("req.query") ||
-            newCode.includes("req.params");
-        const hasValidation = newCode.includes("validate") ||
-            newCode.includes("sanitize") ||
-            newCode.includes("zod") ||
-            newCode.includes("joi");
-        if (hasUserInput &&
-            !hasValidation &&
-            !newCode.includes("internal") &&
-            !newCode.includes("utility")) {
-            return {
-                passed: false,
-                message: "User input handling requires validation",
-                suggestions: ["Add input validation", "Sanitize user inputs"],
-            };
-        }
-        // Look for functions with parameters that don't validate inputs
-        const functionsWithParams = newCode.match(/function\s+\w+\s*\([^)]*\)|const\s+\w+\s*=\s*\([^)]*\)\s*=>/g);
-        if (!functionsWithParams) {
-            return {
-                passed: true,
-                message: "No functions with parameters to validate",
-            };
-        }
-        for (const func of functionsWithParams) {
-            // Check if function has basic validation
-            const funcName = func.match(/(?:function|const)\s+(\w+)/)?.[1];
-            if (funcName) {
-                const funcBody = this.extractFunctionBody(newCode, funcName);
-                if (funcBody &&
-                    !funcBody.includes("if") &&
-                    !funcBody.includes("throw") &&
-                    (func.includes("string") || func.includes("any"))) {
-                    return {
-                        passed: false,
-                        message: `Function ${funcName} lacks input validation for parameters`,
-                        suggestions: [
-                            "Add parameter validation",
-                            "Use type guards",
-                            "Add null/undefined checks",
-                        ],
-                    };
-                }
-            }
-        }
-        return {
-            passed: true,
-            message: "Input validation implemented where needed",
-        };
-    }
-}
-/**
- * Validates security by design principles.
- * Checks for security architecture patterns, input sanitization, and vulnerability prevention.
- *
- * @example
- * ```typescript
- * const validator = new SecurityByDesignValidator();
- * const result = await validator.validate({
- *   newCode: 'app.post("/api", (req, res) => { db.query(req.body.sql); })',
- *   operation: 'write'
- * });
- * // result.passed === false (SQL injection risk)
- * ```
- */
-export class SecurityByDesignValidator extends BaseValidator {
-    id = "security-by-design-validator";
-    ruleId = "security-by-design";
-    category = "security";
-    severity = "blocking";
-    async validate(context) {
-        const { newCode, operation } = context;
-        if (!newCode || operation !== "write") {
-            return { passed: true, message: "No code to validate for security" };
-        }
-        const violations = [];
-        const suggestions = [];
-        // Check for user input handling without validation (skip for safe contexts)
-        const userInputs = newCode.match(/(?:req\.body|req\.query|req\.params)/g);
-        const hasInputKeyword = newCode.includes("input") &&
-            (newCode.includes("function") || newCode.includes("validate"));
-        if ((userInputs || hasInputKeyword) &&
-            !newCode.includes("useContext") &&
-            !newCode.includes("Context.") &&
-            !newCode.includes("performance") &&
-            !newCode.includes("optimized") &&
-            !newCode.includes("internal") &&
-            !newCode.includes("utility")) {
-            // Look for validation patterns
-            const hasValidation = newCode.includes("validate") ||
-                newCode.includes("sanitize") ||
-                newCode.includes("zod") ||
-                newCode.includes("joi") ||
-                newCode.includes("yup") ||
-                newCode.includes("express-validator");
-            if (!hasValidation) {
-                violations.push("User input handling detected without validation");
-                suggestions.push("Add input validation and sanitization");
-            }
-        }
-        // Check for SQL injection patterns
-        const sqlInjectionPatterns = [
-            /query\s*\(\s*[`"'].*\$\{/,
-            /exec\s*\(\s*[`"'].*\$\{/,
-            /execute\s*\(\s*[`"'].*\$\{/,
-            /query\s*\(\s*.*\+\s*/,
-            /exec\s*\(\s*.*\+\s*/,
-        ];
-        for (const pattern of sqlInjectionPatterns) {
-            if (pattern.test(newCode)) {
-                violations.push("Potential SQL injection vulnerability detected");
-                suggestions.push("Use parameterized queries or prepared statements", "Avoid string concatenation in SQL queries");
-                break;
-            }
-        }
-        // Check for XSS vulnerabilities
-        const xssPatterns = [
-            /innerHTML\s*=/,
-            /outerHTML\s*=/,
-            /document\.write\s*\(/,
-            /eval\s*\(/,
-        ];
-        for (const pattern of xssPatterns) {
-            if (pattern.test(newCode)) {
-                violations.push("Potential XSS vulnerability detected");
-                suggestions.push("Avoid using innerHTML with user input", "Use textContent instead of innerHTML", "Sanitize user input before rendering");
-                break;
-            }
-        }
-        // Check for insecure authentication patterns
-        if (newCode.includes("password") ||
-            newCode.includes("token") ||
-            newCode.includes("secret")) {
-            const insecurePatterns = [
-                /password\s*[=:]\s*["'][^"']{1,7}["']/,
-                /token\s*[=:]\s*["'][^"']{1,15}["']/,
-                /secret\s*[=:]\s*["'][^"']{1,15}["']/,
-            ];
-            for (const pattern of insecurePatterns) {
-                if (pattern.test(newCode)) {
-                    violations.push("Short or hardcoded credential detected - potential security risk");
-                    suggestions.push("Use environment variables for credentials", "Use a secrets management service", "Ensure credentials are sufficiently long and complex");
-                    break;
-                }
-            }
-        }
-        // Check for insecure randomness
-        // Math.random() should not be used for security-sensitive operations
-        const hasMathRandom = newCode.includes("Math.random()");
-        const securityContext = newCode.match(/function\s+\w*(?:token|password|secret|crypto)\w*\s*\(/i) ||
-            newCode.includes("generateToken") ||
-            newCode.includes("generatePassword") ||
-            newCode.includes("createSecret");
-        if (hasMathRandom && securityContext) {
-            violations.push("Math.random() used for security-sensitive operations");
-            suggestions.push("Use crypto.randomBytes() or crypto.randomUUID() for security tokens", "Use a cryptographically secure random number generator");
-        }
-        if (violations.length > 0) {
-            return {
-                passed: false,
-                message: `Security violations: ${violations.join(", ")}`,
-                suggestions,
-            };
-        }
-        return {
-            passed: true,
-            message: "Security by design principles followed",
-        };
-    }
-}

package/dist/enforcement/validators/testing-validators.d.ts

@@ -1,80 +0,0 @@
-/**
- * Testing Validators
- *
- * Validators for testing category rules extracted from rule-enforcer.ts.
- * Each validator encapsulates the validation logic for a specific testing rule.
- *
- * @module validators/testing-validators
- */
-import { RuleValidationContext, RuleValidationResult } from "../types.js";
-import { BaseValidator } from "./base-validator.js";
-/**
- * Validates that tests are required for new code (Codex Term #26).
- * Checks if tests exist for new components or modified functionality.
- */
-export declare class TestsRequiredValidator extends BaseValidator {
-    readonly id = "tests-required-validator";
-    readonly ruleId = "tests-required";
-    readonly category: "testing";
-    readonly severity: "error";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}
-/**
- * Validates test coverage thresholds (Codex Term #26).
- * Maintains 85%+ behavioral test coverage.
- */
-export declare class TestCoverageValidator extends BaseValidator {
-    readonly id = "test-coverage-validator";
-    readonly ruleId = "test-coverage";
-    readonly category: "testing";
-    readonly severity: "warning";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}
-/**
- * Validates continuous integration requirements (Codex Term #36).
- * Ensures automated testing and linting on every commit.
- */
-export declare class ContinuousIntegrationValidator extends BaseValidator {
-    readonly id = "continuous-integration-validator";
-    readonly ruleId = "continuous-integration";
-    readonly category: "testing";
-    readonly severity: "error";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}
-/**
- * Validates test failure reporting requirements.
- * Ensures proper test failure handling and reporting mechanisms.
- */
-export declare class TestFailureReportingValidator extends BaseValidator {
-    readonly id = "test-failure-reporting-validator";
-    readonly ruleId = "test-failure-reporting";
-    readonly category: "reporting";
-    readonly severity: "high";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-    /**
-     * Create a warning validation result (convenience method).
-     */
-    private createWarningResult;
-}
-/**
- * Validates performance regression reporting requirements.
- * Ensures performance metrics are tracked and reported.
- */
-export declare class PerformanceRegressionReportingValidator extends BaseValidator {
-    readonly id = "performance-regression-reporting-validator";
-    readonly ruleId = "performance-regression-reporting";
-    readonly category: "reporting";
-    readonly severity: "warning";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}
-/**
- * Validates security vulnerability reporting requirements.
- * Ensures security issues are properly reported.
- */
-export declare class SecurityVulnerabilityReportingValidator extends BaseValidator {
-    readonly id = "security-vulnerability-reporting-validator";
-    readonly ruleId = "security-vulnerability-reporting";
-    readonly category: "reporting";
-    readonly severity: "error";
-    validate(context: RuleValidationContext): Promise<RuleValidationResult>;
-}

package/dist/enforcement/validators/testing-validators.js

@@ -1,252 +0,0 @@
-/**
- * Testing Validators
- *
- * Validators for testing category rules extracted from rule-enforcer.ts.
- * Each validator encapsulates the validation logic for a specific testing rule.
- *
- * @module validators/testing-validators
- */
-import { BaseValidator } from "./base-validator.js";
-/**
- * Validates that tests are required for new code (Codex Term #26).
- * Checks if tests exist for new components or modified functionality.
- */
-export class TestsRequiredValidator extends BaseValidator {
-    id = "tests-required-validator";
-    ruleId = "tests-required";
-    category = "testing";
-    severity = "error";
-    async validate(context) {
-        const { newCode, operation, tests } = context;
-        // For create operations, check if tests array is provided and empty
-        if (operation === "create" && Array.isArray(tests) && tests.length === 0) {
-            return this.createFailureResult("Tests are required when creating new components", ["Add unit tests for the new component", "Include integration tests if applicable"]);
-        }
-        // If no code provided, skip validation
-        if (!newCode) {
-            return this.createSuccessResult("No code to validate for tests");
-        }
-        // If we have newCode, check if it's a test file or has exported functions
-        if (newCode) {
-            // Check for test files themselves (should not require their own tests)
-            if (newCode.includes("describe(") ||
-                newCode.includes("it(") ||
-                newCode.includes("test(")) {
-                return this.createSuccessResult("Test files do not require additional tests");
-            }
-            // Simple check - if we have exported functions and no tests provided, flag it
-            const exportedFunctions = (newCode.match(/export\s+function\s+\w+/g) || []).length;
-            if (exportedFunctions > 0 && (!tests || tests.length === 0)) {
-                // Allow over-engineered code to pass test requirements for edge case
-                if (newCode.includes("if (") && newCode.split("\n").length > 10) {
-                    return this.createSuccessResult("Over-engineered code may have different testing requirements");
-                }
-                return this.createFailureResult("Complex exported functions require tests", ["Add unit tests for exported functions", "Ensure test coverage for all code paths"]);
-            }
-        }
-        return this.createSuccessResult("Tests present or not required");
-    }
-}
-/**
- * Validates test coverage thresholds (Codex Term #26).
- * Maintains 85%+ behavioral test coverage.
- */
-export class TestCoverageValidator extends BaseValidator {
-    id = "test-coverage-validator";
-    ruleId = "test-coverage";
-    category = "testing";
-    severity = "warning";
-    async validate(context) {
-        const { newCode, operation, tests } = context;
-        if (!newCode || operation !== "write") {
-            return this.createSuccessResult("No code to validate for test coverage");
-        }
-        // Check for exported functions that need tests
-        const exportedFunctions = newCode.match(/export\s+(?:function|const|let)\s+(\w+)/g);
-        if (exportedFunctions && exportedFunctions.length > 0) {
-            const testCount = tests ? tests.length : 0;
-            const coverageRatio = testCount / exportedFunctions.length;
-            if (coverageRatio < 0.85) {
-                // Less than 85% coverage
-                return this.createFailureResult(`Test coverage: ${Math.round(coverageRatio * 100)}% (${testCount}/${exportedFunctions.length} functions)`, [
-                    "Add unit tests for exported functions",
-                    "Aim for 85%+ behavioral test coverage",
-                    "Focus on critical code paths first",
-                ]);
-            }
-        }
-        return this.createSuccessResult("Test coverage requirements met (85%+)");
-    }
-}
-/**
- * Validates continuous integration requirements (Codex Term #36).
- * Ensures automated testing and linting on every commit.
- */
-export class ContinuousIntegrationValidator extends BaseValidator {
-    id = "continuous-integration-validator";
-    ruleId = "continuous-integration";
-    category = "testing";
-    severity = "error";
-    async validate(context) {
-        const { files, newCode } = context;
-        // Check for CI configuration files
-        const hasCIConfig = files?.some((file) => file.includes(".github/workflows") ||
-            file.includes(".gitlab-ci.yml") ||
-            file.includes("azure-pipelines.yml") ||
-            file.includes("jenkins") ||
-            file.includes(".circleci"));
-        // If modifying CI configs, validate they include testing steps
-        if (hasCIConfig && newCode) {
-            const hasTestStep = newCode.includes("npm test") ||
-                newCode.includes("yarn test") ||
-                newCode.includes("pnpm test") ||
-                newCode.includes("jest") ||
-                newCode.includes("vitest") ||
-                newCode.includes("mocha");
-            const hasLintStep = newCode.includes("npm run lint") ||
-                newCode.includes("yarn lint") ||
-                newCode.includes("pnpm lint") ||
-                newCode.includes("eslint") ||
-                newCode.includes("prettier --check");
-            if (!hasTestStep) {
-                return this.createFailureResult("CI configuration missing test execution step", [
-                    "Add npm test or equivalent test command to CI pipeline",
-                    "Ensure tests run on every commit",
-                ]);
-            }
-            if (!hasLintStep) {
-                return this.createFailureResult("CI configuration missing linting step", [
-                    "Add npm run lint or equivalent lint command to CI pipeline",
-                    "Ensure code quality checks run on every commit",
-                ]);
-            }
-            return this.createSuccessResult("CI configuration includes testing and linting steps");
-        }
-        // For non-CI file changes, just verify CI is set up
-        if (!hasCIConfig) {
-            // Check if CI files exist elsewhere (not in current changes)
-            return this.createSuccessResult("CI validation skipped (no CI configuration in changes)");
-        }
-        return this.createSuccessResult("Continuous integration requirements met");
-    }
-}
-/**
- * Validates test failure reporting requirements.
- * Ensures proper test failure handling and reporting mechanisms.
- */
-export class TestFailureReportingValidator extends BaseValidator {
-    id = "test-failure-reporting-validator";
-    ruleId = "test-failure-reporting";
-    category = "reporting";
-    severity = "high";
-    async validate(context) {
-        const { files, newCode } = context;
-        // Check if we're modifying test files
-        const isTestFile = files?.some((file) => file.endsWith(".test.ts") ||
-            file.endsWith(".test.js") ||
-            file.endsWith(".spec.ts") ||
-            file.endsWith(".spec.js") ||
-            file.includes("__tests__"));
-        if (isTestFile && newCode) {
-            // Check for proper error handling in tests
-            const hasProperAssertions = newCode.includes("expect(") ||
-                newCode.includes("assert(") ||
-                newCode.includes("should(") ||
-                newCode.includes(".should.");
-            if (!hasProperAssertions) {
-                return this.createFailureResult("Test file missing proper assertions", [
-                    "Add expect() or assert() statements to verify behavior",
-                    "Ensure tests have meaningful assertions",
-                ]);
-            }
-            // Check for test reporting setup
-            const hasReporterConfig = newCode.includes("reporter") ||
-                newCode.includes("coverage") ||
-                newCode.includes("testResultsProcessor");
-            if (!hasReporterConfig) {
-                return this.createWarningResult("Consider adding test reporting configuration", [
-                    "Add test reporters for better failure visibility",
-                    "Configure coverage reporting",
-                ]);
-            }
-        }
-        return this.createSuccessResult("Test failure reporting requirements met");
-    }
-    /**
-     * Create a warning validation result (convenience method).
-     */
-    createWarningResult(message, suggestions) {
-        const result = {
-            passed: true, // Warnings don't fail validation
-            message: `Warning: ${message}`,
-        };
-        if (suggestions && suggestions.length > 0) {
-            result.suggestions = suggestions;
-        }
-        return result;
-    }
-}
-/**
- * Validates performance regression reporting requirements.
- * Ensures performance metrics are tracked and reported.
- */
-export class PerformanceRegressionReportingValidator extends BaseValidator {
-    id = "performance-regression-reporting-validator";
-    ruleId = "performance-regression-reporting";
-    category = "reporting";
-    severity = "warning";
-    async validate(context) {
-        const { newCode, operation } = context;
-        if (!newCode || operation !== "write") {
-            return this.createSuccessResult("No code change to validate");
-        }
-        const hasPerfCode = newCode.includes("performance") ||
-            newCode.includes("benchmark") ||
-            newCode.includes("profiling") ||
-            newCode.includes("measure") ||
-            newCode.includes("optimize");
-        if (hasPerfCode) {
-            const hasReporting = newCode.includes("console.time") ||
-                newCode.includes("performance.now") ||
-                newCode.includes("benchmark") ||
-                newCode.includes("metrics") ||
-                newCode.includes("report");
-            if (!hasReporting) {
-                return this.createFailureResult("Performance code lacks measurement/reporting", ["Add performance.now() or console.time()", "Include metrics reporting"]);
-            }
-        }
-        return this.createSuccessResult("Performance regression reporting requirements met");
-    }
-}
-/**
- * Validates security vulnerability reporting requirements.
- * Ensures security issues are properly reported.
- */
-export class SecurityVulnerabilityReportingValidator extends BaseValidator {
-    id = "security-vulnerability-reporting-validator";
-    ruleId = "security-vulnerability-reporting";
-    category = "reporting";
-    severity = "error";
-    async validate(context) {
-        const { newCode, operation } = context;
-        if (!newCode || operation !== "write") {
-            return this.createSuccessResult("No code change to validate");
-        }
-        const hasSecurityCode = newCode.includes("password") ||
-            newCode.includes("secret") ||
-            newCode.includes("token") ||
-            newCode.includes("auth") ||
-            newCode.includes("encrypt") ||
-            newCode.includes("credential");
-        if (hasSecurityCode) {
-            const exposesSecrets = newCode.includes("console.log") &&
-                (newCode.includes("password") ||
-                    newCode.includes("secret") ||
-                    newCode.includes("token"));
-            if (exposesSecrets) {
-                return this.createFailureResult("Security-sensitive data may be logged", ["Remove console.log of sensitive data", "Use secure logging"]);
-            }
-        }
-        return this.createSuccessResult("Security vulnerability reporting requirements met");
-    }
-}