0xray 4.0.34 → 4.0.36

package/dist/infrastructure/iac-validator.d.ts

@@ -1,150 +0,0 @@
-/**
- * Infrastructure as Code Validation System
- *
- * Comprehensive IaC validation with schema enforcement, pre-commit hooks,
- * and automated CI/CD integration for enterprise-grade cloud deployments.
- *
- * @since 2026-01-08
- */
-import { z } from "zod";
-export declare enum ValidationSeverity {
-    ERROR = "error",
-    WARNING = "warning",
-    INFO = "info"
-}
-export interface ValidationResult {
-    file: string;
-    valid: boolean;
-    errors: ValidationError[];
-    warnings: ValidationWarning[];
-}
-export interface ValidationError {
-    path: string;
-    message: string;
-    severity: ValidationSeverity.ERROR;
-    line?: number;
-    column?: number;
-}
-export interface ValidationWarning {
-    path: string;
-    message: string;
-    severity: ValidationSeverity.WARNING;
-    suggestion?: string;
-}
-export declare const CloudFormationSchema: z.ZodObject<{
-    AWSTemplateFormatVersion: z.ZodOptional<z.ZodString>;
-    Description: z.ZodOptional<z.ZodString>;
-    Metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    Parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        Type: z.ZodString;
-        Default: z.ZodOptional<z.ZodAny>;
-        AllowedValues: z.ZodOptional<z.ZodArray<z.ZodAny>>;
-        Description: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>>;
-    Mappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>>;
-    Conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    Transform: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-    Resources: z.ZodRecord<z.ZodString, z.ZodObject<{
-        Type: z.ZodString;
-        Properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        DependsOn: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        Metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        DeletionPolicy: z.ZodOptional<z.ZodEnum<{
-            Delete: "Delete";
-            Retain: "Retain";
-            Snapshot: "Snapshot";
-        }>>;
-    }, z.core.$strip>>;
-    Outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        Description: z.ZodOptional<z.ZodString>;
-        Value: z.ZodAny;
-        Export: z.ZodOptional<z.ZodObject<{
-            Name: z.ZodString;
-        }, z.core.$strip>>;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-export declare const TerraformSchema: z.ZodObject<{
-    terraform: z.ZodOptional<z.ZodObject<{
-        required_version: z.ZodOptional<z.ZodString>;
-        required_providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-            version: z.ZodOptional<z.ZodString>;
-            source: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>>;
-        backend: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip>>;
-    provider: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>;
-    resource: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>>;
-    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>>;
-    variable: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        type: z.ZodOptional<z.ZodString>;
-        default: z.ZodOptional<z.ZodAny>;
-        description: z.ZodOptional<z.ZodString>;
-        validation: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            condition: z.ZodAny;
-            error_message: z.ZodString;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>>>;
-    output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        value: z.ZodAny;
-        description: z.ZodOptional<z.ZodString>;
-        sensitive: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>>>;
-    locals: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    module: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>;
-}, z.core.$strip>;
-export declare const KubernetesSchema: z.ZodObject<{
-    apiVersion: z.ZodString;
-    kind: z.ZodString;
-    metadata: z.ZodObject<{
-        name: z.ZodString;
-        namespace: z.ZodOptional<z.ZodString>;
-        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>;
-    spec: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, z.core.$strip>;
-export declare const DockerComposeSchema: z.ZodObject<{
-    version: z.ZodOptional<z.ZodString>;
-    services: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        image: z.ZodOptional<z.ZodString>;
-        build: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>]>>;
-        ports: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
-        environment: z.ZodOptional<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodString>, z.ZodArray<z.ZodString>]>>;
-        volumes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        depends_on: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        networks: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        restart: z.ZodOptional<z.ZodEnum<{
-            always: "always";
-            no: "no";
-            "on-failure": "on-failure";
-            "unless-stopped": "unless-stopped";
-        }>>;
-    }, z.core.$strip>>>;
-    volumes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>;
-    networks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodAny>>>;
-}, z.core.$strip>;
-export declare class IaCValidator {
-    private schemas;
-    constructor();
-    private registerSchemas;
-    validateFile(filePath: string): Promise<ValidationResult>;
-    private validateJsonFile;
-    private validateYamlFile;
-    private performSecurityChecks;
-    validateDirectory(dirPath: string): Promise<ValidationResult[]>;
-    private findIaCFiles;
-}
-export declare class PreCommitValidator {
-    private validator;
-    constructor();
-    validateStagedFiles(): Promise<{
-        success: boolean;
-        results: ValidationResult[];
-    }>;
-    validateAllIaCFiles(): Promise<{
-        success: boolean;
-        results: ValidationResult[];
-    }>;
-}
-export declare function validateCommand(args: string[]): Promise<void>;

package/dist/infrastructure/iac-validator.js

@@ -1,465 +0,0 @@
-/**
- * Infrastructure as Code Validation System
- *
- * Comprehensive IaC validation with schema enforcement, pre-commit hooks,
- * and automated CI/CD integration for enterprise-grade cloud deployments.
- *
- * @since 2026-01-08
- */
-import { z } from "zod";
-import * as fs from "fs";
-import * as path from "path";
-import { spawn } from "child_process";
-import { frameworkLogger } from "../core/framework-logger.js";
-// ============================================================================
-// Schema Validation Types
-// ============================================================================
-export var ValidationSeverity;
-(function (ValidationSeverity) {
-    ValidationSeverity["ERROR"] = "error";
-    ValidationSeverity["WARNING"] = "warning";
-    ValidationSeverity["INFO"] = "info";
-})(ValidationSeverity || (ValidationSeverity = {}));
-// ============================================================================
-// Base Schema Validators
-// ============================================================================
-export const CloudFormationSchema = z.object({
-    AWSTemplateFormatVersion: z.string().optional(),
-    Description: z.string().optional(),
-    Metadata: z.record(z.string(), z.any()).optional(),
-    Parameters: z
-        .record(z.string(), z.object({
-        Type: z.string(),
-        Default: z.any().optional(),
-        AllowedValues: z.array(z.any()).optional(),
-        Description: z.string().optional(),
-    }))
-        .optional(),
-    Mappings: z
-        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
-        .optional(),
-    Conditions: z.record(z.string(), z.any()).optional(),
-    Transform: z.union([z.string(), z.array(z.string())]).optional(),
-    Resources: z.record(z.string(), z.object({
-        Type: z.string(),
-        Properties: z.record(z.string(), z.any()).optional(),
-        DependsOn: z.union([z.string(), z.array(z.string())]).optional(),
-        Metadata: z.record(z.string(), z.any()).optional(),
-        DeletionPolicy: z.enum(["Delete", "Retain", "Snapshot"]).optional(),
-    })),
-    Outputs: z
-        .record(z.string(), z.object({
-        Description: z.string().optional(),
-        Value: z.any(),
-        Export: z
-            .object({
-            Name: z.string(),
-        })
-            .optional(),
-    }))
-        .optional(),
-});
-export const TerraformSchema = z.object({
-    terraform: z
-        .object({
-        required_version: z.string().optional(),
-        required_providers: z
-            .record(z.string(), z.object({
-            version: z.string().optional(),
-            source: z.string().optional(),
-        }))
-            .optional(),
-        backend: z.record(z.string(), z.any()).optional(),
-    })
-        .optional(),
-    provider: z.record(z.string(), z.record(z.string(), z.any())).optional(),
-    resource: z
-        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
-        .optional(),
-    data: z
-        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
-        .optional(),
-    variable: z
-        .record(z.string(), z.object({
-        type: z.string().optional(),
-        default: z.any().optional(),
-        description: z.string().optional(),
-        validation: z
-            .array(z.object({
-            condition: z.any(),
-            error_message: z.string(),
-        }))
-            .optional(),
-    }))
-        .optional(),
-    output: z
-        .record(z.string(), z.object({
-        value: z.any(),
-        description: z.string().optional(),
-        sensitive: z.boolean().optional(),
-    }))
-        .optional(),
-    locals: z.record(z.string(), z.any()).optional(),
-    module: z.record(z.string(), z.record(z.string(), z.any())).optional(),
-});
-export const KubernetesSchema = z.object({
-    apiVersion: z.string(),
-    kind: z.string(),
-    metadata: z.object({
-        name: z.string(),
-        namespace: z.string().optional(),
-        labels: z.record(z.string(), z.string()).optional(),
-        annotations: z.record(z.string(), z.string()).optional(),
-    }),
-    spec: z.record(z.string(), z.any()).optional(),
-    status: z.record(z.string(), z.any()).optional(),
-});
-export const DockerComposeSchema = z.object({
-    version: z.string().optional(),
-    services: z
-        .record(z.string(), z.object({
-        image: z.string().optional(),
-        build: z.union([z.string(), z.record(z.string(), z.any())]).optional(),
-        ports: z.array(z.union([z.string(), z.number()])).optional(),
-        environment: z
-            .union([z.record(z.string(), z.string()), z.array(z.string())])
-            .optional(),
-        volumes: z.array(z.string()).optional(),
-        depends_on: z.array(z.string()).optional(),
-        networks: z.array(z.string()).optional(),
-        restart: z
-            .enum(["no", "always", "on-failure", "unless-stopped"])
-            .optional(),
-    }))
-        .optional(),
-    volumes: z.record(z.string(), z.record(z.string(), z.any())).optional(),
-    networks: z.record(z.string(), z.record(z.string(), z.any())).optional(),
-});
-// ============================================================================
-// IaC Validator Class
-// ============================================================================
-export class IaCValidator {
-    schemas = new Map();
-    constructor() {
-        this.registerSchemas();
-    }
-    registerSchemas() {
-        // CloudFormation
-        this.schemas.set("template.yaml", CloudFormationSchema);
-        this.schemas.set("template.yml", CloudFormationSchema);
-        this.schemas.set("cf-template.yaml", CloudFormationSchema);
-        this.schemas.set("cf-template.yml", CloudFormationSchema);
-        // Terraform
-        this.schemas.set("main.tf", TerraformSchema);
-        this.schemas.set("variables.tf", TerraformSchema);
-        this.schemas.set("outputs.tf", TerraformSchema);
-        this.schemas.set("terraform.tf", TerraformSchema);
-        // Kubernetes
-        this.schemas.set("deployment.yaml", KubernetesSchema);
-        this.schemas.set("deployment.yml", KubernetesSchema);
-        this.schemas.set("service.yaml", KubernetesSchema);
-        this.schemas.set("service.yml", KubernetesSchema);
-        this.schemas.set("configmap.yaml", KubernetesSchema);
-        this.schemas.set("configmap.yml", KubernetesSchema);
-        this.schemas.set("secret.yaml", KubernetesSchema);
-        this.schemas.set("secret.yml", KubernetesSchema);
-        // Docker Compose
-        this.schemas.set("docker-compose.yaml", DockerComposeSchema);
-        this.schemas.set("docker-compose.yml", DockerComposeSchema);
-        this.schemas.set("compose.yaml", DockerComposeSchema);
-        this.schemas.set("compose.yml", DockerComposeSchema);
-    }
-    async validateFile(filePath) {
-        const result = {
-            file: filePath,
-            valid: true,
-            errors: [],
-            warnings: [],
-        };
-        try {
-            const content = fs.readFileSync(filePath, "utf-8");
-            const ext = path.extname(filePath).toLowerCase();
-            const filename = path.basename(filePath).toLowerCase();
-            // Determine file type and validate
-            if (ext === ".json") {
-                await this.validateJsonFile(content, result);
-            }
-            else if (ext === ".yaml" || ext === ".yml") {
-                await this.validateYamlFile(filename, content, result);
-            }
-            // Additional security and best practice checks
-            this.performSecurityChecks(filePath, content, result);
-        }
-        catch (error) {
-            result.valid = false;
-            result.errors.push({
-                path: filePath,
-                message: `Failed to read or parse file: ${error instanceof Error ? error.message : String(error)}`,
-                severity: ValidationSeverity.ERROR,
-            });
-        }
-        return result;
-    }
-    async validateJsonFile(content, result) {
-        try {
-            JSON.parse(content);
-        }
-        catch (error) {
-            result.valid = false;
-            result.errors.push({
-                path: result.file,
-                message: `Invalid JSON: ${error instanceof Error ? error.message : String(error)}`,
-                severity: ValidationSeverity.ERROR,
-            });
-        }
-    }
-    async validateYamlFile(filename, content, result) {
-        try {
-            // Import yaml parser dynamically to avoid dependency issues
-            const yaml = await import("yaml");
-            const data = yaml.parse(content);
-            const schema = this.schemas.get(filename);
-            if (schema) {
-                const validation = schema.safeParse(data);
-                if (!validation.success) {
-                    result.valid = false;
-                    validation.error.issues.forEach((err) => {
-                        result.errors.push({
-                            path: `${result.file}.${err.path.join(".")}`,
-                            message: err.message,
-                            severity: ValidationSeverity.ERROR,
-                        });
-                    });
-                }
-            }
-            // Basic YAML structure validation
-            if (typeof data !== "object" || data === null) {
-                result.valid = false;
-                result.errors.push({
-                    path: result.file,
-                    message: "YAML file must contain a valid object structure",
-                    severity: ValidationSeverity.ERROR,
-                });
-            }
-        }
-        catch (error) {
-            result.valid = false;
-            result.errors.push({
-                path: result.file,
-                message: `Failed to parse YAML: ${error instanceof Error ? error.message : String(error)}`,
-                severity: ValidationSeverity.ERROR,
-            });
-        }
-    }
-    performSecurityChecks(filePath, content, result) {
-        const filename = path.basename(filePath).toLowerCase();
-        // Check for hardcoded secrets
-        const secretPatterns = [
-            /password\s*[:=]\s*['"]\w+['"]/i,
-            /secret\s*[:=]\s*['"]\w+['"]/i,
-            /token\s*[:=]\s*['"]\w+['"]/i,
-            /key\s*[:=]\s*['"]\w+['"]/i,
-            /api[_-]?key\s*[:=]\s*['"]\w+['"]/i,
-        ];
-        secretPatterns.forEach((pattern) => {
-            const matches = content.match(pattern);
-            if (matches) {
-                result.warnings.push({
-                    path: filePath,
-                    message: "Potential hardcoded secret detected",
-                    severity: ValidationSeverity.WARNING,
-                    suggestion: "Use environment variables or secret management services",
-                });
-            }
-        });
-        // Check for overly permissive permissions
-        if (filename.includes("iam") || filename.includes("policy")) {
-            if (content.includes("*") && content.includes("Action")) {
-                result.warnings.push({
-                    path: filePath,
-                    message: "Overly permissive IAM policy detected (* action)",
-                    severity: ValidationSeverity.WARNING,
-                    suggestion: "Specify explicit actions instead of wildcard",
-                });
-            }
-        }
-        // Check for missing resource constraints
-        if (filename.includes("deployment") || filename.includes("pod")) {
-            if (!content.includes("resources") && !content.includes("limits")) {
-                result.warnings.push({
-                    path: filePath,
-                    message: "Missing resource limits in deployment",
-                    severity: ValidationSeverity.WARNING,
-                    suggestion: "Add CPU and memory limits for production deployments",
-                });
-            }
-        }
-    }
-    async validateDirectory(dirPath) {
-        const results = [];
-        const files = this.findIaCFiles(dirPath);
-        for (const file of files) {
-            const result = await this.validateFile(file);
-            results.push(result);
-        }
-        return results;
-    }
-    findIaCFiles(dirPath) {
-        const files = [];
-        const extensions = [".yaml", ".yml", ".json", ".tf"];
-        const filenames = Array.from(this.schemas.keys());
-        function scanDir(currentPath) {
-            const items = fs.readdirSync(currentPath);
-            for (const item of items) {
-                const fullPath = path.join(currentPath, item);
-                const stat = fs.statSync(fullPath);
-                if (stat.isDirectory() &&
-                    !item.startsWith(".") &&
-                    item !== "node_modules") {
-                    scanDir(fullPath);
-                }
-                else if (stat.isFile()) {
-                    const ext = path.extname(item).toLowerCase();
-                    const filename = item.toLowerCase();
-                    if (extensions.includes(ext) || filenames.includes(filename)) {
-                        files.push(fullPath);
-                    }
-                }
-            }
-        }
-        scanDir(dirPath);
-        return files;
-    }
-}
-// ============================================================================
-// Pre-commit Hook Integration
-// ============================================================================
-export class PreCommitValidator {
-    validator;
-    constructor() {
-        this.validator = new IaCValidator();
-    }
-    async validateStagedFiles() {
-        try {
-            // Get staged files using spawn to prevent command injection
-            const stagedFiles = await new Promise((resolve, reject) => {
-                const gitProcess = spawn("git", ["diff", "--cached", "--name-only"]);
-                let stdout = "";
-                let stderr = "";
-                gitProcess.stdout?.on("data", (data) => {
-                    stdout += data.toString();
-                });
-                gitProcess.stderr?.on("data", (data) => {
-                    stderr += data.toString();
-                });
-                gitProcess.on("close", (code) => {
-                    if (code === 0) {
-                        const files = stdout
-                            .split("\n")
-                            .filter((file) => file.trim() &&
-                            (file.endsWith(".yaml") ||
-                                file.endsWith(".yml") ||
-                                file.endsWith(".json") ||
-                                file.endsWith(".tf")));
-                        resolve(files);
-                    }
-                    else {
-                        reject(new Error(`git failed with code ${code}: ${stderr}`));
-                    }
-                });
-                gitProcess.on("error", (err) => {
-                    reject(new Error(`Failed to spawn git: ${err.message}`));
-                });
-            });
-            const results = [];
-            for (const file of stagedFiles) {
-                if (fs.existsSync(file)) {
-                    const result = await this.validator.validateFile(file);
-                    results.push(result);
-                }
-            }
-            const hasErrors = results.some((r) => !r.valid);
-            return { success: !hasErrors, results };
-        }
-        catch (error) {
-            frameworkLogger.log("IaCValidator", "validate-staged-files", "error", { error, message: "Failed to validate staged files:" });
-            return { success: false, results: [] };
-        }
-    }
-    async validateAllIaCFiles() {
-        const results = await this.validator.validateDirectory(process.cwd());
-        const hasErrors = results.some((r) => !r.valid);
-        return { success: !hasErrors, results };
-    }
-}
-// ============================================================================
-// CLI Interface
-// ============================================================================
-export async function validateCommand(args) {
-    const validator = new IaCValidator();
-    const preCommitValidator = new PreCommitValidator();
-    if (args.includes("--staged")) {
-        const { success, results } = await preCommitValidator.validateStagedFiles();
-        printResults(results);
-        if (!success) {
-            frameworkLogger.log("IaCValidator", "validate-staged", "error", { message: "\n❌ IaC validation failed. Please fix errors before committing." });
-            process.exit(1);
-        }
-        else {
-            await frameworkLogger.log("iac-validator", "-n-all-iac-files-passed-validation-", "success", { message: "\n✅ All IaC files passed validation." });
-        }
-    }
-    else if (args.includes("--all")) {
-        const { success, results } = await preCommitValidator.validateAllIaCFiles();
-        printResults(results);
-        if (!success) {
-            frameworkLogger.log("IaCValidator", "validate-all", "error", { message: "\n❌ IaC validation failed." });
-            process.exit(1);
-        }
-        else {
-            await frameworkLogger.log("iac-validator", "-n-all-iac-files-passed-validation-", "success", { message: "\n✅ All IaC files passed validation." });
-        }
-    }
-    else {
-        const targetPath = args[0] || ".";
-        const results = await validator.validateDirectory(targetPath);
-        printResults(results);
-        const hasErrors = results.some((r) => !r.valid);
-        if (hasErrors) {
-            process.exit(1);
-        }
-    }
-}
-async function printResults(results) {
-    for (const result of results) {
-        await frameworkLogger.log("iac-validator", "-n-result-file-", "info", {
-            message: `\n📄 ${result.file}:`,
-        });
-        if (result.errors.length > 0) {
-            await frameworkLogger.log("iac-validator", "-errors-", "error", {
-                message: "  ❌ Errors:",
-            });
-            result.errors.forEach((error) => {
-                void frameworkLogger.log("iac-validator", "-error-path-error-message-", "error", { message: `    • ${error.path}: ${error.message}` });
-            });
-        }
-        if (result.warnings.length > 0) {
-            await frameworkLogger.log("iac-validator", "-warnings-", "info", {
-                message: "  ⚠️  Warnings:",
-            });
-            result.warnings.forEach((warning) => {
-                void frameworkLogger.log("iac-validator", "-warning-path-warning-message-", "info", { message: `    • ${warning.path}: ${warning.message}` });
-                if (warning.suggestion) {
-                    void frameworkLogger.log("iac-validator", "-warning-suggestion-", "info", { message: `      💡 ${warning.suggestion}` });
-                }
-            });
-        }
-        if (result.valid &&
-            result.errors.length === 0 &&
-            result.warnings.length === 0) {
-            await frameworkLogger.log("iac-validator", "-valid-", "success", {
-                message: "  ✅ Valid",
-            });
-        }
-    }
-}