@agentic-qe/v3 3.0.0-alpha.3

package/src/shared/security/compliance-patterns.ts

@@ -0,0 +1,666 @@
+/**
+ * Agentic QE v3 - Compliance Pattern Analyzer
+ * Detects security and compliance patterns in source code
+ */
+
+import { FileReader } from '../io';
+
+// ============================================================================
+// Types and Interfaces
+// ============================================================================
+
+export interface PatternMatch {
+  file: string;
+  line: number;
+  column?: number;
+  snippet: string;
+  pattern: string;
+  severity: 'info' | 'warning' | 'critical';
+}
+
+export interface CompliancePatternResult {
+  category: string;
+  passed: boolean;
+  matches: PatternMatch[];
+  missingPatterns: string[];
+}
+
+export interface EncryptionAnalysis {
+  hasEncryption: boolean;
+  encryptionLibraries: string[];
+  unencryptedDataHandling: PatternMatch[];
+  weakCrypto: PatternMatch[];
+}
+
+export interface AccessControlAnalysis {
+  hasAuthMiddleware: boolean;
+  unprotectedRoutes: PatternMatch[];
+  missingRoleChecks: PatternMatch[];
+  hardcodedCredentials: PatternMatch[];
+}
+
+export interface LoggingAnalysis {
+  hasAuditLogging: boolean;
+  sensitiveOperationsWithoutLogging: PatternMatch[];
+  sensitiveDataInLogs: PatternMatch[];
+}
+
+export interface DataProtectionAnalysis {
+  piiFields: PatternMatch[];
+  unmaskedPii: PatternMatch[];
+  missingValidation: PatternMatch[];
+}
+
+export interface SecurityControlsAnalysis {
+  hasRateLimiting: boolean;
+  hasCsrfProtection: boolean;
+  hasCors: boolean;
+  hasInputValidation: boolean;
+  missingControls: string[];
+  vulnerabilities: PatternMatch[];
+}
+
+// ============================================================================
+// Pattern Definitions
+// ============================================================================
+
+const ENCRYPTION_PATTERNS = {
+  // Libraries and imports indicating encryption usage
+  libraries: [
+    /import\s+.*\bfrom\s+['"]crypto['"]/,
+    /import\s+.*\bfrom\s+['"]bcrypt['"]/,
+    /import\s+.*\bfrom\s+['"]argon2['"]/,
+    /import\s+.*\bfrom\s+['"]node-forge['"]/,
+    /import\s+.*\bfrom\s+['"]crypto-js['"]/,
+    /require\s*\(\s*['"]crypto['"]\s*\)/,
+  ],
+  // Encryption function calls
+  encryption: [
+    /\.encrypt\s*\(/,
+    /\.decrypt\s*\(/,
+    /createCipheriv\s*\(/,
+    /createDecipheriv\s*\(/,
+    /\.hash\s*\(/,
+    /bcrypt\.(hash|compare)/,
+    /argon2\.(hash|verify)/,
+  ],
+  // Weak/deprecated crypto
+  weakCrypto: [
+    /createCipher\s*\(\s*['"]des['"]/i,
+    /createCipher\s*\(\s*['"]md5['"]/i,
+    /\.createHash\s*\(\s*['"]md5['"]\s*\)/,
+    /\.createHash\s*\(\s*['"]sha1['"]\s*\)/,
+  ],
+  // Unencrypted sensitive data handling
+  unencryptedData: [
+    /password\s*[:=]\s*[^{]*(?!hash|encrypt|bcrypt)/i,
+    /\.parse\s*\(\s*.*password/i,
+    /JSON\.stringify\s*\([^)]*password[^)]*\)/i,
+  ],
+};
+
+const ACCESS_CONTROL_PATTERNS = {
+  // Auth middleware patterns
+  authMiddleware: [
+    /\.use\s*\(\s*(?:auth|authenticate|passport|jwt|bearer)/i,
+    /middleware\s*[:=].*(?:auth|authenticate|verify)/i,
+    /isAuthenticated/,
+    /requireAuth/,
+    /checkAuth/,
+  ],
+  // Route protection
+  routeProtection: [
+    /(?:app|router)\.\w+\s*\([^)]*,\s*(?:auth|authenticate|protect)/i,
+    /@(?:Auth|Authenticated|RequireAuth|Roles?)\s*\(/,
+  ],
+  // Missing protection patterns (routes without auth)
+  unprotectedRoutes: [
+    /(?:app|router)\.(?:get|post|put|delete|patch)\s*\(\s*['"][^'"]*(?:admin|user|account|profile|settings)[^'"]*['"]\s*,\s*(?:async\s*)?\([^)]*\)\s*=>/i,
+  ],
+  // Hardcoded credentials
+  hardcodedCreds: [
+    /(?:password|secret|apikey|api_key|token)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+    /Authorization\s*[:=]\s*['"]Bearer\s+[^'"]+['"]/i,
+  ],
+};
+
+const LOGGING_PATTERNS = {
+  // Audit logging
+  auditLog: [
+    /audit\.log/i,
+    /auditLog/,
+    /\.audit\s*\(/,
+    /logger\.(?:audit|security)/i,
+    /winston\.(?:audit)/i,
+  ],
+  // General logging
+  generalLog: [
+    /console\.(?:log|info|warn|error)/,
+    /logger\.(?:log|info|warn|error|debug)/,
+    /winston\.(?:log|info|warn|error)/,
+    /pino\.(?:info|warn|error)/,
+  ],
+  // Sensitive operations that should be logged
+  sensitiveOperations: [
+    /\.delete\s*\(/,
+    /\.remove\s*\(/,
+    /\.update\s*\([^)]*(?:password|role|permission)/i,
+    /\.create(?:User|Admin|Account)/i,
+    /login|logout|signIn|signOut/i,
+  ],
+  // Sensitive data in logs (violation)
+  sensitiveInLogs: [
+    /console\.log\s*\([^)]*(?:password|secret|token|apikey|ssn|creditcard)/i,
+    /logger\.(?:log|info|debug)\s*\([^)]*(?:password|secret|token)/i,
+  ],
+};
+
+const DATA_PROTECTION_PATTERNS = {
+  // PII field patterns
+  piiFields: [
+    /(?:email|phone|ssn|social_security|date_of_birth|dob|address|zip_code|postal)\s*[:=?]/i,
+    /firstName|lastName|fullName|name\s*:/i,
+    /creditCard|cardNumber|cvv|expiry/i,
+    /passport|driverLicense|nationalId/i,
+  ],
+  // Masking patterns
+  masking: [
+    /\.mask\s*\(/,
+    /maskPii|maskData|redact/i,
+    /\*{3,}/,
+    /x{3,}/i,
+  ],
+  // Input validation
+  validation: [
+    /\.validate\s*\(/,
+    /Joi\.|yup\.|zod\./,
+    /@IsEmail|@IsString|@IsNumber|@ValidateNested/,
+    /express-validator/,
+  ],
+};
+
+const SECURITY_CONTROLS_PATTERNS = {
+  // Rate limiting
+  rateLimiting: [
+    /rateLimit|rate-limit|rateLimiter/i,
+    /express-rate-limit/,
+    /slowDown/,
+    /throttle/i,
+  ],
+  // CSRF protection
+  csrf: [
+    /csrf|csurf/i,
+    /csrfToken/,
+    /@Csrf/,
+  ],
+  // CORS
+  cors: [
+    /\bcors\b/i,
+    /Access-Control-Allow/,
+    /\.cors\s*\(/,
+  ],
+  // Input sanitization
+  sanitization: [
+    /sanitize|escape|xss/i,
+    /DOMPurify/,
+    /validator\.escape/,
+  ],
+  // SQL injection prevention
+  sqlInjection: [
+    /\$\d|:\w+|\?/, // Parameterized queries
+    /\.prepare\s*\(/,
+    /sequelize|prisma|typeorm|knex/i,
+  ],
+};
+
+// ============================================================================
+// Compliance Pattern Analyzer
+// ============================================================================
+
+export class CompliancePatternAnalyzer {
+  private readonly fileReader: FileReader;
+
+  constructor() {
+    this.fileReader = new FileReader();
+  }
+
+  /**
+   * Analyze encryption patterns in files
+   */
+  async analyzeEncryption(files: string[]): Promise<EncryptionAnalysis> {
+    const encryptionLibraries: string[] = [];
+    const unencryptedDataHandling: PatternMatch[] = [];
+    const weakCrypto: PatternMatch[] = [];
+    let hasEncryption = false;
+
+    for (const file of files) {
+      const result = await this.fileReader.readFile(file);
+      if (!result.success) continue;
+
+      const content = result.value;
+      const lines = content.split('\n');
+
+      // Check for encryption libraries
+      for (const pattern of ENCRYPTION_PATTERNS.libraries) {
+        if (pattern.test(content)) {
+          hasEncryption = true;
+          const match = content.match(pattern);
+          if (match) {
+            const lib = match[0].match(/['"]([^'"]+)['"]/)?.[1];
+            if (lib && !encryptionLibraries.includes(lib)) {
+              encryptionLibraries.push(lib);
+            }
+          }
+        }
+      }
+
+      // Check for encryption usage
+      for (const pattern of ENCRYPTION_PATTERNS.encryption) {
+        if (pattern.test(content)) {
+          hasEncryption = true;
+        }
+      }
+
+      // Check for weak crypto
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of ENCRYPTION_PATTERNS.weakCrypto) {
+          if (pattern.test(line)) {
+            weakCrypto.push({
+              file,
+              line: i + 1,
+              snippet: line.trim().substring(0, 100),
+              pattern: 'weak-crypto',
+              severity: 'critical',
+            });
+          }
+        }
+
+        // Check for unencrypted data handling
+        for (const pattern of ENCRYPTION_PATTERNS.unencryptedData) {
+          if (pattern.test(line)) {
+            unencryptedDataHandling.push({
+              file,
+              line: i + 1,
+              snippet: line.trim().substring(0, 100),
+              pattern: 'unencrypted-data',
+              severity: 'warning',
+            });
+          }
+        }
+      }
+    }
+
+    return {
+      hasEncryption,
+      encryptionLibraries,
+      unencryptedDataHandling,
+      weakCrypto,
+    };
+  }
+
+  /**
+   * Analyze access control patterns
+   */
+  async analyzeAccessControl(files: string[]): Promise<AccessControlAnalysis> {
+    const unprotectedRoutes: PatternMatch[] = [];
+    const missingRoleChecks: PatternMatch[] = [];
+    const hardcodedCredentials: PatternMatch[] = [];
+    let hasAuthMiddleware = false;
+
+    for (const file of files) {
+      const result = await this.fileReader.readFile(file);
+      if (!result.success) continue;
+
+      const content = result.value;
+      const lines = content.split('\n');
+
+      // Check for auth middleware
+      for (const pattern of ACCESS_CONTROL_PATTERNS.authMiddleware) {
+        if (pattern.test(content)) {
+          hasAuthMiddleware = true;
+          break;
+        }
+      }
+
+      // Check for route protection
+      for (const pattern of ACCESS_CONTROL_PATTERNS.routeProtection) {
+        if (pattern.test(content)) {
+          hasAuthMiddleware = true;
+        }
+      }
+
+      // Analyze each line
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+
+        // Check for unprotected routes
+        for (const pattern of ACCESS_CONTROL_PATTERNS.unprotectedRoutes) {
+          if (pattern.test(line)) {
+            // Check if next lines have auth middleware
+            const contextLines = lines.slice(i, i + 3).join('\n');
+            const hasAuth = ACCESS_CONTROL_PATTERNS.authMiddleware.some((p) =>
+              p.test(contextLines)
+            );
+            if (!hasAuth) {
+              unprotectedRoutes.push({
+                file,
+                line: i + 1,
+                snippet: line.trim().substring(0, 100),
+                pattern: 'unprotected-route',
+                severity: 'warning',
+              });
+            }
+          }
+        }
+
+        // Check for hardcoded credentials
+        for (const pattern of ACCESS_CONTROL_PATTERNS.hardcodedCreds) {
+          if (pattern.test(line)) {
+            hardcodedCredentials.push({
+              file,
+              line: i + 1,
+              snippet: line.trim().substring(0, 50) + '...[REDACTED]',
+              pattern: 'hardcoded-credential',
+              severity: 'critical',
+            });
+          }
+        }
+      }
+    }
+
+    return {
+      hasAuthMiddleware,
+      unprotectedRoutes,
+      missingRoleChecks,
+      hardcodedCredentials,
+    };
+  }
+
+  /**
+   * Analyze logging patterns
+   */
+  async analyzeLogging(files: string[]): Promise<LoggingAnalysis> {
+    const sensitiveOperationsWithoutLogging: PatternMatch[] = [];
+    const sensitiveDataInLogs: PatternMatch[] = [];
+    let hasAuditLogging = false;
+
+    for (const file of files) {
+      const result = await this.fileReader.readFile(file);
+      if (!result.success) continue;
+
+      const content = result.value;
+      const lines = content.split('\n');
+
+      // Check for audit logging
+      for (const pattern of LOGGING_PATTERNS.auditLog) {
+        if (pattern.test(content)) {
+          hasAuditLogging = true;
+          break;
+        }
+      }
+
+      // Analyze each line
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+
+        // Check for sensitive operations without logging
+        for (const pattern of LOGGING_PATTERNS.sensitiveOperations) {
+          if (pattern.test(line)) {
+            // Check surrounding context for logging
+            const startLine = Math.max(0, i - 5);
+            const endLine = Math.min(lines.length, i + 5);
+            const context = lines.slice(startLine, endLine).join('\n');
+
+            const hasLogging = LOGGING_PATTERNS.generalLog.some((p) =>
+              p.test(context)
+            );
+            if (!hasLogging) {
+              sensitiveOperationsWithoutLogging.push({
+                file,
+                line: i + 1,
+                snippet: line.trim().substring(0, 100),
+                pattern: 'missing-audit-log',
+                severity: 'warning',
+              });
+            }
+          }
+        }
+
+        // Check for sensitive data in logs
+        for (const pattern of LOGGING_PATTERNS.sensitiveInLogs) {
+          if (pattern.test(line)) {
+            sensitiveDataInLogs.push({
+              file,
+              line: i + 1,
+              snippet: line.trim().substring(0, 100),
+              pattern: 'sensitive-data-logged',
+              severity: 'critical',
+            });
+          }
+        }
+      }
+    }
+
+    return {
+      hasAuditLogging,
+      sensitiveOperationsWithoutLogging,
+      sensitiveDataInLogs,
+    };
+  }
+
+  /**
+   * Analyze data protection patterns
+   */
+  async analyzeDataProtection(files: string[]): Promise<DataProtectionAnalysis> {
+    const piiFields: PatternMatch[] = [];
+    const unmaskedPii: PatternMatch[] = [];
+    const missingValidation: PatternMatch[] = [];
+
+    for (const file of files) {
+      const result = await this.fileReader.readFile(file);
+      if (!result.success) continue;
+
+      const content = result.value;
+      const lines = content.split('\n');
+
+      // Check for validation library usage
+      const hasValidation = DATA_PROTECTION_PATTERNS.validation.some((p) =>
+        p.test(content)
+      );
+
+      // Check for masking patterns
+      const hasMasking = DATA_PROTECTION_PATTERNS.masking.some((p) =>
+        p.test(content)
+      );
+
+      // Analyze each line
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+
+        // Find PII fields
+        for (const pattern of DATA_PROTECTION_PATTERNS.piiFields) {
+          if (pattern.test(line)) {
+            piiFields.push({
+              file,
+              line: i + 1,
+              snippet: line.trim().substring(0, 100),
+              pattern: 'pii-field',
+              severity: 'info',
+            });
+
+            // Check if this PII field has masking
+            const contextLines = lines.slice(Math.max(0, i - 2), i + 3).join('\n');
+            const fieldHasMasking = DATA_PROTECTION_PATTERNS.masking.some((p) =>
+              p.test(contextLines)
+            );
+            if (!fieldHasMasking && !hasMasking) {
+              unmaskedPii.push({
+                file,
+                line: i + 1,
+                snippet: line.trim().substring(0, 100),
+                pattern: 'unmasked-pii',
+                severity: 'warning',
+              });
+            }
+          }
+        }
+      }
+
+      // If file has PII but no validation
+      if (piiFields.length > 0 && !hasValidation) {
+        missingValidation.push({
+          file,
+          line: 1,
+          snippet: 'File contains PII fields without input validation',
+          pattern: 'missing-validation',
+          severity: 'warning',
+        });
+      }
+    }
+
+    return {
+      piiFields,
+      unmaskedPii,
+      missingValidation,
+    };
+  }
+
+  /**
+   * Analyze security controls
+   */
+  async analyzeSecurityControls(files: string[]): Promise<SecurityControlsAnalysis> {
+    const vulnerabilities: PatternMatch[] = [];
+    const missingControls: string[] = [];
+    let hasRateLimiting = false;
+    let hasCsrfProtection = false;
+    let hasCors = false;
+    let hasInputValidation = false;
+
+    for (const file of files) {
+      const result = await this.fileReader.readFile(file);
+      if (!result.success) continue;
+
+      const content = result.value;
+
+      // Check for rate limiting
+      if (SECURITY_CONTROLS_PATTERNS.rateLimiting.some((p) => p.test(content))) {
+        hasRateLimiting = true;
+      }
+
+      // Check for CSRF protection
+      if (SECURITY_CONTROLS_PATTERNS.csrf.some((p) => p.test(content))) {
+        hasCsrfProtection = true;
+      }
+
+      // Check for CORS
+      if (SECURITY_CONTROLS_PATTERNS.cors.some((p) => p.test(content))) {
+        hasCors = true;
+      }
+
+      // Check for input sanitization/validation
+      if (SECURITY_CONTROLS_PATTERNS.sanitization.some((p) => p.test(content))) {
+        hasInputValidation = true;
+      }
+    }
+
+    // Determine missing controls
+    if (!hasRateLimiting) missingControls.push('Rate Limiting');
+    if (!hasCsrfProtection) missingControls.push('CSRF Protection');
+    if (!hasCors) missingControls.push('CORS Configuration');
+    if (!hasInputValidation) missingControls.push('Input Validation/Sanitization');
+
+    return {
+      hasRateLimiting,
+      hasCsrfProtection,
+      hasCors,
+      hasInputValidation,
+      missingControls,
+      vulnerabilities,
+    };
+  }
+
+  /**
+   * Scan files for specific data types (PII, PHI, etc.)
+   */
+  async scanForDataTypes(
+    files: string[],
+    dataTypes: Array<'pii' | 'phi' | 'financial' | 'credentials' | 'biometric'>
+  ): Promise<Map<string, PatternMatch[]>> {
+    const results = new Map<string, PatternMatch[]>();
+
+    const dataTypePatterns: Record<string, RegExp[]> = {
+      pii: [
+        /email|phone|ssn|social_security|address|date_of_birth|dob/i,
+        /firstName|lastName|fullName/i,
+        /passport|driverLicense|nationalId/i,
+      ],
+      phi: [
+        /medical|diagnosis|prescription|patient|health/i,
+        /insurance|provider|treatment/i,
+        /blood_type|allergy|medication/i,
+      ],
+      financial: [
+        /creditCard|cardNumber|cvv|expiry|account_number/i,
+        /bank|routing|swift|iban/i,
+        /transaction|payment|billing/i,
+      ],
+      credentials: [
+        /password|secret|apikey|api_key|token|auth/i,
+        /private_key|certificate|credential/i,
+      ],
+      biometric: [
+        /fingerprint|faceId|retina|voice_print/i,
+        /biometric|facial_recognition/i,
+      ],
+    };
+
+    for (const dataType of dataTypes) {
+      results.set(dataType, []);
+    }
+
+    for (const file of files) {
+      const readResult = await this.fileReader.readFile(file);
+      if (!readResult.success) continue;
+
+      const lines = readResult.value.split('\n');
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+
+        for (const dataType of dataTypes) {
+          const patterns = dataTypePatterns[dataType] || [];
+          for (const pattern of patterns) {
+            if (pattern.test(line)) {
+              const matches = results.get(dataType) || [];
+              matches.push({
+                file,
+                line: i + 1,
+                snippet: line.trim().substring(0, 100),
+                pattern: dataType,
+                severity: 'info',
+              });
+              results.set(dataType, matches);
+              break; // Only count once per line per data type
+            }
+          }
+        }
+      }
+    }
+
+    return results;
+  }
+}
+
+// ============================================================================
+// Singleton Instance
+// ============================================================================
+
+let defaultAnalyzer: CompliancePatternAnalyzer | null = null;
+
+export function getCompliancePatternAnalyzer(): CompliancePatternAnalyzer {
+  if (!defaultAnalyzer) {
+    defaultAnalyzer = new CompliancePatternAnalyzer();
+  }
+  return defaultAnalyzer;
+}

package/src/shared/security/index.ts

@@ -0,0 +1,30 @@
+/**
+ * Agentic QE v3 - Security Utilities
+ */
+
+export { OSVClient } from './osv-client';
+export type {
+  OSVClientConfig,
+  OSVQueryRequest,
+  OSVEcosystem,
+  OSVVulnerability,
+  OSVSeverity,
+  OSVAffected,
+  OSVRange,
+  OSVReference,
+  OSVQueryResponse,
+  OSVBatchQueryRequest,
+  OSVBatchQueryResponse,
+  ParsedVulnerability,
+} from './osv-client';
+
+export { CompliancePatternAnalyzer, getCompliancePatternAnalyzer } from './compliance-patterns';
+export type {
+  PatternMatch,
+  CompliancePatternResult,
+  EncryptionAnalysis,
+  AccessControlAnalysis,
+  LoggingAnalysis,
+  DataProtectionAnalysis,
+  SecurityControlsAnalysis,
+} from './compliance-patterns';