@agentic-qe/v3 3.0.0-alpha.6 → 3.0.0-alpha.8

package/src/shared/security/compliance-patterns.ts

@@ -1,666 +0,0 @@
-/**
- * Agentic QE v3 - Compliance Pattern Analyzer
- * Detects security and compliance patterns in source code
- */
-
-import { FileReader } from '../io';
-
-// ============================================================================
-// Types and Interfaces
-// ============================================================================
-
-export interface PatternMatch {
-  file: string;
-  line: number;
-  column?: number;
-  snippet: string;
-  pattern: string;
-  severity: 'info' | 'warning' | 'critical';
-}
-
-export interface CompliancePatternResult {
-  category: string;
-  passed: boolean;
-  matches: PatternMatch[];
-  missingPatterns: string[];
-}
-
-export interface EncryptionAnalysis {
-  hasEncryption: boolean;
-  encryptionLibraries: string[];
-  unencryptedDataHandling: PatternMatch[];
-  weakCrypto: PatternMatch[];
-}
-
-export interface AccessControlAnalysis {
-  hasAuthMiddleware: boolean;
-  unprotectedRoutes: PatternMatch[];
-  missingRoleChecks: PatternMatch[];
-  hardcodedCredentials: PatternMatch[];
-}
-
-export interface LoggingAnalysis {
-  hasAuditLogging: boolean;
-  sensitiveOperationsWithoutLogging: PatternMatch[];
-  sensitiveDataInLogs: PatternMatch[];
-}
-
-export interface DataProtectionAnalysis {
-  piiFields: PatternMatch[];
-  unmaskedPii: PatternMatch[];
-  missingValidation: PatternMatch[];
-}
-
-export interface SecurityControlsAnalysis {
-  hasRateLimiting: boolean;
-  hasCsrfProtection: boolean;
-  hasCors: boolean;
-  hasInputValidation: boolean;
-  missingControls: string[];
-  vulnerabilities: PatternMatch[];
-}
-
-// ============================================================================
-// Pattern Definitions
-// ============================================================================
-
-const ENCRYPTION_PATTERNS = {
-  // Libraries and imports indicating encryption usage
-  libraries: [
-    /import\s+.*\bfrom\s+['"]crypto['"]/,
-    /import\s+.*\bfrom\s+['"]bcrypt['"]/,
-    /import\s+.*\bfrom\s+['"]argon2['"]/,
-    /import\s+.*\bfrom\s+['"]node-forge['"]/,
-    /import\s+.*\bfrom\s+['"]crypto-js['"]/,
-    /require\s*\(\s*['"]crypto['"]\s*\)/,
-  ],
-  // Encryption function calls
-  encryption: [
-    /\.encrypt\s*\(/,
-    /\.decrypt\s*\(/,
-    /createCipheriv\s*\(/,
-    /createDecipheriv\s*\(/,
-    /\.hash\s*\(/,
-    /bcrypt\.(hash|compare)/,
-    /argon2\.(hash|verify)/,
-  ],
-  // Weak/deprecated crypto
-  weakCrypto: [
-    /createCipher\s*\(\s*['"]des['"]/i,
-    /createCipher\s*\(\s*['"]md5['"]/i,
-    /\.createHash\s*\(\s*['"]md5['"]\s*\)/,
-    /\.createHash\s*\(\s*['"]sha1['"]\s*\)/,
-  ],
-  // Unencrypted sensitive data handling
-  unencryptedData: [
-    /password\s*[:=]\s*[^{]*(?!hash|encrypt|bcrypt)/i,
-    /\.parse\s*\(\s*.*password/i,
-    /JSON\.stringify\s*\([^)]*password[^)]*\)/i,
-  ],
-};
-
-const ACCESS_CONTROL_PATTERNS = {
-  // Auth middleware patterns
-  authMiddleware: [
-    /\.use\s*\(\s*(?:auth|authenticate|passport|jwt|bearer)/i,
-    /middleware\s*[:=].*(?:auth|authenticate|verify)/i,
-    /isAuthenticated/,
-    /requireAuth/,
-    /checkAuth/,
-  ],
-  // Route protection
-  routeProtection: [
-    /(?:app|router)\.\w+\s*\([^)]*,\s*(?:auth|authenticate|protect)/i,
-    /@(?:Auth|Authenticated|RequireAuth|Roles?)\s*\(/,
-  ],
-  // Missing protection patterns (routes without auth)
-  unprotectedRoutes: [
-    /(?:app|router)\.(?:get|post|put|delete|patch)\s*\(\s*['"][^'"]*(?:admin|user|account|profile|settings)[^'"]*['"]\s*,\s*(?:async\s*)?\([^)]*\)\s*=>/i,
-  ],
-  // Hardcoded credentials
-  hardcodedCreds: [
-    /(?:password|secret|apikey|api_key|token)\s*[:=]\s*['"][^'"]{8,}['"]/i,
-    /Authorization\s*[:=]\s*['"]Bearer\s+[^'"]+['"]/i,
-  ],
-};
-
-const LOGGING_PATTERNS = {
-  // Audit logging
-  auditLog: [
-    /audit\.log/i,
-    /auditLog/,
-    /\.audit\s*\(/,
-    /logger\.(?:audit|security)/i,
-    /winston\.(?:audit)/i,
-  ],
-  // General logging
-  generalLog: [
-    /console\.(?:log|info|warn|error)/,
-    /logger\.(?:log|info|warn|error|debug)/,
-    /winston\.(?:log|info|warn|error)/,
-    /pino\.(?:info|warn|error)/,
-  ],
-  // Sensitive operations that should be logged
-  sensitiveOperations: [
-    /\.delete\s*\(/,
-    /\.remove\s*\(/,
-    /\.update\s*\([^)]*(?:password|role|permission)/i,
-    /\.create(?:User|Admin|Account)/i,
-    /login|logout|signIn|signOut/i,
-  ],
-  // Sensitive data in logs (violation)
-  sensitiveInLogs: [
-    /console\.log\s*\([^)]*(?:password|secret|token|apikey|ssn|creditcard)/i,
-    /logger\.(?:log|info|debug)\s*\([^)]*(?:password|secret|token)/i,
-  ],
-};
-
-const DATA_PROTECTION_PATTERNS = {
-  // PII field patterns
-  piiFields: [
-    /(?:email|phone|ssn|social_security|date_of_birth|dob|address|zip_code|postal)\s*[:=?]/i,
-    /firstName|lastName|fullName|name\s*:/i,
-    /creditCard|cardNumber|cvv|expiry/i,
-    /passport|driverLicense|nationalId/i,
-  ],
-  // Masking patterns
-  masking: [
-    /\.mask\s*\(/,
-    /maskPii|maskData|redact/i,
-    /\*{3,}/,
-    /x{3,}/i,
-  ],
-  // Input validation
-  validation: [
-    /\.validate\s*\(/,
-    /Joi\.|yup\.|zod\./,
-    /@IsEmail|@IsString|@IsNumber|@ValidateNested/,
-    /express-validator/,
-  ],
-};
-
-const SECURITY_CONTROLS_PATTERNS = {
-  // Rate limiting
-  rateLimiting: [
-    /rateLimit|rate-limit|rateLimiter/i,
-    /express-rate-limit/,
-    /slowDown/,
-    /throttle/i,
-  ],
-  // CSRF protection
-  csrf: [
-    /csrf|csurf/i,
-    /csrfToken/,
-    /@Csrf/,
-  ],
-  // CORS
-  cors: [
-    /\bcors\b/i,
-    /Access-Control-Allow/,
-    /\.cors\s*\(/,
-  ],
-  // Input sanitization
-  sanitization: [
-    /sanitize|escape|xss/i,
-    /DOMPurify/,
-    /validator\.escape/,
-  ],
-  // SQL injection prevention
-  sqlInjection: [
-    /\$\d|:\w+|\?/, // Parameterized queries
-    /\.prepare\s*\(/,
-    /sequelize|prisma|typeorm|knex/i,
-  ],
-};
-
-// ============================================================================
-// Compliance Pattern Analyzer
-// ============================================================================
-
-export class CompliancePatternAnalyzer {
-  private readonly fileReader: FileReader;
-
-  constructor() {
-    this.fileReader = new FileReader();
-  }
-
-  /**
-   * Analyze encryption patterns in files
-   */
-  async analyzeEncryption(files: string[]): Promise<EncryptionAnalysis> {
-    const encryptionLibraries: string[] = [];
-    const unencryptedDataHandling: PatternMatch[] = [];
-    const weakCrypto: PatternMatch[] = [];
-    let hasEncryption = false;
-
-    for (const file of files) {
-      const result = await this.fileReader.readFile(file);
-      if (!result.success) continue;
-
-      const content = result.value;
-      const lines = content.split('\n');
-
-      // Check for encryption libraries
-      for (const pattern of ENCRYPTION_PATTERNS.libraries) {
-        if (pattern.test(content)) {
-          hasEncryption = true;
-          const match = content.match(pattern);
-          if (match) {
-            const lib = match[0].match(/['"]([^'"]+)['"]/)?.[1];
-            if (lib && !encryptionLibraries.includes(lib)) {
-              encryptionLibraries.push(lib);
-            }
-          }
-        }
-      }
-
-      // Check for encryption usage
-      for (const pattern of ENCRYPTION_PATTERNS.encryption) {
-        if (pattern.test(content)) {
-          hasEncryption = true;
-        }
-      }
-
-      // Check for weak crypto
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        for (const pattern of ENCRYPTION_PATTERNS.weakCrypto) {
-          if (pattern.test(line)) {
-            weakCrypto.push({
-              file,
-              line: i + 1,
-              snippet: line.trim().substring(0, 100),
-              pattern: 'weak-crypto',
-              severity: 'critical',
-            });
-          }
-        }
-
-        // Check for unencrypted data handling
-        for (const pattern of ENCRYPTION_PATTERNS.unencryptedData) {
-          if (pattern.test(line)) {
-            unencryptedDataHandling.push({
-              file,
-              line: i + 1,
-              snippet: line.trim().substring(0, 100),
-              pattern: 'unencrypted-data',
-              severity: 'warning',
-            });
-          }
-        }
-      }
-    }
-
-    return {
-      hasEncryption,
-      encryptionLibraries,
-      unencryptedDataHandling,
-      weakCrypto,
-    };
-  }
-
-  /**
-   * Analyze access control patterns
-   */
-  async analyzeAccessControl(files: string[]): Promise<AccessControlAnalysis> {
-    const unprotectedRoutes: PatternMatch[] = [];
-    const missingRoleChecks: PatternMatch[] = [];
-    const hardcodedCredentials: PatternMatch[] = [];
-    let hasAuthMiddleware = false;
-
-    for (const file of files) {
-      const result = await this.fileReader.readFile(file);
-      if (!result.success) continue;
-
-      const content = result.value;
-      const lines = content.split('\n');
-
-      // Check for auth middleware
-      for (const pattern of ACCESS_CONTROL_PATTERNS.authMiddleware) {
-        if (pattern.test(content)) {
-          hasAuthMiddleware = true;
-          break;
-        }
-      }
-
-      // Check for route protection
-      for (const pattern of ACCESS_CONTROL_PATTERNS.routeProtection) {
-        if (pattern.test(content)) {
-          hasAuthMiddleware = true;
-        }
-      }
-
-      // Analyze each line
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-
-        // Check for unprotected routes
-        for (const pattern of ACCESS_CONTROL_PATTERNS.unprotectedRoutes) {
-          if (pattern.test(line)) {
-            // Check if next lines have auth middleware
-            const contextLines = lines.slice(i, i + 3).join('\n');
-            const hasAuth = ACCESS_CONTROL_PATTERNS.authMiddleware.some((p) =>
-              p.test(contextLines)
-            );
-            if (!hasAuth) {
-              unprotectedRoutes.push({
-                file,
-                line: i + 1,
-                snippet: line.trim().substring(0, 100),
-                pattern: 'unprotected-route',
-                severity: 'warning',
-              });
-            }
-          }
-        }
-
-        // Check for hardcoded credentials
-        for (const pattern of ACCESS_CONTROL_PATTERNS.hardcodedCreds) {
-          if (pattern.test(line)) {
-            hardcodedCredentials.push({
-              file,
-              line: i + 1,
-              snippet: line.trim().substring(0, 50) + '...[REDACTED]',
-              pattern: 'hardcoded-credential',
-              severity: 'critical',
-            });
-          }
-        }
-      }
-    }
-
-    return {
-      hasAuthMiddleware,
-      unprotectedRoutes,
-      missingRoleChecks,
-      hardcodedCredentials,
-    };
-  }
-
-  /**
-   * Analyze logging patterns
-   */
-  async analyzeLogging(files: string[]): Promise<LoggingAnalysis> {
-    const sensitiveOperationsWithoutLogging: PatternMatch[] = [];
-    const sensitiveDataInLogs: PatternMatch[] = [];
-    let hasAuditLogging = false;
-
-    for (const file of files) {
-      const result = await this.fileReader.readFile(file);
-      if (!result.success) continue;
-
-      const content = result.value;
-      const lines = content.split('\n');
-
-      // Check for audit logging
-      for (const pattern of LOGGING_PATTERNS.auditLog) {
-        if (pattern.test(content)) {
-          hasAuditLogging = true;
-          break;
-        }
-      }
-
-      // Analyze each line
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-
-        // Check for sensitive operations without logging
-        for (const pattern of LOGGING_PATTERNS.sensitiveOperations) {
-          if (pattern.test(line)) {
-            // Check surrounding context for logging
-            const startLine = Math.max(0, i - 5);
-            const endLine = Math.min(lines.length, i + 5);
-            const context = lines.slice(startLine, endLine).join('\n');
-
-            const hasLogging = LOGGING_PATTERNS.generalLog.some((p) =>
-              p.test(context)
-            );
-            if (!hasLogging) {
-              sensitiveOperationsWithoutLogging.push({
-                file,
-                line: i + 1,
-                snippet: line.trim().substring(0, 100),
-                pattern: 'missing-audit-log',
-                severity: 'warning',
-              });
-            }
-          }
-        }
-
-        // Check for sensitive data in logs
-        for (const pattern of LOGGING_PATTERNS.sensitiveInLogs) {
-          if (pattern.test(line)) {
-            sensitiveDataInLogs.push({
-              file,
-              line: i + 1,
-              snippet: line.trim().substring(0, 100),
-              pattern: 'sensitive-data-logged',
-              severity: 'critical',
-            });
-          }
-        }
-      }
-    }
-
-    return {
-      hasAuditLogging,
-      sensitiveOperationsWithoutLogging,
-      sensitiveDataInLogs,
-    };
-  }
-
-  /**
-   * Analyze data protection patterns
-   */
-  async analyzeDataProtection(files: string[]): Promise<DataProtectionAnalysis> {
-    const piiFields: PatternMatch[] = [];
-    const unmaskedPii: PatternMatch[] = [];
-    const missingValidation: PatternMatch[] = [];
-
-    for (const file of files) {
-      const result = await this.fileReader.readFile(file);
-      if (!result.success) continue;
-
-      const content = result.value;
-      const lines = content.split('\n');
-
-      // Check for validation library usage
-      const hasValidation = DATA_PROTECTION_PATTERNS.validation.some((p) =>
-        p.test(content)
-      );
-
-      // Check for masking patterns
-      const hasMasking = DATA_PROTECTION_PATTERNS.masking.some((p) =>
-        p.test(content)
-      );
-
-      // Analyze each line
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-
-        // Find PII fields
-        for (const pattern of DATA_PROTECTION_PATTERNS.piiFields) {
-          if (pattern.test(line)) {
-            piiFields.push({
-              file,
-              line: i + 1,
-              snippet: line.trim().substring(0, 100),
-              pattern: 'pii-field',
-              severity: 'info',
-            });
-
-            // Check if this PII field has masking
-            const contextLines = lines.slice(Math.max(0, i - 2), i + 3).join('\n');
-            const fieldHasMasking = DATA_PROTECTION_PATTERNS.masking.some((p) =>
-              p.test(contextLines)
-            );
-            if (!fieldHasMasking && !hasMasking) {
-              unmaskedPii.push({
-                file,
-                line: i + 1,
-                snippet: line.trim().substring(0, 100),
-                pattern: 'unmasked-pii',
-                severity: 'warning',
-              });
-            }
-          }
-        }
-      }
-
-      // If file has PII but no validation
-      if (piiFields.length > 0 && !hasValidation) {
-        missingValidation.push({
-          file,
-          line: 1,
-          snippet: 'File contains PII fields without input validation',
-          pattern: 'missing-validation',
-          severity: 'warning',
-        });
-      }
-    }
-
-    return {
-      piiFields,
-      unmaskedPii,
-      missingValidation,
-    };
-  }
-
-  /**
-   * Analyze security controls
-   */
-  async analyzeSecurityControls(files: string[]): Promise<SecurityControlsAnalysis> {
-    const vulnerabilities: PatternMatch[] = [];
-    const missingControls: string[] = [];
-    let hasRateLimiting = false;
-    let hasCsrfProtection = false;
-    let hasCors = false;
-    let hasInputValidation = false;
-
-    for (const file of files) {
-      const result = await this.fileReader.readFile(file);
-      if (!result.success) continue;
-
-      const content = result.value;
-
-      // Check for rate limiting
-      if (SECURITY_CONTROLS_PATTERNS.rateLimiting.some((p) => p.test(content))) {
-        hasRateLimiting = true;
-      }
-
-      // Check for CSRF protection
-      if (SECURITY_CONTROLS_PATTERNS.csrf.some((p) => p.test(content))) {
-        hasCsrfProtection = true;
-      }
-
-      // Check for CORS
-      if (SECURITY_CONTROLS_PATTERNS.cors.some((p) => p.test(content))) {
-        hasCors = true;
-      }
-
-      // Check for input sanitization/validation
-      if (SECURITY_CONTROLS_PATTERNS.sanitization.some((p) => p.test(content))) {
-        hasInputValidation = true;
-      }
-    }
-
-    // Determine missing controls
-    if (!hasRateLimiting) missingControls.push('Rate Limiting');
-    if (!hasCsrfProtection) missingControls.push('CSRF Protection');
-    if (!hasCors) missingControls.push('CORS Configuration');
-    if (!hasInputValidation) missingControls.push('Input Validation/Sanitization');
-
-    return {
-      hasRateLimiting,
-      hasCsrfProtection,
-      hasCors,
-      hasInputValidation,
-      missingControls,
-      vulnerabilities,
-    };
-  }
-
-  /**
-   * Scan files for specific data types (PII, PHI, etc.)
-   */
-  async scanForDataTypes(
-    files: string[],
-    dataTypes: Array<'pii' | 'phi' | 'financial' | 'credentials' | 'biometric'>
-  ): Promise<Map<string, PatternMatch[]>> {
-    const results = new Map<string, PatternMatch[]>();
-
-    const dataTypePatterns: Record<string, RegExp[]> = {
-      pii: [
-        /email|phone|ssn|social_security|address|date_of_birth|dob/i,
-        /firstName|lastName|fullName/i,
-        /passport|driverLicense|nationalId/i,
-      ],
-      phi: [
-        /medical|diagnosis|prescription|patient|health/i,
-        /insurance|provider|treatment/i,
-        /blood_type|allergy|medication/i,
-      ],
-      financial: [
-        /creditCard|cardNumber|cvv|expiry|account_number/i,
-        /bank|routing|swift|iban/i,
-        /transaction|payment|billing/i,
-      ],
-      credentials: [
-        /password|secret|apikey|api_key|token|auth/i,
-        /private_key|certificate|credential/i,
-      ],
-      biometric: [
-        /fingerprint|faceId|retina|voice_print/i,
-        /biometric|facial_recognition/i,
-      ],
-    };
-
-    for (const dataType of dataTypes) {
-      results.set(dataType, []);
-    }
-
-    for (const file of files) {
-      const readResult = await this.fileReader.readFile(file);
-      if (!readResult.success) continue;
-
-      const lines = readResult.value.split('\n');
-
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-
-        for (const dataType of dataTypes) {
-          const patterns = dataTypePatterns[dataType] || [];
-          for (const pattern of patterns) {
-            if (pattern.test(line)) {
-              const matches = results.get(dataType) || [];
-              matches.push({
-                file,
-                line: i + 1,
-                snippet: line.trim().substring(0, 100),
-                pattern: dataType,
-                severity: 'info',
-              });
-              results.set(dataType, matches);
-              break; // Only count once per line per data type
-            }
-          }
-        }
-      }
-    }
-
-    return results;
-  }
-}
-
-// ============================================================================
-// Singleton Instance
-// ============================================================================
-
-let defaultAnalyzer: CompliancePatternAnalyzer | null = null;
-
-export function getCompliancePatternAnalyzer(): CompliancePatternAnalyzer {
-  if (!defaultAnalyzer) {
-    defaultAnalyzer = new CompliancePatternAnalyzer();
-  }
-  return defaultAnalyzer;
-}

package/src/shared/security/index.ts

@@ -1,30 +0,0 @@
-/**
- * Agentic QE v3 - Security Utilities
- */
-
-export { OSVClient } from './osv-client';
-export type {
-  OSVClientConfig,
-  OSVQueryRequest,
-  OSVEcosystem,
-  OSVVulnerability,
-  OSVSeverity,
-  OSVAffected,
-  OSVRange,
-  OSVReference,
-  OSVQueryResponse,
-  OSVBatchQueryRequest,
-  OSVBatchQueryResponse,
-  ParsedVulnerability,
-} from './osv-client';
-
-export { CompliancePatternAnalyzer, getCompliancePatternAnalyzer } from './compliance-patterns';
-export type {
-  PatternMatch,
-  CompliancePatternResult,
-  EncryptionAnalysis,
-  AccessControlAnalysis,
-  LoggingAnalysis,
-  DataProtectionAnalysis,
-  SecurityControlsAnalysis,
-} from './compliance-patterns';