@arcadialdev/arcality 2.4.24 → 2.4.25

package/src/envSetup.ts

@@ -1,205 +1,205 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import prompts from 'prompts';
-
-export class UserCancelledError extends Error {
-  constructor(message = 'Usuario canceló la operación') {
-    super(message);
-    this.name = 'UserCancelledError';
-  }
-}
-
-type EnvValues = {
-  BASE_URL?: string;
-  LOGIN_USER?: string;
-  LOGIN_PASSWORD?: string;
-  ARCALITY_PROJECT_ID?: string;
-};
-
-interface ArcalityConfigFile {
-  apiKey?: string;
-  projectId?: string;
-  project?: {
-    name?: string;
-    baseUrl?: string;
-    frameworkDetected?: string;
-  };
-  auth?: {
-    username?: string;
-    password?: string;
-  };
-  runtime?: {
-    yamlOutputDir?: string;
-    reuseSuccessfulYamls?: boolean;
-    singleConfigurationMode?: boolean;
-  };
-}
-
-function envPath(): string {
-  return path.join(process.cwd(), '.env');
-}
-
-function arcalityConfigPath(): string {
-  return path.join(process.cwd(), 'arcality.config');
-}
-
-function escapeEnvValue(v: string): string {
-  const needsQuotes = /[\s"'`\\]/.test(v);
-  const cleaned = v.replace(/"/g, '\\"');
-  return needsQuotes ? `"${cleaned}"` : cleaned;
-}
-
-function parseDotEnv(content: string): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const line of content.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-
-    const idx = trimmed.indexOf('=');
-    if (idx === -1) continue;
-
-    const k = trimmed.slice(0, idx).trim();
-    let v = trimmed.slice(idx + 1).trim();
-
-    if (
-      (v.startsWith('"') && v.endsWith('"')) ||
-      (v.startsWith("'") && v.endsWith("'"))
-    ) {
-      v = v.slice(1, -1);
-    }
-    out[k] = v;
-  }
-  return out;
-}
-
-export function readExistingEnv(): Record<string, string> {
-  const p = envPath();
-  if (!fs.existsSync(p)) return {};
-  return parseDotEnv(fs.readFileSync(p, 'utf8'));
-}
-
-/**
- * Loads arcality.config if it exists.
- */
-function loadArcalityConfig(): ArcalityConfigFile | null {
-  const p = arcalityConfigPath();
-  try {
-    if (!fs.existsSync(p)) return null;
-    let raw = fs.readFileSync(p, 'utf8');
-    if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1);
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-
-function writeEnv(values: EnvValues): void {
-  const existing = readExistingEnv();
-  const merged = { ...existing, ...values };
-
-  const lines = [
-    '# Auto-generado por Arcality testRunner',
-    `BASE_URL=${escapeEnvValue(merged.BASE_URL ?? '')}`,
-    `LOGIN_USER=${escapeEnvValue(merged.LOGIN_USER ?? '')}`,
-    `LOGIN_PASSWORD=${escapeEnvValue(merged.LOGIN_PASSWORD ?? '')}`,
-  ];
-
-  if (merged.ARCALITY_PROJECT_ID) {
-    lines.push(`ARCALITY_PROJECT_ID=${escapeEnvValue(merged.ARCALITY_PROJECT_ID)}`);
-  }
-  lines.push('');
-
-  fs.writeFileSync(envPath(), lines.join('\n'), 'utf8');
-}
-
-function isValidBaseUrl(url: string): boolean {
-  try {
-    const u = new URL(url);
-    return u.protocol === 'http:' || u.protocol === 'https:';
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Ensures environment is configured for test execution.
- * In single-config mode, reads from arcality.config first.
- * Falls back to .env prompts for backward compatibility.
- */
-export async function ensureEnvInteractive(): Promise<void> {
-  // Try to load arcality.config first
-  const arcalityConfig = loadArcalityConfig();
-
-  if (arcalityConfig) {
-    // Inject config values into process.env for the current session
-    if (arcalityConfig.project?.baseUrl) {
-      process.env.BASE_URL = arcalityConfig.project.baseUrl;
-    }
-    if (arcalityConfig.auth?.username) {
-      process.env.LOGIN_USER = arcalityConfig.auth.username;
-    }
-    if (arcalityConfig.auth?.password) {
-      process.env.LOGIN_PASSWORD = arcalityConfig.auth.password;
-    }
-    if (arcalityConfig.projectId) {
-      process.env.ARCALITY_PROJECT_ID = arcalityConfig.projectId;
-    }
-    if (arcalityConfig.apiKey) {
-      process.env.ARCALITY_API_KEY = arcalityConfig.apiKey;
-    }
-
-    // All good — no prompts needed
-    return;
-  }
-
-  // Fallback: prompt for missing .env values (legacy mode)
-  const existing = readExistingEnv();
-  const questions: prompts.PromptObject[] = [];
-
-  if (!existing.BASE_URL) {
-    questions.push({
-      type: 'text',
-      name: 'BASE_URL',
-      message: 'Base URL (ej: http://localhost:3000):',
-      initial: 'http://localhost:3000',
-      validate: (v: string) =>
-        isValidBaseUrl(v) ? true : 'URL inválida (usa http/https)',
-    });
-  }
-
-  if (!existing.LOGIN_USER) {
-    questions.push({
-      type: 'text',
-      name: 'LOGIN_USER',
-      message: 'Usuario:',
-      validate: (v: string) =>
-        v?.trim().length ? true : 'Usuario requerido',
-    });
-  }
-
-  if (!existing.LOGIN_PASSWORD) {
-    questions.push({
-      type: 'password',
-      name: 'LOGIN_PASSWORD',
-      message: 'Contraseña:',
-      validate: (v: string) =>
-        v?.length ? true : 'Contraseña requerida',
-    });
-  }
-
-  if (questions.length > 0) {
-    const res = await prompts(questions, {
-      onCancel: () => {
-        throw new UserCancelledError();
-      },
-    });
-
-    const merged: EnvValues = {
-      BASE_URL: res.BASE_URL ?? existing.BASE_URL,
-      LOGIN_USER: res.LOGIN_USER ?? existing.LOGIN_USER,
-      LOGIN_PASSWORD: res.LOGIN_PASSWORD ?? existing.LOGIN_PASSWORD,
-    };
-    writeEnv(merged);
-    console.log('Archivo .env actualizado.');
-  }
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import prompts from 'prompts';
+
+export class UserCancelledError extends Error {
+  constructor(message = 'Usuario canceló la operación') {
+    super(message);
+    this.name = 'UserCancelledError';
+  }
+}
+
+type EnvValues = {
+  BASE_URL?: string;
+  LOGIN_USER?: string;
+  LOGIN_PASSWORD?: string;
+  ARCALITY_PROJECT_ID?: string;
+};
+
+interface ArcalityConfigFile {
+  apiKey?: string;
+  projectId?: string;
+  project?: {
+    name?: string;
+    baseUrl?: string;
+    frameworkDetected?: string;
+  };
+  auth?: {
+    username?: string;
+    password?: string;
+  };
+  runtime?: {
+    yamlOutputDir?: string;
+    reuseSuccessfulYamls?: boolean;
+    singleConfigurationMode?: boolean;
+  };
+}
+
+function envPath(): string {
+  return path.join(process.cwd(), '.env');
+}
+
+function arcalityConfigPath(): string {
+  return path.join(process.cwd(), 'arcality.config');
+}
+
+function escapeEnvValue(v: string): string {
+  const needsQuotes = /[\s"'`\\]/.test(v);
+  const cleaned = v.replace(/"/g, '\\"');
+  return needsQuotes ? `"${cleaned}"` : cleaned;
+}
+
+function parseDotEnv(content: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+
+    const idx = trimmed.indexOf('=');
+    if (idx === -1) continue;
+
+    const k = trimmed.slice(0, idx).trim();
+    let v = trimmed.slice(idx + 1).trim();
+
+    if (
+      (v.startsWith('"') && v.endsWith('"')) ||
+      (v.startsWith("'") && v.endsWith("'"))
+    ) {
+      v = v.slice(1, -1);
+    }
+    out[k] = v;
+  }
+  return out;
+}
+
+export function readExistingEnv(): Record<string, string> {
+  const p = envPath();
+  if (!fs.existsSync(p)) return {};
+  return parseDotEnv(fs.readFileSync(p, 'utf8'));
+}
+
+/**
+ * Loads arcality.config if it exists.
+ */
+function loadArcalityConfig(): ArcalityConfigFile | null {
+  const p = arcalityConfigPath();
+  try {
+    if (!fs.existsSync(p)) return null;
+    let raw = fs.readFileSync(p, 'utf8');
+    if (raw.charCodeAt(0) === 0xFEFF) raw = raw.slice(1);
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function writeEnv(values: EnvValues): void {
+  const existing = readExistingEnv();
+  const merged = { ...existing, ...values };
+
+  const lines = [
+    '# Auto-generado por Arcality testRunner',
+    `BASE_URL=${escapeEnvValue(merged.BASE_URL ?? '')}`,
+    `LOGIN_USER=${escapeEnvValue(merged.LOGIN_USER ?? '')}`,
+    `LOGIN_PASSWORD=${escapeEnvValue(merged.LOGIN_PASSWORD ?? '')}`,
+  ];
+
+  if (merged.ARCALITY_PROJECT_ID) {
+    lines.push(`ARCALITY_PROJECT_ID=${escapeEnvValue(merged.ARCALITY_PROJECT_ID)}`);
+  }
+  lines.push('');
+
+  fs.writeFileSync(envPath(), lines.join('\n'), 'utf8');
+}
+
+function isValidBaseUrl(url: string): boolean {
+  try {
+    const u = new URL(url);
+    return u.protocol === 'http:' || u.protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Ensures environment is configured for test execution.
+ * In single-config mode, reads from arcality.config first.
+ * Falls back to .env prompts for backward compatibility.
+ */
+export async function ensureEnvInteractive(): Promise<void> {
+  // Try to load arcality.config first
+  const arcalityConfig = loadArcalityConfig();
+
+  if (arcalityConfig) {
+    // Inject config values into process.env for the current session
+    if (arcalityConfig.project?.baseUrl) {
+      process.env.BASE_URL = arcalityConfig.project.baseUrl;
+    }
+    if (arcalityConfig.auth?.username) {
+      process.env.LOGIN_USER = arcalityConfig.auth.username;
+    }
+    if (arcalityConfig.auth?.password) {
+      process.env.LOGIN_PASSWORD = arcalityConfig.auth.password;
+    }
+    if (arcalityConfig.projectId) {
+      process.env.ARCALITY_PROJECT_ID = arcalityConfig.projectId;
+    }
+    if (arcalityConfig.apiKey) {
+      process.env.ARCALITY_API_KEY = arcalityConfig.apiKey;
+    }
+
+    // All good — no prompts needed
+    return;
+  }
+
+  // Fallback: prompt for missing .env values (legacy mode)
+  const existing = readExistingEnv();
+  const questions: prompts.PromptObject[] = [];
+
+  if (!existing.BASE_URL) {
+    questions.push({
+      type: 'text',
+      name: 'BASE_URL',
+      message: 'Base URL (ej: http://localhost:3000):',
+      initial: 'http://localhost:3000',
+      validate: (v: string) =>
+        isValidBaseUrl(v) ? true : 'URL inválida (usa http/https)',
+    });
+  }
+
+  if (!existing.LOGIN_USER) {
+    questions.push({
+      type: 'text',
+      name: 'LOGIN_USER',
+      message: 'Usuario:',
+      validate: (v: string) =>
+        v?.trim().length ? true : 'Usuario requerido',
+    });
+  }
+
+  if (!existing.LOGIN_PASSWORD) {
+    questions.push({
+      type: 'password',
+      name: 'LOGIN_PASSWORD',
+      message: 'Contraseña:',
+      validate: (v: string) =>
+        v?.length ? true : 'Contraseña requerida',
+    });
+  }
+
+  if (questions.length > 0) {
+    const res = await prompts(questions, {
+      onCancel: () => {
+        throw new UserCancelledError();
+      },
+    });
+
+    const merged: EnvValues = {
+      BASE_URL: res.BASE_URL ?? existing.BASE_URL,
+      LOGIN_USER: res.LOGIN_USER ?? existing.LOGIN_USER,
+      LOGIN_PASSWORD: res.LOGIN_PASSWORD ?? existing.LOGIN_PASSWORD,
+    };
+    writeEnv(merged);
+    console.log('Archivo .env actualizado.');
+  }
+}

package/src/index.ts

@@ -1,25 +1,25 @@
-import 'dotenv/config';
-import { showBanner } from './consoleBanner';
-import { promptAndRunPlaywrightTests } from './testRunner';
-import { KnowledgeService } from './KnowledgeService';
-import { ArcalityClient } from './arcalityClient';
-import { loadConfig } from './configLoader';
-
-async function main() {
-  showBanner();
-
-  const config = loadConfig();
-  const arcalityClient = new ArcalityClient(config.ARCALITY_API_KEY);
-  const knowledgeService = KnowledgeService.getInstance();
-
-  await promptAndRunPlaywrightTests(arcalityClient, knowledgeService);
-}
-
-main().catch((err) => {
-  // Normal user cancellation is not an error
-  if (err instanceof Error && err.name === 'UserCancelledError') {
-    process.exit(130);
-  }
-  console.error(err);
-  process.exit(1);
-});
+import 'dotenv/config';
+import { showBanner } from './consoleBanner';
+import { promptAndRunPlaywrightTests } from './testRunner';
+import { KnowledgeService } from './KnowledgeService';
+import { ArcalityClient } from './arcalityClient';
+import { loadConfig } from './configLoader';
+
+async function main() {
+  showBanner();
+
+  const config = loadConfig();
+  const arcalityClient = new ArcalityClient(config.ARCALITY_API_KEY);
+  const knowledgeService = KnowledgeService.getInstance();
+
+  await promptAndRunPlaywrightTests(arcalityClient, knowledgeService);
+}
+
+main().catch((err) => {
+  // Normal user cancellation is not an error
+  if (err instanceof Error && err.name === 'UserCancelledError') {
+    process.exit(130);
+  }
+  console.error(err);
+  process.exit(1);
+});

package/src/services/collectiveMemoryService.ts

@@ -30,7 +30,7 @@ function isConfigured(): boolean {
 
 // ─── 1. REGLAS DE UI / NEGOCIO ──────────────────────────────────────────────
 
-export type RuleType = 'UI_UX' | 'VALIDATION' | 'NAVIGATION' | 'BUSINESS';
+export type RuleType = 'UI_UX' | 'VALIDATION' | 'NAVIGATION' | 'BUSINESS' | 'SECURITY';
 export type Severity = 'critical' | 'important' | 'suggestion';
 
 export async function pushRule(rule: {

package/src/services/securityScanner.ts

@@ -0,0 +1,128 @@
+import { Page } from '@playwright/test';
+import {
+  SecurityFinding,
+  audit_http_headers,
+  scan_sensitive_data_exposure,
+  // test_auth_bypass can be added here if there are common protected routes to check.
+} from '../../tests/_helpers/qa-security-tools';
+
+/**
+ * The main service for running automated security scans at different points in the test lifecycle.
+ */
+export class SecurityScanner {
+  private page: Page;
+  private report: SecurityFinding[] = [];
+
+  constructor(page: Page) {
+    this.page = page;
+  }
+
+  /**
+   * Runs a series of automated scans against the current state of the page.
+   * This is intended to be called at the end of a test run to aggregate findings.
+   * @returns A promise that resolves to an array of found vulnerabilities.
+   */
+  async runAllScans(): Promise<SecurityFinding[]> {
+    console.log('[QA-SEC] Starting comprehensive security scan...');
+    
+    // Scan 1: Audit HTTP Security Headers
+    const headerVulnerabilities = await audit_http_headers(this.page);
+    this.report.push(...headerVulnerabilities);
+
+    // Scan 2: Scan for sensitive data in browser storage
+    const storageVulnerabilities = await scan_sensitive_data_exposure(this.page);
+    this.report.push(...storageVulnerabilities);
+
+    // Scan 3: Check for open redirect vulnerabilities (basic check)
+    await this.testOpenRedirect();
+
+    // More scans like auth bypass for known admin URLs could be added here.
+
+    console.log(`[QA-SEC] Comprehensive scan finished. Found ${this.report.length} potential vulnerabilities.`);
+    return this.getReport();
+  }
+
+  /**
+   * A basic test for open redirect vulnerabilities on the current URL.
+   */
+  async testOpenRedirect(): Promise<void> {
+    const url = new URL(this.page.url());
+    const redirectParams = ['redirect', 'next', 'url', 'returnTo', 'dest'];
+    
+    for (const param of redirectParams) {
+        if (url.searchParams.has(param)) {
+            const originalValue = url.searchParams.get(param);
+            const payload = 'https://www.evil-redirect.com';
+            url.searchParams.set(param, payload);
+
+            console.log(`[QA-SEC] Testing Open Redirect on param: ${param}`);
+            
+            try {
+                await this.page.goto(url.toString(), { waitUntil: 'networkidle' });
+                
+                if (this.page.url().startsWith(payload)) {
+                    const vulnerability: SecurityFinding = {
+                        type: 'confirmed_vulnerability',
+                        category: 'Open Redirect',
+                        severity: 'Medium',
+                        confidence: 'High',
+                        exploitability: 'confirmed',
+                        status: 'detected',
+                        description: `The application is vulnerable to Open Redirect. The '${param}' parameter was manipulated to redirect the user to an external, malicious site.`,
+                        impact: 'Attackers can use this to craft phishing links that appear to come from the trusted domain but redirect to malicious sites.',
+                        evidence: {
+                            vulnerableUrl: url.toString(),
+                            parameter: param,
+                            payload: payload,
+                        },
+                        reproductionSteps: [
+                            `Navigate to: ${url.toString()}`,
+                            "Observe that the page redirects to the payload domain."
+                        ],
+                        remediation: 'Validate all redirection URLs against a whitelist of allowed domains. Do not blindly redirect to user-supplied URLs.',
+                        classification: {
+                            cwe: 'CWE-601'
+                        }
+                    };
+                    this.report.push(vulnerability);
+                    // Go back to the original page to continue other tests
+                    await this.page.goBack();
+                }
+            } catch (error) {
+                console.log(`[QA-SEC] Error during open redirect test, this might be expected if the navigation was blocked. Continuing scan.`);
+                // It's possible the navigation to the evil site fails, which is good.
+                // We should ensure we can recover and continue.
+                await this.page.goBack(); // Try to recover state
+            }
+        }
+    }
+  }
+
+
+  /**
+   * Adds a vulnerability to the report. Can be used by other parts of the system
+   * to feed into this scanner's report.
+   * @param vuln - The vulnerability to add.
+   */
+  addVulnerability(vuln: SecurityFinding) {
+    this.report.push(vuln);
+  }
+
+  /**
+   * Returns the final list of vulnerabilities.
+   */
+  getReport(): SecurityFinding[] {
+    // Deduplicate vulnerabilities to avoid noise in the report
+    const uniqueReport: SecurityFinding[] = [];
+    const seen = new Set<string>();
+
+    for (const vuln of this.report) {
+      const key = `${vuln.category}|${vuln.description}|${vuln.evidence.selector || ''}`;
+      if (!seen.has(key)) {
+        uniqueReport.push(vuln);
+        seen.add(key);
+      }
+    }
+    return uniqueReport;
+  }
+}