@arcadialdev/arcality 2.4.27 → 2.4.29

package/src/services/collectiveMemoryService.ts

@@ -0,0 +1,178 @@
+/**
+ * collectiveMemoryService.ts
+ * Servicio de escritura hacia la Memoria Colectiva del backend de Arcality.
+ *
+ * REGLAS CRÍTICAS:
+ * - NUNCA interrumpe el flujo principal (todo en try/catch silencioso)
+ * - NUNCA envía datos sensibles (passwords, tokens, PII)
+ * - NUNCA duplica fields (valida contra /portal/context primero)
+ * - SIEMPRE usa snake_case según JsonNamingPolicy.SnakeCaseLower del servidor
+ * - NUNCA envía project_id vacío o con GUID cero
+ */
+
+const getBase = () => process.env.ARCALITY_API_URL ? `${process.env.ARCALITY_API_URL}/api/v1` : null;
+const getKey  = () => process.env.ARCALITY_API_KEY || '';
+const getPid  = () => process.env.ARCALITY_PROJECT_ID || '';
+
+const EMPTY_GUID = '00000000-0000-0000-0000-000000000000';
+
+function isConfigured(): boolean {
+    const base = getBase();
+    const key  = getKey();
+    const pid  = getPid();
+
+    if (!base || !key || !pid || pid === EMPTY_GUID) {
+        // Silencioso — no loguear en cada percepción para no hacer ruido
+        return false;
+    }
+    return true;
+}
+
+// ─── 1. REGLAS DE UI / NEGOCIO ──────────────────────────────────────────────
+
+export type RuleType = 'UI_UX' | 'VALIDATION' | 'NAVIGATION' | 'BUSINESS' | 'SECURITY';
+export type Severity = 'critical' | 'important' | 'suggestion';
+
+export async function pushRule(rule: {
+    rule_type: RuleType;
+    title: string;
+    description: string;
+    severity?: Severity;
+}): Promise<string | null> {
+    if (!isConfigured()) return null;
+    try {
+        const res = await fetch(`${getBase()}/portal/rules`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-api-key': getKey()
+            },
+            body: JSON.stringify({
+                project_id: getPid(),
+                rule_type: rule.rule_type,
+                title: rule.title.substring(0, 100),
+                description: rule.description.substring(0, 500),
+                severity: rule.severity ?? 'important',
+                source: 'agent'
+            })
+        });
+
+        if (!res.ok) {
+            console.warn(`[CollectiveMemory] pushRule HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+            return null;
+        }
+
+        const data = await res.json();
+        console.log(`\x1b[32m[CollectiveMemory] ✅ Regla guardada: "${rule.title}"\x1b[0m`);
+        return data.id ?? null;
+    } catch (err: any) {
+        console.warn(`[CollectiveMemory] pushRule error: ${err?.message}`);
+        return null;
+    }
+}
+
+// ─── 2. CATÁLOGO DE CAMPOS ──────────────────────────────────────────────────
+
+export type FieldType = 'email' | 'password' | 'text' | 'number' | 'select' | 'checkbox' | 'textarea' | 'date';
+
+export async function pushField(field: {
+    field_identifier: string;
+    field_type?: FieldType | string;
+    is_required?: boolean;
+    validation_rule?: string;
+    page_id?: string | null;
+    existingFieldIds?: string[]; // Lista de ids ya guardados para deduplicación
+}): Promise<string | null> {
+    if (!isConfigured()) return null;
+
+    // Deduplicación: no insertar si ya existe en el contexto recuperado
+    if (field.existingFieldIds?.includes(field.field_identifier)) {
+        return null; // Ya catalogado, no duplicar
+    }
+
+    try {
+        const res = await fetch(`${getBase()}/portal/fields`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-api-key': getKey()
+            },
+            body: JSON.stringify({
+                project_id: getPid(),
+                page_id: field.page_id ?? null,
+                field_identifier: field.field_identifier.substring(0, 100),
+                field_type: field.field_type ?? 'text',
+                is_required: field.is_required ?? false,
+                validation_rule: field.validation_rule?.substring(0, 300) ?? null,
+                source: 'agent'
+            })
+        });
+
+        if (!res.ok) {
+            return null;
+        }
+
+        const data = await res.json();
+        return data.id ?? null;
+    } catch (err: any) {
+        // Silencioso — fire-and-forget, 'terminated' es esperado al finalizar el proceso
+        return null;
+    }
+}
+
+// ─── 3. CONOCIMIENTO / DOCUMENTACIÓN ────────────────────────────────────────
+
+export type DocType = 'PROCESS' | 'VALIDATION' | 'NAVIGATION' | 'COMPONENT' | 'GENERAL';
+
+export async function pushKnowledge(knowledge: {
+    doc_type: DocType;
+    title: string;
+    content: string;
+}): Promise<string | null> {
+    if (!isConfigured()) return null;
+    try {
+        const res = await fetch(`${getBase()}/portal/knowledge`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-api-key': getKey()
+            },
+            body: JSON.stringify({
+                project_id: getPid(),
+                doc_type: knowledge.doc_type,
+                title: knowledge.title.substring(0, 150),
+                content: knowledge.content.substring(0, 500),
+                source: 'agent'
+            })
+        });
+
+        if (!res.ok) {
+            console.warn(`[CollectiveMemory] pushKnowledge HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+            return null;
+        }
+
+        const data = await res.json();
+        console.log(`\x1b[32m[CollectiveMemory] ✅ Conocimiento guardado: "${knowledge.title}"\x1b[0m`);
+        return data.id ?? null;
+    } catch (err: any) {
+        console.warn(`[CollectiveMemory] pushKnowledge error: ${err?.message}`);
+        return null;
+    }
+}
+
+// ─── HELPER: Obtener campos ya conocidos para deduplicación ─────────────────
+
+export async function getKnownFieldIdentifiers(pathUrl: string): Promise<string[]> {
+    if (!isConfigured()) return [];
+    try {
+        const res = await fetch(
+            `${getBase()}/portal/context?project_id=${getPid()}&path=${encodeURIComponent(pathUrl)}`,
+            { headers: { 'x-api-key': getKey() } }
+        );
+        if (!res.ok) return [];
+        const data = await res.json();
+        return (data?.fields ?? []).map((f: any) => f.field_identifier ?? '').filter(Boolean);
+    } catch {
+        return [];
+    }
+}

package/src/services/securityScanner.ts

@@ -0,0 +1,128 @@
+import { Page } from '@playwright/test';
+import {
+  SecurityFinding,
+  audit_http_headers,
+  scan_sensitive_data_exposure,
+  // test_auth_bypass can be added here if there are common protected routes to check.
+} from '../../tests/_helpers/qa-security-tools';
+
+/**
+ * The main service for running automated security scans at different points in the test lifecycle.
+ */
+export class SecurityScanner {
+  private page: Page;
+  private report: SecurityFinding[] = [];
+
+  constructor(page: Page) {
+    this.page = page;
+  }
+
+  /**
+   * Runs a series of automated scans against the current state of the page.
+   * This is intended to be called at the end of a test run to aggregate findings.
+   * @returns A promise that resolves to an array of found vulnerabilities.
+   */
+  async runAllScans(): Promise<SecurityFinding[]> {
+    console.log('[QA-SEC] Starting comprehensive security scan...');
+    
+    // Scan 1: Audit HTTP Security Headers
+    const headerVulnerabilities = await audit_http_headers(this.page);
+    this.report.push(...headerVulnerabilities);
+
+    // Scan 2: Scan for sensitive data in browser storage
+    const storageVulnerabilities = await scan_sensitive_data_exposure(this.page);
+    this.report.push(...storageVulnerabilities);
+
+    // Scan 3: Check for open redirect vulnerabilities (basic check)
+    await this.testOpenRedirect();
+
+    // More scans like auth bypass for known admin URLs could be added here.
+
+    console.log(`[QA-SEC] Comprehensive scan finished. Found ${this.report.length} potential vulnerabilities.`);
+    return this.getReport();
+  }
+
+  /**
+   * A basic test for open redirect vulnerabilities on the current URL.
+   */
+  async testOpenRedirect(): Promise<void> {
+    const url = new URL(this.page.url());
+    const redirectParams = ['redirect', 'next', 'url', 'returnTo', 'dest'];
+    
+    for (const param of redirectParams) {
+        if (url.searchParams.has(param)) {
+            const originalValue = url.searchParams.get(param);
+            const payload = 'https://www.evil-redirect.com';
+            url.searchParams.set(param, payload);
+
+            console.log(`[QA-SEC] Testing Open Redirect on param: ${param}`);
+            
+            try {
+                await this.page.goto(url.toString(), { waitUntil: 'networkidle' });
+                
+                if (this.page.url().startsWith(payload)) {
+                    const vulnerability: SecurityFinding = {
+                        type: 'confirmed_vulnerability',
+                        category: 'Open Redirect',
+                        severity: 'Medium',
+                        confidence: 'High',
+                        exploitability: 'confirmed',
+                        status: 'detected',
+                        description: `The application is vulnerable to Open Redirect. The '${param}' parameter was manipulated to redirect the user to an external, malicious site.`,
+                        impact: 'Attackers can use this to craft phishing links that appear to come from the trusted domain but redirect to malicious sites.',
+                        evidence: {
+                            vulnerableUrl: url.toString(),
+                            parameter: param,
+                            payload: payload,
+                        },
+                        reproductionSteps: [
+                            `Navigate to: ${url.toString()}`,
+                            "Observe that the page redirects to the payload domain."
+                        ],
+                        remediation: 'Validate all redirection URLs against a whitelist of allowed domains. Do not blindly redirect to user-supplied URLs.',
+                        classification: {
+                            cwe: 'CWE-601'
+                        }
+                    };
+                    this.report.push(vulnerability);
+                    // Go back to the original page to continue other tests
+                    await this.page.goBack();
+                }
+            } catch (error) {
+                console.log(`[QA-SEC] Error during open redirect test, this might be expected if the navigation was blocked. Continuing scan.`);
+                // It's possible the navigation to the evil site fails, which is good.
+                // We should ensure we can recover and continue.
+                await this.page.goBack(); // Try to recover state
+            }
+        }
+    }
+  }
+
+
+  /**
+   * Adds a vulnerability to the report. Can be used by other parts of the system
+   * to feed into this scanner's report.
+   * @param vuln - The vulnerability to add.
+   */
+  addVulnerability(vuln: SecurityFinding) {
+    this.report.push(vuln);
+  }
+
+  /**
+   * Returns the final list of vulnerabilities.
+   */
+  getReport(): SecurityFinding[] {
+    // Deduplicate vulnerabilities to avoid noise in the report
+    const uniqueReport: SecurityFinding[] = [];
+    const seen = new Set<string>();
+
+    for (const vuln of this.report) {
+      const key = `${vuln.category}|${vuln.description}|${vuln.evidence.selector || ''}`;
+      if (!seen.has(key)) {
+        uniqueReport.push(vuln);
+        seen.add(key);
+      }
+    }
+    return uniqueReport;
+  }
+}

package/src/testRunner.ts

@@ -0,0 +1,201 @@
+import 'dotenv/config';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { select, isCancel, outro, spinner, text } from '@clack/prompts';
+import chalk from 'chalk';
+import { ensureEnvInteractive, readExistingEnv } from './envSetup';
+import { KnowledgeService } from './KnowledgeService';
+import { ArcalityClient } from './arcalityClient';
+
+type Choice = { title: string; value: string };
+
+class UserCancelledError extends Error {
+    constructor(message = 'User cancelled the operation') {
+        super(message);
+        this.name = 'UserCancelledError';
+    }
+}
+
+function walk(dir: string): string[] {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const files: string[] = [];
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) files.push(...walk(full));
+        else files.push(full);
+    }
+    return files;
+}
+
+function isPlaywrightTestFile(file: string): boolean {
+    return (
+        file.endsWith('.spec.ts') ||
+        file.endsWith('.spec.js') ||
+        file.endsWith('.test.ts') ||
+        file.endsWith('.test.js')
+    );
+}
+
+function getChoices(testDir: string): { label: string; value: string }[] {
+    if (!fs.existsSync(testDir)) return [];
+
+    const files = walk(testDir).filter(isPlaywrightTestFile).sort();
+    const rels = files.map((abs) => path.relative(process.cwd(), abs).split(path.sep).join('/'));
+
+    return [
+        ...rels.map((r) => ({ label: r, value: r })),
+        { label: '❌ Exit', value: '__EXIT__' },
+    ];
+}
+
+function ensureInteractiveStdin(): void {
+    // If NO TTY, arrows will not work. Better to fail with a clear message.
+    if (!process.stdin.isTTY) {
+        throw new Error(
+            'The terminal is not interactive (stdin is not TTY). Run this command in a real terminal (not a pipe), and avoid ts-node-dev/watch.'
+        );
+    }
+}
+
+async function runPlaywright(selection: string): Promise<void> {
+    const isWin = process.platform === 'win32';
+    const pwBin = isWin
+        ? path.join(process.cwd(), 'node_modules', '.bin', 'playwright.cmd')
+        : path.join(process.cwd(), 'node_modules', '.bin', 'playwright');
+
+    const baseArgs = ['test', '--headed', '--project=chromium'];
+    const args =
+        selection === '__ALL__'
+            ? baseArgs
+            : [...baseArgs, selection];
+
+    const s = spinner();
+    s.start(`Running test: ${selection}`);
+
+    let triedNpx = false;
+    let lastError;
+    for (let attempt = 0; attempt < 2; attempt++) {
+        let bin = pwBin;
+        let binArgs = args;
+        let useShell = isWin;
+        if (triedNpx) {
+            bin = isWin ? 'npx.cmd' : 'npx';
+            binArgs = ['playwright', ...args];
+            useShell = isWin;
+        }
+
+        const spawnBin = (isWin && bin.includes(' ')) ? `"${bin}"` : bin;
+
+        try {
+            await new Promise<void>((resolve, reject) => {
+                const child = spawn(spawnBin, binArgs, {
+                    stdio: 'inherit',
+                    shell: useShell,
+                    windowsHide: true,
+                    env: process.env,
+                    cwd: process.cwd(),
+                });
+                process.removeAllListeners('SIGINT');
+                const onSigint = () => {
+                    child.kill('SIGINT');
+                    reject(new UserCancelledError());
+                };
+                process.once('SIGINT', onSigint);
+                child.on('close', (code: any) => {
+                    process.removeListener('SIGINT', onSigint);
+                    if (code === 0) resolve();
+                    else reject(new Error(`Arcality engine finished with code ${code}`));
+                });
+                child.on('error', (err: any) => {
+                    process.removeListener('SIGINT', onSigint);
+                    reject(err);
+                });
+            });
+
+            s.message('Performing report rebranding...');
+            try {
+                const isWin = process.platform === 'win32';
+                const nodeCmd = isWin ? 'node.exe' : 'node';
+                const { spawnSync } = require('node:child_process');
+                spawnSync(nodeCmd, [path.join(process.cwd(), 'scripts', 'rebrand-report.mjs')], { stdio: 'ignore', windowsHide: true });
+            } catch (e) { /* ignore */ }
+
+            s.stop(chalk.green('✅ Test completed.'));
+
+            const reportPath = path.join(process.cwd(), 'tests-report', 'index.html');
+            if (fs.existsSync(reportPath)) {
+                if (isWin) {
+                    spawn('cmd', ['/c', 'start', '""', `"${reportPath}"`], {
+                        stdio: 'ignore',
+                        shell: true,
+                        detached: true,
+                        windowsHide: true
+                    });
+                } else {
+                    const openCmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+                    spawn(openCmd, [reportPath], {
+                        stdio: 'ignore',
+                        shell: true,
+                        detached: true
+                    });
+                }
+            }
+            return;
+        } catch (err) {
+            lastError = err;
+            if (!triedNpx) {
+                triedNpx = true;
+                continue;
+            }
+            s.stop(chalk.red('❌ The test failed.'));
+            if (err instanceof Error) {
+                throw new Error(`Arcality Engine Error:\n${err.message}`);
+            } else {
+                throw err;
+            }
+        }
+    }
+    throw lastError;
+}
+
+export async function promptAndRunPlaywrightTests(arcalityClient: ArcalityClient, knowledgeService: KnowledgeService): Promise<void> {
+    while (true) {
+        try {
+            await ensureEnvInteractive();
+
+            const testDir = path.join(process.cwd(), 'tests');
+            const options = getChoices(testDir);
+
+            if (options.length === 0) {
+                console.log('No tests found in:', testDir);
+                return;
+            }
+
+            const selection = await select({
+                message: 'Select the test to run:',
+                options,
+            });
+
+            if (isCancel(selection) || selection === '__EXIT__') {
+                outro(chalk.cyan('See you later!'));
+                return;
+            }
+
+            await runPlaywright(selection as string);
+
+            await text({
+                message: 'Press Enter to return to menu...',
+                placeholder: 'Enter'
+            });
+
+        } catch (err) {
+            if (err instanceof UserCancelledError) {
+                outro(chalk.cyan('Operation cancelled.'));
+                return;
+            }
+            console.error('Error:', err instanceof Error ? err.message : err);
+            await new Promise(res => setTimeout(res, 1000));
+        }
+    }
+}