@arcadialdev/arcality 2.4.29 → 2.4.31

package/tests/_helpers/discover-view.spec.ts

@@ -1,238 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import 'dotenv/config';
-import { test, expect } from '@playwright/test';
-
-test('discover visible components on view', async ({ page }) => {
-  const target = process.env.TARGET_PATH || '/';
-  const base = process.env.BASE_URL || '';
-
-  // Perform canonical login if credentials available
-  const user = process.env.LOGIN_USER || '';
-  const pass = process.env.LOGIN_PASSWORD || '';
-  if (user && pass) {
-    const loginUrl = base + '/login';
-    console.log('Logging in via', loginUrl);
-    await page.goto(loginUrl);
-
-    // Generic selector strategies
-    const userSelectors = [
-      'input[type="email"]', 'input[name="email"]', 'input[name="username"]',
-      'input[name="user"]', 'input[name="login"]', 'input[id="email"]',
-      'input[id="username"]', 'input[placeholder*="user" i]',
-      'input[placeholder*="usuario" i]', 'input[placeholder*="mail" i]'
-    ];
-    const passSelectors = [
-      'input[type="password"]', 'input[name="password"]',
-      'input[name="pass"]', 'input[id="password"]',
-      'input[placeholder*="pass" i]', 'input[placeholder*="contra" i]'
-    ];
-    const submitSelectors = [
-      'button[type="submit"]', 'input[type="submit"]',
-      'button:has-text("Login")', 'button:has-text("Sign in")',
-      'button:has-text("Entrar")', 'button:has-text("Ingresar")',
-      'button:has-text("Iniciar")', 'button:has-text("Acceder")',
-      '[role="button"]:has-text("Login")', '[role="button"]:has-text("Entrar")'
-    ];
-
-    let email = null;
-    for (const s of userSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        email = loc;
-        console.log('Found user field:', s);
-        break;
-      }
-    }
-
-    let password = null;
-    for (const s of passSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        password = loc;
-        console.log('Found password field:', s);
-        break;
-      }
-    }
-
-    let submit = null;
-    for (const s of submitSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        submit = loc;
-        console.log('Found submit button:', s);
-        break;
-      }
-    }
-
-    if (email && password && submit) {
-      await email.fill(user);
-      await password.fill(pass);
-      await submit.click();
-      await expect(page).not.toHaveURL(/\/login(\b|$)/i, { timeout: 15000 }).catch(e => console.warn('Login URL check timeout/fail, continuing...'));
-      try {
-        await page.locator('nav, aside, [role="navigation"], [data-testid="sidebar"]').first().waitFor({ state: 'visible', timeout: 5000 });
-      } catch { }
-    } else {
-      console.warn('Could not detect all login fields (user, password, submit) - skipping auto-login step.');
-    }
-  }
-
-  const url = base + target;
-  console.log('Navigating to', url);
-  await page.goto(url);
-  await page.waitForLoadState('networkidle');
-
-  // Optionally wait for main container if present
-  try {
-    await page.locator('main, [role="main"]').first().waitFor({ state: 'visible', timeout: 3000 });
-  } catch { }
-
-  // Gather visible interactive elements and some metadata
-  const components = await page.evaluate(() => {
-    function isVisible(el: any) {
-      if (!el) return false;
-      const style = window.getComputedStyle(el);
-      if (style && (style.visibility === 'hidden' || style.display === 'none' || +style.opacity === 0)) return false;
-      const rect = el.getBoundingClientRect();
-      return rect.width > 0 && rect.height > 0;
-    }
-
-    function cssPath(el: any) {
-      if (!(el instanceof Element)) return '';
-      const path = [];
-      while (el && el.nodeType === Node.ELEMENT_NODE && el.tagName.toLowerCase() !== 'html') {
-        let selector = el.tagName.toLowerCase();
-        if (el.id) selector += `#${el.id}`;
-        else {
-          const cls = Array.from(el.classList || []).slice(0, 3).map((c: any) => c.replace(/[^a-z0-9_-]/gi, '')).join('.');
-          if (cls) selector += `.${cls}`;
-        }
-        const siblingIndex = Array.from(el.parentNode ? el.parentNode.children : []).filter((x: any) => x.tagName === el.tagName).indexOf(el) + 1;
-        if (siblingIndex > 1) selector += `:nth-of-type(${siblingIndex})`;
-        path.unshift(selector);
-        el = el.parentElement;
-      }
-      return path.join(' > ');
-    }
-
-    function nearestHeading(el: any) {
-      let cur = el;
-      while (cur) {
-        const headings = Array.from(cur.querySelectorAll('h1,h2,h3,h4,h5,h6')) as any[];
-        const h = headings.find((x) => x && x.textContent && x.textContent.trim());
-        if (h) return (h.textContent as string).trim().slice(0, 200);
-        cur = cur.parentElement;
-      }
-      return '';
-    }
-
-    function nearestLabelForInput(el: any) {
-      if (!el) return '';
-      if (el.id) {
-        const lbl = document.querySelector(`label[for="${el.id}"]`) as any;
-        if (lbl && lbl.textContent) return (lbl.textContent as string).trim().slice(0, 200);
-      }
-      // find closest preceding label sibling
-      let cur = el.previousElementSibling as any;
-      while (cur) {
-        if (cur.tagName?.toLowerCase() === 'label' && cur.textContent) return (cur.textContent as string).trim().slice(0, 200);
-        cur = cur.previousElementSibling;
-      }
-      // try parent label
-      const parentLabel = el.closest('label') as any;
-      if (parentLabel && parentLabel.textContent) return (parentLabel.textContent as string).trim().slice(0, 200);
-      return '';
-    }
-
-    function attributesMap(el: any) {
-      const out: Record<string, string> = {};
-      if (!(el instanceof Element)) return out;
-      for (const a of Array.from(el.attributes || [])) {
-        out[a.name] = a.value;
-      }
-      return out;
-    }
-
-    const nodes = Array.from(document.querySelectorAll('a, button, input, textarea, select, [role], label, h1,h2,h3,h4,h5,h6'))
-      .filter(isVisible);
-
-    const list = nodes.map((el: any) => {
-      const tag = el.tagName.toLowerCase();
-      const attrs = attributesMap(el);
-      const text = (el.textContent || '').trim().replace(/\s+/g, ' ').slice(0, 400);
-      const aria = attrs['aria-label'] || attrs['aria-labelledby'] || '';
-      const placeholder = attrs['placeholder'] || '';
-      const id = el.id || '';
-      const name = attrs['name'] || '';
-      const rect = el.getBoundingClientRect();
-      const parentText = (el.parentElement && el.parentElement.textContent)
-        ? (el.parentElement.textContent as string).trim().replace(/\s+/g, ' ').slice(0, 200)
-        : '';
-
-      return {
-        tag,
-        id,
-        name,
-        type: attrs['type'] || '',
-        text,
-        aria,
-        placeholder,
-        attributes: attrs,
-        data: Object.keys(attrs).filter(k => k.startsWith('data-')).reduce((acc, k) => { acc[k] = attrs[k]; return acc; }, {} as Record<string, string>),
-        boundingRect: { x: rect.x, y: rect.y, width: rect.width, height: rect.height },
-        nearestHeading: nearestHeading(el),
-        parentText,
-        label: (tag === 'input' || tag === 'textarea' || tag === 'select') ? nearestLabelForInput(el) : '',
-        selector: cssPath(el),
-      };
-    });
-
-    return { timestamp: Date.now(), url: location.href, components: list };
-  });
-
-  const outDir = process.env.DOMAIN_DIR || path.join(process.cwd(), 'out');
-  if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
-  const filePath = path.join(outDir, `components-${Date.now()}.json`);
-  fs.writeFileSync(filePath, JSON.stringify({ url, timestamp: new Date().toISOString(), components }, null, 2), 'utf8');
-
-  console.log('Wrote components list to', filePath, 'found', components.components.length, 'items');
-
-  // Optional: autofill fields based on discovered components
-  if (process.env.AUTOFILL === 'true') {
-    console.log('AUTOFILL enabled — filling detected fields (skipping login fields)');
-    for (const c of (components as any).components) {
-      try {
-        // Skip login fields
-        if (c.selector && /input\[type="email"\]|input\[type="password"\]/i.test(c.selector)) continue;
-
-        const locator = page.locator(c.selector);
-        if ((await locator.count()) === 0) continue;
-
-        if (c.tag === 'input') {
-          const t = (c.type || '').toLowerCase();
-          if (t === 'email') await locator.fill(`test+${Date.now()}@example.com`).catch(() => { });
-          else if (t === 'password') await locator.fill(`P@ssw0rd!${Math.floor(Math.random() * 90000)}`).catch(() => { });
-          else if (t === 'tel') await locator.fill('5551234567').catch(() => { });
-          else if (t === 'number') await locator.fill('1').catch(() => { });
-          else await locator.fill('sample text').catch(() => { });
-        } else if (c.tag === 'textarea') {
-          await locator.fill('sample text').catch(() => { });
-        } else if (c.tag === 'select') {
-          // try to select a non-empty option
-          await locator.selectOption({ index: 1 }).catch(() => { });
-        }
-      } catch (e) {
-        // ignore individual fill errors
-      }
-    }
-
-    if (process.env.AUTOSUBMIT === 'true') {
-      console.log('AUTOSUBMIT enabled — attempting to submit form');
-      try {
-        const submit = page.locator('button[type="submit"], input[type="submit"]').first();
-        if (await submit.count()) await submit.click().catch(() => { });
-      } catch { }
-    }
-  }
-});

package/tests/_helpers/extract-view.spec.ts

@@ -1,118 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import 'dotenv/config';
-import { test, expect } from '@playwright/test';
-
-test('extract view DOM and accessibility snapshot', async ({ page }) => {
-  const target = process.env.TARGET_PATH || '/';
-  const base = process.env.BASE_URL || '';
-
-  // Perform canonical login if credentials available
-  const user = process.env.LOGIN_USER || '';
-  const pass = process.env.LOGIN_PASSWORD || '';
-  if (user && pass) {
-    const loginUrl = base + '/login';
-    console.log('Logging in via', loginUrl);
-    await page.goto(loginUrl);
-
-    // Generic selector strategies
-    const userSelectors = [
-      'input[type="email"]', 'input[name="email"]', 'input[name="username"]',
-      'input[name="user"]', 'input[name="login"]', 'input[id="email"]',
-      'input[id="username"]', 'input[placeholder*="user" i]',
-      'input[placeholder*="usuario" i]', 'input[placeholder*="mail" i]'
-    ];
-    const passSelectors = [
-      'input[type="password"]', 'input[name="password"]',
-      'input[name="pass"]', 'input[id="password"]',
-      'input[placeholder*="pass" i]', 'input[placeholder*="contra" i]'
-    ];
-    const submitSelectors = [
-      'button[type="submit"]', 'input[type="submit"]',
-      'button:has-text("Login")', 'button:has-text("Sign in")',
-      'button:has-text("Entrar")', 'button:has-text("Ingresar")',
-      'button:has-text("Iniciar")', 'button:has-text("Acceder")',
-      '[role="button"]:has-text("Login")', '[role="button"]:has-text("Entrar")'
-    ];
-
-    let email = null;
-    for (const s of userSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        email = loc;
-        console.log('Found user field:', s);
-        break;
-      }
-    }
-
-    let password = null;
-    for (const s of passSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        password = loc;
-        console.log('Found password field:', s);
-        break;
-      }
-    }
-
-    let submit = null;
-    for (const s of submitSelectors) {
-      const loc = page.locator(s).first();
-      if (await loc.isVisible().catch(() => false)) {
-        submit = loc;
-        console.log('Found submit button:', s);
-        break;
-      }
-    }
-
-    if (email && password && submit) {
-      await email.fill(user);
-      await password.fill(pass);
-      await submit.click();
-      await expect(page).not.toHaveURL(/\/login(\b|$)/i, { timeout: 15000 }).catch(e => console.warn('Login URL check timeout/fail, continuing...'));
-      try {
-        await page.locator('nav, aside, [role="navigation"], [data-testid="sidebar"]').first().waitFor({ state: 'visible', timeout: 5000 });
-      } catch { }
-    } else {
-      console.warn('Could not detect all login fields (user, password, submit) - skipping auto-login step.');
-    }
-  }
-
-  const url = base + target;
-  console.log('Navigating to', url);
-  await page.goto(url);
-  await page.waitForLoadState('networkidle');
-
-  // Capture full HTML
-  const html = await page.content();
-
-  // Capture accessibility tree (helps detect components/roles/labels)
-  // Note: page.accessibility was deprecated/removed in Playwright 1.38+
-  let accessibility = null;
-  try {
-    accessibility = await (page as any).accessibility?.snapshot({ interestingOnly: false });
-  } catch (e: any) {
-    console.warn('Accessibility snapshot failed:', e?.message ?? e);
-  }
-
-  const outDir = process.env.DOMAIN_DIR || path.join(process.cwd(), 'out');
-  if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
-
-  const filePath = path.join(outDir, `view-snapshot-${Date.now()}.json`);
-  fs.writeFileSync(
-    filePath,
-    JSON.stringify(
-      {
-        url,
-        timestamp: new Date().toISOString(),
-        html,
-        accessibility,
-      },
-      null,
-      2
-    ),
-    'utf8'
-  );
-
-  console.log('Wrote view snapshot to', filePath);
-});

package/tests/_helpers/qa-security-tools.ts

@@ -1,265 +0,0 @@
-/* eslint-disable no-console */
-import { Page, expect } from '@playwright/test';
-
-export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
-
-export type SecurityFindingType = 'confirmed_vulnerability' | 'security_misconfiguration' | 'potential_issue' | 'informational';
-export type Confidence = 'High' | 'Medium' | 'Low';
-export type Exploitability = 'confirmed' | 'likely' | 'unknown' | 'not_confirmed';
-
-export interface SecurityFinding {
-  type: SecurityFindingType;
-  category: string;
-  subcategory?: string;
-  severity: Severity;
-  confidence: Confidence;
-  exploitability: Exploitability;
-  status: 'detected';
-  description: string;
-  impact?: string;
-  evidence: {
-    [key: string]: any;
-  };
-  reproductionSteps?: string[];
-  remediation: string;
-  classification?: {
-    owaspTop10?: string;
-    cwe?: string;
-  };
-}
-
-/**
- * Attempts to inject a simple XSS payload into a specified element and checks for an alert.
- * @param page - The Playwright Page object.
- * @param selector - The selector for the input field to test.
- * @returns A vulnerability object if successful, null otherwise.
- */
-export async function test_xss_injection(
-  page: Page,
-  selector: string,
-): Promise<SecurityFinding | null> {
-  const payload = `<script>alert('XSS-ARCALITY-TEST')</script>`;
-  console.log(`[QA-SEC] Testing XSS on selector: ${selector}`);
-
-  let alertTriggered = false;
-  page.once('dialog', async (dialog) => {
-    if (dialog.message().includes('XSS-ARCALITY-TEST')) {
-      alertTriggered = true;
-    }
-    await dialog.dismiss();
-  });
-
-  await page.fill(selector, payload);
-  // Submit the form or trigger the action that would process the input
-  // This part is crucial and might need to be adapted based on the application's behavior
-  await page.press(selector, 'Enter'); 
-
-  // Wait a moment for any potential script execution
-  await page.waitForTimeout(1000);
-
-  if (alertTriggered) {
-    console.log(`[QA-SEC] XSS Vulnerability DETECTED at ${selector}`);
-    return {
-      type: 'confirmed_vulnerability',
-      category: 'Injection',
-      subcategory: 'Reflected XSS',
-      severity: 'High',
-      confidence: 'High',
-      exploitability: 'confirmed',
-      status: 'detected',
-      description: `A reflected Cross-Site Scripting (XSS) vulnerability was detected in the element '${selector}'. The application executed a script injected into this input field.`,
-      impact: 'Allows execution of arbitrary JavaScript in the context of the user session, potentially leading to session hijacking, credential theft, or unauthorized actions.',
-      evidence: {
-        payload,
-        url: page.url(),
-        selector,
-      },
-      reproductionSteps: [
-        `Navigate to the page containing '${selector}'.`,
-        `Inject the payload: ${payload}`,
-        'Trigger the form submission or blur event.',
-        'Observe the script execution (alert dialog).'
-      ],
-      remediation: 'Sanitize all user-supplied input on the server-side before rendering it back to the page. Use libraries like DOMPurify on the client-side as an additional layer of defense.',
-      classification: {
-        owaspTop10: 'A03:2021 Injection',
-        cwe: 'CWE-79'
-      }
-    };
-  }
-
-  console.log(`[QA-SEC] No XSS detected for selector: ${selector}`);
-  return null;
-}
-
-/**
- * Checks if a given URL, assumed to be protected, can be accessed without authentication.
- * @param page - The Playwright Page object.
- * @param url - The protected URL to test.
- * @param redirectUrl - The URL the app should redirect to if unauthorized.
- * @returns A vulnerability object if bypass is successful, null otherwise.
- */
-export async function test_auth_bypass(
-  page: Page,
-  url: string,
-  redirectUrl: string | RegExp,
-): Promise<SecurityFinding | null> {
-  console.log(`[QA-SEC] Testing Auth Bypass on URL: ${url}`);
-  const response = await page.goto(url, { waitUntil: 'domcontentloaded' });
-
-  // If the page loads the protected content (doesn't redirect or redirects to a different page)
-  if (response?.ok() && !page.url().match(redirectUrl)) {
-    console.log(`[QA-SEC] Auth Bypass DETECTED for URL: ${url}`);
-    return {
-      type: 'confirmed_vulnerability',
-      category: 'Broken Access Control',
-      subcategory: 'Authentication Bypass',
-      severity: 'Critical',
-      confidence: 'High',
-      exploitability: 'confirmed',
-      status: 'detected',
-      description: `Unauthorized access to the protected route '${url}' was successful. The application failed to enforce authentication, allowing a direct bypass to sensitive content.`,
-      impact: 'An unauthenticated attacker can access protected resources, potentially reading or modifying sensitive user data.',
-      evidence: {
-        accessedUrl: url,
-        finalUrl: page.url(),
-      },
-      reproductionSteps: [
-        'Ensure no active session (cleared cookies/storage).',
-        `Navigate directly to: ${url}`,
-        'Observe that the protected page loads without redirection.'
-      ],
-      remediation: 'Implement server-side middleware to verify user authentication and authorization status before serving any protected routes.',
-      classification: {
-        owaspTop10: 'A01:2021 Broken Access Control',
-        cwe: 'CWE-285'
-      }
-    };
-  }
-
-  console.log(`[QA-SEC] No Auth Bypass detected for URL: ${url}`);
-  return null;
-}
-
-/**
- * Audits the HTTP security headers of the current page.
- * @param page - The Playwright Page object.
- * @returns An array of vulnerability objects for missing headers.
- */
-export async function audit_http_headers(page: Page): Promise<SecurityFinding[]> {
-  console.log(`[QA-SEC] Auditing HTTP Headers for: ${page.url()}`);
-  const response = await page.reload({ waitUntil: 'domcontentloaded' });
-  const headers = response?.headers();
-  const vulnerabilities: SecurityFinding[] = [];
-
-  const securityHeaders = {
-    'Content-Security-Policy': {
-      severity: 'Medium',
-      remediation: 'Implement a strict Content-Security-Policy (CSP) to mitigate XSS and other injection attacks. Start with a restrictive policy and gradually allow trusted sources.',
-      impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
-      cwe: 'CWE-16'
-    },
-    'Strict-Transport-Security': {
-      severity: 'Medium',
-      remediation: 'Implement HTTP Strict Transport Security (HSTS) to force browsers to communicate over HTTPS, preventing downgrade attacks.',
-      impact: 'Man-in-the-middle attacks could downgrade the connection to HTTP, allowing traffic interception.',
-      cwe: 'CWE-319'
-    },
-    'X-Content-Type-Options': {
-      severity: 'Low',
-      remediation: 'Set `X-Content-Type-Options: nosniff` to prevent browsers from MIME-sniffing a response away from the declared content-type.',
-      impact: 'Browsers may interpret non-executable MIME types as executable, leading to potential XSS.',
-      cwe: 'CWE-430'
-    },
-    'X-Frame-Options': {
-      severity: 'Medium',
-      remediation: 'Set `X-Frame-Options: SAMEORIGIN` or `DENY` to protect against clickjacking attacks by preventing the page from being loaded in an iframe on other domains.',
-      impact: 'Attackers could trick users into clicking visually hidden elements, causing unintended actions (Clickjacking).',
-      cwe: 'CWE-1021'
-    }
-  };
-
-  for (const [header, info] of Object.entries(securityHeaders)) {
-    if (!headers || !Object.keys(headers).find(h => h.toLowerCase() === header.toLowerCase())) {
-        vulnerabilities.push({
-            type: 'security_misconfiguration',
-            category: 'Missing Security Header',
-            subcategory: header,
-            severity: info.severity as Severity,
-            confidence: 'High',
-            exploitability: 'not_confirmed',
-            status: 'detected',
-            description: `The '${header}' HTTP header is missing. This header is crucial for defending against various web attacks.`,
-            impact: info.impact,
-            evidence: {
-                url: page.url(),
-                missingHeader: header
-            },
-            reproductionSteps: [
-                `Navigate to ${page.url()}`,
-                `Inspect the response headers.`,
-                `Verify that ${header} is absent.`
-            ],
-            remediation: info.remediation,
-            classification: {
-                owaspTop10: 'A05:2021 Security Misconfiguration',
-                cwe: info.cwe
-            }
-        });
-    }
-  }
-  
-  console.log(`[QA-SEC] Found ${vulnerabilities.length} missing security headers.`);
-  return vulnerabilities;
-}
-
-/**
- * Scans localStorage and sessionStorage for potentially sensitive data.
- * @param page - The Playwright Page object.
- * @returns An array of vulnerability objects for any sensitive data found.
- */
-export async function scan_sensitive_data_exposure(page: Page): Promise<SecurityFinding[]> {
-  console.log(`[QA-SEC] Scanning localStorage and sessionStorage for sensitive data.`);
-  const vulnerabilities: SecurityFinding[] = [];
-  const sensitiveKeywords = ['token', 'password', 'secret', 'key', 'jwt', 'auth'];
-
-  const storages = {
-    localStorage: await page.evaluate(() => Object.entries(window.localStorage)),
-    sessionStorage: await page.evaluate(() => Object.entries(window.sessionStorage)),
-  };
-
-  for (const [storageType, items] of Object.entries(storages)) {
-    for (const [key, value] of items) {
-      if (sensitiveKeywords.some(keyword => key.toLowerCase().includes(keyword))) {
-        vulnerabilities.push({
-          type: 'potential_issue',
-          category: 'Sensitive Data Exposure',
-          subcategory: 'Browser Storage',
-          severity: 'Medium',
-          confidence: 'Medium',
-          exploitability: 'unknown',
-          status: 'detected',
-          description: `Potentially sensitive data was found in ${storageType}. Storing sensitive information like tokens or keys in browser storage is insecure.`,
-          impact: 'If an attacker discovers an XSS vulnerability, they can read localStorage/sessionStorage and exfiltrate secrets.',
-          evidence: {
-            storage: storageType,
-            key: key,
-            valuePreview: value ? `${value.substring(0, 10)}...` : '(empty)',
-          },
-          reproductionSteps: [
-            `Open Developer Tools on ${page.url()}`,
-            `Check ${storageType} for the key '${key}'.`
-          ],
-          remediation: 'Avoid storing sensitive data in browser storage. Use secure, HttpOnly cookies for session tokens. If you must store data, encrypt it first.',
-          classification: {
-            owaspTop10: 'A04:2021 Insecure Design',
-            cwe: 'CWE-312'
-          }
-        });
-      }
-    }
-  }
-
-  console.log(`[QA-SEC] Found ${vulnerabilities.length} instances of sensitive data in browser storage.`);
-  return vulnerabilities;
-}