@avi770/testteam 1.2.0 → 3.0.0

package/agents/66-soc2-control-validator.ts

@@ -0,0 +1,210 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { Browser } from 'playwright';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+/** Glob-like manual scan for .ts files under src/. */
+function findTsFiles(dir: string, results: string[] = []): string[] {
+  if (!fs.existsSync(dir)) return results;
+
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory() && entry.name !== 'node_modules' && entry.name !== '.git') {
+      findTsFiles(fullPath, results);
+    } else if (entry.isFile() && entry.name.endsWith('.ts')) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+export class Soc2ControlValidatorAgent extends BaseAgent {
+  readonly agentId = 66;
+  readonly agentName = 'SOC2 Control Validator';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+    const srcDir = path.join(projectRoot, 'src');
+
+    // Check 1: Audit logging evidence
+    const auditFindings = this.checkAuditLogging(srcDir);
+    findings.push(...auditFindings);
+
+    // Check 2: Session timeout
+    const sessionFindings = this.checkSessionTimeout(srcDir);
+    findings.push(...sessionFindings);
+
+    // Check 3: MFA UI
+    const mfaFindings = await this.checkMfaUI();
+    findings.push(...mfaFindings);
+
+    // Check 4: Role-based access
+    const rbacFindings = this.checkRoleBasedAccess(srcDir);
+    findings.push(...rbacFindings);
+
+    return findings;
+  }
+
+  private checkAuditLogging(srcDir: string): Finding[] {
+    const findings: Finding[] = [];
+
+    if (!fs.existsSync(srcDir)) {
+      findings.push({
+        id: `${this.agentId}-no-src`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'soc2-control-validator',
+        description: 'No src/ directory found — cannot check for audit logging',
+      });
+      return findings;
+    }
+
+    const tsFiles = findTsFiles(srcDir);
+    let hasAuditLogging = false;
+
+    for (const filePath of tsFiles) {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      if (/audit/i.test(content) && (/log/i.test(content) || /trail/i.test(content) || /event/i.test(content))) {
+        hasAuditLogging = true;
+        this.addEvidence({
+          type: 'log',
+          path: filePath,
+          description: 'Audit logging evidence found',
+        });
+        break;
+      }
+    }
+
+    if (!hasAuditLogging) {
+      findings.push({
+        id: `${this.agentId}-no-audit-logging`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'soc2-control-validator',
+        description: 'No audit logging evidence found in source code',
+        suggestedFix: 'Implement audit logging for security-relevant events',
+      });
+    }
+
+    return findings;
+  }
+
+  private checkSessionTimeout(srcDir: string): Finding[] {
+    const findings: Finding[] = [];
+
+    if (!fs.existsSync(srcDir)) return findings;
+
+    const tsFiles = findTsFiles(srcDir);
+    let hasSessionTimeout = false;
+
+    for (const filePath of tsFiles) {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      if (/sessionTimeout/i.test(content) || /session.*timeout/i.test(content) || /setTimeout.*session/i.test(content) || /idle.*timeout/i.test(content)) {
+        hasSessionTimeout = true;
+        break;
+      }
+    }
+
+    if (!hasSessionTimeout) {
+      findings.push({
+        id: `${this.agentId}-no-session-timeout`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'soc2-control-validator',
+        description: 'No session timeout configuration found in source code',
+        suggestedFix: 'Implement session timeout to auto-logout inactive users',
+      });
+    }
+
+    return findings;
+  }
+
+  private async checkMfaUI(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const { chromium } = await import('playwright');
+      let browser: Browser | null = null;
+
+      try {
+        browser = await chromium.launch({ headless: true });
+        const page = await browser.newPage();
+
+        await page.goto(this.baseUrl, { waitUntil: 'domcontentloaded', timeout: 10_000 });
+
+        const bodyText = await page.evaluate(() => document.body.innerText.toLowerCase());
+
+        const hasMfaUI = bodyText.includes('two-factor') ||
+          bodyText.includes('2fa') ||
+          bodyText.includes('mfa') ||
+          bodyText.includes('multi-factor') ||
+          bodyText.includes('authenticator');
+
+        if (!hasMfaUI) {
+          findings.push({
+            id: `${this.agentId}-no-mfa`,
+            type: 'code-bug-security',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'soc2-control-validator',
+            description: 'No MFA/2FA UI elements detected',
+            suggestedFix: 'Implement multi-factor authentication for SOC2 compliance',
+          });
+        }
+
+        await page.close().catch(() => undefined);
+      } finally {
+        if (browser) await browser.close().catch(() => undefined);
+      }
+    } catch {
+      // Playwright not available — skip MFA UI check
+    }
+
+    return findings;
+  }
+
+  private checkRoleBasedAccess(srcDir: string): Finding[] {
+    const findings: Finding[] = [];
+
+    if (!fs.existsSync(srcDir)) return findings;
+
+    const tsFiles = findTsFiles(srcDir);
+    let hasRbac = false;
+
+    for (const filePath of tsFiles) {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      if (/role/i.test(content) && (/guard/i.test(content) || /permission/i.test(content) || /authorize/i.test(content) || /access/i.test(content))) {
+        hasRbac = true;
+        break;
+      }
+    }
+
+    if (!hasRbac) {
+      findings.push({
+        id: `${this.agentId}-no-rbac`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'soc2-control-validator',
+        description: 'No role-based access control evidence found in source code',
+        suggestedFix: 'Implement RBAC with role checks on protected resources',
+      });
+    }
+
+    return findings;
+  }
+}

package/agents/67-wcag-aaa-tester.ts

@@ -0,0 +1,241 @@
+import type { Browser, Page } from 'playwright';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+import { login } from '../helpers/navigation';
+
+export class WcagAaaTesterAgent extends BaseAgent {
+  readonly agentId = 67;
+  readonly agentName = 'WCAG AAA Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    if (!this.config.modules || this.config.modules.length === 0) {
+      throw new Error('WcagAaaTesterAgent requires at least one module in config.modules');
+    }
+
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
+    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    const { chromium } = await import('playwright');
+
+    let browser: Browser | null = null;
+
+    try {
+      browser = await chromium.launch({ headless: true });
+      const page = await browser.newPage();
+
+      if (credentials) {
+        try {
+          await login(page, credentials, loginUrl);
+        } catch {
+          findings.push({
+            id: `${this.agentId}-login-failed`,
+            type: 'infra-issue',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'wcag-aaa-tester',
+            description: 'Login failed — continuing anonymously',
+          });
+        }
+      }
+
+      for (const mod of this.config.modules) {
+        const fullUrl = mod.route.startsWith('http')
+          ? mod.route
+          : `${this.baseUrl}${mod.route}`;
+
+        try {
+          await page.goto(fullUrl, { waitUntil: 'domcontentloaded', timeout: 10_000 });
+        } catch {
+          continue;
+        }
+
+        // Test 1: Text contrast ratio >= 7:1 (AAA)
+        const contrastFindings = await this.checkContrast(page, mod.id);
+        findings.push(...contrastFindings);
+
+        // Test 2: Text resizable to 200%
+        const resizeFindings = await this.checkTextResize(page, mod.id);
+        findings.push(...resizeFindings);
+
+        // Test 3: Keyboard navigation
+        const keyboardFindings = await this.checkKeyboardNavigation(page, mod.id);
+        findings.push(...keyboardFindings);
+      }
+
+      await page.close().catch(() => undefined);
+    } catch (playwrightError) {
+      findings.push({
+        id: `${this.agentId}-playwright-failure`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'wcag-aaa-tester',
+        description: `Playwright execution failed: ${playwrightError instanceof Error ? playwrightError.message.split('\n')[0] : String(playwrightError)}`,
+      });
+    } finally {
+      if (browser) await browser.close().catch(() => undefined);
+    }
+
+    return findings;
+  }
+
+  private async checkContrast(page: Page, moduleId: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const lowContrastCount = await page.evaluate(() => {
+        function getLuminance(r: number, g: number, b: number): number {
+          const sRGB = [r, g, b].map(c => {
+            const s = c / 255;
+            return s <= 0.03928 ? s / 12.92 : Math.pow((s + 0.055) / 1.055, 2.4);
+          });
+          return 0.2126 * sRGB[0] + 0.7152 * sRGB[1] + 0.0722 * sRGB[2];
+        }
+
+        function parseColor(color: string): [number, number, number] | null {
+          const match = color.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)/);
+          if (match) return [parseInt(match[1]), parseInt(match[2]), parseInt(match[3])];
+          return null;
+        }
+
+        const elements = document.querySelectorAll('p, span, a, h1, h2, h3, h4, h5, h6, li, td, th, label');
+        let lowContrast = 0;
+
+        for (const el of Array.from(elements).slice(0, 50)) {
+          const style = window.getComputedStyle(el);
+          const fg = parseColor(style.color);
+          const bg = parseColor(style.backgroundColor);
+
+          if (fg && bg) {
+            const fgLum = getLuminance(...fg);
+            const bgLum = getLuminance(...bg);
+            const ratio = (Math.max(fgLum, bgLum) + 0.05) / (Math.min(fgLum, bgLum) + 0.05);
+
+            if (ratio < 7) {
+              lowContrast++;
+            }
+          }
+        }
+
+        return lowContrast;
+      });
+
+      if (lowContrastCount > 0) {
+        findings.push({
+          id: `${this.agentId}-low-contrast-${moduleId}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: moduleId,
+          description: `${lowContrastCount} element(s) have contrast ratio below 7:1 (WCAG AAA requirement)`,
+        });
+      }
+    } catch {
+      // Contrast check failed — non-critical
+    }
+
+    return findings;
+  }
+
+  private async checkTextResize(page: Page, moduleId: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const hasOverflow = await page.evaluate(() => {
+        document.documentElement.style.fontSize = '200%';
+
+        // Wait a tick for reflow
+        const body = document.body;
+        const hasHorizontalOverflow = body.scrollWidth > window.innerWidth;
+
+        // Reset
+        document.documentElement.style.fontSize = '';
+
+        return hasHorizontalOverflow;
+      });
+
+      if (hasOverflow) {
+        findings.push({
+          id: `${this.agentId}-text-resize-overflow-${moduleId}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: moduleId,
+          description: `Content overflows horizontally when text is resized to 200% in ${moduleId}`,
+        });
+      }
+    } catch {
+      // Resize check failed — non-critical
+    }
+
+    return findings;
+  }
+
+  private async checkKeyboardNavigation(page: Page, moduleId: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      // Tab through elements and check focus visibility
+      const focusableCount = await page.evaluate(() => {
+        const focusable = document.querySelectorAll('a, button, input, select, textarea, [tabindex]');
+        return focusable.length;
+      });
+
+      if (focusableCount === 0) {
+        findings.push({
+          id: `${this.agentId}-no-focusable-${moduleId}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: moduleId,
+          description: `No focusable elements found in ${moduleId} — keyboard navigation may not work`,
+        });
+        return findings;
+      }
+
+      // Press Tab a few times and check if focus is visible
+      for (let i = 0; i < Math.min(5, focusableCount); i++) {
+        await page.keyboard.press('Tab');
+      }
+
+      const hasFocusIndicator = await page.evaluate(() => {
+        const focused = document.activeElement;
+        if (!focused || focused === document.body) return false;
+
+        const style = window.getComputedStyle(focused);
+        const hasOutline = style.outlineStyle !== 'none' && style.outlineWidth !== '0px';
+        const hasBoxShadow = style.boxShadow !== 'none';
+        const hasBorder = style.borderColor !== style.backgroundColor;
+
+        return hasOutline || hasBoxShadow || hasBorder;
+      });
+
+      if (!hasFocusIndicator) {
+        findings.push({
+          id: `${this.agentId}-no-focus-indicator-${moduleId}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: moduleId,
+          description: `Focus indicator not visible during keyboard navigation in ${moduleId}`,
+        });
+      }
+    } catch {
+      // Keyboard nav check failed — non-critical
+    }
+
+    return findings;
+  }
+}

package/agents/68-dead-code-detector.ts

@@ -0,0 +1,135 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+
+/** Find all .ts files under a directory (excluding tests and node_modules). */
+function findTsFiles(dir: string, results: string[] = []): string[] {
+  if (!fs.existsSync(dir)) return results;
+
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory() && entry.name !== 'node_modules' && entry.name !== '.git' && entry.name !== 'dist') {
+      findTsFiles(fullPath, results);
+    } else if (entry.isFile() && entry.name.endsWith('.ts') && !entry.name.endsWith('.test.ts') && !entry.name.endsWith('.spec.ts') && !entry.name.endsWith('.d.ts')) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+/** Extract exported identifiers from a file. */
+function extractExports(content: string): string[] {
+  const exports: string[] = [];
+
+  // export function/class/const/let/var/type/interface/enum
+  const exportPattern = /export\s+(?:async\s+)?(?:function|class|const|let|var|type|interface|enum)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/g;
+  let match: RegExpExecArray | null;
+  while ((match = exportPattern.exec(content)) !== null) {
+    exports.push(match[1]);
+  }
+
+  // export { ... }
+  const namedExportPattern = /export\s*\{([^}]+)\}/g;
+  while ((match = namedExportPattern.exec(content)) !== null) {
+    const names = match[1].split(',').map(n => n.trim().split(/\s+as\s+/)[0].trim());
+    exports.push(...names.filter(n => n.length > 0));
+  }
+
+  return exports;
+}
+
+export class DeadCodeDetectorAgent extends BaseAgent {
+  readonly agentId = 68;
+  readonly agentName = 'Dead Code Detector';
+
+  protected async preFlight(): Promise<void> {
+    // File-based agent
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+    const srcDir = path.join(projectRoot, 'src');
+
+    if (!fs.existsSync(srcDir)) {
+      findings.push({
+        id: `${this.agentId}-no-src-dir`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'dead-code-detector',
+        description: 'No src/ directory found in project root',
+      });
+      return findings;
+    }
+
+    const tsFiles = findTsFiles(srcDir);
+
+    // Phase 1: Collect all exports
+    const exportMap: Map<string, { file: string; name: string }[]> = new Map();
+    const allContents: Map<string, string> = new Map();
+
+    for (const filePath of tsFiles) {
+      const content = fs.readFileSync(filePath, 'utf-8');
+      allContents.set(filePath, content);
+
+      const fileExports = extractExports(content);
+      for (const exp of fileExports) {
+        const existing = exportMap.get(exp) ?? [];
+        existing.push({ file: filePath, name: exp });
+        exportMap.set(exp, existing);
+      }
+    }
+
+    // Phase 2: Check which exports are imported somewhere
+    const allContent = Array.from(allContents.values()).join('\n');
+    let unusedCount = 0;
+
+    for (const [name, locations] of exportMap) {
+      // Skip common/expected exports
+      if (['default', 'main', 'App', 'bootstrap', 'configure'].includes(name)) continue;
+
+      // Count occurrences across all files
+      const fromPattern = new RegExp(`\\b${name}\\b`, 'g');
+      const totalOccurrences = (allContent.match(fromPattern) ?? []).length;
+
+      // If the name only appears in its own export(s), it's unused
+      if (totalOccurrences <= locations.length) {
+        unusedCount++;
+        if (unusedCount <= 10) {
+          findings.push({
+            id: `${this.agentId}-unused-export-${unusedCount}`,
+            type: 'test-bug',
+            severity: 'low',
+            agentId: this.agentId,
+            module: 'dead-code-detector',
+            file: locations[0].file,
+            description: `Unused export: "${name}" in ${path.relative(projectRoot, locations[0].file)}`,
+          });
+        }
+      }
+    }
+
+    if (unusedCount > 10) {
+      findings.push({
+        id: `${this.agentId}-unused-export-summary`,
+        type: 'test-bug',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'dead-code-detector',
+        description: `${unusedCount} total unused exports found (showing first 10)`,
+      });
+    }
+
+    this.addEvidence({
+      type: 'log',
+      path: '',
+      description: `Scanned ${tsFiles.length} files, found ${exportMap.size} exports, ${unusedCount} potentially unused`,
+    });
+
+    return findings;
+  }
+}