@avi770/testteam 1.2.0 → 3.0.0

package/agents/39-api-contract-tester.ts

@@ -0,0 +1,199 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+const REQUEST_TIMEOUT_MS = 10_000;
+
+interface OpenApiPath {
+  [method: string]: {
+    responses?: Record<string, {
+      content?: Record<string, {
+        schema?: OpenApiSchema;
+      }>;
+    }>;
+  };
+}
+
+interface OpenApiSchema {
+  type?: string;
+  properties?: Record<string, OpenApiSchema>;
+  items?: OpenApiSchema;
+  required?: string[];
+}
+
+interface OpenApiSpec {
+  paths?: Record<string, OpenApiPath>;
+}
+
+export class ApiContractTesterAgent extends BaseAgent {
+  readonly agentId = 39;
+  readonly agentName = 'API Contract Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+
+    // Try to find OpenAPI spec
+    const specPaths = [
+      join(projectRoot, 'openapi.json'),
+      join(projectRoot, 'swagger.json'),
+      join(projectRoot, 'docs', 'openapi.json'),
+      join(projectRoot, 'docs', 'swagger.json'),
+    ];
+
+    let spec: OpenApiSpec | null = null;
+    let specPath = '';
+
+    for (const path of specPaths) {
+      try {
+        const content = await readFile(path, 'utf-8');
+        spec = JSON.parse(content) as OpenApiSpec;
+        specPath = path;
+        break;
+      } catch {
+        // File not found — try next
+      }
+    }
+
+    if (!spec) {
+      findings.push({
+        id: `${this.agentId}-no-spec`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'api-contract-tester',
+        description: 'No OpenAPI/Swagger spec found — cannot validate API contracts',
+      });
+      return findings;
+    }
+
+    this.addEvidence({
+      type: 'report',
+      path: specPath,
+      description: `Using OpenAPI spec from ${specPath}`,
+    });
+
+    const paths = spec.paths ?? {};
+
+    for (const [path, methods] of Object.entries(paths)) {
+      for (const [method, definition] of Object.entries(methods)) {
+        if (method.startsWith('x-') || method === 'parameters') continue;
+        const httpMethod = method.toUpperCase();
+        if (!['GET', 'POST', 'PUT', 'DELETE', 'PATCH'].includes(httpMethod)) continue;
+
+        const contractFindings = await this.testEndpoint(path, httpMethod, definition);
+        findings.push(...contractFindings);
+      }
+    }
+
+    return findings;
+  }
+
+  private async testEndpoint(
+    path: string,
+    method: string,
+    definition: OpenApiPath[string],
+  ): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const url = `${this.baseUrl}${path}`;
+
+    try {
+      const response = await Promise.race([
+        fetch(url, {
+          method,
+          headers: { 'Content-Type': 'application/json' },
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      const statusStr = String(response.status);
+      const responseDef = definition.responses?.[statusStr] ?? definition.responses?.['200'];
+
+      if (!responseDef) {
+        return findings;
+      }
+
+      const jsonContent = responseDef.content?.['application/json'];
+      if (!jsonContent?.schema) {
+        return findings;
+      }
+
+      let body: unknown;
+      const contentType = response.headers.get('content-type') ?? '';
+      if (contentType.includes('application/json')) {
+        body = await response.json();
+      } else {
+        return findings;
+      }
+
+      const schemaFindings = this.validateSchema(
+        body,
+        jsonContent.schema,
+        `${method} ${path}`,
+      );
+      findings.push(...schemaFindings);
+    } catch {
+      // Request failed — endpoint may not be reachable
+    }
+
+    return findings;
+  }
+
+  private validateSchema(
+    body: unknown,
+    schema: OpenApiSchema,
+    context: string,
+  ): Finding[] {
+    const findings: Finding[] = [];
+
+    if (schema.type === 'object' && schema.properties && typeof body === 'object' && body !== null) {
+      const record = body as Record<string, unknown>;
+
+      // Check required fields
+      for (const field of schema.required ?? []) {
+        if (!(field in record)) {
+          findings.push({
+            id: `${this.agentId}-missing-field-${context.replace(/\s/g, '-')}-${field}`,
+            type: 'test-bug',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'api-contract-tester',
+            description: `Missing required field "${field}" in response for ${context}`,
+          });
+        }
+      }
+
+      // Check types of present fields
+      for (const [field, fieldSchema] of Object.entries(schema.properties)) {
+        if (field in record && fieldSchema.type) {
+          const actualType = Array.isArray(record[field]) ? 'array' : typeof record[field];
+          const expectedType = fieldSchema.type === 'integer' ? 'number' : fieldSchema.type;
+
+          if (actualType !== expectedType && record[field] !== null) {
+            findings.push({
+              id: `${this.agentId}-wrong-type-${context.replace(/\s/g, '-')}-${field}`,
+              type: 'test-bug',
+              severity: 'high',
+              agentId: this.agentId,
+              module: 'api-contract-tester',
+              description: `Wrong type for field "${field}" in ${context}: expected ${expectedType}, got ${actualType}`,
+            });
+          }
+        }
+      }
+    }
+
+    return findings;
+  }
+}

package/agents/40-rate-limit-tester.ts

@@ -0,0 +1,94 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+const REQUEST_TIMEOUT_MS = 10_000;
+const RAPID_REQUEST_COUNT = 50;
+
+/** Default endpoints to test for rate limiting. */
+const DEFAULT_ENDPOINTS = [
+  '/api/auth/login',
+  '/api/tasks',
+  '/api/clients',
+] as const;
+
+export class RateLimitTesterAgent extends BaseAgent {
+  readonly agentId = 40;
+  readonly agentName = 'Rate Limit Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const endpoints = this.discoverEndpoints();
+
+    for (const endpoint of endpoints) {
+      const endpointFindings = await this.testRateLimit(endpoint);
+      findings.push(...endpointFindings);
+    }
+
+    return findings;
+  }
+
+  private discoverEndpoints(): string[] {
+    if (this.config.modules && this.config.modules.length > 0) {
+      return this.config.modules.map(m => `/api${m.route}`);
+    }
+    return [...DEFAULT_ENDPOINTS];
+  }
+
+  private async testRateLimit(endpoint: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const url = `${this.baseUrl}${endpoint}`;
+    let got429 = false;
+    let successCount = 0;
+    let errorCount = 0;
+
+    const promises = Array.from({ length: RAPID_REQUEST_COUNT }, async () => {
+      try {
+        const response = await Promise.race([
+          fetch(url, {
+            method: 'GET',
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+          }),
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+          ),
+        ]) as Response;
+
+        if (response.status === 429) {
+          got429 = true;
+        } else {
+          successCount++;
+        }
+      } catch {
+        errorCount++;
+      }
+    });
+
+    await Promise.all(promises);
+
+    if (!got429) {
+      findings.push({
+        id: `${this.agentId}-no-rate-limit-${endpoint.replace(/\//g, '_')}`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'rate-limit-tester',
+        description: `No rate limiting on endpoint ${endpoint} — sent ${RAPID_REQUEST_COUNT} rapid requests with no 429 response`,
+      });
+    }
+
+    this.addEvidence({
+      type: 'log',
+      path: `rate-limit-${endpoint.replace(/\//g, '_')}`,
+      description: `Rate limit test for ${endpoint}: 429=${got429}, successes=${successCount}, errors=${errorCount}`,
+    });
+
+    return findings;
+  }
+}

package/agents/41-api-pagination-tester.ts

@@ -0,0 +1,97 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+const REQUEST_TIMEOUT_MS = 10_000;
+
+/** Edge-case pagination parameters to test. */
+const PAGINATION_TESTS = [
+  { param: 'page=0', description: 'page=0 (zero-indexed edge case)' },
+  { param: 'page=-1', description: 'page=-1 (negative page)' },
+  { param: 'page=99999', description: 'page=99999 (very high page)' },
+  { param: 'limit=0', description: 'limit=0 (zero limit)' },
+  { param: 'limit=10000', description: 'limit=10000 (excessively high limit)' },
+] as const;
+
+export class ApiPaginationTesterAgent extends BaseAgent {
+  readonly agentId = 41;
+  readonly agentName = 'API Pagination Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const endpoints = this.discoverListEndpoints();
+
+    for (const endpoint of endpoints) {
+      for (const test of PAGINATION_TESTS) {
+        const testFindings = await this.testPagination(endpoint, test.param, test.description);
+        findings.push(...testFindings);
+      }
+    }
+
+    return findings;
+  }
+
+  private discoverListEndpoints(): string[] {
+    if (this.config.modules && this.config.modules.length > 0) {
+      return this.config.modules.map(m => `/api${m.route}`);
+    }
+    return ['/api/tasks', '/api/clients'];
+  }
+
+  private async testPagination(
+    endpoint: string,
+    queryParam: string,
+    description: string,
+  ): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const url = `${this.baseUrl}${endpoint}?${queryParam}`;
+
+    try {
+      const response = await Promise.race([
+        fetch(url, {
+          method: 'GET',
+          headers: { 'Content-Type': 'application/json' },
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      // Check for server errors (crashes)
+      if (response.status >= 500) {
+        findings.push({
+          id: `${this.agentId}-crash-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+          type: 'code-bug-logic',
+          severity: 'high',
+          agentId: this.agentId,
+          module: 'api-pagination-tester',
+          description: `Endpoint ${endpoint} returned ${response.status} for ${description} — server crash on edge-case pagination`,
+        });
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: `pagination-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+        description: `${endpoint}?${queryParam}: status=${response.status}`,
+      });
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-error-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'api-pagination-tester',
+        description: `Failed to test ${endpoint} with ${description}: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    return findings;
+  }
+}

package/agents/42-graphql-tester.ts

@@ -0,0 +1,222 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+const REQUEST_TIMEOUT_MS = 10_000;
+
+const GRAPHQL_PATHS = ['/graphql', '/api/graphql'] as const;
+
+/** Standard introspection query. */
+const INTROSPECTION_QUERY = '{ __schema { types { name } } }';
+
+/** Deeply nested query (10+ levels). */
+function buildDeepQuery(depth: number): string {
+  let query = '{ __typename';
+  const openBraces: string[] = [];
+  for (let i = 0; i < depth; i++) {
+    query += ` __type(name: "Query") { name fields { name type { name`;
+    openBraces.push(' } }');
+  }
+  query += openBraces.reverse().join('');
+  query += ' }';
+  return query;
+}
+
+export class GraphqlTesterAgent extends BaseAgent {
+  readonly agentId = 42;
+  readonly agentName = 'GraphQL Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Discover GraphQL endpoint
+    let graphqlUrl: string | null = null;
+
+    for (const path of GRAPHQL_PATHS) {
+      const url = `${this.baseUrl}${path}`;
+      try {
+        const response = await Promise.race([
+          fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ query: '{ __typename }' }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+          }),
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+          ),
+        ]) as Response;
+
+        if (response.status !== 404) {
+          graphqlUrl = url;
+          break;
+        }
+      } catch {
+        // Path not available
+      }
+    }
+
+    if (!graphqlUrl) {
+      findings.push({
+        id: `${this.agentId}-no-graphql`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'graphql-tester',
+        description: 'No GraphQL endpoint found at /graphql or /api/graphql',
+      });
+      return findings;
+    }
+
+    // Test 1: Introspection
+    const introspectionFindings = await this.testIntrospection(graphqlUrl);
+    findings.push(...introspectionFindings);
+
+    // Test 2: Deep query (depth limiting)
+    const depthFindings = await this.testQueryDepth(graphqlUrl);
+    findings.push(...depthFindings);
+
+    // Test 3: Unauthenticated access
+    const authFindings = await this.testUnauthenticatedAccess(graphqlUrl);
+    findings.push(...authFindings);
+
+    return findings;
+  }
+
+  private async testIntrospection(graphqlUrl: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const response = await Promise.race([
+        fetch(graphqlUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ query: INTROSPECTION_QUERY }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      if (response.status === 200) {
+        const body = await response.json() as { data?: { __schema?: unknown } };
+        if (body.data?.__schema) {
+          findings.push({
+            id: `${this.agentId}-introspection-enabled`,
+            type: 'code-bug-security',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'graphql-tester',
+            description: 'GraphQL introspection is enabled in production — schema is exposed to attackers',
+          });
+        }
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: 'graphql-introspection',
+        description: `Introspection query: status=${response.status}`,
+      });
+    } catch {
+      // Request failed
+    }
+
+    return findings;
+  }
+
+  private async testQueryDepth(graphqlUrl: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const deepQuery = buildDeepQuery(10);
+
+    try {
+      const response = await Promise.race([
+        fetch(graphqlUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ query: deepQuery }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      if (response.status === 200) {
+        const body = await response.json() as { errors?: unknown[] };
+        if (!body.errors) {
+          findings.push({
+            id: `${this.agentId}-no-depth-limit`,
+            type: 'code-bug-security',
+            severity: 'high',
+            agentId: this.agentId,
+            module: 'graphql-tester',
+            description: 'No query depth limit on GraphQL endpoint — deeply nested queries (10+ levels) are accepted without error',
+          });
+        }
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: 'graphql-depth',
+        description: `Deep query test (10 levels): status=${response.status}`,
+      });
+    } catch {
+      // Request failed
+    }
+
+    return findings;
+  }
+
+  private async testUnauthenticatedAccess(graphqlUrl: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Send a query that would typically need auth
+    const query = '{ users { id email } }';
+
+    try {
+      const response = await Promise.race([
+        fetch(graphqlUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          // No Authorization header
+          body: JSON.stringify({ query }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      if (response.status === 200) {
+        const body = await response.json() as { data?: { users?: unknown[] } };
+        if (body.data?.users && Array.isArray(body.data.users) && body.data.users.length > 0) {
+          findings.push({
+            id: `${this.agentId}-no-field-auth`,
+            type: 'code-bug-security',
+            severity: 'high',
+            agentId: this.agentId,
+            module: 'graphql-tester',
+            description: 'GraphQL returns user data without authentication — field-level authorization is missing',
+          });
+        }
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: 'graphql-unauth',
+        description: `Unauthenticated query test: status=${response.status}`,
+      });
+    } catch {
+      // Request failed
+    }
+
+    return findings;
+  }
+}