@avi770/testteam 1.2.0

package/agents/06-api-exerciser.ts

@@ -0,0 +1,311 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { BaseAgent } from './base-agent';
+import type { Finding } from '../core/types';
+import { ApiClient } from '../helpers/api-client';
+
+/** A parsed HTTP endpoint extracted from a route file. */
+interface ParsedEndpoint {
+  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
+  path: string;
+  sourceFile: string;
+}
+
+type HttpMethod = ParsedEndpoint['method'];
+
+/** Regex patterns to locate route registrations in Express/NestJS route files. */
+function buildRouterPattern(verb: string): RegExp {
+  return new RegExp(
+    `router\\.${verb}\\s*\\(\\s*['"\`]([^'"\`]+)['"\`]`,
+    'gi',
+  );
+}
+
+function buildDecoratorPattern(decorator: string): RegExp {
+  return new RegExp(
+    `@${decorator}\\s*\\(\\s*['"\`]([^'"\`]*)['"\`]\\s*\\)`,
+    'g',
+  );
+}
+
+const ROUTES_DIR = join(process.cwd(), 'apps', 'api', 'src', 'routes');
+const RESPONSE_TIME_THRESHOLD_MS = 500;
+
+export class ApiExerciserAgent extends BaseAgent {
+  readonly agentId = 6;
+  readonly agentName = 'API Exerciser';
+
+  protected async preFlight(): Promise<void> {
+    const env = this.config.environments['alpha'] ?? Object.values(this.config.environments)[0];
+    if (!env) {
+      throw new Error('No environment configured — cannot determine API base URL');
+    }
+
+    try {
+      const response = await fetch(env.baseUrl, {
+        method: 'HEAD',
+        signal: AbortSignal.timeout(10_000),
+      });
+      if (response.status >= 500) {
+        throw new Error(`API base URL returned ${response.status}`);
+      }
+    } catch (err) {
+      throw new Error(
+        `API base URL is not reachable: ${env.baseUrl} — ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const env = this.config.environments['alpha'] ?? Object.values(this.config.environments)[0];
+    if (!env) {
+      findings.push({
+        id: `${this.agentId}-no-env`,
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'api-exerciser',
+        description: 'No environment configured — cannot determine API base URL',
+      });
+      return findings;
+    }
+
+    const endpoints = await this.discoverEndpoints();
+
+    const credentials = this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    let authedClient: ApiClient | null = null;
+    if (credentials) {
+      try {
+        authedClient = await ApiClient.createAuthenticated(env.baseUrl, credentials);
+      } catch {
+        // Non-fatal — auth tests will still run via unauthenticated client
+      }
+    }
+
+    const anonClient = new ApiClient(env.baseUrl);
+
+    for (const endpoint of endpoints) {
+      // Happy path: authenticated request should return 2xx
+      if (authedClient) {
+        const happyFindings = await this.runHappyPath(authedClient, endpoint);
+        findings.push(...happyFindings);
+      }
+
+      // Auth check: request without token should return 401
+      const authFindings = await this.runAuthCheck(anonClient, endpoint);
+      findings.push(...authFindings);
+
+      // Validation check: POST/PUT with empty body should return 400
+      if (endpoint.method === 'POST' || endpoint.method === 'PUT') {
+        const validationFindings = await this.runValidationCheck(anonClient, endpoint);
+        findings.push(...validationFindings);
+      }
+    }
+
+    return findings;
+  }
+
+  private async discoverEndpoints(): Promise<ParsedEndpoint[]> {
+    const endpoints: ParsedEndpoint[] = [];
+
+    let files: string[];
+    try {
+      const entries = await readdir(ROUTES_DIR);
+      files = entries.filter(f => f.endsWith('.ts') && !f.endsWith('.test.ts'));
+    } catch {
+      return endpoints;
+    }
+
+    for (const file of files) {
+      const filePath = join(ROUTES_DIR, file);
+      let content: string;
+      try {
+        content = await readFile(filePath, 'utf-8');
+      } catch {
+        continue;
+      }
+
+      const fileEndpoints = this.parseRouteFile(content, file);
+      endpoints.push(...fileEndpoints);
+    }
+
+    return endpoints;
+  }
+
+  parseRouteFile(content: string, sourceFile: string): ParsedEndpoint[] {
+    const endpoints: ParsedEndpoint[] = [];
+    const methodVerbs: Array<[HttpMethod, string, string]> = [
+      ['GET', 'get', 'Get'],
+      ['POST', 'post', 'Post'],
+      ['PUT', 'put', 'Put'],
+      ['DELETE', 'delete', 'Delete'],
+    ];
+
+    for (const [method, verbLower, decoratorName] of methodVerbs) {
+      // Match router.get/post/put/delete('path', ...) patterns
+      const routerPattern = buildRouterPattern(verbLower);
+      let match = routerPattern.exec(content);
+      while (match !== null) {
+        const path = match[1];
+        if (path) {
+          endpoints.push({ method, path, sourceFile });
+        }
+        match = routerPattern.exec(content);
+      }
+
+      // Match @Get/@Post/@Put/@Delete('path') NestJS decorator patterns
+      const decoratorPattern = buildDecoratorPattern(decoratorName);
+      let dMatch = decoratorPattern.exec(content);
+      while (dMatch !== null) {
+        const path = dMatch[1] ?? '';
+        endpoints.push({ method, path: path || '/', sourceFile });
+        dMatch = decoratorPattern.exec(content);
+      }
+    }
+
+    return endpoints;
+  }
+
+  private async runHappyPath(client: ApiClient, endpoint: ParsedEndpoint): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const normalizedPath = this.normalizePath(endpoint.path);
+
+    try {
+      let response;
+      switch (endpoint.method) {
+        case 'GET':
+          response = await client.get(normalizedPath);
+          break;
+        case 'POST':
+          response = await client.post(normalizedPath, { test: true });
+          break;
+        case 'PUT':
+          response = await client.put(normalizedPath, { test: true });
+          break;
+        case 'DELETE':
+          response = await client.delete(normalizedPath);
+          break;
+      }
+
+      if (response.status >= 400 && response.status !== 401 && response.status !== 404) {
+        findings.push({
+          id: `${this.agentId}-happy-${endpoint.method}-${normalizedPath.replace(/\//g, '_')}`,
+          type: 'code-bug-logic',
+          severity: 'high',
+          agentId: this.agentId,
+          module: endpoint.sourceFile,
+          description: `[API Exerciser] ${endpoint.method} ${normalizedPath} returned unexpected ${response.status} (expected 2xx)`,
+          file: endpoint.sourceFile,
+        });
+      }
+
+      if (response.durationMs > RESPONSE_TIME_THRESHOLD_MS) {
+        findings.push({
+          id: `${this.agentId}-slow-${endpoint.method}-${normalizedPath.replace(/\//g, '_')}`,
+          type: 'code-bug-logic',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: endpoint.sourceFile,
+          description: `[API Exerciser] ${endpoint.method} ${normalizedPath} responded in ${response.durationMs}ms (threshold: ${RESPONSE_TIME_THRESHOLD_MS}ms)`,
+          file: endpoint.sourceFile,
+        });
+      }
+    } catch {
+      // Network-level failure is non-fatal for individual endpoints
+    }
+
+    return findings;
+  }
+
+  private async runAuthCheck(client: ApiClient, endpoint: ParsedEndpoint): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const normalizedPath = this.normalizePath(endpoint.path);
+
+    try {
+      let response;
+      switch (endpoint.method) {
+        case 'GET':
+          response = await client.get(normalizedPath);
+          break;
+        case 'POST':
+          response = await client.post(normalizedPath, {});
+          break;
+        case 'PUT':
+          response = await client.put(normalizedPath, {});
+          break;
+        case 'DELETE':
+          response = await client.delete(normalizedPath);
+          break;
+      }
+
+      const isPublicRoute =
+        normalizedPath.includes('/auth') ||
+        normalizedPath.includes('/health') ||
+        normalizedPath.includes('/public');
+
+      if (response.status !== 401 && !isPublicRoute) {
+        findings.push({
+          id: `${this.agentId}-auth-${endpoint.method}-${normalizedPath.replace(/\//g, '_')}`,
+          type: 'code-bug-security',
+          severity: 'high',
+          agentId: this.agentId,
+          module: endpoint.sourceFile,
+          description:
+            `[API Exerciser] ${endpoint.method} ${normalizedPath} did not return 401 for unauthenticated request (got ${response.status})`,
+          file: endpoint.sourceFile,
+          suggestedFix: 'Ensure authentication guard is applied to this endpoint',
+        });
+      }
+    } catch {
+      // Network-level failure
+    }
+
+    return findings;
+  }
+
+  private async runValidationCheck(
+    client: ApiClient,
+    endpoint: ParsedEndpoint,
+  ): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const normalizedPath = this.normalizePath(endpoint.path);
+
+    try {
+      const response =
+        endpoint.method === 'POST'
+          ? await client.post(normalizedPath, {})
+          : await client.put(normalizedPath, {});
+
+      // 401 is acceptable (auth guard fires before validation); 400 is the target
+      if (response.status !== 400 && response.status !== 401) {
+        findings.push({
+          id: `${this.agentId}-validation-${endpoint.method}-${normalizedPath.replace(/\//g, '_')}`,
+          type: 'code-bug-logic',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: endpoint.sourceFile,
+          description:
+            `[API Exerciser] ${endpoint.method} ${normalizedPath} with empty body returned ${response.status} instead of 400`,
+          file: endpoint.sourceFile,
+          suggestedFix:
+            'Add input validation (e.g. class-validator DTO) to reject empty bodies',
+        });
+      }
+    } catch {
+      // Network-level failure
+    }
+
+    return findings;
+  }
+
+  /** Replace path parameters like :id or {id} with placeholder values. */
+  private normalizePath(path: string): string {
+    return path
+      .replace(/:([a-zA-Z_][a-zA-Z0-9_]*)/g, '1')
+      .replace(/\{[^}]+\}/g, '1');
+  }
+}

package/agents/07-security-scout.ts

@@ -0,0 +1,188 @@
+import { execFile } from 'child_process';
+import { BaseAgent } from './base-agent';
+import type { Finding, FindingSeverity } from '../core/types';
+import { ApiClient } from '../helpers/api-client';
+
+/** Shape of a single vulnerability entry in `pnpm audit --json` output. */
+interface AuditVulnerability {
+  severity: string;
+  via?: Array<string | { title?: string; severity?: string }>;
+  fixAvailable?: boolean | { name: string; version: string };
+}
+
+/** Top-level shape of `pnpm audit --json` output. */
+interface AuditReport {
+  vulnerabilities?: Record<string, AuditVulnerability>;
+  metadata?: {
+    vulnerabilities?: {
+      critical?: number;
+      high?: number;
+      moderate?: number;
+      low?: number;
+      info?: number;
+      total?: number;
+    };
+  };
+}
+
+/** Security headers that must be present on every HTTP response. */
+const REQUIRED_SECURITY_HEADERS: ReadonlyArray<string> = [
+  'content-security-policy',
+  'x-frame-options',
+  'strict-transport-security',
+  'x-content-type-options',
+];
+
+function execFilePromise(
+  file: string,
+  args: string[],
+): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve) => {
+    execFile(file, args, { shell: true }, (error, stdout, stderr) => {
+      if (error) {
+        // pnpm audit exits with non-zero when vulnerabilities exist; capture stdout anyway
+        resolve({ stdout: stdout ?? '', stderr: stderr ?? '' });
+        return;
+      }
+      resolve({ stdout: stdout ?? '', stderr: stderr ?? '' });
+    });
+  });
+}
+
+/** Map pnpm/npm audit severity strings to FindingSeverity values. */
+function mapAuditSeverity(auditSeverity: string): FindingSeverity {
+  switch (auditSeverity.toLowerCase()) {
+    case 'critical': return 'critical';
+    case 'high': return 'high';
+    case 'moderate': return 'medium';
+    case 'low': return 'low';
+    default: return 'low';
+  }
+}
+
+export class SecurityScoutAgent extends BaseAgent {
+  readonly agentId = 7;
+  readonly agentName = 'Security Scout';
+
+  protected async preFlight(): Promise<void> {
+    await execFilePromise('pnpm', ['--version']);
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const auditFindings = await this.runDependencyAudit();
+    findings.push(...auditFindings);
+
+    const headerFindings = await this.checkSecurityHeaders();
+    findings.push(...headerFindings);
+
+    return findings;
+  }
+
+  private async runDependencyAudit(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    let stdout: string;
+    try {
+      const result = await execFilePromise('pnpm', ['audit', '--json']);
+      stdout = result.stdout;
+    } catch {
+      findings.push({
+        id: `${this.agentId}-audit-failed`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'security-scout',
+        description: '[Security Scout] pnpm audit failed to run — dependency vulnerabilities could not be assessed',
+      });
+      return findings;
+    }
+
+    if (!stdout.trim()) {
+      return findings;
+    }
+
+    let report: AuditReport;
+    try {
+      report = JSON.parse(stdout) as AuditReport;
+    } catch {
+      findings.push({
+        id: `${this.agentId}-audit-parse-error`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'security-scout',
+        description: '[Security Scout] pnpm audit JSON output could not be parsed',
+      });
+      return findings;
+    }
+
+    const vulnerabilities = report.vulnerabilities ?? {};
+
+    for (const [pkgName, vuln] of Object.entries(vulnerabilities)) {
+      const severity = mapAuditSeverity(vuln.severity);
+
+      const viaDescriptions = (vuln.via ?? [])
+        .map(v => (typeof v === 'string' ? v : (v.title ?? 'unknown')))
+        .join(', ');
+
+      findings.push({
+        id: `${this.agentId}-vuln-${pkgName.replace(/[^a-zA-Z0-9_-]/g, '_')}`,
+        type: 'code-bug-security',
+        severity,
+        agentId: this.agentId,
+        module: 'dependencies',
+        description: `[Security Scout] Vulnerability in "${pkgName}" (${vuln.severity}): ${viaDescriptions || 'see audit output'}`,
+        suggestedFix: vuln.fixAvailable
+          ? `Run \`pnpm audit fix\` — fix is available`
+          : 'No automatic fix available; review and update manually',
+      });
+    }
+
+    return findings;
+  }
+
+  private async checkSecurityHeaders(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const env = this.config.environments['alpha'] ?? Object.values(this.config.environments)[0];
+    if (!env) {
+      return findings;
+    }
+
+    const client = new ApiClient(env.baseUrl);
+
+    let response;
+    try {
+      response = await client.get('/');
+    } catch {
+      findings.push({
+        id: `${this.agentId}-headers-unreachable`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'security-scout',
+        description: `[Security Scout] Could not reach ${env.baseUrl}/ to check security headers`,
+      });
+      return findings;
+    }
+
+    for (const header of REQUIRED_SECURITY_HEADERS) {
+      const headerValue = response.headers[header] ?? response.headers[header.toLowerCase()];
+      if (!headerValue) {
+        findings.push({
+          id: `${this.agentId}-missing-header-${header.replace(/[^a-zA-Z0-9]/g, '_')}`,
+          type: 'code-bug-security',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: 'security-headers',
+          description: `[Security Scout] Missing security header: ${header}`,
+          suggestedFix: `Add the "${header}" response header to all HTTP responses`,
+        });
+      }
+    }
+
+    return findings;
+  }
+}

package/agents/08-a11y-guardian.ts

@@ -0,0 +1,212 @@
+import { execFile } from 'child_process';
+import type { Browser, Page } from 'playwright';
+import { BaseAgent } from './base-agent';
+import type { Finding, FindingSeverity } from '../core/types';
+import { login, navigateToSection, waitForSectionLoad } from '../helpers/navigation';
+import { captureScreenshot } from '../helpers/screenshot';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+/** Subset of the axe-core AxeResults shape we need. */
+interface AxeResults {
+  violations: Array<{
+    id: string;
+    impact?: string | null;
+    description: string;
+    help: string;
+    helpUrl: string;
+    nodes: Array<{ html: string }>;
+  }>;
+}
+
+function execFilePromise(
+  file: string,
+  args: string[],
+): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(file, args, { shell: true }, (error, stdout, stderr) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve({ stdout: stdout ?? '', stderr: stderr ?? '' });
+    });
+  });
+}
+
+/** Map axe-core impact values to FindingSeverity. */
+export function mapAxeImpact(impact: string | null): FindingSeverity {
+  switch ((impact ?? '').toLowerCase()) {
+    case 'critical': return 'critical';
+    case 'serious': return 'high';
+    case 'moderate': return 'medium';
+    case 'minor': return 'low';
+    default: return 'low';
+  }
+}
+
+export class A11yGuardianAgent extends BaseAgent {
+  readonly agentId = 8;
+  readonly agentName = 'A11y Guardian';
+
+  protected async preFlight(): Promise<void> {
+    await execFilePromise('npx', ['playwright', '--version']);
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    if (!env) {
+      findings.push({
+        id: `${this.agentId}-no-env`,
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'a11y-guardian',
+        description: 'No environment configured — cannot perform accessibility scan',
+      });
+      return findings;
+    }
+
+    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
+    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${env.baseUrl}${rawLoginUrl}`;
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    if (!credentials) {
+      findings.push({
+        id: `${this.agentId}-no-credentials`,
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'a11y-guardian',
+        description: 'No credentials configured — cannot log in for accessibility scan',
+      });
+      return findings;
+    }
+
+    const { chromium } = await import('playwright');
+    const { AxeBuilder } = await import('@axe-core/playwright');
+
+    let browser: Browser | null = null;
+    let page: Page | null = null;
+
+    try {
+      browser = await chromium.launch({ headless: true });
+      page = await browser.newPage();
+
+      try {
+        await login(page, credentials, loginUrl);
+      } catch (loginError) {
+        findings.push({
+          id: `${this.agentId}-login-failed`,
+          type: 'infra-issue',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: 'auth',
+          description: `Login failed (will scan anonymously): ${loginError instanceof Error ? loginError.message.split('\n')[0] : String(loginError)}`,
+        });
+        // Navigate to baseUrl so anonymous scanning can proceed
+        await page.goto(env.baseUrl, { waitUntil: 'networkidle', timeout: 10000 }).catch(() => {});
+      }
+
+      for (const module of this.config.modules) {
+        try {
+          await navigateToSection(page, module.id, this.config);
+          await waitForSectionLoad(page);
+        } catch (navErr) {
+          findings.push({
+            id: `${this.agentId}-nav-${module.id}`,
+            type: 'infra-issue',
+            severity: 'high',
+            agentId: this.agentId,
+            module: module.id,
+            description: `[A11y] Navigation to module "${module.id}" failed: ${navErr instanceof Error ? navErr.message : String(navErr)}`,
+          });
+          continue;
+        }
+
+        const screenshotPath = await captureScreenshot(
+          page,
+          `a11y-${module.id}`,
+          this.runDir,
+        );
+        this.addEvidence({
+          type: 'screenshot',
+          path: screenshotPath,
+          description: `A11y scan screenshot for module "${module.id}"`,
+        });
+
+        let axeResults: AxeResults;
+        try {
+          axeResults = await new AxeBuilder({ page }).analyze();
+        } catch (axeErr) {
+          findings.push({
+            id: `${this.agentId}-axe-error-${module.id}`,
+            type: 'infra-issue',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: module.id,
+            description: `[A11y] axe-core scan failed for module "${module.id}": ${axeErr instanceof Error ? axeErr.message : String(axeErr)}`,
+          });
+          continue;
+        }
+
+        for (const violation of axeResults.violations) {
+          const severity = mapAxeImpact(violation.impact ?? null);
+          const nodeCount = violation.nodes.length;
+
+          findings.push({
+            id: `${this.agentId}-axe-${module.id}-${violation.id}`,
+            type: 'code-bug-logic',
+            severity,
+            agentId: this.agentId,
+            module: module.id,
+            description:
+              `[A11y] ${violation.description} (rule: ${violation.id}, ${nodeCount} node${nodeCount !== 1 ? 's' : ''})`,
+            screenshot: screenshotPath,
+            suggestedFix: violation.help,
+          });
+        }
+      }
+
+      // Optional: Lighthouse CI
+      await this.runLighthouseIfAvailable();
+
+      // Optional: Pa11y CI
+      await this.runPa11yIfAvailable();
+    } finally {
+      if (page) await page.close().catch(() => undefined);
+      if (browser) await browser.close().catch(() => undefined);
+    }
+
+    return findings;
+  }
+
+  private async runLighthouseIfAvailable(): Promise<void> {
+    try {
+      await execFilePromise('npx', ['lhci', 'autorun']);
+      this.addEvidence({
+        type: 'report',
+        path: 'lhci-report',
+        description: 'Lighthouse CI accessibility report',
+      });
+    } catch {
+      // Lighthouse not available or failed — non-fatal, skip silently
+    }
+  }
+
+  private async runPa11yIfAvailable(): Promise<void> {
+    try {
+      await execFilePromise('npx', ['pa11y-ci']);
+      this.addEvidence({
+        type: 'report',
+        path: 'pa11y-report',
+        description: 'Pa11y CI accessibility report',
+      });
+    } catch {
+      // Pa11y not available or failed — non-fatal, skip silently
+    }
+  }
+}