@avi770/testteam 1.2.0

package/agents/13-performance-profiler.ts

@@ -0,0 +1,271 @@
+import type { Browser, Page } from 'playwright';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { login, navigateToSection } from '../helpers/navigation';
+import { resolveEnvironment, isUrlReachable } from '../helpers/env-resolver';
+
+/** LCP threshold in milliseconds (Core Web Vitals "Good" boundary). */
+const LCP_THRESHOLD_MS = 2500;
+
+/** FCP threshold in milliseconds (Core Web Vitals "Good" boundary). */
+const FCP_THRESHOLD_MS = 1800;
+
+/** JS heap size threshold: 100 MB in bytes. */
+const HEAP_SIZE_THRESHOLD_BYTES = 100 * 1024 * 1024;
+
+interface NavigationEntry {
+  loadEventEnd: number;
+  startTime: number;
+}
+
+interface PaintEntry {
+  name: string;
+  startTime: number;
+}
+
+interface MemoryInfo {
+  usedJSHeapSize: number;
+}
+
+interface ExtendedPerformance extends Performance {
+  memory?: MemoryInfo;
+}
+
+export class PerformanceProfilerAgent extends BaseAgent {
+  readonly agentId = 13;
+  readonly agentName = 'Performance Profiler';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
+    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    if (!credentials) {
+      findings.push({
+        id: '13-no-credentials',
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'performance-profiler',
+        description: 'No credentials configured in auth.credentials — cannot log in',
+      });
+      return findings;
+    }
+
+    const { chromium } = await import('playwright');
+
+    let browser: Browser | null = null;
+    let page: Page | null = null;
+
+    try {
+      browser = await chromium.launch({ headless: true });
+      page = await browser.newPage();
+
+      await login(page, credentials, loginUrl);
+
+      for (const module of this.config.modules) {
+        const moduleFindings = await this.profileModule(page, module.id);
+        findings.push(...moduleFindings);
+      }
+
+      // Check memory after navigating all sections (Chromium only)
+      const memoryFindings = await this.checkMemoryUsage(page);
+      findings.push(...memoryFindings);
+
+      // Run Lighthouse if available
+      const lighthouseFindings = await this.runLighthouse(this.baseUrl);
+      findings.push(...lighthouseFindings);
+    } finally {
+      if (page) await page.close().catch(() => undefined);
+      if (browser) await browser.close().catch(() => undefined);
+    }
+
+    return findings;
+  }
+
+  private async profileModule(page: Page, moduleId: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      await navigateToSection(page, moduleId, this.config);
+    } catch (navErr) {
+      findings.push({
+        id: `13-nav-${moduleId}`,
+        type: 'infra-issue',
+        severity: 'high',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Navigation to module "${moduleId}" failed: ${navErr instanceof Error ? navErr.message : String(navErr)}`,
+      });
+      return findings;
+    }
+
+    // Measure navigation load time
+    const loadTimeMs = await page
+      .evaluate((): number => {
+        const entries = performance.getEntriesByType('navigation') as unknown as NavigationEntry[];
+        if (entries.length === 0) return 0;
+        const nav = entries[0];
+        return nav.loadEventEnd - nav.startTime;
+      })
+      .catch(() => 0);
+
+    this.addEvidence({
+      type: 'log',
+      path: `${this.runDir}/perf-${moduleId}.json`,
+      description: `Performance metrics for module "${moduleId}" — loadTime: ${loadTimeMs}ms`,
+    });
+
+    // Measure paint timings (FCP / LCP)
+    const paintEntriesRaw = await page
+      .evaluate((): PaintEntry[] => {
+        return performance.getEntriesByType('paint').map((e) => ({
+          name: e.name,
+          startTime: e.startTime,
+        }));
+      })
+      .catch(() => [] as PaintEntry[]);
+
+    const paintEntries: PaintEntry[] = Array.isArray(paintEntriesRaw) ? paintEntriesRaw : [];
+    const fcpEntry = paintEntries.find((e) => e.name === 'first-contentful-paint');
+    const fcpMs = fcpEntry?.startTime ?? 0;
+
+    // LCP is reported via PerformanceObserver; use largest-contentful-paint entries if present
+    const lcpMs = await page
+      .evaluate((): number => {
+        const entries = performance.getEntriesByType(
+          'largest-contentful-paint',
+        ) as Array<{ startTime: number }>;
+        if (entries.length === 0) return 0;
+        return entries[entries.length - 1].startTime;
+      })
+      .catch(() => 0);
+
+    if (fcpMs > FCP_THRESHOLD_MS) {
+      findings.push({
+        id: `13-fcp-${moduleId}`,
+        type: 'code-bug-logic',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `First Contentful Paint for module "${moduleId}" is ${fcpMs.toFixed(0)}ms (threshold: ${FCP_THRESHOLD_MS}ms)`,
+        suggestedFix:
+          'Reduce server response time, eliminate render-blocking resources, or defer non-critical scripts',
+      });
+    }
+
+    if (lcpMs > LCP_THRESHOLD_MS) {
+      findings.push({
+        id: `13-lcp-${moduleId}`,
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Largest Contentful Paint for module "${moduleId}" is ${lcpMs.toFixed(0)}ms (threshold: ${LCP_THRESHOLD_MS}ms)`,
+        suggestedFix:
+          'Optimise hero images, preload critical assets, or reduce Time To First Byte',
+      });
+    }
+
+    if (loadTimeMs > 0 && loadTimeMs > this.config.thresholds.apiResponseTime * 2) {
+      findings.push({
+        id: `13-load-time-${moduleId}`,
+        type: 'code-bug-logic',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Page load time for module "${moduleId}" is ${loadTimeMs.toFixed(0)}ms (threshold: ${this.config.thresholds.apiResponseTime * 2}ms)`,
+        suggestedFix: 'Review waterfall of network requests and defer non-critical loading',
+      });
+    }
+
+    return findings;
+  }
+
+  private async checkMemoryUsage(page: Page): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const usedHeap = await page
+        .evaluate((): number => {
+          const perf = performance as ExtendedPerformance;
+          return perf.memory?.usedJSHeapSize ?? 0;
+        })
+        .catch(() => 0);
+
+      if (usedHeap > HEAP_SIZE_THRESHOLD_BYTES) {
+        const usedMb = (usedHeap / 1024 / 1024).toFixed(1);
+        const thresholdMb = (HEAP_SIZE_THRESHOLD_BYTES / 1024 / 1024).toFixed(0);
+        findings.push({
+          id: '13-memory-heap',
+          type: 'code-bug-logic',
+          severity: 'high',
+          agentId: this.agentId,
+          module: 'memory',
+          description: `JS heap size after navigating all modules is ${usedMb}MB (threshold: ${thresholdMb}MB). Possible memory leak.`,
+          suggestedFix:
+            'Profile with Chrome DevTools Memory panel, check for event listener leaks and large retained objects',
+        });
+      }
+    } catch {
+      // memory API is Chromium-only; ignore on other browsers
+    }
+
+    return findings;
+  }
+
+  private async runLighthouse(baseUrl: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      // Dynamically import lighthouse — it is an optional peer dependency.
+      // Use a variable to prevent TypeScript from statically resolving the module.
+      const lighthouseModuleName = 'lighthouse';
+      const lighthouse = await import(/* webpackIgnore: true */ lighthouseModuleName).catch((): null => null) as { default?: (...args: unknown[]) => Promise<unknown> } | null;
+      if (!lighthouse?.default) return findings;
+
+      const run = lighthouse.default as (url: string, opts: Record<string, unknown>) => Promise<{ lhr: { categories: Record<string, { score: number | null }> } } | undefined>;
+
+      const result = await run(baseUrl, {
+        onlyCategories: ['performance'],
+        output: 'json',
+        logLevel: 'silent',
+      });
+
+      if (!result) return findings;
+
+      const perfScore = (result.lhr.categories['performance']?.score ?? null);
+      if (perfScore === null) return findings;
+
+      const perfPercent = Math.round(perfScore * 100);
+      const threshold = this.config.thresholds.lighthouse.performance;
+
+      if (perfPercent < threshold) {
+        findings.push({
+          id: '13-lighthouse-performance',
+          type: 'code-bug-logic',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: 'lighthouse',
+          description: `Lighthouse performance score is ${perfPercent} (threshold: ${threshold})`,
+          suggestedFix:
+            'Address Lighthouse performance opportunities: reduce unused JavaScript, serve next-gen images, avoid large layout shifts',
+        });
+      }
+    } catch {
+      // Lighthouse not installed or audit failed — skip without failing
+    }
+
+    return findings;
+  }
+}

package/agents/14-data-integrity-auditor.ts

@@ -0,0 +1,417 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { ApiClient } from '../helpers/api-client';
+import { resolveEnvironment, isUrlReachable } from '../helpers/env-resolver';
+
+/** Shape returned by the /api/clients endpoint for a single client record. */
+interface ClientRecord {
+  id: string;
+  name: string;
+  email: string;
+  amount?: number;
+  createdAt?: string;
+  [key: string]: unknown;
+}
+
+/** Payload used when creating a test client. */
+interface CreateClientPayload {
+  name: string;
+  email: string;
+  amount?: number;
+  testRecord?: boolean;
+  timezone?: string;
+}
+
+export class DataIntegrityAuditorAgent extends BaseAgent {
+  readonly agentId = 14;
+  readonly agentName = 'Data Integrity Auditor';
+
+  protected async preFlight(): Promise<void> {
+    if (!this.config.accuracy.enabled) {
+      throw new Error(
+        'config.accuracy.enabled is false — Data Integrity Auditor requires accuracy checks to be enabled',
+      );
+    }
+
+    const { env, fallback } = await resolveEnvironment(this.config, this.phase);
+
+    if (!env) {
+      throw new Error('No environment configured — cannot verify API reachability');
+    }
+
+    // If we fell back to alpha, don't throw on unreachable — execute() will handle it gracefully
+    if (!fallback) {
+      const reachable = await isUrlReachable(env.baseUrl);
+      if (!reachable) {
+        throw new Error(`API base URL is not reachable: ${env.baseUrl}`);
+      }
+    }
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    const { env, fallback } = await resolveEnvironment(this.config, this.phase);
+
+    if (!env) {
+      findings.push({
+        id: '14-no-env',
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: 'No environment configured — cannot determine base URL',
+      });
+      return findings;
+    }
+
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    if (!credentials) {
+      findings.push({
+        id: '14-no-credentials',
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: 'No credentials configured in auth.credentials — cannot authenticate',
+      });
+      return findings;
+    }
+
+    let client: ApiClient;
+    try {
+      client = await ApiClient.createAuthenticated(env.baseUrl, credentials);
+    } catch (authErr) {
+      // Auth failure is always medium — indicates missing API or wrong credentials, not a data integrity bug
+      const authSeverity = 'medium' as const;
+      findings.push({
+        id: '14-auth-failed',
+        type: 'infra-issue',
+        severity: authSeverity,
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `Authentication failed: ${authErr instanceof Error ? authErr.message : String(authErr)}`,
+      });
+      return findings;
+    }
+
+    // CRUD round-trip tests
+    const crudFindings = await this.testCrudRoundTrip(client);
+    findings.push(...crudFindings);
+
+    // Decimal precision test
+    const decimalFindings = await this.testDecimalPrecision(client);
+    findings.push(...decimalFindings);
+
+    // Timezone test
+    const timezoneFindings = await this.testTimezone(client);
+    findings.push(...timezoneFindings);
+
+    return findings;
+  }
+
+  private async testCrudRoundTrip(client: ApiClient): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    let createdId: string | null = null;
+
+    const createPayload: CreateClientPayload = {
+      name: 'TF-DataIntegrity-Test',
+      email: `tf-integrity-${Date.now()}@test.invalid`,
+      testRecord: true,
+    };
+
+    // CREATE
+    let createResp;
+    try {
+      createResp = await client.post('/api/clients', createPayload);
+    } catch (err) {
+      findings.push({
+        id: '14-crud-create-error',
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `POST /api/clients failed: ${err instanceof Error ? err.message : String(err)}`,
+      });
+      return findings;
+    }
+
+    if (createResp.status !== 200 && createResp.status !== 201) {
+      findings.push({
+        id: '14-crud-create-status',
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `POST /api/clients returned ${createResp.status} — expected 200 or 201`,
+      });
+      return findings;
+    }
+
+    const created = createResp.body as ClientRecord;
+    createdId = created?.id ?? null;
+
+    if (!createdId) {
+      findings.push({
+        id: '14-crud-create-no-id',
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: 'POST /api/clients response did not include an `id` field',
+      });
+      return findings;
+    }
+
+    // READ — verify all fields match what was sent
+    let readResp;
+    try {
+      readResp = await client.get(`/api/clients/${createdId}`);
+    } catch (err) {
+      findings.push({
+        id: `14-crud-read-error-${createdId}`,
+        type: 'infra-issue',
+        severity: 'critical',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `GET /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
+      });
+      return findings;
+    }
+
+    if (readResp.status !== 200) {
+      findings.push({
+        id: `14-crud-read-status-${createdId}`,
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `GET /api/clients/${createdId} returned ${readResp.status} — expected 200 after create`,
+      });
+    } else {
+      const read = readResp.body as ClientRecord;
+      // Verify fields match
+      const mismatches: string[] = [];
+      if (read.name !== createPayload.name) {
+        mismatches.push(`name: sent "${createPayload.name}", got "${read.name}"`);
+      }
+      if (read.email !== createPayload.email) {
+        mismatches.push(`email: sent "${createPayload.email}", got "${read.email}"`);
+      }
+
+      if (mismatches.length > 0) {
+        findings.push({
+          id: `14-crud-field-mismatch-${createdId}`,
+          type: 'code-bug-logic',
+          severity: 'high',
+          agentId: this.agentId,
+          module: 'data-integrity',
+          description: `CREATE→READ field mismatch for client ${createdId}: ${mismatches.join('; ')}`,
+          suggestedFix: 'Verify the API serialises and persists all fields from the request body',
+        });
+      }
+    }
+
+    // UPDATE
+    const updatePayload = { name: 'TF-DataIntegrity-Updated' };
+    let updateResp;
+    try {
+      updateResp = await client.put(`/api/clients/${createdId}`, updatePayload);
+    } catch (err) {
+      findings.push({
+        id: `14-crud-update-error-${createdId}`,
+        type: 'infra-issue',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `PUT /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
+      });
+    }
+
+    if (updateResp && (updateResp.status === 200 || updateResp.status === 204)) {
+      // Read back and verify update was applied
+      const afterUpdateResp = await client.get(`/api/clients/${createdId}`).catch(() => null);
+      if (afterUpdateResp && afterUpdateResp.status === 200) {
+        const updated = afterUpdateResp.body as ClientRecord;
+        if (updated.name !== updatePayload.name) {
+          findings.push({
+            id: `14-crud-update-mismatch-${createdId}`,
+            type: 'code-bug-logic',
+            severity: 'high',
+            agentId: this.agentId,
+            module: 'data-integrity',
+            description:
+              `UPDATE→READ mismatch for client ${createdId}: name should be "${updatePayload.name}" but got "${updated.name}"`,
+            suggestedFix: 'Verify the API persists PUT request body fields correctly',
+          });
+        }
+      }
+    }
+
+    // DELETE
+    let deleteResp;
+    try {
+      deleteResp = await client.delete(`/api/clients/${createdId}`);
+    } catch (err) {
+      findings.push({
+        id: `14-crud-delete-error-${createdId}`,
+        type: 'infra-issue',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `DELETE /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
+      });
+      return findings;
+    }
+
+    if (deleteResp.status !== 200 && deleteResp.status !== 204) {
+      findings.push({
+        id: `14-crud-delete-status-${createdId}`,
+        type: 'code-bug-logic',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `DELETE /api/clients/${createdId} returned ${deleteResp.status} — expected 200 or 204`,
+      });
+    }
+
+    // Verify 404 after delete
+    const afterDeleteResp = await client.get(`/api/clients/${createdId}`).catch(() => null);
+    if (afterDeleteResp && afterDeleteResp.status !== 404) {
+      findings.push({
+        id: `14-crud-delete-verify-${createdId}`,
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: 'data-integrity',
+        description: `GET /api/clients/${createdId} returned ${afterDeleteResp.status} after DELETE — expected 404`,
+        suggestedFix: 'Ensure DELETE removes the record and subsequent GET returns 404',
+      });
+    }
+
+    return findings;
+  }
+
+  private async testDecimalPrecision(client: ApiClient): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const precision = this.config.accuracy.decimalPrecision;
+    const testAmount = 1000.105;
+
+    let createdId: string | null = null;
+
+    try {
+      const createPayload: CreateClientPayload = {
+        name: 'TF-Decimal-Test',
+        email: `tf-decimal-${Date.now()}@test.invalid`,
+        amount: testAmount,
+        testRecord: true,
+      };
+
+      const createResp = await client.post('/api/clients', createPayload);
+      if (createResp.status !== 200 && createResp.status !== 201) {
+        // API may not support amount field — skip precision check
+        return findings;
+      }
+
+      const created = createResp.body as ClientRecord;
+      createdId = created?.id ?? null;
+      if (!createdId) return findings;
+
+      const readResp = await client.get(`/api/clients/${createdId}`);
+      if (readResp.status !== 200) return findings;
+
+      const record = readResp.body as ClientRecord;
+      const storedAmount = record?.amount;
+
+      if (storedAmount !== undefined && storedAmount !== null) {
+        // Check drift: compare to expected precision
+        const factor = Math.pow(10, precision);
+        const expected = Math.round(testAmount * factor) / factor;
+        const stored = Math.round(Number(storedAmount) * factor) / factor;
+
+        if (expected !== stored) {
+          findings.push({
+            id: `14-decimal-drift-${createdId}`,
+            type: 'code-bug-logic',
+            severity: 'high',
+            agentId: this.agentId,
+            module: 'data-integrity',
+            description:
+              `Decimal precision drift: sent amount ${testAmount}, stored as ${storedAmount}. ` +
+              `Expected ${expected} at ${precision} decimal places, got ${stored}`,
+            suggestedFix:
+              'Use NUMERIC/DECIMAL SQL types with explicit precision rather than FLOAT. ' +
+              'Validate and round amounts to configured decimal precision on input.',
+          });
+        }
+      }
+    } catch {
+      // Endpoint may not support amount — skip
+    } finally {
+      if (createdId) {
+        await client.delete(`/api/clients/${createdId}`).catch(() => undefined);
+      }
+    }
+
+    return findings;
+  }
+
+  private async testTimezone(client: ApiClient): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const expectedTimezone = this.config.accuracy.timezone;
+    let createdId: string | null = null;
+
+    try {
+      const createPayload: CreateClientPayload = {
+        name: 'TF-Timezone-Test',
+        email: `tf-tz-${Date.now()}@test.invalid`,
+        testRecord: true,
+      };
+
+      const createResp = await client.post('/api/clients', createPayload);
+      if (createResp.status !== 200 && createResp.status !== 201) return findings;
+
+      const created = createResp.body as ClientRecord;
+      createdId = created?.id ?? null;
+      if (!createdId) return findings;
+
+      const readResp = await client.get(`/api/clients/${createdId}`);
+      if (readResp.status !== 200) return findings;
+
+      const record = readResp.body as ClientRecord;
+      const createdAt = record?.createdAt;
+
+      if (createdAt && typeof createdAt === 'string') {
+        // ISO 8601 dates should end with Z (UTC) or include timezone offset
+        const isUtc = createdAt.endsWith('Z') || createdAt.includes('+00:00');
+        const isConfiguredTz = expectedTimezone === 'UTC' ? isUtc : createdAt.includes(expectedTimezone);
+
+        if (!isConfiguredTz && !isUtc) {
+          findings.push({
+            id: `14-timezone-mismatch-${createdId}`,
+            type: 'code-bug-logic',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'data-integrity',
+            description:
+              `Timezone mismatch: createdAt "${createdAt}" does not reflect configured timezone "${expectedTimezone}"`,
+            suggestedFix:
+              'Ensure all datetime fields are stored and returned in the configured timezone. ' +
+              'Store as UTC and convert on display, or consistently use the configured timezone.',
+          });
+        }
+      }
+    } catch {
+      // Endpoint may not return createdAt — skip
+    } finally {
+      if (createdId) {
+        await client.delete(`/api/clients/${createdId}`).catch(() => undefined);
+      }
+    }
+
+    return findings;
+  }
+}