@avi770/testteam 2.0.0 → 3.2.0

package/agents/17-documentation-validator.ts

@@ -1,266 +0,0 @@
-import { readdir, readFile, stat } from 'node:fs/promises';
-import { join } from 'path';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-
-/** Regex to extract URLs from markdown link syntax [text](url) */
-const MARKDOWN_LINK_REGEX = /\[.*?\]\((https?:\/\/[^)]+)\)/g;
-
-/** Regex to extract bare URLs (not inside markdown link parens) */
-const BARE_URL_REGEX = /(?<!\()(https?:\/\/[^\s"'<>)\]]+)/g;
-
-/** Regex to find catch blocks that swallow errors with just a log */
-const BARE_CATCH_LOG_REGEX = /catch\s*\([^)]*\)\s*\{[^}]*(?:console\.log|console\.error|logger\.\w+)\s*\(\s*(?:\w+\.message|error\.message)\s*\)[^}]*\}/g;
-
-async function fileExists(p: string): Promise<boolean> {
-  try { await stat(p); return true; } catch { return false; }
-}
-
-async function isDirectory(p: string): Promise<boolean> {
-  try { return (await stat(p)).isDirectory(); } catch { return false; }
-}
-
-export class DocumentationValidatorAgent extends BaseAgent {
-  readonly agentId = 17;
-  readonly agentName = 'Documentation Validator';
-
-  protected async preFlight(): Promise<void> {
-    const projectRoot = this.resolveProjectRoot();
-
-    const readmeExists = await fileExists(join(projectRoot, 'README.md'));
-    const docsExists = await fileExists(join(projectRoot, 'docs'));
-
-    if (!readmeExists && !docsExists) {
-      throw new Error(
-        'No README.md or docs/ directory found — nothing to validate',
-      );
-    }
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const projectRoot = this.resolveProjectRoot();
-
-    // 1. Collect all markdown files from project root and docs/
-    const markdownFiles = await this.collectMarkdownFiles(projectRoot);
-
-    // 2. Extract all URLs from markdown files
-    const urlSources = await this.extractUrlsFromFiles(markdownFiles);
-
-    // 3. HTTP HEAD each URL — create finding for 404/5xx
-    const brokenLinkFindings = await this.checkUrls(urlSources);
-    findings.push(...brokenLinkFindings);
-
-    // 4. Scan source code for catch blocks that only log error.message
-    const catchFindings = await this.scanForBareCatchLogs(projectRoot);
-    findings.push(...catchFindings);
-
-    return findings;
-  }
-
-  // ---------------------------------------------------------------------------
-  // Helpers
-  // ---------------------------------------------------------------------------
-
-  /**
-   * Resolve the project root. The runDir is typically a subdirectory created
-   * for the current test run; the actual project root is the repo root.
-   * We walk upward from runDir until we find a package.json or use CWD.
-   */
-  private resolveProjectRoot(): string {
-    // Prefer process.cwd() — the test runner / CLI always sets CWD to repo root
-    return process.cwd();
-  }
-
-  /** Recursively collect .md files from projectRoot and any docs/ sub-directory. */
-  private async collectMarkdownFiles(projectRoot: string): Promise<string[]> {
-    const files: string[] = [];
-
-    // Root-level .md files
-    try {
-      const rootEntries = await readdir(projectRoot);
-      for (const entry of rootEntries) {
-        if (entry.endsWith('.md')) {
-          files.push(join(projectRoot, entry));
-        }
-      }
-    } catch {
-      // Cannot read project root — return empty
-      return files;
-    }
-
-    // docs/ sub-directory (recursive)
-    const docsDir = join(projectRoot, 'docs');
-    const docsIsDir = await isDirectory(docsDir);
-    if (docsIsDir) {
-      await this.walkMarkdownFiles(docsDir, files);
-    }
-
-    return files;
-  }
-
-  private async walkMarkdownFiles(dir: string, results: string[]): Promise<void> {
-    let entries: string[];
-    try {
-      entries = await readdir(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const fullPath = join(dir, entry);
-      try {
-        const s = await stat(fullPath);
-        if (s.isDirectory()) {
-          await this.walkMarkdownFiles(fullPath, results);
-        } else if (entry.endsWith('.md')) {
-          results.push(fullPath);
-        }
-      } catch {
-        // Skip unreadable entries
-      }
-    }
-  }
-
-  /**
-   * Extract all HTTP/HTTPS URLs from the given markdown files.
-   * Returns a map: url → source file path.
-   */
-  private async extractUrlsFromFiles(files: string[]): Promise<Map<string, string>> {
-    const urlMap = new Map<string, string>();
-
-    for (const filePath of files) {
-      let content: string;
-      try {
-        content = await readFile(filePath, 'utf-8');
-      } catch {
-        continue;
-      }
-
-      // Markdown link syntax
-      for (const match of content.matchAll(MARKDOWN_LINK_REGEX)) {
-        const url = match[1];
-        if (url && !urlMap.has(url)) {
-          urlMap.set(url, filePath);
-        }
-      }
-
-      // Bare URLs not already captured via markdown links
-      for (const match of content.matchAll(BARE_URL_REGEX)) {
-        const url = match[0];
-        if (url && !urlMap.has(url)) {
-          urlMap.set(url, filePath);
-        }
-      }
-    }
-
-    return urlMap;
-  }
-
-  /** HEAD each URL; create a 'low' finding for 404 or 5xx responses. */
-  private async checkUrls(urlSources: Map<string, string>): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    let findingIndex = 0;
-
-    for (const [url, sourceFile] of urlSources) {
-      let status: number | null = null;
-
-      try {
-        const response = await fetch(url, {
-          method: 'HEAD',
-          signal: AbortSignal.timeout(10_000),
-          redirect: 'follow',
-        });
-        status = response.status;
-      } catch {
-        // Network error — treat as unreachable
-        status = null;
-      }
-
-      const isBroken =
-        status === null ||
-        status === 404 ||
-        status >= 500;
-
-      if (isBroken) {
-        const statusLabel = status !== null ? String(status) : 'unreachable';
-        findings.push({
-          id: `${this.agentId}-broken-link-${findingIndex++}`,
-          type: 'test-bug',
-          severity: 'low',
-          agentId: this.agentId,
-          module: 'documentation',
-          description: `Broken link [${statusLabel}]: ${url}`,
-          file: sourceFile,
-        });
-      }
-    }
-
-    return findings;
-  }
-
-  /**
-   * Scan TypeScript / JavaScript source files for catch blocks that only log
-   * error.message without providing a user-friendly message.
-   */
-  private async scanForBareCatchLogs(projectRoot: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const srcDirs = ['src', 'apps', 'libs', 'packages'];
-
-    for (const dir of srcDirs) {
-      const fullDir = join(projectRoot, dir);
-      const dirExists = await fileExists(fullDir);
-      if (!dirExists) continue;
-
-      const sourceFiles: string[] = [];
-      await this.walkSourceFiles(fullDir, sourceFiles);
-
-      for (const filePath of sourceFiles) {
-        let content: string;
-        try {
-          content = await readFile(filePath, 'utf-8');
-        } catch {
-          continue;
-        }
-
-        const matches = content.match(BARE_CATCH_LOG_REGEX);
-        if (matches && matches.length > 0) {
-          findings.push({
-            id: `${this.agentId}-bare-catch-${filePath.replace(/[^a-z0-9]/gi, '-').slice(-60)}`,
-            type: 'code-bug-logic',
-            severity: 'low',
-            agentId: this.agentId,
-            module: 'error-handling',
-            description: `${matches.length} catch block(s) in "${filePath}" only log error.message without a user-friendly message`,
-            file: filePath,
-            suggestedFix: 'Replace bare error.message logs with structured error responses that include user-friendly messages',
-          });
-        }
-      }
-    }
-
-    return findings;
-  }
-
-  private async walkSourceFiles(dir: string, results: string[]): Promise<void> {
-    let entries: string[];
-    try {
-      entries = await readdir(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry === 'node_modules' || entry === 'dist' || entry === '.git') continue;
-      const fullPath = join(dir, entry);
-      try {
-        const s = await stat(fullPath);
-        if (s.isDirectory()) {
-          await this.walkSourceFiles(fullPath, results);
-        } else if (entry.endsWith('.ts') || entry.endsWith('.js')) {
-          results.push(fullPath);
-        }
-      } catch {
-        // Skip unreadable entries
-      }
-    }
-  }
-}

package/agents/18-integration-watchdog.ts

@@ -1,178 +0,0 @@
-import { execFile } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { BaseAgent } from './base-agent';
-import type { Finding } from '../core/types';
-
-interface ExecResult {
-  stdout: string;
-  stderr: string;
-}
-
-function runVitest(vitestConfigPath: string, cwd: string): Promise<ExecResult> {
-  return new Promise<ExecResult>((resolveP, rejectP) => {
-    execFile(
-      'npx',
-      ['vitest', 'run', '--config', vitestConfigPath],
-      { cwd, shell: true },
-      (err, stdout, stderr) => {
-        if (err) {
-          const enriched = Object.assign(new Error(err.message), {
-            stdout: stdout ?? '',
-            stderr: stderr ?? '',
-          });
-          rejectP(enriched);
-          return;
-        }
-        resolveP({ stdout: stdout ?? '', stderr: stderr ?? '' });
-      },
-    );
-  });
-}
-
-export class IntegrationWatchdogAgent extends BaseAgent {
-  readonly agentId = 18;
-  readonly agentName = 'Integration Watchdog';
-  private repoRoot = '';
-
-  protected async preFlight(): Promise<void> {
-    this.repoRoot = this.config.projectRoot ?? process.cwd();
-
-    if (this.config.integrations.length === 0) {
-      throw new Error(
-        'IntegrationWatchdogAgent requires at least one integration in config.integrations',
-      );
-    }
-
-    // Verify worker directories exist
-    const workersDir = resolve(this.repoRoot, 'apps', 'workers');
-    if (!existsSync(workersDir)) {
-      throw new Error(`Worker directory not found: ${workersDir}`);
-    }
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    // -----------------------------------------------------------------------
-    // Worker coverage checks
-    // -----------------------------------------------------------------------
-    for (const worker of this.config.workers) {
-      const workerName = worker.name;
-
-      // Check source file exists
-      const workerSrcCandidates = [
-        resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.ts`),
-        resolve(this.repoRoot, 'apps', 'workers', 'src', workerName, 'index.ts'),
-        resolve(this.repoRoot, 'apps', 'workers', `${workerName}.ts`),
-      ];
-
-      const workerSrcExists = workerSrcCandidates.some((p) => existsSync(p));
-      if (!workerSrcExists) {
-        findings.push({
-          id: `${this.agentId}-worker-missing-${workerName}`,
-          type: 'infra-issue',
-          severity: 'medium',
-          agentId: this.agentId,
-          module: `worker:${workerName}`,
-          description:
-            `Worker source file not found for "${workerName}". ` +
-            `Searched: ${workerSrcCandidates.join(', ')}`,
-          suggestedFix: `Create the worker source file at apps/workers/src/${workerName}.ts`,
-        });
-        continue;
-      }
-
-      // Check test files exist
-      const workerTestCandidates = [
-        resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.test.ts`),
-        resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.spec.ts`),
-        resolve(this.repoRoot, 'apps', 'workers', '__tests__', `${workerName}.test.ts`),
-        resolve(this.repoRoot, 'apps', 'workers', 'src', workerName, `${workerName}.test.ts`),
-      ];
-
-      const workerTestExists = workerTestCandidates.some((p) => existsSync(p));
-      if (!workerTestExists) {
-        findings.push({
-          id: `${this.agentId}-worker-no-tests-${workerName}`,
-          type: 'test-bug',
-          severity: 'medium',
-          agentId: this.agentId,
-          module: `worker:${workerName}`,
-          description: `No test file found for worker "${workerName}".`,
-          suggestedFix: `Add tests at apps/workers/src/${workerName}.test.ts`,
-        });
-      }
-    }
-
-    // -----------------------------------------------------------------------
-    // Run worker tests if workers config and vitest config exist
-    // -----------------------------------------------------------------------
-    if (this.config.workers.length > 0) {
-      const vitestConfig = resolve(this.repoRoot, 'apps', 'workers', 'vitest.config.ts');
-      if (existsSync(vitestConfig)) {
-        try {
-          await runVitest(vitestConfig, this.repoRoot);
-        } catch (error) {
-          const stderr =
-            error instanceof Error && 'stderr' in error
-              ? String((error as NodeJS.ErrnoException & { stderr?: string }).stderr)
-              : String(error);
-          const stdout =
-            error instanceof Error && 'stdout' in error
-              ? String((error as NodeJS.ErrnoException & { stdout?: string }).stdout)
-              : '';
-
-          findings.push({
-            id: `${this.agentId}-worker-tests-failed`,
-            type: 'test-bug',
-            severity: 'high',
-            agentId: this.agentId,
-            module: 'workers',
-            description: `Worker test suite failed.\n${stderr || stdout}`,
-            suggestedFix: 'Fix the failing worker tests before promoting to UAT.',
-          });
-        }
-      }
-    }
-
-    // -----------------------------------------------------------------------
-    // Integration sandbox checks
-    // -----------------------------------------------------------------------
-    for (const integration of this.config.integrations) {
-      const integrationName = integration.name;
-
-      // Detect sandbox availability — look for connection config
-      const connectionConfigCandidates = [
-        resolve(this.repoRoot, 'apps', 'workers', 'src', 'integrations', `${integrationName}.ts`),
-        resolve(this.repoRoot, 'apps', 'api', 'src', 'integrations', `${integrationName}.ts`),
-        resolve(
-          this.repoRoot,
-          'apps',
-          'workers',
-          'src',
-          'integrations',
-          `${integrationName}-sandbox.ts`,
-        ),
-      ];
-
-      const sandboxAvailable = connectionConfigCandidates.some((p) => existsSync(p));
-
-      if (!sandboxAvailable) {
-        findings.push({
-          id: `${this.agentId}-integration-no-sandbox-${integrationName}`,
-          type: 'infra-issue',
-          severity: 'low',
-          agentId: this.agentId,
-          module: `integration:${integrationName}`,
-          description:
-            `Advisory: No sandbox connection config found for integration "${integrationName}". ` +
-            `End-to-end integration testing cannot be performed automatically.`,
-          suggestedFix: `Add a sandbox configuration at apps/workers/src/integrations/${integrationName}.ts`,
-        });
-      }
-    }
-
-    return findings;
-  }
-}

package/agents/19-tenant-isolation-auditor.ts

@@ -1,199 +0,0 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { ApiClient } from '../helpers/api-client';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-export class TenantIsolationAuditorAgent extends BaseAgent {
-  readonly agentId = 19;
-  readonly agentName = 'Tenant Isolation Auditor';
-
-  protected async preFlight(): Promise<void> {
-    if (!this.config.tenancy.enabled) {
-      throw new Error(
-        'TenantIsolationAuditorAgent requires config.tenancy.enabled to be true',
-      );
-    }
-
-    if (this.config.tenancy.testFirms.length < 1) {
-      throw new Error(
-        'TenantIsolationAuditorAgent requires at least one firm in config.tenancy.testFirms',
-      );
-    }
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    const { env, fallback } = await resolveEnvironment(this.config, this.phase);
-
-    if (!env) {
-      findings.push({
-        id: `${this.agentId}-no-env`,
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'tenancy',
-        description: 'No environment configured — cannot run tenant isolation audit',
-      });
-      return findings;
-    }
-
-    const credentials =
-      this.config.auth.credentials?.['admin'] ??
-      Object.values(this.config.auth.credentials ?? {})[0];
-
-    if (!credentials) {
-      findings.push({
-        id: `${this.agentId}-no-credentials`,
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'tenancy',
-        description: 'No credentials configured — cannot authenticate for tenant isolation audit',
-      });
-      return findings;
-    }
-
-    const firmA = this.config.tenancy.testFirms[0]!;
-    const firmB =
-      this.config.tenancy.testFirms.length > 1 ? this.config.tenancy.testFirms[1] : null;
-    const isolationField = this.config.tenancy.isolationField;
-
-    let client: ApiClient;
-    try {
-      client = await ApiClient.createAuthenticated(env.baseUrl, credentials);
-    } catch (error) {
-      // Auth failure is always medium — indicates missing API or wrong credentials, not a tenant isolation bug
-      const authSeverity = 'medium' as const;
-      findings.push({
-        id: `${this.agentId}-auth-failed`,
-        type: 'infra-issue',
-        severity: authSeverity,
-        agentId: this.agentId,
-        module: 'tenancy',
-        description: `Authentication failed for tenant isolation audit: ${error instanceof Error ? error.message : String(error)}`,
-      });
-      return findings;
-    }
-
-    // -----------------------------------------------------------------------
-    // Test 1: URL tampering — access resources with wrong firmId in URL
-    // -----------------------------------------------------------------------
-    const urlTamperPaths = [
-      `/api/clients?${isolationField}=${firmA}`,
-      `/api/invoices?${isolationField}=${firmA}`,
-      `/api/transactions?${isolationField}=${firmA}`,
-    ];
-
-    // Use firmB if available, otherwise try a synthetic non-existent firm
-    const wrongFirm = firmB ?? 'wrong-firm-99999';
-
-    for (const basePath of urlTamperPaths) {
-      const tamperedPath = basePath.replace(`${isolationField}=${firmA}`, `${isolationField}=${wrongFirm}`);
-      let response;
-      try {
-        response = await client.get(tamperedPath);
-      } catch {
-        // Network or parse error — skip this path
-        continue;
-      }
-
-      if (response.status === 200) {
-        const hasData =
-          Array.isArray(response.body)
-            ? (response.body as unknown[]).length > 0
-            : response.body !== null && typeof response.body === 'object';
-
-        if (hasData) {
-          findings.push({
-            id: `${this.agentId}-url-tamper-${tamperedPath.replace(/[^a-zA-Z0-9]/g, '-')}`,
-            type: 'code-bug-security',
-            severity: 'critical',
-            agentId: this.agentId,
-            module: 'tenancy',
-            description:
-              `URL tampering data leak: GET ${tamperedPath} returned 200 with data while authenticated as firm "${firmA}". ` +
-              `Firm "${wrongFirm}" data should not be accessible.`,
-            suggestedFix:
-              `Enforce tenant scoping in all query handlers — always filter by the authenticated user's ${isolationField}, ignoring URL parameters.`,
-          });
-        }
-      }
-    }
-
-    // -----------------------------------------------------------------------
-    // Test 2: API parameter tampering — POST with different firmId
-    // -----------------------------------------------------------------------
-    const postPaths = ['/api/clients/search', '/api/invoices/search', '/api/reports/generate'];
-
-    for (const path of postPaths) {
-      let response;
-      try {
-        response = await client.post(path, { [isolationField]: wrongFirm, limit: 5 });
-      } catch {
-        continue;
-      }
-
-      if (response.status === 200) {
-        const hasData =
-          Array.isArray(response.body)
-            ? (response.body as unknown[]).length > 0
-            : response.body !== null && typeof response.body === 'object';
-
-        if (hasData) {
-          findings.push({
-            id: `${this.agentId}-param-tamper-${path.replace(/\//g, '-')}`,
-            type: 'code-bug-security',
-            severity: 'critical',
-            agentId: this.agentId,
-            module: 'tenancy',
-            description:
-              `API parameter tampering data leak: POST ${path} with ${isolationField}=${wrongFirm} returned 200 with data ` +
-              `while authenticated as firm "${firmA}".`,
-            suggestedFix:
-              `Never trust ${isolationField} from the request body — always derive it from the authenticated user's JWT claims.`,
-          });
-        }
-      }
-    }
-
-    // -----------------------------------------------------------------------
-    // Test 3: Search isolation — search for firm B data while logged in as firm A
-    // -----------------------------------------------------------------------
-    if (firmB !== null) {
-      const searchPaths = [
-        { path: `/api/clients/search`, body: { query: firmB, limit: 5 } },
-        { path: `/api/invoices/search`, body: { query: firmB, limit: 5 } },
-      ];
-
-      for (const { path, body } of searchPaths) {
-        let response;
-        try {
-          response = await client.post(path, body);
-        } catch {
-          continue;
-        }
-
-        if (response.status === 200) {
-          const results = Array.isArray(response.body) ? (response.body as unknown[]) : [];
-          if (results.length > 0) {
-            findings.push({
-              id: `${this.agentId}-search-isolation-${path.replace(/\//g, '-')}`,
-              type: 'code-bug-security',
-              severity: 'critical',
-              agentId: this.agentId,
-              module: 'tenancy',
-              description:
-                `Search isolation failure: POST ${path} with query for firm "${firmB}" ` +
-                `returned ${results.length} result(s) while authenticated as firm "${firmA}".`,
-              suggestedFix:
-                'All search handlers must apply tenant scoping before executing the query.',
-            });
-          }
-        }
-      }
-    }
-
-    return findings;
-  }
-}