@avi770/testteam 3.0.0 → 3.2.0

package/agents/39-api-contract-tester.ts

@@ -1,199 +0,0 @@
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-const REQUEST_TIMEOUT_MS = 10_000;
-
-interface OpenApiPath {
-  [method: string]: {
-    responses?: Record<string, {
-      content?: Record<string, {
-        schema?: OpenApiSchema;
-      }>;
-    }>;
-  };
-}
-
-interface OpenApiSchema {
-  type?: string;
-  properties?: Record<string, OpenApiSchema>;
-  items?: OpenApiSchema;
-  required?: string[];
-}
-
-interface OpenApiSpec {
-  paths?: Record<string, OpenApiPath>;
-}
-
-export class ApiContractTesterAgent extends BaseAgent {
-  readonly agentId = 39;
-  readonly agentName = 'API Contract Tester';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const projectRoot = this.config.projectRoot ?? process.cwd();
-
-    // Try to find OpenAPI spec
-    const specPaths = [
-      join(projectRoot, 'openapi.json'),
-      join(projectRoot, 'swagger.json'),
-      join(projectRoot, 'docs', 'openapi.json'),
-      join(projectRoot, 'docs', 'swagger.json'),
-    ];
-
-    let spec: OpenApiSpec | null = null;
-    let specPath = '';
-
-    for (const path of specPaths) {
-      try {
-        const content = await readFile(path, 'utf-8');
-        spec = JSON.parse(content) as OpenApiSpec;
-        specPath = path;
-        break;
-      } catch {
-        // File not found — try next
-      }
-    }
-
-    if (!spec) {
-      findings.push({
-        id: `${this.agentId}-no-spec`,
-        type: 'infra-issue',
-        severity: 'low',
-        agentId: this.agentId,
-        module: 'api-contract-tester',
-        description: 'No OpenAPI/Swagger spec found — cannot validate API contracts',
-      });
-      return findings;
-    }
-
-    this.addEvidence({
-      type: 'report',
-      path: specPath,
-      description: `Using OpenAPI spec from ${specPath}`,
-    });
-
-    const paths = spec.paths ?? {};
-
-    for (const [path, methods] of Object.entries(paths)) {
-      for (const [method, definition] of Object.entries(methods)) {
-        if (method.startsWith('x-') || method === 'parameters') continue;
-        const httpMethod = method.toUpperCase();
-        if (!['GET', 'POST', 'PUT', 'DELETE', 'PATCH'].includes(httpMethod)) continue;
-
-        const contractFindings = await this.testEndpoint(path, httpMethod, definition);
-        findings.push(...contractFindings);
-      }
-    }
-
-    return findings;
-  }
-
-  private async testEndpoint(
-    path: string,
-    method: string,
-    definition: OpenApiPath[string],
-  ): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const url = `${this.baseUrl}${path}`;
-
-    try {
-      const response = await Promise.race([
-        fetch(url, {
-          method,
-          headers: { 'Content-Type': 'application/json' },
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        }),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-        ),
-      ]) as Response;
-
-      const statusStr = String(response.status);
-      const responseDef = definition.responses?.[statusStr] ?? definition.responses?.['200'];
-
-      if (!responseDef) {
-        return findings;
-      }
-
-      const jsonContent = responseDef.content?.['application/json'];
-      if (!jsonContent?.schema) {
-        return findings;
-      }
-
-      let body: unknown;
-      const contentType = response.headers.get('content-type') ?? '';
-      if (contentType.includes('application/json')) {
-        body = await response.json();
-      } else {
-        return findings;
-      }
-
-      const schemaFindings = this.validateSchema(
-        body,
-        jsonContent.schema,
-        `${method} ${path}`,
-      );
-      findings.push(...schemaFindings);
-    } catch {
-      // Request failed — endpoint may not be reachable
-    }
-
-    return findings;
-  }
-
-  private validateSchema(
-    body: unknown,
-    schema: OpenApiSchema,
-    context: string,
-  ): Finding[] {
-    const findings: Finding[] = [];
-
-    if (schema.type === 'object' && schema.properties && typeof body === 'object' && body !== null) {
-      const record = body as Record<string, unknown>;
-
-      // Check required fields
-      for (const field of schema.required ?? []) {
-        if (!(field in record)) {
-          findings.push({
-            id: `${this.agentId}-missing-field-${context.replace(/\s/g, '-')}-${field}`,
-            type: 'test-bug',
-            severity: 'medium',
-            agentId: this.agentId,
-            module: 'api-contract-tester',
-            description: `Missing required field "${field}" in response for ${context}`,
-          });
-        }
-      }
-
-      // Check types of present fields
-      for (const [field, fieldSchema] of Object.entries(schema.properties)) {
-        if (field in record && fieldSchema.type) {
-          const actualType = Array.isArray(record[field]) ? 'array' : typeof record[field];
-          const expectedType = fieldSchema.type === 'integer' ? 'number' : fieldSchema.type;
-
-          if (actualType !== expectedType && record[field] !== null) {
-            findings.push({
-              id: `${this.agentId}-wrong-type-${context.replace(/\s/g, '-')}-${field}`,
-              type: 'test-bug',
-              severity: 'high',
-              agentId: this.agentId,
-              module: 'api-contract-tester',
-              description: `Wrong type for field "${field}" in ${context}: expected ${expectedType}, got ${actualType}`,
-            });
-          }
-        }
-      }
-    }
-
-    return findings;
-  }
-}

package/agents/40-rate-limit-tester.ts

@@ -1,94 +0,0 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-const REQUEST_TIMEOUT_MS = 10_000;
-const RAPID_REQUEST_COUNT = 50;
-
-/** Default endpoints to test for rate limiting. */
-const DEFAULT_ENDPOINTS = [
-  '/api/auth/login',
-  '/api/tasks',
-  '/api/clients',
-] as const;
-
-export class RateLimitTesterAgent extends BaseAgent {
-  readonly agentId = 40;
-  readonly agentName = 'Rate Limit Tester';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const endpoints = this.discoverEndpoints();
-
-    for (const endpoint of endpoints) {
-      const endpointFindings = await this.testRateLimit(endpoint);
-      findings.push(...endpointFindings);
-    }
-
-    return findings;
-  }
-
-  private discoverEndpoints(): string[] {
-    if (this.config.modules && this.config.modules.length > 0) {
-      return this.config.modules.map(m => `/api${m.route}`);
-    }
-    return [...DEFAULT_ENDPOINTS];
-  }
-
-  private async testRateLimit(endpoint: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const url = `${this.baseUrl}${endpoint}`;
-    let got429 = false;
-    let successCount = 0;
-    let errorCount = 0;
-
-    const promises = Array.from({ length: RAPID_REQUEST_COUNT }, async () => {
-      try {
-        const response = await Promise.race([
-          fetch(url, {
-            method: 'GET',
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-          }),
-          new Promise<never>((_, reject) =>
-            setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-          ),
-        ]) as Response;
-
-        if (response.status === 429) {
-          got429 = true;
-        } else {
-          successCount++;
-        }
-      } catch {
-        errorCount++;
-      }
-    });
-
-    await Promise.all(promises);
-
-    if (!got429) {
-      findings.push({
-        id: `${this.agentId}-no-rate-limit-${endpoint.replace(/\//g, '_')}`,
-        type: 'code-bug-security',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'rate-limit-tester',
-        description: `No rate limiting on endpoint ${endpoint} — sent ${RAPID_REQUEST_COUNT} rapid requests with no 429 response`,
-      });
-    }
-
-    this.addEvidence({
-      type: 'log',
-      path: `rate-limit-${endpoint.replace(/\//g, '_')}`,
-      description: `Rate limit test for ${endpoint}: 429=${got429}, successes=${successCount}, errors=${errorCount}`,
-    });
-
-    return findings;
-  }
-}

package/agents/41-api-pagination-tester.ts

@@ -1,97 +0,0 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-const REQUEST_TIMEOUT_MS = 10_000;
-
-/** Edge-case pagination parameters to test. */
-const PAGINATION_TESTS = [
-  { param: 'page=0', description: 'page=0 (zero-indexed edge case)' },
-  { param: 'page=-1', description: 'page=-1 (negative page)' },
-  { param: 'page=99999', description: 'page=99999 (very high page)' },
-  { param: 'limit=0', description: 'limit=0 (zero limit)' },
-  { param: 'limit=10000', description: 'limit=10000 (excessively high limit)' },
-] as const;
-
-export class ApiPaginationTesterAgent extends BaseAgent {
-  readonly agentId = 41;
-  readonly agentName = 'API Pagination Tester';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const endpoints = this.discoverListEndpoints();
-
-    for (const endpoint of endpoints) {
-      for (const test of PAGINATION_TESTS) {
-        const testFindings = await this.testPagination(endpoint, test.param, test.description);
-        findings.push(...testFindings);
-      }
-    }
-
-    return findings;
-  }
-
-  private discoverListEndpoints(): string[] {
-    if (this.config.modules && this.config.modules.length > 0) {
-      return this.config.modules.map(m => `/api${m.route}`);
-    }
-    return ['/api/tasks', '/api/clients'];
-  }
-
-  private async testPagination(
-    endpoint: string,
-    queryParam: string,
-    description: string,
-  ): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const url = `${this.baseUrl}${endpoint}?${queryParam}`;
-
-    try {
-      const response = await Promise.race([
-        fetch(url, {
-          method: 'GET',
-          headers: { 'Content-Type': 'application/json' },
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        }),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-        ),
-      ]) as Response;
-
-      // Check for server errors (crashes)
-      if (response.status >= 500) {
-        findings.push({
-          id: `${this.agentId}-crash-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
-          type: 'code-bug-logic',
-          severity: 'high',
-          agentId: this.agentId,
-          module: 'api-pagination-tester',
-          description: `Endpoint ${endpoint} returned ${response.status} for ${description} — server crash on edge-case pagination`,
-        });
-      }
-
-      this.addEvidence({
-        type: 'log',
-        path: `pagination-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
-        description: `${endpoint}?${queryParam}: status=${response.status}`,
-      });
-    } catch (error) {
-      findings.push({
-        id: `${this.agentId}-error-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
-        type: 'infra-issue',
-        severity: 'low',
-        agentId: this.agentId,
-        module: 'api-pagination-tester',
-        description: `Failed to test ${endpoint} with ${description}: ${error instanceof Error ? error.message : String(error)}`,
-      });
-    }
-
-    return findings;
-  }
-}

package/agents/42-graphql-tester.ts

@@ -1,222 +0,0 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-const REQUEST_TIMEOUT_MS = 10_000;
-
-const GRAPHQL_PATHS = ['/graphql', '/api/graphql'] as const;
-
-/** Standard introspection query. */
-const INTROSPECTION_QUERY = '{ __schema { types { name } } }';
-
-/** Deeply nested query (10+ levels). */
-function buildDeepQuery(depth: number): string {
-  let query = '{ __typename';
-  const openBraces: string[] = [];
-  for (let i = 0; i < depth; i++) {
-    query += ` __type(name: "Query") { name fields { name type { name`;
-    openBraces.push(' } }');
-  }
-  query += openBraces.reverse().join('');
-  query += ' }';
-  return query;
-}
-
-export class GraphqlTesterAgent extends BaseAgent {
-  readonly agentId = 42;
-  readonly agentName = 'GraphQL Tester';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    // Discover GraphQL endpoint
-    let graphqlUrl: string | null = null;
-
-    for (const path of GRAPHQL_PATHS) {
-      const url = `${this.baseUrl}${path}`;
-      try {
-        const response = await Promise.race([
-          fetch(url, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ query: '{ __typename }' }),
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-          }),
-          new Promise<never>((_, reject) =>
-            setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-          ),
-        ]) as Response;
-
-        if (response.status !== 404) {
-          graphqlUrl = url;
-          break;
-        }
-      } catch {
-        // Path not available
-      }
-    }
-
-    if (!graphqlUrl) {
-      findings.push({
-        id: `${this.agentId}-no-graphql`,
-        type: 'infra-issue',
-        severity: 'low',
-        agentId: this.agentId,
-        module: 'graphql-tester',
-        description: 'No GraphQL endpoint found at /graphql or /api/graphql',
-      });
-      return findings;
-    }
-
-    // Test 1: Introspection
-    const introspectionFindings = await this.testIntrospection(graphqlUrl);
-    findings.push(...introspectionFindings);
-
-    // Test 2: Deep query (depth limiting)
-    const depthFindings = await this.testQueryDepth(graphqlUrl);
-    findings.push(...depthFindings);
-
-    // Test 3: Unauthenticated access
-    const authFindings = await this.testUnauthenticatedAccess(graphqlUrl);
-    findings.push(...authFindings);
-
-    return findings;
-  }
-
-  private async testIntrospection(graphqlUrl: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    try {
-      const response = await Promise.race([
-        fetch(graphqlUrl, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ query: INTROSPECTION_QUERY }),
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        }),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-        ),
-      ]) as Response;
-
-      if (response.status === 200) {
-        const body = await response.json() as { data?: { __schema?: unknown } };
-        if (body.data?.__schema) {
-          findings.push({
-            id: `${this.agentId}-introspection-enabled`,
-            type: 'code-bug-security',
-            severity: 'medium',
-            agentId: this.agentId,
-            module: 'graphql-tester',
-            description: 'GraphQL introspection is enabled in production — schema is exposed to attackers',
-          });
-        }
-      }
-
-      this.addEvidence({
-        type: 'log',
-        path: 'graphql-introspection',
-        description: `Introspection query: status=${response.status}`,
-      });
-    } catch {
-      // Request failed
-    }
-
-    return findings;
-  }
-
-  private async testQueryDepth(graphqlUrl: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const deepQuery = buildDeepQuery(10);
-
-    try {
-      const response = await Promise.race([
-        fetch(graphqlUrl, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ query: deepQuery }),
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        }),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-        ),
-      ]) as Response;
-
-      if (response.status === 200) {
-        const body = await response.json() as { errors?: unknown[] };
-        if (!body.errors) {
-          findings.push({
-            id: `${this.agentId}-no-depth-limit`,
-            type: 'code-bug-security',
-            severity: 'high',
-            agentId: this.agentId,
-            module: 'graphql-tester',
-            description: 'No query depth limit on GraphQL endpoint — deeply nested queries (10+ levels) are accepted without error',
-          });
-        }
-      }
-
-      this.addEvidence({
-        type: 'log',
-        path: 'graphql-depth',
-        description: `Deep query test (10 levels): status=${response.status}`,
-      });
-    } catch {
-      // Request failed
-    }
-
-    return findings;
-  }
-
-  private async testUnauthenticatedAccess(graphqlUrl: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    // Send a query that would typically need auth
-    const query = '{ users { id email } }';
-
-    try {
-      const response = await Promise.race([
-        fetch(graphqlUrl, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          // No Authorization header
-          body: JSON.stringify({ query }),
-          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        }),
-        new Promise<never>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
-        ),
-      ]) as Response;
-
-      if (response.status === 200) {
-        const body = await response.json() as { data?: { users?: unknown[] } };
-        if (body.data?.users && Array.isArray(body.data.users) && body.data.users.length > 0) {
-          findings.push({
-            id: `${this.agentId}-no-field-auth`,
-            type: 'code-bug-security',
-            severity: 'high',
-            agentId: this.agentId,
-            module: 'graphql-tester',
-            description: 'GraphQL returns user data without authentication — field-level authorization is missing',
-          });
-        }
-      }
-
-      this.addEvidence({
-        type: 'log',
-        path: 'graphql-unauth',
-        description: `Unauthenticated query test: status=${response.status}`,
-      });
-    } catch {
-      // Request failed
-    }
-
-    return findings;
-  }
-}