@birdapi/velinstyle 1.2.1 → 1.3.0

package/core/security/rules/repo/index.js

@@ -0,0 +1,143 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+export function registerRepoRules() {
+  registerSecurityRule({
+    id: 'repo.package-json',
+    category: 'repo',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'audit'],
+    title: 'package.json',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'package.json'))) return [];
+      return [{
+        ruleId: 'repo.package-json',
+        category: 'repo',
+        severity: 'error',
+        message: 'package.json missing',
+        path: 'package.json',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.codeowners',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'CODEOWNERS',
+    run(ctx) {
+      if (
+        fileExists(join(ctx.root, 'CODEOWNERS'))
+        || fileExists(join(ctx.root, '.github', 'CODEOWNERS'))
+      ) return [];
+      return [{
+        ruleId: 'repo.codeowners',
+        category: 'repo',
+        severity: 'info',
+        message: 'CODEOWNERS not found',
+        fix: 'Add .github/CODEOWNERS for review ownership',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.dependabot',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'Dependabot / Renovate',
+    run(ctx) {
+      if (
+        fileExists(join(ctx.root, '.github', 'dependabot.yml'))
+        || fileExists(join(ctx.root, 'renovate.json'))
+        || fileExists(join(ctx.root, '.github', 'renovate.json'))
+      ) return [];
+      return [{
+        ruleId: 'repo.dependabot',
+        category: 'repo',
+        severity: 'info',
+        message: 'No Dependabot/Renovate config',
+        fix: 'Enable dependency update automation',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.backup-files',
+    category: 'repo',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'audit', 'scan'],
+    title: 'Backup / debug files',
+    run(ctx) {
+      const files = walkFiles(
+        ctx.root,
+        (n) => /\.(bak|old|tmp|swp)$/i.test(n) || /^debug\.log$/i.test(n),
+        40,
+      );
+      return files.map((abs) => ({
+        ruleId: 'repo.backup-files',
+        category: 'repo',
+        severity: 'warning',
+        message: 'Backup/debug file in tree',
+        path: rel(ctx.root, abs),
+        fix: 'Delete or gitignore',
+      }));
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.exec-spawn',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'child_process usage',
+    run(ctx) {
+      const files = walkFiles(
+        ctx.root,
+        (n, abs) => /\.(js|mjs|cjs)$/i.test(n) && !abs.includes(`${join('node_modules')}`),
+        120,
+      );
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs);
+        if (!t) continue;
+        if (/child_process|execSync|spawnSync|\bexec\(|\bspawn\(/.test(t)) {
+          const path = rel(ctx.root, abs);
+          if (path.startsWith('cli/') || path.startsWith('scripts/') || path.startsWith('core/security/')) {
+            continue; // allowlisted tooling
+          }
+          findings.push({
+            ruleId: 'repo.exec-spawn',
+            category: 'repo',
+            severity: 'info',
+            message: 'Process spawn/exec detected — review for injection',
+            path,
+          });
+        }
+      }
+      return findings.slice(0, 25);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.publishconfig',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'publishConfig',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (!pkg || pkg.name !== '@birdapi/velinstyle') return [];
+      if (pkg.publishConfig?.access === 'public') return [];
+      return [{
+        ruleId: 'repo.publishconfig',
+        category: 'repo',
+        severity: 'info',
+        message: 'Consider publishConfig.access=public for scoped package',
+        path: 'package.json',
+      }];
+    },
+  });
+}

package/core/security/rules/secrets/index.js

@@ -0,0 +1,133 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+const SECRET_RE =
+  /(?:api[_-]?key|secret|token|password|passwd|auth[_-]?token)\s*[=:]\s*['"][^'"]{8,}['"]/i;
+const AWS_RE = /AKIA[0-9A-Z]{16}/;
+const PRIVATE_KEY = /-----BEGIN (?:RSA |OPENSSH )?PRIVATE KEY-----/;
+
+export function registerSecretsRules() {
+  registerSecurityRule({
+    id: 'secrets.env-tracked',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit', 'publish'],
+    title: 'Tracked .env',
+    description: '.env must not be committed.',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.env', '.env.local', '.env.production']) {
+        const p = join(ctx.root, name);
+        if (fileExists(p)) {
+          findings.push({
+            ruleId: 'secrets.env-tracked',
+            category: 'secrets',
+            severity: 'error',
+            message: `${name} exists in project root — ensure it is gitignored and not committed`,
+            path: name,
+            fix: 'Add to .gitignore; use secrets manager / CI secrets',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.gitignore-env',
+    category: 'secrets',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'secrets', 'audit'],
+    title: '.gitignore covers .env',
+    run(ctx) {
+      const gi = readText(join(ctx.root, '.gitignore')) || '';
+      if (!gi.includes('.env')) {
+        return [{
+          ruleId: 'secrets.gitignore-env',
+          category: 'secrets',
+          severity: 'warning',
+          message: '.gitignore does not mention .env',
+          path: '.gitignore',
+          fix: 'Add .env and .env.* to .gitignore',
+        }];
+      }
+      return [];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.npmrc-auth',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit', 'publish'],
+    title: 'npmrc auth token',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.npmrc', '.npmrc.local']) {
+        const t = readText(join(ctx.root, name));
+        if (t && /_authToken|_auth\s*=|\/\/.*:_password=/i.test(t)) {
+          findings.push({
+            ruleId: 'secrets.npmrc-auth',
+            category: 'secrets',
+            severity: 'error',
+            message: `${name} contains auth credentials`,
+            path: name,
+            fix: 'Use env NPM_TOKEN; never commit tokens',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.hardcoded',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'scan', 'audit'],
+    title: 'Hardcoded secrets',
+    run(ctx) {
+      const findings = [];
+      const files = walkFiles(
+        ctx.root,
+        (n) => /\.(js|mjs|cjs|ts|json|env|yml|yaml|sh|ps1|html)$/i.test(n),
+        200,
+      );
+      for (const abs of files) {
+        const t = readText(abs);
+        if (!t) continue;
+        if (PRIVATE_KEY.test(t) || AWS_RE.test(t) || SECRET_RE.test(t)) {
+          findings.push({
+            ruleId: 'secrets.hardcoded',
+            category: 'secrets',
+            severity: 'error',
+            message: 'Possible hardcoded secret or private key',
+            path: rel(ctx.root, abs),
+            fix: 'Remove secret; rotate if exposed',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.pem-files',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit'],
+    title: 'PEM / key files',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.(pem|key|p12|pfx)$/i.test(n), 50);
+      return files.map((abs) => ({
+        ruleId: 'secrets.pem-files',
+        category: 'secrets',
+        severity: 'error',
+        message: 'Key/certificate file present in tree',
+        path: rel(ctx.root, abs),
+        fix: 'Store outside repo / use secret store',
+      }));
+    },
+  });
+}

package/core/security/score/dependency-health.js

@@ -0,0 +1,53 @@
+/**
+ * Dependency Health summary from findings + package.json heuristics.
+ * Note: "outdated" here is heuristic (message/code), not live `npm outdated`.
+ */
+import { join } from 'path';
+import { fileExists, readJson } from '../checks/fs.js';
+
+/**
+ * @param {string} root
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function computeDependencyHealth(root, findings) {
+  const depFindings = findings.filter(
+    (f) =>
+      (f.category === 'deps' || f.ruleId?.startsWith('deps.'))
+      || f.category === 'malware'
+      || f.ruleId?.includes('lifecycle')
+      || f.ruleId?.includes('lockfile')
+      || f.ruleId?.includes('typosquat'),
+  );
+
+  const pkg = readJson(join(root, 'package.json')) || {};
+  const hasLock = fileExists(join(root, 'package-lock.json')) || fileExists(join(root, 'pnpm-lock.yaml')) || fileExists(join(root, 'yarn.lock'));
+
+  let deprecated = depFindings.filter((f) => /deprecat/i.test(f.message) || f.code === 'deprecated').length;
+  let noLockfile = depFindings.filter((f) => f.code === 'no-lockfile' || f.ruleId === 'deps.lockfile').length;
+  if (!hasLock && noLockfile === 0) noLockfile = 1;
+  // Heuristic "outdated" only when explicitly coded/messaged — not lockfile absence
+  let outdated = depFindings.filter((f) =>
+    f.code === 'outdated' || (/outdated/i.test(f.message) && f.code !== 'no-lockfile'),
+  ).length;
+  let critical = depFindings.filter((f) => f.severity === 'error').length;
+
+  let score = 100;
+  score -= critical * 20;
+  score -= deprecated * 8;
+  score -= outdated * 5;
+  score -= noLockfile * 15;
+  if (!pkg.engines?.node) score -= 3;
+  score = Math.max(0, Math.min(100, score));
+
+  return {
+    score,
+    deprecated,
+    outdated,
+    noLockfile,
+    critical,
+    hasLockfile: hasLock,
+    hasEngines: Boolean(pkg.engines?.node),
+    note: 'outdated is heuristic only (no live npm outdated)',
+    gate: critical > 0 ? 'fail' : score < 80 ? 'warn' : 'pass',
+  };
+}

package/core/security/score/release-health.js

@@ -0,0 +1,66 @@
+/**
+ * Release Health — pre-publish gate summary.
+ */
+import { join } from 'path';
+import { fileExists, readJson, readText } from '../checks/fs.js';
+import { execSync } from 'child_process';
+
+/**
+ * @param {string} root
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function computeReleaseHealth(root, findings) {
+  const pkg = readJson(join(root, 'package.json')) || {};
+  const version = pkg.version || '';
+
+  const checks = {
+    readme: fileExists(join(root, 'README.md')),
+    changelog: fileExists(join(root, 'CHANGELOG.md')),
+    license: fileExists(join(root, 'LICENSE')) || fileExists(join(root, 'LICENSE.md')) || Boolean(pkg.license),
+    securityMd: fileExists(join(root, 'SECURITY.md')),
+    releaseNotes:
+      fileExists(join(root, `RELEASE_NOTES_${version}.md`))
+      || (version && (readText(join(root, 'CHANGELOG.md')) || '').includes(`[${version}]`)),
+    provenance:
+      Boolean(pkg.publishConfig?.provenance)
+      || /id-token\s*:\s*write/.test(readText(join(root, '.github', 'workflows', 'publish-npm.yml')) || ''),
+  };
+
+  let tagOk = null;
+  let cleanTree = null;
+  try {
+        const tag = execSync(`git tag -l "v${version}"`, { cwd: root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        tagOk = Boolean(tag);
+      } catch {
+        tagOk = null;
+      }
+      try {
+        const dirty = execSync('git status --porcelain', { cwd: root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        cleanTree = dirty.length === 0;
+  } catch {
+    cleanTree = null;
+  }
+
+  const publishErrors = findings.filter(
+    (f) => (f.category === 'publish' || f.ruleId?.startsWith('publish.') || f.ruleId?.startsWith('release.')) && f.severity === 'error',
+  ).length;
+
+  const missing = Object.entries(checks).filter(([, v]) => !v).map(([k]) => k);
+  let score = 100;
+  score -= missing.length * 10;
+  score -= publishErrors * 15;
+  if (tagOk === false) score -= 8;
+  if (cleanTree === false) score -= 5;
+  score = Math.max(0, Math.min(100, score));
+
+  const ready = publishErrors === 0 && checks.readme && checks.changelog && checks.license && checks.securityMd;
+  return {
+    score,
+    gate: ready ? (missing.length || cleanTree === false ? 'warn' : 'pass') : 'fail',
+    ready: ready && publishErrors === 0,
+    status: ready && publishErrors === 0 ? 'READY FOR PUBLISH' : 'BLOCKED',
+    checks: { ...checks, tagMatchesVersion: tagOk, workingTreeClean: cleanTree },
+    missing,
+    version,
+  };
+}

package/core/security/score/score.js

@@ -0,0 +1,102 @@
+/**
+ * Aggregate Security Engine findings into category scores + overall.
+ */
+
+const SEV_WEIGHT = { error: 18, warning: 8, info: 2 };
+
+/**
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function scoreFindings(findings) {
+  const byCat = {};
+  for (const f of findings) {
+    const cat = f.code || f.category || 'repo';
+    // findings carry rule category via ruleId prefix or explicit
+  }
+
+  const categories = {
+    supplyChain: { label: 'Supply Chain', findings: [] },
+    secrets: { label: 'Secrets', findings: [] },
+    dependencies: { label: 'Dependencies', findings: [] },
+    publish: { label: 'Publish', findings: [] },
+    ci: { label: 'CI', findings: [] },
+    workflows: { label: 'Workflows', findings: [] },
+    malware: { label: 'Malware', findings: [] },
+    repo: { label: 'Repository', findings: [] },
+    consumer: { label: 'Consumer', findings: [] },
+  };
+
+  for (const f of findings) {
+    const cat = mapFindingCategory(f);
+    if (!categories[cat]) categories[cat] = { label: cat, findings: [] };
+    categories[cat].findings.push(f);
+  }
+
+  /** @type {Record<string, { score: number, gate: string, label: string, count: number }>} */
+  const scores = {};
+  let totalDeduction = 0;
+  let errorCount = 0;
+
+  for (const [key, bucket] of Object.entries(categories)) {
+    let ded = 0;
+    for (const f of bucket.findings) {
+      ded += SEV_WEIGHT[f.severity] || 4;
+      if (f.severity === 'error') errorCount += 1;
+    }
+    ded = Math.min(100, ded);
+    const score = Math.max(0, 100 - ded);
+    const gate = gateFromFindings(bucket.findings);
+    if (key === 'malware' && bucket.findings.length === 0) {
+      scores[key] = {
+        score: null,
+        na: true,
+        gate: 'pass',
+        label: bucket.label,
+        count: 0,
+        note: 'no malware rules fired',
+      };
+    } else {
+      scores[key] = { score, gate, label: bucket.label, count: bucket.findings.length };
+      totalDeduction += ded * 0.12;
+    }
+  }
+
+  const securityScore = Math.max(0, Math.min(100, Math.round(100 - totalDeduction)));
+  const overallGate = errorCount > 0 ? 'fail' : Object.values(scores).some((s) => s.gate === 'warn') ? 'warn' : 'pass';
+  const overall = overallGate === 'fail' ? 'BLOCKED' : overallGate === 'warn' ? 'READY_WITH_WARNINGS' : 'READY';
+
+  return { securityScore, scores, overall, overallGate, findings };
+}
+
+function mapFindingCategory(f) {
+  if (f.category) {
+    if (f.category === 'deps') return 'dependencies';
+    if (f.category === 'ci') return 'ci';
+    if (f.category === 'secrets') return 'secrets';
+    if (f.category === 'publish') return 'publish';
+    if (f.category === 'malware') return 'malware';
+    if (f.category === 'consumer') return 'consumer';
+    if (f.category === 'repo') return 'repo';
+  }
+  const id = f.ruleId || '';
+  if (id.startsWith('secrets.') || id.startsWith('secret.')) return 'secrets';
+  if (id === 'deps.lifecycle-hooks' || id === 'deps.typosquat' || id.startsWith('malware.')) return 'malware';
+  if (id.startsWith('deps.') || id.startsWith('dependency.')) return 'dependencies';
+  if (id.startsWith('workflow.') || id.startsWith('ci.')) return 'ci';
+  if (id.startsWith('publish.') || id.startsWith('release.')) return 'publish';
+  if (id.startsWith('consumer.')) return 'consumer';
+  if (id.includes('supply') || id.startsWith('lockfile') || id.startsWith('lifecycle')) return 'supplyChain';
+  return 'repo';
+}
+
+function gateFromFindings(findings) {
+  if (findings.some((f) => f.severity === 'error')) return 'fail';
+  if (findings.some((f) => f.severity === 'warning')) return 'warn';
+  return 'pass';
+}
+
+export function gateLabel(gate) {
+  if (gate === 'fail') return 'FAIL';
+  if (gate === 'warn') return 'WARNING';
+  return 'PASS';
+}

package/core/security/timeline/timeline.js

@@ -0,0 +1,76 @@
+/**
+ * Security Timeline — local last-run stamps.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+const CATEGORIES = ['repository', 'dependencies', 'publish', 'ci', 'secrets', 'consumer', 'audit'];
+
+/**
+ * @param {string} root
+ */
+export function timelinePath(root) {
+  return join(root, '.velin', 'security', 'timeline.json');
+}
+
+/**
+ * @param {string} root
+ */
+export function loadTimeline(root) {
+  const p = timelinePath(root);
+  if (!existsSync(p)) {
+    return { version: 1, entries: {} };
+  }
+  try {
+    return JSON.parse(readFileSync(p, 'utf-8'));
+  } catch {
+    return { version: 1, entries: {} };
+  }
+}
+
+/**
+ * @param {string} root
+ * @param {string[]} categories
+ * @param {Date} [when]
+ */
+export function touchTimeline(root, categories, when = new Date()) {
+  const data = loadTimeline(root);
+  const iso = when.toISOString();
+  const dateLabel = when.toLocaleDateString('de-DE', { day: '2-digit', month: '2-digit', year: 'numeric' });
+  for (const c of categories) {
+    const key = normalizeCat(c);
+    data.entries[key] = { at: iso, label: dateLabel };
+  }
+  const p = timelinePath(root);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, `${JSON.stringify(data, null, 2)}\n`, 'utf-8');
+  return data;
+}
+
+function normalizeCat(c) {
+  if (c === 'repo') return 'repository';
+  if (c === 'deps') return 'dependencies';
+  return c;
+}
+
+/**
+ * Rows for Experience / report.
+ * @param {ReturnType<typeof loadTimeline>} data
+ */
+export function timelineRows(data) {
+  const labels = {
+    repository: 'Repository geprüft',
+    dependencies: 'Dependencies geprüft',
+    publish: 'Publish geprüft',
+    ci: 'CI geprüft',
+    secrets: 'Secrets geprüft',
+    consumer: 'Consumer geprüft',
+    audit: 'Audit geprüft',
+  };
+  return CATEGORIES.filter((k) => data.entries?.[k]).map((k) => ({
+    key: k,
+    title: labels[k] || k,
+    date: data.entries[k].label || data.entries[k].at?.slice(0, 10),
+    at: data.entries[k].at,
+  }));
+}