@birdapi/velinstyle 1.2.2 → 1.3.0

package/core/security/report/report.js

@@ -0,0 +1,113 @@
+/**
+ * Security report builders (JSON / Markdown / Experience payload).
+ */
+import { gateLabel } from '../score/score.js';
+import { timelineRows } from '../timeline/timeline.js';
+
+/**
+ * @param {object} result — engine result
+ */
+export function toExperiencePayload(result) {
+  const { securityScore, scores, overall, dependencyHealth, releaseHealth, timeline, mode, findings } = result;
+  const items = [
+    { label: 'Security Score', value: String(securityScore) },
+    { label: 'Overall', value: overall },
+    { label: 'Mode', value: mode },
+  ];
+  if (dependencyHealth) {
+    items.push({ label: 'Dependency Health', value: `${dependencyHealth.score} %` });
+  }
+  if (releaseHealth) {
+    items.push({ label: 'Release Health', value: releaseHealth.status });
+  }
+
+  const tableRows = Object.entries(scores || {}).map(([k, v]) => [
+    v.label || k,
+    gateLabel(v.gate),
+    v.na ? 'n/a' : String(v.score),
+  ]);
+
+  const notifications = [];
+  if (overall === 'BLOCKED') {
+    notifications.push({ tone: 'danger', message: 'Security gate BLOCKED — fix errors before publish' });
+  } else if (overall === 'READY_WITH_WARNINGS') {
+    notifications.push({ tone: 'warning', message: 'Ready with warnings — review WARNING findings' });
+  } else {
+    notifications.push({ tone: 'success', message: 'Security Overall READY' });
+  }
+
+  const tl = timelineRows(timeline || { entries: {} });
+  if (tl.length) {
+    notifications.push({
+      tone: 'info',
+      message: `Timeline: ${tl.map((r) => `${r.title} ${r.date}`).join(' · ')}`,
+    });
+  }
+
+  return {
+    message: `Security Score ${securityScore} / 100 · ${overall}`,
+    items,
+    table: {
+      columns: ['Area', 'Gate', 'Score'],
+      rows: tableRows,
+    },
+    score: { value: securityScore, label: 'Security' },
+    findings: (findings || []).slice(0, 40).map((f) => ({
+      severity: f.severity,
+      message: f.message,
+      path: f.path,
+      rule: f.ruleId,
+    })),
+    notifications,
+    meta: {
+      dependencyHealth,
+      releaseHealth,
+      timeline: tl,
+      mode,
+    },
+  };
+}
+
+/**
+ * @param {object} result
+ */
+export function toMarkdownReport(result) {
+  const lines = [
+    '# Velin Security Report',
+    '',
+    `**Score:** ${result.securityScore} / 100`,
+    `**Overall:** ${result.overall}`,
+    `**Mode:** ${result.mode}`,
+    '',
+    '## Categories',
+    '',
+  ];
+  for (const [k, v] of Object.entries(result.scores || {})) {
+    const scorePart = v.na ? 'n/a' : String(v.score);
+    const note = v.note ? ` — ${v.note}` : '';
+    lines.push(`- **${v.label || k}:** ${gateLabel(v.gate)} (${scorePart})${note}`);
+  }
+  if (result.dependencyHealth) {
+    lines.push('', '## Dependency Health', '');
+    const dh = result.dependencyHealth;
+    lines.push(
+      `Score ${dh.score}% · deprecated ${dh.deprecated} · no-lockfile ${dh.noLockfile ?? 0} · outdated (heuristic) ${dh.outdated} · critical ${dh.critical}`,
+    );
+    if (dh.note) lines.push(`_${dh.note}_`);
+  }
+  if (result.releaseHealth) {
+    lines.push('', '## Release Health', '');
+    lines.push(`**${result.releaseHealth.status}** (score ${result.releaseHealth.score})`);
+  }
+  const tl = timelineRows(result.timeline || { entries: {} });
+  if (tl.length) {
+    lines.push('', '## Security Timeline', '');
+    for (const r of tl) lines.push(`- ${r.title}: ${r.date}`);
+  }
+  lines.push('', '## Findings', '');
+  for (const f of result.findings || []) {
+    lines.push(`- **${f.severity}** \`${f.ruleId}\`: ${f.message}${f.path ? ` (${f.path})` : ''}`);
+  }
+  lines.push('');
+  return lines.join('\n');
+}

package/core/security/rules/ci/index.js

@@ -0,0 +1,146 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readText, walkFiles, rel, workflowHints, isShaPinned } from '../../checks/fs.js';
+import { join } from 'path';
+
+export function registerCiRules() {
+  registerSecurityRule({
+    id: 'workflow.present',
+    category: 'ci',
+    severity: 'info',
+    modes: ['repo', 'ci', 'audit'],
+    title: 'Workflows directory',
+    run(ctx) {
+      if (fileExists(join(ctx.root, '.github', 'workflows'))) return [];
+      return [{
+        ruleId: 'workflow.present',
+        category: 'ci',
+        severity: 'info',
+        message: 'No .github/workflows directory',
+        path: '.github/workflows',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'workflow.sha-pinning',
+    category: 'ci',
+    severity: 'warning',
+    modes: ['repo', 'ci', 'audit', 'publish'],
+    title: 'SHA pinning',
+    description: 'GitHub Actions should pin actions by commit SHA.',
+    run(ctx) {
+      const dir = join(ctx.root, '.github', 'workflows');
+      if (!fileExists(dir)) return [];
+      const files = walkFiles(dir, (n) => /\.ya?ml$/i.test(n), 40);
+      const findings = [];
+      for (const abs of files) {
+        const hints = workflowHints(readText(abs) || '');
+        for (const u of hints.uses) {
+          if (!isShaPinned(u) && /@(v?\d|main|master|latest)/i.test(u)) {
+            findings.push({
+              ruleId: 'workflow.sha-pinning',
+              category: 'ci',
+              severity: 'warning',
+              message: `Action not SHA-pinned: ${u}`,
+              path: rel(ctx.root, abs),
+              fix: 'Pin uses: owner/action@<40-char-sha>',
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'workflow.pull-request-target',
+    category: 'ci',
+    severity: 'error',
+    modes: ['repo', 'ci', 'audit'],
+    title: 'pull_request_target',
+    run(ctx) {
+      const dir = join(ctx.root, '.github', 'workflows');
+      if (!fileExists(dir)) return [];
+      const files = walkFiles(dir, (n) => /\.ya?ml$/i.test(n), 40);
+      const findings = [];
+      for (const abs of files) {
+        const hints = workflowHints(readText(abs) || '');
+        if (hints.hasPullRequestTarget) {
+          findings.push({
+            ruleId: 'workflow.pull-request-target',
+            category: 'ci',
+            severity: 'error',
+            message: 'Workflow uses pull_request_target — high risk if checkout PR code',
+            path: rel(ctx.root, abs),
+            fix: 'Avoid untrusted code execution on pull_request_target',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'workflow.permissions',
+    category: 'ci',
+    severity: 'warning',
+    modes: ['repo', 'ci', 'audit'],
+    title: 'Explicit permissions',
+    run(ctx) {
+      const dir = join(ctx.root, '.github', 'workflows');
+      if (!fileExists(dir)) return [];
+      const files = walkFiles(dir, (n) => /\.ya?ml$/i.test(n), 40);
+      const findings = [];
+      for (const abs of files) {
+        const hints = workflowHints(readText(abs) || '');
+        if (!hints.hasPermissions) {
+          findings.push({
+            ruleId: 'workflow.permissions',
+            category: 'ci',
+            severity: 'warning',
+            message: 'Workflow missing top-level permissions: block',
+            path: rel(ctx.root, abs),
+            fix: 'Set least-privilege permissions',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'workflow.publish-token',
+    category: 'ci',
+    severity: 'info',
+    modes: ['repo', 'ci', 'audit', 'publish'],
+    title: 'Publish token / EOTP',
+    run(ctx) {
+      const pub = join(ctx.root, '.github', 'workflows', 'publish-npm.yml');
+      if (!fileExists(pub)) return [];
+      const text = readText(pub) || '';
+      const findings = [];
+      if (/NPM_TOKEN|NODE_AUTH_TOKEN/.test(text)) {
+        findings.push({
+          ruleId: 'workflow.publish-token',
+          category: 'ci',
+          severity: 'info',
+          message: 'Publish workflow uses NPM_TOKEN — use npm Automation token (no OTP/EOTP)',
+          path: '.github/workflows/publish-npm.yml',
+          fix: 'Granular Automation token with publish access; avoid classic 2FA tokens in CI',
+        });
+      }
+      const hints = workflowHints(text);
+      if (!hints.hasIdToken) {
+        findings.push({
+          ruleId: 'workflow.publish-provenance',
+          category: 'ci',
+          severity: 'warning',
+          message: 'Publish workflow may lack id-token: write for npm provenance',
+          path: '.github/workflows/publish-npm.yml',
+          fix: 'Add permissions.id-token: write for provenance',
+        });
+      }
+      return findings;
+    },
+  });
+}

package/core/security/rules/consumer/index.js

@@ -0,0 +1,174 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+export function registerConsumerRules() {
+  registerSecurityRule({
+    id: 'consumer.velinstyle-installed',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit', 'scan'],
+    title: 'VelinStyle installed',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.name === '@birdapi/velinstyle') return [];
+      const dep = pkg.dependencies?.['@birdapi/velinstyle'] || pkg.devDependencies?.['@birdapi/velinstyle'];
+      const vendor =
+        fileExists(join(ctx.root, 'vendor', 'velinstyle.min.css'))
+        || fileExists(join(ctx.root, 'vendor', 'velinstyle', 'velinstyle.min.css'));
+      if (dep || vendor) return [];
+      return [{
+        ruleId: 'consumer.velinstyle-installed',
+        category: 'consumer',
+        severity: 'warning',
+        message: '@birdapi/velinstyle not found in package.json or vendor/',
+        fix: 'npm i @birdapi/velinstyle or copy dist to vendor/',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.version-floor',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit'],
+    title: 'Minimum recommended version',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.name === '@birdapi/velinstyle') return [];
+      const raw = pkg.dependencies?.['@birdapi/velinstyle'] || pkg.devDependencies?.['@birdapi/velinstyle'];
+      if (!raw) return [];
+      const m = String(raw).match(/(\d+)\.(\d+)\.(\d+)/);
+      if (!m) return [];
+      const [maj, min, pat] = m.slice(1).map(Number);
+      const tooOld = maj < 1 || (maj === 1 && min < 2) || (maj === 1 && min === 2 && pat < 2);
+      if (!tooOld) return [];
+      return [{
+        ruleId: 'consumer.version-floor',
+        category: 'consumer',
+        severity: 'warning',
+        message: `VelinStyle ${raw} is below recommended 1.2.2+`,
+        code: 'outdated',
+        fix: 'Upgrade to @birdapi/velinstyle@^1.2.2',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.noopener',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'target=_blank noopener',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 80);
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs) || '';
+        const re = /target=["']_blank["'](?![^>]*rel=["'][^"']*noopener)/gi;
+        if (re.test(t)) {
+          findings.push({
+            ruleId: 'consumer.noopener',
+            category: 'consumer',
+            severity: 'warning',
+            message: 'target="_blank" without rel="noopener noreferrer"',
+            path: rel(ctx.root, abs),
+            fix: 'Add rel="noopener noreferrer"',
+          });
+        }
+      }
+      return findings.slice(0, 20);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.inline-script',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'Inline scripts',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 80);
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs) || '';
+        if (/<script(?![^>]*\bsrc=)[^>]*>\s*[^<\s]/i.test(t)) {
+          findings.push({
+            ruleId: 'consumer.inline-script',
+            category: 'consumer',
+            severity: 'warning',
+            message: 'Inline <script> increases XSS surface',
+            path: rel(ctx.root, abs),
+            fix: 'Move to external module',
+          });
+        }
+      }
+      return findings.slice(0, 15);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.csp-meta',
+    category: 'consumer',
+    severity: 'info',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'CSP meta',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 40);
+      if (!files.length) return [];
+      const any = files.some((abs) => /Content-Security-Policy/i.test(readText(abs) || ''));
+      if (any) return [];
+      return [{
+        ruleId: 'consumer.csp-meta',
+        category: 'consumer',
+        severity: 'info',
+        message: 'No CSP meta found in scanned HTML',
+        fix: 'Add Content-Security-Policy header or meta',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.app-debug',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit', 'scan'],
+    title: 'Debug flags',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.env', '.env.example', 'config/app.php', 'velinstyle.config.js']) {
+        const t = readText(join(ctx.root, name));
+        if (t && /APP_DEBUG\s*=\s*true|debug\s*:\s*true/i.test(t)) {
+          findings.push({
+            ruleId: 'consumer.app-debug',
+            category: 'consumer',
+            severity: 'warning',
+            message: `Debug flag enabled in ${name}`,
+            path: name,
+            fix: 'Disable debug in production',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.source-maps',
+    category: 'consumer',
+    severity: 'info',
+    modes: ['consumer', 'audit'],
+    title: 'Public source maps',
+    run(ctx) {
+      const maps = walkFiles(join(ctx.root, 'dist'), (n) => n.endsWith('.map'), 30);
+      if (!maps.length) return [];
+      return [{
+        ruleId: 'consumer.source-maps',
+        category: 'consumer',
+        severity: 'info',
+        message: `${maps.length} source map(s) under dist/ — ensure intentional for production`,
+        path: 'dist/',
+      }];
+    },
+  });
+}

package/core/security/rules/deps/index.js

@@ -0,0 +1,182 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+const KNOWN_POPULAR = [
+  'react', 'vue', 'lodash', 'express', 'webpack', 'typescript', 'eslint', 'vite',
+  'next', 'axios', 'jquery', 'moment', 'chalk', 'commander',
+];
+
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      dp[i][j] = Math.min(
+        dp[i - 1][j] + 1,
+        dp[i][j - 1] + 1,
+        dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1),
+      );
+    }
+  }
+  return dp[m][n];
+}
+
+export function registerDepsRules() {
+  registerSecurityRule({
+    id: 'deps.lockfile',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'publish'],
+    title: 'Lockfile present',
+    run(ctx) {
+      const ok =
+        fileExists(join(ctx.root, 'package-lock.json'))
+        || fileExists(join(ctx.root, 'pnpm-lock.yaml'))
+        || fileExists(join(ctx.root, 'yarn.lock'));
+      if (ok) return [];
+      return [{
+        ruleId: 'deps.lockfile',
+        category: 'deps',
+        severity: 'warning',
+        message: 'No lockfile found (package-lock / pnpm-lock / yarn.lock)',
+        code: 'no-lockfile',
+        fix: 'Commit a lockfile for reproducible installs',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.lifecycle-hooks',
+    category: 'malware',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'publish', 'malware'],
+    title: 'Risky lifecycle scripts',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (!pkg?.scripts) return [];
+      const findings = [];
+      for (const hook of ['preinstall', 'install', 'postinstall', 'prepublish']) {
+        const s = pkg.scripts[hook];
+        if (!s) continue;
+        if (/curl\s|wget\s|Invoke-WebRequest|fetch\(['"]https?:/i.test(s)) {
+          findings.push({
+            ruleId: 'deps.lifecycle-hooks',
+            category: 'malware',
+            severity: 'error',
+            message: `Lifecycle script "${hook}" downloads remote content`,
+            path: 'package.json',
+            code: 'critical',
+            fix: 'Remove network installs from lifecycle hooks',
+          });
+        } else if (/node\s|npx\s|bash\s|sh\s/i.test(s)) {
+          findings.push({
+            ruleId: 'deps.lifecycle-hooks',
+            category: 'malware',
+            severity: 'info',
+            message: `Lifecycle script "${hook}" runs shell/node — review carefully`,
+            path: 'package.json',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.engines',
+    category: 'deps',
+    severity: 'info',
+    modes: ['repo', 'consumer', 'deps', 'audit'],
+    title: 'Node engines field',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (pkg?.engines?.node) return [];
+      return [{
+        ruleId: 'deps.engines',
+        category: 'deps',
+        severity: 'info',
+        message: 'package.json missing engines.node',
+        path: 'package.json',
+        fix: 'Declare supported Node versions',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.license-field',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'deps', 'audit', 'publish'],
+    title: 'License field',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (pkg?.license) return [];
+      return [{
+        ruleId: 'deps.license-field',
+        category: 'deps',
+        severity: 'warning',
+        message: 'package.json missing license field',
+        path: 'package.json',
+        code: 'deprecated',
+        fix: 'Set license (e.g. MIT)',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.typosquat',
+    category: 'malware',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'malware'],
+    title: 'Typosquat heuristic',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      const names = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+      const findings = [];
+      for (const name of names) {
+        const base = name.includes('/') ? name.split('/').pop() : name;
+        for (const pop of KNOWN_POPULAR) {
+          const d = levenshtein(base.toLowerCase(), pop);
+          if (d === 1 && base.toLowerCase() !== pop) {
+            findings.push({
+              ruleId: 'deps.typosquat',
+              category: 'malware',
+              severity: 'warning',
+              message: `Package "${name}" is 1 edit from popular "${pop}" — verify intentional`,
+              path: 'package.json',
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.deprecated-request',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit'],
+    title: 'Known deprecated packages',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      const names = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+      const deprecated = ['request', 'node-uuid', 'crypto', 'gulp-util'];
+      return names
+        .filter((n) => deprecated.includes(n))
+        .map((n) => ({
+          ruleId: 'deps.deprecated-request',
+          category: 'deps',
+          severity: 'warning',
+          message: `Dependency "${n}" is widely considered deprecated`,
+          path: 'package.json',
+          code: 'deprecated',
+          fix: 'Replace with maintained alternative',
+        }));
+    },
+  });
+}

package/core/security/rules/index.js

@@ -0,0 +1,24 @@
+import { registerSecretsRules } from './secrets/index.js';
+import { registerDepsRules } from './deps/index.js';
+import { registerCiRules } from './ci/index.js';
+import { registerPublishRules } from './publish/index.js';
+import { registerRepoRules } from './repo/index.js';
+import { registerConsumerRules } from './consumer/index.js';
+
+let loaded = false;
+
+/** Idempotent: register all built-in Security Engine rules. */
+export function loadBuiltinSecurityRules() {
+  if (loaded) return;
+  registerSecretsRules();
+  registerDepsRules();
+  registerCiRules();
+  registerPublishRules();
+  registerRepoRules();
+  registerConsumerRules();
+  loaded = true;
+}
+
+export function resetBuiltinSecurityRulesFlag() {
+  loaded = false;
+}