@complior/engine 0.9.0

package/src/domain/scanner/layers/lockfile-parsers.test.ts

@@ -0,0 +1,320 @@
+import { describe, it, expect } from 'vitest';
+import {
+  parsePackageLockJson,
+  parseYarnLock,
+  parsePnpmLockYaml,
+  parseCargoLock,
+  parseGoSum,
+  parsePipfileLock,
+  parseLockfiles,
+} from './lockfile-parsers.js';
+
+describe('parsePackageLockJson', () => {
+  it('parses v2/v3 packages format', () => {
+    const content = JSON.stringify({
+      lockfileVersion: 3,
+      packages: {
+        '': { name: 'my-app', version: '1.0.0' },
+        'node_modules/express': { version: '4.18.2', license: 'MIT' },
+        'node_modules/body-parser': { version: '1.20.1', license: 'MIT' },
+      },
+    });
+    const deps = parsePackageLockJson(content);
+    expect(deps).toHaveLength(2);
+    expect(deps[0].name).toBe('express');
+    expect(deps[0].version).toBe('4.18.2');
+    expect(deps[0].ecosystem).toBe('npm');
+    expect(deps[0].isDirect).toBe(true);
+    expect(deps[0].license).toBe('MIT');
+  });
+
+  it('identifies transitive deps in nested node_modules', () => {
+    const content = JSON.stringify({
+      lockfileVersion: 3,
+      packages: {
+        '': { name: 'app', version: '1.0.0' },
+        'node_modules/express': { version: '4.18.2' },
+        'node_modules/express/node_modules/ms': { version: '2.1.3' },
+      },
+    });
+    const deps = parsePackageLockJson(content);
+    const ms = deps.find(d => d.name === 'ms');
+    expect(ms).toBeDefined();
+    expect(ms!.isDirect).toBe(false);
+  });
+
+  it('parses v1 dependencies format', () => {
+    const content = JSON.stringify({
+      lockfileVersion: 1,
+      dependencies: {
+        lodash: { version: '4.17.21' },
+        axios: {
+          version: '1.6.2',
+          dependencies: {
+            'follow-redirects': { version: '1.15.3' },
+          },
+        },
+      },
+    });
+    const deps = parsePackageLockJson(content);
+    expect(deps).toHaveLength(3);
+    const lodash = deps.find(d => d.name === 'lodash');
+    expect(lodash!.isDirect).toBe(true);
+    const follow = deps.find(d => d.name === 'follow-redirects');
+    expect(follow!.isDirect).toBe(false);
+    expect(follow!.version).toBe('1.15.3');
+  });
+
+  it('returns empty for invalid JSON', () => {
+    const deps = parsePackageLockJson('not json');
+    expect(deps).toHaveLength(0);
+  });
+
+  it('returns empty for empty object', () => {
+    const deps = parsePackageLockJson('{}');
+    expect(deps).toHaveLength(0);
+  });
+
+  it('preserves license from packages', () => {
+    const content = JSON.stringify({
+      lockfileVersion: 3,
+      packages: {
+        '': { name: 'app' },
+        'node_modules/gpl-pkg': { version: '1.0.0', license: 'GPL-3.0' },
+      },
+    });
+    const deps = parsePackageLockJson(content);
+    expect(deps[0].license).toBe('GPL-3.0');
+  });
+
+  it('handles scoped packages', () => {
+    const content = JSON.stringify({
+      lockfileVersion: 3,
+      packages: {
+        '': { name: 'app' },
+        'node_modules/@scope/pkg': { version: '2.0.0' },
+      },
+    });
+    const deps = parsePackageLockJson(content);
+    expect(deps[0].name).toBe('@scope/pkg');
+  });
+});
+
+describe('parseYarnLock', () => {
+  it('parses basic yarn.lock v1 entries', () => {
+    const content = `"express@^4.18.0":
+  version "4.18.2"
+  resolved "https://registry.yarnpkg.com/express/-/express-4.18.2.tgz"
+
+"lodash@^4.17.0":
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz"
+`;
+    const deps = parseYarnLock(content);
+    expect(deps).toHaveLength(2);
+    expect(deps[0].name).toBe('express');
+    expect(deps[0].version).toBe('4.18.2');
+    expect(deps[0].ecosystem).toBe('npm');
+  });
+
+  it('parses scoped packages', () => {
+    const content = `"@types/node@^18.0.0":
+  version "18.19.3"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-18.19.3.tgz"
+`;
+    const deps = parseYarnLock(content);
+    expect(deps).toHaveLength(1);
+    expect(deps[0].name).toBe('@types/node');
+    expect(deps[0].version).toBe('18.19.3');
+  });
+
+  it('returns empty for empty content', () => {
+    const deps = parseYarnLock('');
+    expect(deps).toHaveLength(0);
+  });
+});
+
+describe('parsePnpmLockYaml', () => {
+  it('parses packages section', () => {
+    const content = `lockfileVersion: '6.0'
+
+packages:
+  /express@4.18.2:
+    resolution: {integrity: sha512-abc}
+  /lodash@4.17.21:
+    resolution: {integrity: sha512-def}
+
+settings:
+  autoInstallPeers: true
+`;
+    const deps = parsePnpmLockYaml(content);
+    expect(deps).toHaveLength(2);
+    expect(deps[0].name).toBe('express');
+    expect(deps[0].version).toBe('4.18.2');
+    expect(deps[0].ecosystem).toBe('npm');
+  });
+
+  it('returns empty for no packages section', () => {
+    const content = `lockfileVersion: '6.0'\nsettings:\n  autoInstallPeers: true\n`;
+    const deps = parsePnpmLockYaml(content);
+    expect(deps).toHaveLength(0);
+  });
+});
+
+describe('parseCargoLock', () => {
+  it('parses Cargo.lock packages', () => {
+    const content = `# This file is automatically generated
+[[package]]
+name = "serde"
+version = "1.0.193"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "tokio"
+version = "1.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+`;
+    const deps = parseCargoLock(content);
+    expect(deps).toHaveLength(2);
+    expect(deps[0].name).toBe('serde');
+    expect(deps[0].version).toBe('1.0.193');
+    expect(deps[0].ecosystem).toBe('cargo');
+    expect(deps[1].name).toBe('tokio');
+    expect(deps[1].version).toBe('1.35.0');
+  });
+
+  it('returns empty for empty content', () => {
+    const deps = parseCargoLock('');
+    expect(deps).toHaveLength(0);
+  });
+});
+
+describe('parseGoSum', () => {
+  it('parses go.sum entries', () => {
+    const content = `github.com/gin-gonic/gin v1.9.1 h1:abc=
+github.com/gin-gonic/gin v1.9.1/go.mod h1:def=
+github.com/stretchr/testify v1.8.4 h1:ghi=
+`;
+    const deps = parseGoSum(content);
+    expect(deps).toHaveLength(2); // deduped (gin appears twice, different hash)
+    expect(deps[0].name).toBe('github.com/gin-gonic/gin');
+    expect(deps[0].version).toBe('1.9.1');
+    expect(deps[0].ecosystem).toBe('go');
+  });
+
+  it('deduplicates same package+version', () => {
+    const content = `golang.org/x/text v0.14.0 h1:abc=
+golang.org/x/text v0.14.0/go.mod h1:def=
+`;
+    const deps = parseGoSum(content);
+    expect(deps).toHaveLength(1);
+  });
+
+  it('returns empty for empty content', () => {
+    const deps = parseGoSum('');
+    expect(deps).toHaveLength(0);
+  });
+});
+
+describe('parsePipfileLock', () => {
+  it('parses default and develop sections', () => {
+    const content = JSON.stringify({
+      default: {
+        requests: { version: '==2.31.0' },
+        flask: { version: '==3.0.0' },
+      },
+      develop: {
+        pytest: { version: '==7.4.3' },
+      },
+    });
+    const deps = parsePipfileLock(content);
+    expect(deps).toHaveLength(3);
+    const requests = deps.find(d => d.name === 'requests');
+    expect(requests!.version).toBe('2.31.0'); // == stripped
+    expect(requests!.isDirect).toBe(true);
+    expect(requests!.ecosystem).toBe('python');
+    const pytest = deps.find(d => d.name === 'pytest');
+    expect(pytest!.isDirect).toBe(false); // develop section
+  });
+
+  it('returns empty for invalid JSON', () => {
+    const deps = parsePipfileLock('not json');
+    expect(deps).toHaveLength(0);
+  });
+
+  it('handles missing sections', () => {
+    const content = JSON.stringify({ default: { numpy: { version: '==1.26.0' } } });
+    const deps = parsePipfileLock(content);
+    expect(deps).toHaveLength(1);
+  });
+});
+
+describe('parseLockfiles', () => {
+  it('routes to correct parser by filename', () => {
+    const files = [
+      {
+        relativePath: 'package-lock.json',
+        content: JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            '': { name: 'app' },
+            'node_modules/express': { version: '4.18.2' },
+          },
+        }),
+      },
+    ];
+    const deps = parseLockfiles(files);
+    expect(deps).toHaveLength(1);
+    expect(deps[0].name).toBe('express');
+  });
+
+  it('handles lockfile in subdirectory', () => {
+    const files = [
+      {
+        relativePath: 'backend/package-lock.json',
+        content: JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            '': { name: 'backend' },
+            'node_modules/hono': { version: '3.12.0' },
+          },
+        }),
+      },
+    ];
+    const deps = parseLockfiles(files);
+    expect(deps).toHaveLength(1);
+    expect(deps[0].name).toBe('hono');
+  });
+
+  it('ignores non-lockfile files', () => {
+    const files = [
+      { relativePath: 'src/app.ts', content: 'console.log("hello")' },
+      { relativePath: 'README.md', content: '# readme' },
+    ];
+    const deps = parseLockfiles(files);
+    expect(deps).toHaveLength(0);
+  });
+
+  it('combines deps from multiple lockfiles', () => {
+    const files = [
+      {
+        relativePath: 'package-lock.json',
+        content: JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            '': { name: 'app' },
+            'node_modules/express': { version: '4.18.2' },
+          },
+        }),
+      },
+      {
+        relativePath: 'Cargo.lock',
+        content: `[[package]]\nname = "serde"\nversion = "1.0.193"\n`,
+      },
+    ];
+    const deps = parseLockfiles(files);
+    expect(deps).toHaveLength(2);
+    expect(deps.map(d => d.ecosystem)).toContain('npm');
+    expect(deps.map(d => d.ecosystem)).toContain('cargo');
+  });
+});

package/src/domain/scanner/layers/lockfile-parsers.ts

@@ -0,0 +1,184 @@
+export interface LockfileDependency {
+  readonly name: string;
+  readonly version: string;
+  readonly ecosystem: 'npm' | 'cargo' | 'go' | 'python';
+  readonly isDirect: boolean;
+  readonly license?: string;
+}
+
+interface PackageInfo {
+  readonly version?: string;
+  readonly license?: string;
+  readonly dependencies?: Record<string, unknown>;
+}
+
+export const parsePackageLockJson = (content: string): readonly LockfileDependency[] => {
+  try {
+    const lock = JSON.parse(content) as Record<string, unknown>;
+    const deps: LockfileDependency[] = [];
+
+    // npm lockfile v2/v3 (packages format)
+    const packages = lock.packages as Record<string, PackageInfo> | undefined;
+    if (packages) {
+      for (const [path, info] of Object.entries(packages)) {
+        if (path === '') continue; // root package
+        const name = path.replace('node_modules/', '').replace(/^.*node_modules\//, '');
+        if (!name) continue;
+        deps.push({
+          name,
+          version: info.version ?? 'unknown',
+          ecosystem: 'npm',
+          isDirect: !path.includes('node_modules/') || path.split('node_modules/').length === 2,
+          license: info.license,
+        });
+      }
+    }
+    // npm lockfile v1 (dependencies format)
+    else if (lock.dependencies) {
+      const walkDeps = (obj: Record<string, unknown>, direct: boolean) => {
+        for (const [name, raw] of Object.entries(obj)) {
+          const info = raw as PackageInfo;
+          deps.push({
+            name,
+            version: info.version ?? 'unknown',
+            ecosystem: 'npm',
+            isDirect: direct,
+          });
+          if (info.dependencies) {
+            walkDeps(info.dependencies as Record<string, unknown>, false);
+          }
+        }
+      };
+      walkDeps(lock.dependencies as Record<string, unknown>, true);
+    }
+    return deps;
+  } catch {
+    return [];
+  }
+};
+
+export const parseYarnLock = (content: string): readonly LockfileDependency[] => {
+  const deps: LockfileDependency[] = [];
+  // yarn.lock v1 format: "pkg@^version":\n  version "X.Y.Z"
+  const blocks = content.split(/\n(?=\S)/);
+  for (const block of blocks) {
+    const headerMatch = block.match(/^"?(@?[^@\s"]+)@/);
+    const versionMatch = block.match(/version\s+"([^"]+)"/);
+    if (headerMatch && versionMatch) {
+      deps.push({
+        name: headerMatch[1],
+        version: versionMatch[1],
+        ecosystem: 'npm',
+        isDirect: false, // yarn.lock doesn't distinguish
+      });
+    }
+  }
+  return deps;
+};
+
+export const parsePnpmLockYaml = (content: string): readonly LockfileDependency[] => {
+  const deps: LockfileDependency[] = [];
+  // Simple pnpm-lock.yaml parser (packages section)
+  const lines = content.split('\n');
+  let inPackages = false;
+  for (const line of lines) {
+    if (line.startsWith('packages:')) { inPackages = true; continue; }
+    if (inPackages && /^\S/.test(line) && !line.startsWith(' ') && !line.startsWith('/')) {
+      inPackages = false; continue;
+    }
+    if (inPackages) {
+      // Format: /name@version: or /@scope/name@version:
+      const match = line.match(/^\s+[/'"]?(@?[^@:'"]+)@([^:'"]+)/);
+      if (match) {
+        deps.push({
+          name: match[1],
+          version: match[2].replace(/['":]/g, ''),
+          ecosystem: 'npm',
+          isDirect: false,
+        });
+      }
+    }
+  }
+  return deps;
+};
+
+export const parseCargoLock = (content: string): readonly LockfileDependency[] => {
+  const deps: LockfileDependency[] = [];
+  const blocks = content.split('[[package]]');
+  for (const block of blocks) {
+    const nameMatch = block.match(/name\s*=\s*"([^"]+)"/);
+    const versionMatch = block.match(/version\s*=\s*"([^"]+)"/);
+    if (nameMatch && versionMatch) {
+      deps.push({
+        name: nameMatch[1],
+        version: versionMatch[1],
+        ecosystem: 'cargo',
+        isDirect: false, // Cargo.lock doesn't distinguish
+      });
+    }
+  }
+  return deps;
+};
+
+export const parseGoSum = (content: string): readonly LockfileDependency[] => {
+  const deps: LockfileDependency[] = [];
+  const seen = new Set<string>();
+  for (const line of content.split('\n')) {
+    const match = line.match(/^(\S+)\s+v([^\s/]+)/);
+    if (match) {
+      const key = `${match[1]}@${match[2]}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      deps.push({
+        name: match[1],
+        version: match[2],
+        ecosystem: 'go',
+        isDirect: false,
+      });
+    }
+  }
+  return deps;
+};
+
+export const parsePipfileLock = (content: string): readonly LockfileDependency[] => {
+  try {
+    const lock = JSON.parse(content) as Record<string, unknown>;
+    const deps: LockfileDependency[] = [];
+    for (const section of ['default', 'develop'] as const) {
+      const packages = lock[section] as Record<string, PackageInfo> | undefined;
+      if (!packages) continue;
+      for (const [name, info] of Object.entries(packages)) {
+        deps.push({
+          name,
+          version: (info.version ?? 'unknown').replace(/^==/, ''),
+          ecosystem: 'python',
+          isDirect: section === 'default',
+        });
+      }
+    }
+    return deps;
+  } catch {
+    return [];
+  }
+};
+
+const LOCKFILE_PARSERS: Readonly<Record<string, (content: string) => readonly LockfileDependency[]>> = {
+  'package-lock.json': parsePackageLockJson,
+  'yarn.lock': parseYarnLock,
+  'pnpm-lock.yaml': parsePnpmLockYaml,
+  'Cargo.lock': parseCargoLock,
+  'go.sum': parseGoSum,
+  'Pipfile.lock': parsePipfileLock,
+};
+
+export const parseLockfiles = (files: readonly { relativePath: string; content: string }[]): readonly LockfileDependency[] => {
+  const allDeps: LockfileDependency[] = [];
+  for (const file of files) {
+    const filename = file.relativePath.split('/').pop() ?? '';
+    const parser = LOCKFILE_PARSERS[filename];
+    if (parser) {
+      allDeps.push(...parser(file.content));
+    }
+  }
+  return allDeps;
+};

package/src/domain/scanner/regulation-version.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest';
+import {
+  createRegulationVersion,
+  SCANNER_RULES_VERSION,
+  REGULATION_INFO,
+} from './regulation-version.js';
+
+describe('SCANNER_RULES_VERSION', () => {
+  it('is a semver string', () => {
+    expect(SCANNER_RULES_VERSION).toMatch(/^\d+\.\d+\.\d+$/);
+  });
+});
+
+describe('REGULATION_INFO', () => {
+  it('references eu-ai-act', () => {
+    expect(REGULATION_INFO.regulation).toBe('eu-ai-act');
+  });
+
+  it('has EU regulation reference number', () => {
+    expect(REGULATION_INFO.version).toBe('2024.1689');
+  });
+
+  it('has a last updated date', () => {
+    const date = new Date(REGULATION_INFO.lastUpdated);
+    expect(date.getTime()).not.toBeNaN();
+  });
+});
+
+describe('createRegulationVersion', () => {
+  it('creates version with correct fields', () => {
+    const version = createRegulationVersion(19);
+
+    expect(version.regulation).toBe('eu-ai-act');
+    expect(version.version).toBe('2024.1689');
+    expect(version.rulesVersion).toBe(SCANNER_RULES_VERSION);
+    expect(version.checkCount).toBe(19);
+    expect(version.lastUpdated).toBeTruthy();
+  });
+
+  it('reflects actual check count', () => {
+    const v1 = createRegulationVersion(10);
+    const v2 = createRegulationVersion(50);
+
+    expect(v1.checkCount).toBe(10);
+    expect(v2.checkCount).toBe(50);
+  });
+
+  it('returns frozen-like object', () => {
+    const version = createRegulationVersion(19);
+    expect(typeof version.regulation).toBe('string');
+    expect(typeof version.rulesVersion).toBe('string');
+    expect(typeof version.checkCount).toBe('number');
+  });
+});

package/src/domain/scanner/regulation-version.ts

@@ -0,0 +1,23 @@
+export interface RegulationVersion {
+  readonly regulation: string;
+  readonly version: string;
+  readonly rulesVersion: string;
+  readonly checkCount: number;
+  readonly lastUpdated: string;
+}
+
+export const SCANNER_RULES_VERSION = '1.0.0';
+
+export const REGULATION_INFO = {
+  regulation: 'eu-ai-act',
+  version: '2024.1689',
+  lastUpdated: '2026-02-26',
+} as const;
+
+export const createRegulationVersion = (checkCount: number): RegulationVersion => ({
+  regulation: REGULATION_INFO.regulation,
+  version: REGULATION_INFO.version,
+  rulesVersion: SCANNER_RULES_VERSION,
+  checkCount,
+  lastUpdated: REGULATION_INFO.lastUpdated,
+});

package/src/domain/scanner/role-filter.test.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect } from 'vitest';
+import { getCheckRole, filterFindingsByRole } from './role-filter.js';
+import type { Finding } from '../../types/common.types.js';
+
+const makeFinding = (checkId: string, type: 'pass' | 'fail' | 'skip' = 'fail'): Finding => ({
+  checkId,
+  type,
+  message: `Check ${checkId}`,
+  severity: 'medium',
+});
+
+describe('getCheckRole', () => {
+  it('returns provider for provider-only checks', () => {
+    expect(getCheckRole('qms')).toBe('provider');
+    expect(getCheckRole('gpai-transparency')).toBe('provider');
+    expect(getCheckRole('l4-conformity-assessment')).toBe('provider');
+    expect(getCheckRole('content-marking')).toBe('provider');
+  });
+
+  it('returns deployer for deployer-only checks', () => {
+    expect(getCheckRole('monitoring-policy')).toBe('deployer');
+    expect(getCheckRole('fria')).toBe('deployer');
+    expect(getCheckRole('worker-notification')).toBe('deployer');
+    expect(getCheckRole('l4-deployer-monitoring')).toBe('deployer');
+  });
+
+  it('returns both for unlisted checks', () => {
+    expect(getCheckRole('l1-risk')).toBe('both');
+    expect(getCheckRole('technical-documentation')).toBe('both');
+    expect(getCheckRole('sdk-no-disclosure')).toBe('both');
+    expect(getCheckRole('unknown-check')).toBe('both');
+  });
+});
+
+describe('filterFindingsByRole', () => {
+  const findings: readonly Finding[] = [
+    makeFinding('qms'),              // provider-only
+    makeFinding('fria'),             // deployer-only
+    makeFinding('l1-risk'),          // both
+    makeFinding('gpai-transparency'), // provider-only
+    makeFinding('worker-notification'), // deployer-only
+    makeFinding('technical-documentation', 'pass'), // both, pass
+  ];
+
+  it('role=both returns all findings unchanged', () => {
+    const result = filterFindingsByRole(findings, 'both');
+    expect(result).toBe(findings); // same reference
+    expect(result).toHaveLength(6);
+  });
+
+  it('role=deployer skips provider-only checks', () => {
+    const result = filterFindingsByRole(findings, 'deployer');
+    expect(result).toHaveLength(6);
+
+    // Provider-only → skip
+    const qms = result.find(f => f.checkId === 'qms')!;
+    expect(qms.type).toBe('skip');
+    expect(qms.message).toContain('provider-only');
+
+    const gpai = result.find(f => f.checkId === 'gpai-transparency')!;
+    expect(gpai.type).toBe('skip');
+
+    // Deployer-only → unchanged
+    const fria = result.find(f => f.checkId === 'fria')!;
+    expect(fria.type).toBe('fail');
+
+    const worker = result.find(f => f.checkId === 'worker-notification')!;
+    expect(worker.type).toBe('fail');
+
+    // Both → unchanged
+    const risk = result.find(f => f.checkId === 'l1-risk')!;
+    expect(risk.type).toBe('fail');
+
+    const techDoc = result.find(f => f.checkId === 'technical-documentation')!;
+    expect(techDoc.type).toBe('pass');
+  });
+
+  it('role=provider skips deployer-only checks', () => {
+    const result = filterFindingsByRole(findings, 'provider');
+    expect(result).toHaveLength(6);
+
+    // Deployer-only → skip
+    const fria = result.find(f => f.checkId === 'fria')!;
+    expect(fria.type).toBe('skip');
+    expect(fria.message).toContain('deployer-only');
+
+    const worker = result.find(f => f.checkId === 'worker-notification')!;
+    expect(worker.type).toBe('skip');
+
+    // Provider-only → unchanged
+    const qms = result.find(f => f.checkId === 'qms')!;
+    expect(qms.type).toBe('fail');
+
+    const gpai = result.find(f => f.checkId === 'gpai-transparency')!;
+    expect(gpai.type).toBe('fail');
+  });
+
+  it('preserves finding count (skip replaces, does not remove)', () => {
+    const result = filterFindingsByRole(findings, 'deployer');
+    expect(result).toHaveLength(findings.length);
+  });
+
+  it('empty findings returns empty', () => {
+    const result = filterFindingsByRole([], 'deployer');
+    expect(result).toHaveLength(0);
+  });
+
+  it('all-applicable findings unchanged for any role', () => {
+    const bothFindings: Finding[] = [
+      makeFinding('l1-risk'),
+      makeFinding('technical-documentation', 'pass'),
+    ];
+    expect(filterFindingsByRole(bothFindings, 'deployer')).toEqual(bothFindings);
+    expect(filterFindingsByRole(bothFindings, 'provider')).toEqual(bothFindings);
+  });
+});