@danypops/pi-packed 0.19.9 → 0.19.11

package/service/src/adoption/advisories.ts

@@ -0,0 +1,268 @@
+/**
+ * advisories.ts — vulnerability advisory scanning for installed Pi
+ * packages. Nothing in Pi or Packed today checks installed dependency
+ * trees against known advisories; a third party (exitcode0.net's
+ * dep-audit) proved the lockfile-free approach works: batch installed
+ * versions per package against npm's own bulk advisory endpoint. Zero
+ * code execution, one bounded/timed-out network call for the scan itself.
+ */
+import { compare, satisfies, valid } from "semver";
+import { readInstalledPackages, readResolvedVersion } from "../packages/installed.ts";
+import { NPM_REGISTRY_BASE, REGISTRY_FETCH_TIMEOUT_MS } from "../shared/constants.ts";
+import type { Diagnostic } from "./check.ts";
+
+const BULK_ADVISORY_PATH = "/-/npm/v1/security/advisories/bulk";
+const MAX_PACKAGES_PER_SCAN = 200;
+const MAX_ADVISORIES_PER_PACKAGE = 25;
+const MAX_FINDINGS = 200;
+const MAX_BULK_RESPONSE_BYTES = 2 * 1024 * 1024;
+const MAX_PACKUMENT_BYTES = 4 * 1024 * 1024;
+const SEMVER_OPTS = { loose: true, includePrerelease: true } as const;
+/** A patch published within this window is weaker assurance than one that
+ * has aged without a new report -- not yet enough time for the community
+ * to catch a bad or incomplete fix (the "poisoned patch" pattern). This is
+ * Packed's own threshold, not copied from a source verified at write time;
+ * documented explicitly so it can be revisited. */
+export const PATCHED_VERSION_FRESH_DAYS = 7;
+
+export type AdvisorySeverity = "critical" | "high" | "moderate" | "low";
+
+export interface RawAdvisory {
+	id: number | string;
+	url: string;
+	title: string;
+	severity: AdvisorySeverity;
+	vulnerableVersions: string;
+}
+
+export interface PatchedVersionAge {
+	version: string;
+	publishedAt: string;
+	ageDays: number;
+	/** true when ageDays < PATCHED_VERSION_FRESH_DAYS -- an explicit, separate
+	 * signal, never folded into severity. */
+	fresh: boolean;
+}
+
+export interface AdvisoryFinding {
+	packageName: string;
+	installedVersion: string;
+	id: number | string;
+	url: string;
+	title: string;
+	severity: AdvisorySeverity;
+	vulnerableVersions: string;
+	/** undefined when no published version outside the vulnerable range
+	 * could be found (registry lookup failed, or truly nothing fixes it
+	 * yet) -- never guessed. */
+	patchedVersionAge?: PatchedVersionAge;
+}
+
+export interface AdvisoryReport {
+	scanned: number;
+	findings: AdvisoryFinding[];
+	diagnostics: Diagnostic[];
+	truncated: boolean;
+}
+
+/** Resolves the real, on-disk installed version for every npm-sourced Pi
+ * package (or just one, when named) -- ground truth from node_modules,
+ * never a trusted-but-unverified declared pin. Silently omits a package
+ * whose version can't be resolved rather than guessing. git:/local
+ * sources are omitted (no meaningful npm advisory lookup applies). */
+export function resolveInstalledVersions(piHome: string, only?: string): Record<string, string> {
+	const names = readInstalledPackages(piHome)
+		.map((pkg) => pkg.name)
+		.filter((name) => !only || name === only);
+	const out: Record<string, string> = {};
+	for (const name of names) {
+		const version = readResolvedVersion(piHome, `npm:${name}`);
+		if (version) out[name] = version;
+	}
+	return out;
+}
+
+function boundedBodyJson(text: string, maxBytes: number): unknown {
+	if (Buffer.byteLength(text, "utf8") > maxBytes) throw new Error("response exceeded bound");
+	return JSON.parse(text);
+}
+
+/** One bounded, timed-out POST against npm's real bulk advisory endpoint --
+ * lockfile-free by design, matching how Pi itself installs packages (no
+ * package-lock.json to audit against). Never throws: any failure (network,
+ * timeout, malformed response) resolves to {}, so a scan degrades to "no
+ * known advisories" rather than crashing or reporting false negatives as
+ * if they were verified-clean. */
+export async function fetchBulkAdvisories(
+	packages: Record<string, string[]>,
+	options: { registryBase?: string; timeoutMs?: number } = {},
+): Promise<Record<string, RawAdvisory[]>> {
+	if (Object.keys(packages).length === 0) return {};
+	try {
+		const response = await fetch(`${options.registryBase ?? NPM_REGISTRY_BASE}${BULK_ADVISORY_PATH}`, {
+			method: "POST",
+			headers: { "content-type": "application/json", accept: "application/json" },
+			body: JSON.stringify(packages),
+			signal: AbortSignal.timeout(options.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS),
+		});
+		if (!response.ok) return {};
+		const text = await response.text();
+		const data = boundedBodyJson(text, MAX_BULK_RESPONSE_BYTES) as Record<string, unknown>;
+		const out: Record<string, RawAdvisory[]> = {};
+		for (const [name, entries] of Object.entries(data)) {
+			if (!Array.isArray(entries)) continue;
+			out[name] = entries
+				.slice(0, MAX_ADVISORIES_PER_PACKAGE)
+				.map((raw): RawAdvisory | undefined => {
+					const entry = raw as Record<string, unknown>;
+					if (typeof entry.id !== "number" && typeof entry.id !== "string") return undefined;
+					if (typeof entry.vulnerable_versions !== "string") return undefined;
+					const severity: AdvisorySeverity =
+						entry.severity === "critical" || entry.severity === "high" || entry.severity === "moderate" || entry.severity === "low"
+							? entry.severity
+							: "high";
+					return {
+						id: entry.id,
+						url: typeof entry.url === "string" ? entry.url.slice(0, 2_048) : "",
+						title: typeof entry.title === "string" ? entry.title.slice(0, 512) : "unknown advisory",
+						severity,
+						vulnerableVersions: entry.vulnerable_versions.slice(0, 512),
+					};
+				})
+				.filter((entry): entry is RawAdvisory => entry !== undefined);
+		}
+		return out;
+	} catch {
+		return {};
+	}
+}
+
+/** Fetches only what's needed from the full packument (version list + publish
+ * times) to compute a patched-version-age heuristic -- one bounded,
+ * best-effort GET per package that actually has an advisory, never per
+ * package scanned. Never throws. */
+async function fetchPackageTimes(
+	name: string,
+	registryBase: string,
+	timeoutMs: number,
+): Promise<{ versions: string[]; time: Record<string, string> } | undefined> {
+	try {
+		const encoded = encodeURIComponent(name).replace("%2F", "/");
+		const response = await fetch(`${registryBase}/${encoded}`, {
+			headers: { accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs),
+		});
+		if (!response.ok) return undefined;
+		const text = await response.text();
+		const data = boundedBodyJson(text, MAX_PACKUMENT_BYTES) as { versions?: Record<string, unknown>; time?: Record<string, unknown> };
+		if (!data.versions || !data.time) return undefined;
+		const time: Record<string, string> = {};
+		for (const [version, value] of Object.entries(data.time)) if (typeof value === "string") time[version] = value;
+		return { versions: Object.keys(data.versions).filter((v) => valid(v)), time };
+	} catch {
+		return undefined;
+	}
+}
+
+/** The smallest published version that is both newer than the installed one
+ * and outside the advisory's vulnerable range -- "the fix", derived the same
+ * way npm's own arborist re-resolves an avoided range, not from a
+ * patched_versions field (the bulk endpoint doesn't return one; only the
+ * full legacy audit report does). */
+function findPatchedVersion(installedVersion: string, vulnerableVersions: string, versions: string[]): string | undefined {
+	const candidates = versions
+		.filter((v) => valid(v) && compare(v, installedVersion) > 0 && !satisfies(v, vulnerableVersions, SEMVER_OPTS))
+		.sort(compare);
+	return candidates[0];
+}
+
+function diagnosticFor(finding: AdvisoryFinding): Diagnostic {
+	const severityMap: Record<AdvisorySeverity, Diagnostic["severity"]> = {
+		critical: "error",
+		high: "error",
+		moderate: "warning",
+		low: "info",
+	};
+	const freshNote = finding.patchedVersionAge
+		? finding.patchedVersionAge.fresh
+			? ` (patched in ${finding.patchedVersionAge.version}, published ${finding.patchedVersionAge.ageDays}d ago -- recent enough that the fix itself is a weaker signal)`
+			: ` (patched in ${finding.patchedVersionAge.version}, published ${finding.patchedVersionAge.ageDays}d ago)`
+		: "";
+	return {
+		code: "PI_PACKAGE_ADVISORY",
+		severity: severityMap[finding.severity],
+		path: finding.packageName,
+		message: `${finding.title} (${finding.severity}, ${finding.id}) affects installed ${finding.installedVersion}; vulnerable range: ${finding.vulnerableVersions}${freshNote}`,
+		...(finding.patchedVersionAge ? { fix: `upgrade to ${finding.patchedVersionAge.version}` } : {}),
+	};
+}
+
+/**
+ * Scans a bounded set of installed packages (name -> resolved version)
+ * against npm's bulk advisory endpoint. No lockfile required, matching how
+ * Pi itself installs packages. The patched-version-age heuristic is always
+ * a separate, explicit field on each finding -- never silently folded into
+ * severity, since a fresh patch and a mature one carry genuinely different
+ * trust even at the same advisory severity.
+ */
+export async function scanInstalledPackages(
+	installed: Record<string, string>,
+	options: { registryBase?: string; timeoutMs?: number } = {},
+): Promise<AdvisoryReport> {
+	const registryBase = options.registryBase ?? NPM_REGISTRY_BASE;
+	const timeoutMs = options.timeoutMs ?? REGISTRY_FETCH_TIMEOUT_MS;
+	const entries = Object.entries(installed).slice(0, MAX_PACKAGES_PER_SCAN);
+	const truncatedByCount = Object.keys(installed).length > entries.length;
+	const bulkInput: Record<string, string[]> = {};
+	for (const [name, version] of entries) bulkInput[name] = [version];
+	const advisoriesByPackage = await fetchBulkAdvisories(bulkInput, { registryBase, timeoutMs });
+
+	const findings: AdvisoryFinding[] = [];
+	let truncated = truncatedByCount;
+	for (const [name, version] of entries) {
+		const advisories = advisoriesByPackage[name];
+		if (!advisories || advisories.length === 0) continue;
+		let times: { versions: string[]; time: Record<string, string> } | undefined;
+		for (const advisory of advisories) {
+			if (findings.length >= MAX_FINDINGS) {
+				truncated = true;
+				break;
+			}
+			let patchedVersionAge: PatchedVersionAge | undefined;
+			if (times === undefined) times = (await fetchPackageTimes(name, registryBase, timeoutMs)) ?? { versions: [], time: {} };
+			const patched = findPatchedVersion(version, advisory.vulnerableVersions, times.versions);
+			if (patched && times.time[patched]) {
+				const publishedAt = times.time[patched]!;
+				const ageDays = Math.max(0, Math.floor((Date.now() - Date.parse(publishedAt)) / (24 * 60 * 60 * 1000)));
+				patchedVersionAge = { version: patched, publishedAt, ageDays, fresh: ageDays < PATCHED_VERSION_FRESH_DAYS };
+			}
+			findings.push({
+				packageName: name,
+				installedVersion: version,
+				id: advisory.id,
+				url: advisory.url,
+				title: advisory.title,
+				severity: advisory.severity,
+				vulnerableVersions: advisory.vulnerableVersions,
+				patchedVersionAge,
+			});
+		}
+		if (findings.length >= MAX_FINDINGS) break;
+	}
+
+	return { scanned: entries.length, findings, diagnostics: findings.map(diagnosticFor), truncated };
+}
+
+const MAX_ADVISORY_OUTPUT = 16 * 1024;
+
+/** Same rendering shape as check.ts's formatCheckReport -- one bounded,
+ * consistent diagnostic envelope across Packed, not a new ad hoc format. */
+export function formatAdvisoryReport(report: AdvisoryReport, json: boolean): string {
+	if (json) return `${JSON.stringify(report)}\n`;
+	if (report.diagnostics.length === 0) return `no known advisories for ${report.scanned} scanned package(s)\n`;
+	let output = `${report.diagnostics.length} advisory finding(s) across ${report.scanned} scanned package(s)\n`;
+	for (const diagnostic of report.diagnostics)
+		output += `${diagnostic.severity.toUpperCase()} ${diagnostic.path}: ${diagnostic.message}${diagnostic.fix ? ` Fix: ${diagnostic.fix}` : ""}\n`;
+	if (report.truncated) output += "Output truncated by configured bounds.\n";
+	return output.slice(0, MAX_ADVISORY_OUTPUT);
+}