@dataparade/cli 0.0.2 → 0.0.3

package/README.md

@@ -112,6 +112,7 @@ The CLI emits **all** Engineering, Privacy, and Security property keys (from the
 - Database: `connection_encryption`, `backup_frequency`, `audit_logging_enabled`, etc. when patterns match.
 - Auth: `mfa_required`, `authentication_method`, `sso_integration` from auth middleware patterns.
 - Routes: `request_validation`, `api_type`, `https_enforced` for route patterns.
+- Data flow edges (graph mapping): `engineering.protocol` is set to `rest` or `graphql` for `api_call` flows when the endpoint, method, or source code indicates HTTP REST vs GraphQL (see `infer-data-flow-protocol.ts`). Pattern rules in `property.patterns.yaml` also set `api_type` to `graphql` for `/graphql` URLs and paths.
 
 **Terraform / IaC (`.tf` / `.tfvars`):**
 

package/dist/src/core/pipeline/graph-mapping.js

@@ -10,6 +10,7 @@ const minimal_terraform_layout_1 = require("./diagram-layout/minimal-terraform-l
 const section_helpers_1 = require("./diagram-layout/section-helpers");
 const terraform_lane_layout_1 = require("./diagram-layout/terraform-lane-layout");
 const terraform_minimal_services_1 = require("./terraform-minimal-services");
+const infer_data_flow_protocol_1 = require("./infer-data-flow-protocol");
 function stripCodeFromSourceLocation(loc) {
     if (!loc)
         return undefined;
@@ -157,6 +158,10 @@ function mapDataFlowToEdge(flow, componentsById) {
     if (flow.actions && flow.actions.length > 0) {
         engineering.actions = flow.actions;
     }
+    const protocol = (0, infer_data_flow_protocol_1.inferDataFlowProtocol)(flow);
+    if (protocol) {
+        engineering.protocol = protocol;
+    }
     const privacy = {
         dataCategories: flow.dataCategories ?? [],
         dataSubjectCategories: flow.dataSubjectCategories,

package/dist/src/core/pipeline/infer-data-flow-protocol.d.ts

@@ -0,0 +1,7 @@
+import type { DetectedDataFlow } from "../types/data-flow";
+export type InferredDataFlowProtocol = "rest" | "graphql";
+/**
+ * Infer engineering.protocol for a scanned data flow (rest | graphql).
+ * Returns undefined when the flow type is not HTTP/API-shaped or there is no signal.
+ */
+export declare function inferDataFlowProtocol(flow: DetectedDataFlow): InferredDataFlowProtocol | undefined;

package/dist/src/core/pipeline/infer-data-flow-protocol.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inferDataFlowProtocol = inferDataFlowProtocol;
+const GRAPHQL_SIGNAL = /\bgraphql\b|\/graphql\b/i;
+function textSuggestsGraphql(text) {
+    return GRAPHQL_SIGNAL.test(text);
+}
+function flowCodeSuggestsGraphql(flow) {
+    const locations = [
+        flow.sourceLocation,
+        ...(flow.sourceLocations ?? []),
+    ].filter((loc) => loc != null);
+    for (const loc of locations) {
+        if (typeof loc.code === "string" && textSuggestsGraphql(loc.code)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Infer engineering.protocol for a scanned data flow (rest | graphql).
+ * Returns undefined when the flow type is not HTTP/API-shaped or there is no signal.
+ */
+function inferDataFlowProtocol(flow) {
+    const endpoint = flow.endpoint?.trim() ?? "";
+    if (endpoint && textSuggestsGraphql(endpoint)) {
+        return "graphql";
+    }
+    if (flowCodeSuggestsGraphql(flow)) {
+        return "graphql";
+    }
+    if (flow.type !== "api_call") {
+        return undefined;
+    }
+    if (endpoint || flow.method?.trim()) {
+        return "rest";
+    }
+    return undefined;
+}

package/dist/tests/unit/analyzers/typescript/property-detection.spec.js

@@ -122,6 +122,18 @@ describe("property-detection", () => {
             expect(out.integration_method).toBe("api");
             expect(out.authentication_method).toBe("api_key");
         });
+        it("sets api_type graphql when url path is GraphQL", () => {
+            const finding = makeFinding({
+                pattern: "external_api_call",
+                name: "Graph API",
+                properties: {
+                    serviceName: "internal",
+                    url: "https://api.example.com/graphql",
+                },
+            });
+            const out = (0, property_inference_1.getPropertiesFromFinding)(finding);
+            expect(out.api_type).toBe("graphql");
+        });
     });
     describe("express_route", () => {
         it("sets request_validation and connection_encryption", () => {
@@ -133,6 +145,16 @@ describe("property-detection", () => {
             const out = (0, property_inference_1.getPropertiesFromFinding)(finding);
             expect(out.request_validation).toBe(true);
             expect(out.connection_encryption).toBe(true);
+            expect(out.api_type).toBe("rest");
+        });
+        it("sets api_type graphql for GraphQL route path", () => {
+            const finding = makeFinding({
+                pattern: "express_route",
+                name: "POST /graphql",
+                properties: { httpMethods: ["POST"], path: "/graphql" },
+            });
+            const out = (0, property_inference_1.getPropertiesFromFinding)(finding);
+            expect(out.api_type).toBe("graphql");
         });
     });
 });

package/dist/tests/unit/core/graph-mapping.spec.js

@@ -106,6 +106,7 @@ describe("core/pipeline/graph-mapping - DP-P0-CLI-402", () => {
             return;
         const properties = edge.data.properties;
         expect(properties.engineering.transferType).toBe("api_call");
+        expect(properties.engineering.protocol).toBe("rest");
         expect(properties.engineering.name).toContain("Test Application");
         expect(properties.engineering.actions).toEqual(["read"]);
         expect(properties.privacy.dataCategories).toEqual([
@@ -122,6 +123,57 @@ describe("core/pipeline/graph-mapping - DP-P0-CLI-402", () => {
         expect(properties.targetScopeConfidence).toBe("high");
         expect(properties.targetScopeReason).toBe("same-section-id");
     });
+    it("sets engineering.protocol to graphql when flow endpoint is a GraphQL URL", () => {
+        const scanResult = {
+            components: [
+                {
+                    id: "component-1",
+                    name: "API Service",
+                    type: "asset",
+                    subType: "api",
+                    confidence: 0.9,
+                    detectedFrom: [{ pattern: "express_route" }],
+                    sourceLocations: [
+                        { filePath: "src/api.ts", startLine: 1, endLine: 10 },
+                    ],
+                    properties: {},
+                },
+                {
+                    id: "component-2",
+                    name: "External API",
+                    type: "third_party",
+                    subType: "saas_service",
+                    confidence: 0.9,
+                    detectedFrom: [{ pattern: "external_api_call" }],
+                    sourceLocations: [
+                        { filePath: "src/api.ts", startLine: 20, endLine: 30 },
+                    ],
+                    properties: {},
+                },
+            ],
+            dataFlows: [
+                {
+                    id: "flow-gql",
+                    sourceComponentId: "component-1",
+                    targetComponentId: "component-2",
+                    type: "api_call",
+                    confidence: 0.9,
+                    endpoint: "https://api.example.com/graphql",
+                    method: "POST",
+                },
+            ],
+            filesScanned: 1,
+            filesSkipped: 0,
+            totalLines: 50,
+            scanDurationMs: 5,
+            warnings: [],
+            errors: [],
+        };
+        const graph = (0, graph_mapping_1.buildDiagramGraphFromScanResult)(scanResult);
+        const properties = graph.edges[0]?.data
+            ?.properties;
+        expect(properties?.engineering?.protocol).toBe("graphql");
+    });
     it("places managed provider service nodes after provider in layout", () => {
         const scanResult = {
             components: [

package/dist/tests/unit/core/infer-data-flow-protocol.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/core/infer-data-flow-protocol.spec.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const infer_data_flow_protocol_1 = require("../../../src/core/pipeline/infer-data-flow-protocol");
+function baseFlow(overrides = {}) {
+    return {
+        id: "flow-1",
+        sourceComponentId: "a",
+        targetComponentId: "b",
+        type: "api_call",
+        confidence: 0.9,
+        ...overrides,
+    };
+}
+describe("inferDataFlowProtocol", () => {
+    it("returns graphql for /graphql endpoint", () => {
+        expect((0, infer_data_flow_protocol_1.inferDataFlowProtocol)(baseFlow({ endpoint: "https://api.example.com/graphql" }))).toBe("graphql");
+    });
+    it("returns graphql when source code mentions graphql", () => {
+        expect((0, infer_data_flow_protocol_1.inferDataFlowProtocol)(baseFlow({
+            sourceLocation: {
+                filePath: "src/client.ts",
+                startLine: 1,
+                endLine: 2,
+                code: "client.query({ query: GET_USERS }) // graphql",
+            },
+        }))).toBe("graphql");
+    });
+    it("returns rest for api_call with HTTP endpoint", () => {
+        expect((0, infer_data_flow_protocol_1.inferDataFlowProtocol)(baseFlow({ endpoint: "/api/users", method: "GET" }))).toBe("rest");
+    });
+    it("returns undefined for database_query", () => {
+        expect((0, infer_data_flow_protocol_1.inferDataFlowProtocol)(baseFlow({ type: "database_query", endpoint: "postgres://..." }))).toBeUndefined();
+    });
+    it("returns undefined for api_call without endpoint or method", () => {
+        expect((0, infer_data_flow_protocol_1.inferDataFlowProtocol)(baseFlow())).toBeUndefined();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dataparade/cli",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
   "publishConfig": {
     "access": "public",