@dataparade/cli 0.0.3 → 0.0.4

package/dist/tests/unit/cli/scan-quota-flow.spec.js

@@ -27,10 +27,12 @@ describe("scan quota flow", () => {
     afterEach(() => {
         fs_1.default.rmSync(tempRoot, { recursive: true, force: true });
         delete process.env.DATAPARADE_WORKSPACE_API_KEY;
+        delete process.env.DATAPARADE_SKIP_AUTO_UPLOAD;
         process.exitCode = 0;
     });
     it("skips quota API when workspace key is present but AI is disabled", async () => {
         process.env.DATAPARADE_WORKSPACE_API_KEY = "dp_live_test";
+        process.env.DATAPARADE_SKIP_AUTO_UPLOAD = "true";
         await (0, cli_1.run)(["node", "cli", "scan", tempRoot]);
         expect(fetchMock).not.toHaveBeenCalled();
     });

package/dist/tests/unit/config/upload-env.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/config/upload-env.spec.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const upload_env_1 = require("../../../src/config/upload-env");
+describe("resolveSkipAutoUpload", () => {
+    it("is false when unset", () => {
+        expect((0, upload_env_1.resolveSkipAutoUpload)({})).toBe(false);
+    });
+    it("is true for truthy env values", () => {
+        expect((0, upload_env_1.resolveSkipAutoUpload)({ DATAPARADE_SKIP_AUTO_UPLOAD: "true" })).toBe(true);
+        expect((0, upload_env_1.resolveSkipAutoUpload)({ DATAPARADE_SKIP_AUTO_UPLOAD: "1" })).toBe(true);
+    });
+});

package/dist/tests/unit/config/validate-scan-ai.spec.js

@@ -39,6 +39,14 @@ describe("validate-scan-ai", () => {
         expect((0, validate_scan_ai_1.validateAiInferenceCredentials)(config)).toEqual([]);
         expect((0, validate_scan_ai_1.resolveAiMode)(config)).toBe("platform");
     });
+    it("accepts hosted worker infer proxy without BYOK or workspace key", () => {
+        const config = baseConfig({
+            enableAiInference: true,
+            hostedInferProxyUrl: "http://127.0.0.1:4567/infer",
+        });
+        expect((0, validate_scan_ai_1.validateAiInferenceCredentials)(config)).toEqual([]);
+        expect((0, validate_scan_ai_1.resolveAiMode)(config)).toBe("hosted_worker");
+    });
     it("allows workspace key with AI disabled", () => {
         const errors = (0, validate_scan_ai_1.validateAiInferenceCredentials)(baseConfig({
             enableAiInference: false,

package/dist/tests/unit/platform-api/dataparade-app-base-url.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/platform-api/dataparade-app-base-url.spec.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const dataparade_app_base_url_1 = require("../../../src/platform-api/dataparade-app-base-url");
+describe("getDataparadeAppBaseUrl", () => {
+    it("defaults to production frontend URL", () => {
+        expect((0, dataparade_app_base_url_1.getDataparadeAppBaseUrl)({})).toBe(dataparade_app_base_url_1.DEFAULT_DATAPARADE_APP_URL);
+    });
+    it("strips trailing slash from DATAPARADE_APP_URL", () => {
+        expect((0, dataparade_app_base_url_1.getDataparadeAppBaseUrl)({
+            DATAPARADE_APP_URL: "http://localhost:3001/",
+        })).toBe("http://localhost:3001");
+    });
+});

package/dist/tests/unit/platform-api/upload-client.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/platform-api/upload-client.spec.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const upload_client_1 = require("../../../src/platform-api/upload-client");
+describe("cliUploadPreview", () => {
+    const originalFetch = global.fetch;
+    afterEach(() => {
+        global.fetch = originalFetch;
+        jest.restoreAllMocks();
+    });
+    it("posts dataflow to upload endpoint", async () => {
+        global.fetch = jest.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ draftId: "draft-1", projectName: "proj" }),
+        });
+        const result = await (0, upload_client_1.cliUploadPreview)({
+            apiKey: "dp_live_testkey123456",
+            dataflow: { schemaVersion: "1.0", graph: { nodes: [], edges: [] } },
+            projectName: "proj",
+            scanJobId: "job-1",
+        });
+        expect(result.draftId).toBe("draft-1");
+        expect(global.fetch).toHaveBeenCalledWith(expect.stringContaining("/api/scans/cli/upload"), expect.objectContaining({
+            method: "POST",
+            headers: expect.objectContaining({
+                Authorization: "Bearer dp_live_testkey123456",
+            }),
+        }));
+    });
+    it("throws with API error message", async () => {
+        global.fetch = jest.fn().mockResolvedValue({
+            ok: false,
+            status: 400,
+            json: async () => ({ message: "Invalid dataflow" }),
+        });
+        await expect((0, upload_client_1.cliUploadPreview)({
+            apiKey: "dp_live_testkey123456",
+            dataflow: {},
+        })).rejects.toThrow("Invalid dataflow");
+    });
+});

package/dist/tests/unit/publish-manifest.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/publish-manifest.spec.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+describe("npm publish manifest", () => {
+    const pkgPath = path_1.default.resolve(__dirname, "../../package.json");
+    const pkg = JSON.parse(fs_1.default.readFileSync(pkgPath, "utf8"));
+    it("lists typescript as a runtime dependency (required by TS analyzer)", () => {
+        expect(pkg.dependencies?.typescript).toBeDefined();
+        expect(pkg.devDependencies?.typescript).toBeUndefined();
+    });
+    it("includes patterns/ in published files (runtime YAML configs)", () => {
+        expect(pkg.files).toContain("patterns");
+    });
+});

package/dist/tests/unit/upload/build-preview-url.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/upload/build-preview-url.spec.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const build_preview_url_1 = require("../../../src/upload/build-preview-url");
+describe("buildImportPreviewUrl", () => {
+    const original = process.env.DATAPARADE_APP_URL;
+    afterEach(() => {
+        if (original === undefined) {
+            delete process.env.DATAPARADE_APP_URL;
+        }
+        else {
+            process.env.DATAPARADE_APP_URL = original;
+        }
+    });
+    it("builds dashboard deep link with importDraft query param", () => {
+        process.env.DATAPARADE_APP_URL = "http://localhost:3001";
+        const url = (0, build_preview_url_1.buildImportPreviewUrl)("draft-abc");
+        expect(url).toBe("http://localhost:3001/dashboard?importDraft=draft-abc");
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dataparade/cli",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "dataPARADE CLI — scan codebases for privacy and security data flows",
   "publishConfig": {
     "access": "public",
@@ -58,9 +58,10 @@
   },
   "dependencies": {
     "@sentry/node": "^10.38.0",
+    "commander": "^12.1.0",
     "dotenv": "^16.4.7",
     "langsmith": "^0.3.14",
-    "commander": "^12.1.0",
+    "typescript": "^5.7.3",
     "yaml": "^2.8.2",
     "zod": "^4.3.5"
   },
@@ -72,11 +73,11 @@
     "globals": "^15.14.0",
     "jest": "^29.7.0",
     "ts-jest": "^29.2.5",
-    "typescript": "^5.7.3",
     "typescript-eslint": "^8.20.0"
   },
   "files": [
     "dist",
+    "patterns",
     "LICENSE",
     "README.md",
     "package.json"

package/patterns/README.md

@@ -0,0 +1,322 @@
+# TypeScript / JavaScript Patterns
+
+This document describes the TypeScript/JavaScript patterns implemented by the
+CLI TS/JS analyzer for **DP-P0-CLI-104**. These patterns are heuristic and not
+exhaustive; they are designed to provide useful structural signals for the
+classifier and data-flow detector.
+
+Patterns are configured in two layers:
+
+- A **YAML configuration file** at `cli/patterns/typescript.patterns.yaml`
+  which defines pattern IDs, known libraries/SDKs, regexes, and confidences.
+- A **TypeScript execution engine** (`cli/src/analyzers/typescript/typescript-detection.ts`
+  and `cli/src/analyzers/typescript/typescript-detection-config.ts`) that loads the YAML,
+  validates it, compiles regexes, and applies them to `FileInfo` plus the TS/JS
+  code model.
+
+Each detected match produces a `RawFinding` object using the shared `PatternId`
+union from `cli/src/core/types/detection.ts`. The YAML file controls **what**
+we look for (libraries, regexes, keys); the TypeScript engine controls **how**
+those patterns are applied.
+
+---
+
+## `express_route`
+
+**Purpose:** Detect HTTP route handlers in common web frameworks.
+
+**Frameworks covered (heuristic):**
+
+- Express (imports from `"express"`)
+- NestJS (imports from `"@nestjs/common"` / `"@nestjs/core"`)
+- Next.js / React route handlers (file-path based heuristic such as
+  `pages/api/*`, `app/*`, `*route.ts`, `*route.js`)
+
+**Examples:**
+
+```ts
+// Express
+import express from "express";
+
+const app = express();
+app.get("/users", (req, res) => {
+  res.send("ok");
+});
+```
+
+```ts
+// NestJS
+import { Controller, Get } from "@nestjs/common";
+
+@Controller("users")
+export class UsersController {
+  @Get("/")
+  findAll() {}
+}
+```
+
+```ts
+// Next.js API route (pages/api/users.ts)
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  res.status(200).json({ ok: true });
+}
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- `framework: "express" | "nest" | "next_or_react_route"`
+- `httpMethods: string[]` – e.g. `["GET"]` when a method can be inferred
+- `path?: string` – route path when it can be parsed (e.g. `"/users"`)
+
+---
+
+## `database_connection`
+
+**Purpose:** Detect creation or usage of database and cache clients.
+
+**Libraries covered (heuristic):**
+
+- `pg` (`new Pool(...)`, `new Client(...)`)
+- `mysql2` (`createConnection(...)`)
+- Prisma (`new PrismaClient(...)`)
+- Mongoose (`mongoose.connect(...)`)
+- Redis (`createClient(...)`)
+- Supabase (`createClient(...)` from `@supabase/supabase-js`)
+
+**Examples:**
+
+```ts
+import { Pool } from "pg";
+
+const pool = new Pool({
+  connectionString: process.env.DATABASE_URL,
+});
+```
+
+```ts
+import { PrismaClient } from "@prisma/client";
+
+const prisma = new PrismaClient();
+```
+
+```ts
+import mongoose from "mongoose";
+
+mongoose.connect(process.env.MONGO_URL!);
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- `client: string` – e.g. `"pg"`, `"mysql2"`, `"prisma"`, `"mongoose"`, `"redis"`, `"supabase"`
+- `databaseType: string` – e.g. `"postgres"`, `"mysql"`, `"mongo"`, `"redis"`, `"unknown"`
+- For heuristic SQL keyword matches, an additional hint:
+  - `hint: "raw_sql_keyword"`
+
+---
+
+## `external_api_call`
+
+**Purpose:** Detect calls to external HTTP APIs or third-party SDKs.
+
+**HTTP clients covered (heuristic):**
+
+- Global `fetch(...)`
+- `axios.get/post/put/delete/patch(...)`
+- `got(...)`
+
+**Known SDK/service hints:**
+
+- Stripe (`"stripe"`)
+- SendGrid (`"sendgrid"`)
+- Twilio (`"twilio"`)
+- OpenAI (`"openai"`)
+- AWS SDK (`"@aws-sdk/..."`)
+- Firebase (`"firebase"`)
+
+**Examples:**
+
+```ts
+// Generic HTTP call
+const res = await fetch("https://api.example.com/users");
+```
+
+```ts
+// Axios with method
+import axios from "axios";
+
+await axios.post("https://api.example.com/users", { name: "Alice" });
+```
+
+```ts
+// Stripe SDK import
+import Stripe from "stripe";
+
+const stripe = new Stripe(process.env.STRIPE_KEY!, { apiVersion: "2022-11-15" });
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- For direct HTTP calls:
+  - `client: string` – e.g. `"fetch"`, `"axios.get"`, `"axios.post"`, `"got"`
+  - `url: string` – full URL if present in the call
+  - `httpMethod?: string` – uppercase method when derivable
+- For SDK / service hints:
+  - `client: string` – service/client identifier, e.g. `"stripe"`
+  - `serviceName: string` – same as `client` for now
+
+---
+
+## `auth_middleware`
+
+**Purpose:** Detect authentication/authorization-related middleware and guards.
+
+**Libraries and patterns covered (heuristic):**
+
+- Passport (`passport.authenticate(...)`, imports from `"passport"` or modules containing `"passport"`)
+- JSON Web Tokens (`jsonwebtoken`, `jwt.sign(...)`, `jwt.verify(...)`)
+- NestJS auth guards (`@nestjs/passport`, `UseGuards(...)`)
+
+**Examples:**
+
+```ts
+import passport from "passport";
+
+app.get(
+  "/profile",
+  passport.authenticate("jwt", { session: false }),
+  (req, res) => res.send("ok"),
+);
+```
+
+```ts
+import jwt from "jsonwebtoken";
+
+const token = jwt.sign({ sub: user.id }, process.env.JWT_SECRET!);
+```
+
+```ts
+import { UseGuards } from "@nestjs/common";
+import { AuthGuard } from "@nestjs/passport";
+
+@UseGuards(AuthGuard("jwt"))
+@Get("me")
+getProfile() {}
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- For Passport:
+  - `library: "passport"`
+  - `strategy?: string` – strategy name when parsed from `passport.authenticate("strategy", ...)`
+- For JWT:
+  - `library: "jsonwebtoken"`
+- For NestJS guards:
+  - `library: "nestjs_auth"`
+
+---
+
+## `env_variable`
+
+**Purpose:** Detect environment variable usage in TS/JS code.
+
+**Pattern:** `process.env.<KEY>`
+
+**Examples:**
+
+```ts
+const dbUrl = process.env.DATABASE_URL;
+const apiKey = process.env.API_KEY;
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- `key: string` – the environment variable key, e.g. `"DATABASE_URL"`, `"API_KEY"`
+
+---
+
+## `config_file`
+
+**Purpose:** Detect access to configuration objects in TS/JS code that likely
+point to configuration or secret values (for later mapping to assets or
+environment configuration).
+
+**Pattern:** `config.<field>` where `<field>` is one of:
+
+- `database`
+- `db`
+- `apiKey`
+- `api_key`
+- `auth`
+- `redis`
+
+**Examples:**
+
+```ts
+import config from "./config";
+
+const dbConfig = config.database;
+const redisConfig = config.redis;
+```
+
+**Properties set on `RawFinding.properties`:**
+
+- `key: string` – the accessed config key, e.g. `"database"`, `"apiKey"`
+
+---
+
+## Actor detection (`web_actor`, `service_actor`)
+
+**Purpose:** Detect human and system actors so the classifier can emit
+`DetectedComponent` entries with `type: "actor"` alongside assets and third
+parties.
+
+Actor detection is configured in a shared YAML file:
+
+-- `cli/patterns/actor.patterns.yaml` – defines regexes and rules for emitting
+  `web_actor` and `service_actor` findings, and attaches basic properties such
+  as `actorType`, `roleNames`, and `sourceContext`.
+
+The classifier maps these pattern IDs to actors via `classifier/components.classifier.yaml`:
+
+- `web_actor` → `type: actor`, `subType: customer`
+- `service_actor` → `type: actor`, `subType: employee`
+
+### Signals used by the TS/JS analyzer
+
+The TypeScript/JavaScript analyzer loads `actor.patterns.yaml` through
+`cli/src/config/actor-detection-config.ts` and applies rules in
+`cli/src/analyzers/typescript/actor-detection.ts`. Current heuristics include:
+
+- **Frontend session hook**
+  - File path matches `hooks/useSession.ts` / `hooks/useSession.tsx`.
+  - Emits a `web_actor` finding named `"Customer"` with:
+    - `properties.actorType = "customer"`
+    - `properties.sourceContext = "frontend_session"`.
+
+- **Backend controllers using `req.user`**
+  - Content contains `req.user` (e.g. NestJS/Express controllers).
+  - Emits a `web_actor` finding named `"Customer"` with:
+    - `properties.actorType = "customer"`
+    - `properties.sourceContext = "backend_controller"`.
+
+- **Backend admin role checks**
+  - Content contains simple admin role checks (e.g. `isAdmin`, `role: "admin"`).
+  - Emits a `service_actor` finding named `"Admin user"` with:
+    - `properties.actorType = "employee"`
+    - `properties.roleNames = ["admin"]`
+    - `properties.sourceContext = "backend_role_check"`.
+
+Other language analyzers can reuse the same `web_actor` / `service_actor`
+pattern IDs by loading `actor.patterns.yaml` and emitting compatible
+`RawFinding`s; the classifier does not need to change for each language.
+
+---
+
+These patterns are intentionally conservative and heuristic. They are meant to
+provide a good baseline for:
+
+- Component classification (assets, third parties, etc.).
+- Structural data-flow detection (who talks to which DB / third-party).
+
+Additional patterns and refinements can be added in future tasks and should be
+documented by extending this file.

package/patterns/actor.patterns.yaml

@@ -0,0 +1,51 @@
+---
+# Shared actor-detection config: regexes and rules to emit actor-related findings.
+# This is language-agnostic; analyzers (TypeScript, Python, etc.) can all load it.
+#
+# The classifier maps patternIds like web_actor / service_actor → type: actor and
+# coarse subTypes (e.g. customer, employee) via classifier/components.classifier.yaml.
+# This file focuses on *where* we see actors in code and which properties to attach.
+
+regexes:
+  # Frontend: Next.js/React session hook file
+  ts_frontend_session_hook_file: "hooks/useSession\\.tsx?$"
+
+  # Backend: NestJS / Express controllers using req.user
+  ts_backend_req_user: "\\breq\\.user\\b"
+
+  # Backend: simple admin role checks
+  ts_role_admin: "\\b(isAdmin|is_admin)\\b|\\brole[s]?\\s*[:=]\\s*['\"]admin['\"]"
+
+rules:
+  # Frontend web customer: useSession hook representing logged-in customer user
+  - id: web_actor_frontend_session
+    patternId: web_actor
+    name: Customer
+    file_path_regex: ts_frontend_session_hook_file
+    confidence: 0.9
+    properties:
+      actorType: customer
+      sourceContext: frontend_session
+
+  # Backend web customer: controllers using req.user (authenticated user context)
+  - id: web_actor_backend_req_user
+    patternId: web_actor
+    name: Customer
+    content_regex: ts_backend_req_user
+    confidence: 0.85
+    properties:
+      actorType: customer
+      sourceContext: backend_controller
+
+  # Backend admin employee: admin checks around user/role handling
+  - id: service_actor_admin_employee
+    patternId: service_actor
+    name: Admin user
+    content_regex: ts_role_admin
+    confidence: 0.8
+    properties:
+      actorType: employee
+      roleNames:
+        - admin
+      sourceContext: backend_role_check
+