@euconform/core 1.0.1 → 1.3.0

package/src/scanner/detectors/ai-provider-detector.ts

@@ -0,0 +1,135 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+import { SOURCE_EXTENSIONS } from "./shared";
+
+// ---------------------------------------------------------------------------
+// Provider patterns
+// ---------------------------------------------------------------------------
+
+interface ProviderPattern {
+  id: string;
+  name: string;
+  /** Regex applied per line to detect imports/requires */
+  importPattern: RegExp;
+}
+
+const PROVIDER_IMPORTS: ProviderPattern[] = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI SDK",
+    importPattern: /(?:from\s+['"]openai['"]|require\s*\(\s*['"]openai['"])/,
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic SDK",
+    importPattern:
+      /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\s*\(\s*['"]@anthropic-ai\/sdk['"])/,
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere SDK",
+    importPattern: /(?:from\s+['"]cohere-ai['"]|require\s*\(\s*['"]cohere-ai['"])/,
+  },
+  {
+    id: "ai-provider-google-genai",
+    name: "Google Generative AI",
+    importPattern:
+      /(?:from\s+['"]@google\/generative-ai['"]|require\s*\(\s*['"]@google\/generative-ai['"])/,
+  },
+  {
+    id: "ai-provider-mistral",
+    name: "Mistral AI SDK",
+    importPattern:
+      /(?:from\s+['"]@mistralai\/mistralai['"]|require\s*\(\s*['"]@mistralai\/mistralai['"])/,
+  },
+];
+
+interface ApiEndpoint {
+  id: string;
+  name: string;
+  pattern: RegExp;
+}
+
+const API_ENDPOINTS: ApiEndpoint[] = [
+  {
+    id: "ai-provider-openai-api",
+    name: "OpenAI API endpoint",
+    pattern: /api\.openai\.com/,
+  },
+  {
+    id: "ai-provider-anthropic-api",
+    name: "Anthropic API endpoint",
+    pattern: /api\.anthropic\.com/,
+  },
+  {
+    id: "ai-provider-cohere-api",
+    name: "Cohere API endpoint",
+    pattern: /api\.cohere\.ai/,
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+
+export function detectAiProviderSignals(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+
+  const lines = ctx.lines;
+  const signalMap = new Map<string, DetectedSignal>();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+
+    // Check import/require patterns
+    for (const provider of PROVIDER_IMPORTS) {
+      if (provider.importPattern.test(line)) {
+        addEvidence(signalMap, provider.id, provider.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200),
+        });
+      }
+    }
+
+    // Check API endpoint URLs
+    for (const endpoint of API_ENDPOINTS) {
+      if (endpoint.pattern.test(line)) {
+        addEvidence(signalMap, endpoint.id, endpoint.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200),
+        });
+      }
+    }
+  }
+
+  return Array.from(signalMap.values());
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function addEvidence(
+  map: Map<string, DetectedSignal>,
+  id: string,
+  name: string,
+  confidence: "high" | "medium" | "low",
+  evidence: { file: string; line?: number; snippet: string }
+): void {
+  const existing = map.get(id);
+  if (existing) {
+    existing.evidence.push(evidence);
+  } else {
+    map.set(id, {
+      id,
+      name,
+      category: "ai-provider",
+      confidence,
+      evidence: [evidence],
+    });
+  }
+}

package/src/scanner/detectors/compliance-detector.ts

@@ -0,0 +1,232 @@
+import { IMPLEMENTATION_PROVENANCE, isUserFacingPath } from "../../evidence/compliance-evaluation";
+import type {
+  ConfidenceLevel,
+  DetectedSignal,
+  DetectorContext,
+  SignalCategory,
+  SignalEvidence,
+} from "../../evidence/types";
+import { SOURCE_EXTENSIONS } from "./shared";
+
+interface ComplianceRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+  requiresUserFacingPath?: boolean;
+}
+
+const rules: ComplianceRule[] = [
+  // --- compliance-disclosure ---
+  {
+    id: "compliance-disclosure-ai-generated",
+    name: "AI disclosure text",
+    category: "compliance-disclosure",
+    pattern: /\b(?:generated\s+by\s+ai|ai[- ]generated|powered\s+by\s+ai)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-disclosure-ai-notice",
+    name: "AI transparency notice",
+    category: "compliance-disclosure",
+    pattern: /\b(?:artificial\s+intelligence|machine\s+learning\s+model|transparency\s+notice)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-logging ---
+  {
+    id: "compliance-logging-structured",
+    name: "Structured logging library",
+    category: "compliance-logging",
+    pattern:
+      /\bfrom\s+['"](?:winston|pino|bunyan)['"]|\brequire\(\s*['"](?:winston|pino|bunyan)['"]\)/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-logging-audit",
+    name: "Audit trail pattern",
+    category: "compliance-logging",
+    pattern: /\b(?:audit[._-]?log|audit[._-]?trail|log[._-]?audit)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-logging-middleware",
+    name: "Logging middleware",
+    category: "compliance-logging",
+    pattern: /\b(?:logging[Mm]iddleware|requestLogger|morgan)\b/,
+    confidence: "low",
+  },
+
+  // --- compliance-oversight ---
+  {
+    id: "compliance-oversight-review",
+    name: "Human review flow",
+    category: "compliance-oversight",
+    pattern: /\b(?:human[_-]?review|manual[_-]?review|approval[_-]?flow|review[_-]?gate)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-oversight-approve-reject",
+    name: "Approval/rejection mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:onApprove|onReject|handleApproval|approveAction|rejectAction)\b/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-oversight-override",
+    name: "Override mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:override[_-]?ai|human[_-]?override|manual[_-]?override)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-bias ---
+  {
+    id: "compliance-bias-fairness",
+    name: "Fairness/bias testing",
+    category: "compliance-bias",
+    pattern: /\b(?:fairness[_-]?test|bias[_-]?test|disparate[_-]?impact|demographic[_-]?parity)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-bias-benchmark",
+    name: "Bias benchmark reference",
+    category: "compliance-bias",
+    pattern: /\bCrowS[_-]?Pairs\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-bias-euconform",
+    name: "EuConform bias utilities",
+    category: "compliance-bias",
+    pattern: /\bfrom\s+['"]@euconform\/core.*bias/,
+    confidence: "medium",
+  },
+
+  // --- compliance-data ---
+  {
+    id: "compliance-data-quality",
+    name: "Data quality checks",
+    category: "compliance-data",
+    pattern: /\b(?:data[_-]?quality|data[_-]?validation|dataset[_-]?doc|data[_-]?lineage)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-data-pii",
+    name: "PII handling / anonymization",
+    category: "compliance-data",
+    pattern: /\b(?:pii[_-]?filter|anonymi[sz]e|pseudonymi[sz]e|redact[_-]?pii)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-data-gdpr",
+    name: "GDPR reference",
+    category: "compliance-data",
+    pattern: /\bGDPR\b|data[_-]?protection[_-]?regulation/i,
+    confidence: "low",
+  },
+
+  // --- compliance-reporting ---
+  {
+    id: "compliance-reporting-json",
+    name: "JSON export capability",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:exportJSON|downloadJSON|writeJSONFile|saveJSONReport|exportAuditJSON|exportAnnexJSON|generateAnnexJson)\b|(?:writeFile(?:Sync)?|saveAs|download)\s*\([^)]*(?:report|audit|annex|compliance)[^)]*\.json/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-reporting-pdf",
+    name: "PDF export capability",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:jspdf|pdf[_-]?lib|pdfmake|generatePDF|exportPDF|downloadPDF|renderPDF|generateAnnexPdf)\b|puppeteer.*\.pdf/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-reporting-report",
+    name: "Report generation",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:generateReport|buildReport|exportReport|downloadReport|createReport|annex[_-]?iv[_-]?report|compliance[_-]?report|audit[_-]?report)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-incident ---
+  {
+    id: "compliance-incident-sentry",
+    name: "Sentry error reporting",
+    category: "compliance-incident",
+    pattern: /\bfrom\s+['"]@sentry\/|\bSentry\.init\b|\brequire\(\s*['"]@sentry\//,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-incident-boundary",
+    name: "Error boundary",
+    category: "compliance-incident",
+    pattern: /\bErrorBoundary\b|componentDidCatch/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-incident-response",
+    name: "Incident response hook",
+    category: "compliance-incident",
+    pattern: /\b(?:incident[_-]?report|incident[_-]?response|useIncident|alerting[_-]?hook)\b/i,
+    confidence: "medium",
+  },
+];
+
+function canEvaluateRule(rule: ComplianceRule, file: DetectorContext["file"]): boolean {
+  if (!IMPLEMENTATION_PROVENANCE.has(file.provenance)) return false;
+  if (rule.category === "compliance-disclosure") return isUserFacingPath(file.relativePath);
+  if (rule.requiresUserFacingPath) return isUserFacingPath(file.relativePath);
+  return true;
+}
+
+function gatherEvidence(
+  lines: string[],
+  pattern: RegExp,
+  filePath: string,
+  maxItems: number
+): SignalEvidence[] {
+  const evidence: SignalEvidence[] = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= maxItems) break;
+    }
+  }
+  return evidence;
+}
+
+export function detectCompliance(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+
+  const signalMap = new Map<string, DetectedSignal>();
+
+  for (const rule of rules) {
+    if (!canEvaluateRule(rule, file)) continue;
+
+    const evidence = gatherEvidence(ctx.lines, rule.pattern, file.relativePath, 3);
+    if (evidence.length === 0) continue;
+
+    const existing = signalMap.get(rule.id);
+    if (existing) {
+      existing.evidence.push(...evidence);
+    } else {
+      signalMap.set(rule.id, {
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+
+  return Array.from(signalMap.values());
+}

package/src/scanner/detectors/config-detector.ts

@@ -0,0 +1,316 @@
+import type {
+  ConfidenceLevel,
+  DetectedSignal,
+  DetectorContext,
+  SignalCategory,
+  SignalEvidence,
+} from "../../evidence/types";
+
+// ---------------------------------------------------------------------------
+// .env file detection — variable names only, never values
+// ---------------------------------------------------------------------------
+
+interface EnvKeyRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const envKeyRules: EnvKeyRule[] = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI API key",
+    category: "ai-provider",
+    pattern: /^OPENAI_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic API key",
+    category: "ai-provider",
+    pattern: /^ANTHROPIC_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-azure-openai",
+    name: "Azure OpenAI key",
+    category: "ai-provider",
+    pattern: /^AZURE_OPENAI_/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-google-ai",
+    name: "Google AI key",
+    category: "ai-provider",
+    pattern: /^(?:GOOGLE_AI_API_KEY|GEMINI_API_KEY)\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere API key",
+    category: "ai-provider",
+    pattern: /^COHERE_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-replicate",
+    name: "Replicate API token",
+    category: "ai-provider",
+    pattern: /^REPLICATE_API_TOKEN\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-huggingface",
+    name: "HuggingFace token",
+    category: "ai-provider",
+    pattern: /^HUGGINGFACE_TOKEN\b|^HF_TOKEN\b/,
+    confidence: "high",
+  },
+  {
+    id: "local-inference-ollama",
+    name: "Ollama host config",
+    category: "local-inference",
+    pattern: /^OLLAMA_HOST\b|^OLLAMA_BASE_URL\b/,
+    confidence: "high",
+  },
+  {
+    id: "rag-pinecone",
+    name: "Pinecone API key",
+    category: "rag",
+    pattern: /^PINECONE_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "rag-weaviate",
+    name: "Weaviate config",
+    category: "rag",
+    pattern: /^WEAVIATE_/,
+    confidence: "high",
+  },
+  {
+    id: "rag-chroma",
+    name: "ChromaDB config",
+    category: "rag",
+    pattern: /^CHROMA_/,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Docker Compose detection
+// ---------------------------------------------------------------------------
+
+interface DockerServiceRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const dockerServiceRules: DockerServiceRule[] = [
+  {
+    id: "local-inference-ollama-docker",
+    name: "Ollama Docker service",
+    category: "local-inference",
+    pattern: /\bollama\/ollama\b|image:\s*ollama/,
+    confidence: "high",
+  },
+  {
+    id: "rag-chromadb-docker",
+    name: "ChromaDB Docker service",
+    category: "rag",
+    pattern: /\bchromadb\/chroma\b|image:\s*chroma/,
+    confidence: "high",
+  },
+  {
+    id: "rag-weaviate-docker",
+    name: "Weaviate Docker service",
+    category: "rag",
+    pattern: /\bsemitechnologies\/weaviate\b|image:\s*weaviate/,
+    confidence: "high",
+  },
+  {
+    id: "rag-redis-vector",
+    name: "Redis with vector module",
+    category: "rag",
+    pattern: /redis\/redis-stack|redisearch|redis-stack-server/,
+    confidence: "high",
+  },
+  {
+    id: "rag-qdrant-docker",
+    name: "Qdrant Docker service",
+    category: "rag",
+    pattern: /\bqdrant\/qdrant\b|image:\s*qdrant/,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Dockerfile detection
+// ---------------------------------------------------------------------------
+
+interface DockerfileRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const dockerfileRules: DockerfileRule[] = [
+  {
+    id: "local-inference-pip-ai",
+    name: "AI pip packages in Dockerfile",
+    category: "local-inference",
+    pattern:
+      /pip\s+install\s+.*\b(?:torch|tensorflow|transformers|langchain|llama[-_]?cpp|vllm|onnxruntime)\b/,
+    confidence: "high",
+  },
+  {
+    id: "local-inference-model-download",
+    name: "Model download in Dockerfile",
+    category: "local-inference",
+    pattern:
+      /\b(?:huggingface-cli\s+download|wget\s+.*(?:\.gguf|\.safetensors|\.bin)|COPY\s+.*(?:model|weights))\b/i,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// File matching helpers
+// ---------------------------------------------------------------------------
+
+function isEnvExample(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^\.env\.(?:example|sample)$/.test(basename);
+}
+
+function isDockerCompose(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^docker-compose/.test(basename);
+}
+
+function isDockerfile(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^Dockerfile/.test(basename);
+}
+
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+
+export function detectConfig(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  const signals: DetectedSignal[] = [];
+
+  const lines = ctx.lines;
+
+  if (isEnvExample(file.relativePath)) {
+    detectEnvKeys(file.relativePath, lines, signals);
+  } else if (isDockerCompose(file.relativePath)) {
+    detectDockerServices(file.relativePath, lines, signals);
+  } else if (isDockerfile(file.relativePath)) {
+    detectDockerfilePatterns(file.relativePath, lines, signals);
+  }
+
+  return signals;
+}
+
+function extractEnvVarName(rawLine: string): string | null {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#")) return null;
+  const eqIndex = line.indexOf("=");
+  return eqIndex >= 0 ? line.slice(0, eqIndex).trim() : line.trim();
+}
+
+function detectEnvKeys(relativePath: string, lines: string[], signals: DetectedSignal[]): void {
+  for (const rule of envKeyRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const varName = extractEnvVarName(lines[i] ?? "");
+      if (varName && rule.pattern.test(varName)) {
+        evidence.push({ file: relativePath, line: i + 1, snippet: varName });
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}
+
+function detectDockerServices(
+  relativePath: string,
+  lines: string[],
+  signals: DetectedSignal[]
+): void {
+  for (const rule of dockerServiceRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120),
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}
+
+function detectDockerfilePatterns(
+  relativePath: string,
+  lines: string[],
+  signals: DetectedSignal[]
+): void {
+  for (const rule of dockerfileRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120),
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}