@euconform/core 1.2.0 → 1.3.0

package/src/scanner/detectors/compliance-detector.ts

@@ -0,0 +1,232 @@
+import { IMPLEMENTATION_PROVENANCE, isUserFacingPath } from "../../evidence/compliance-evaluation";
+import type {
+  ConfidenceLevel,
+  DetectedSignal,
+  DetectorContext,
+  SignalCategory,
+  SignalEvidence,
+} from "../../evidence/types";
+import { SOURCE_EXTENSIONS } from "./shared";
+
+interface ComplianceRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+  requiresUserFacingPath?: boolean;
+}
+
+const rules: ComplianceRule[] = [
+  // --- compliance-disclosure ---
+  {
+    id: "compliance-disclosure-ai-generated",
+    name: "AI disclosure text",
+    category: "compliance-disclosure",
+    pattern: /\b(?:generated\s+by\s+ai|ai[- ]generated|powered\s+by\s+ai)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-disclosure-ai-notice",
+    name: "AI transparency notice",
+    category: "compliance-disclosure",
+    pattern: /\b(?:artificial\s+intelligence|machine\s+learning\s+model|transparency\s+notice)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-logging ---
+  {
+    id: "compliance-logging-structured",
+    name: "Structured logging library",
+    category: "compliance-logging",
+    pattern:
+      /\bfrom\s+['"](?:winston|pino|bunyan)['"]|\brequire\(\s*['"](?:winston|pino|bunyan)['"]\)/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-logging-audit",
+    name: "Audit trail pattern",
+    category: "compliance-logging",
+    pattern: /\b(?:audit[._-]?log|audit[._-]?trail|log[._-]?audit)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-logging-middleware",
+    name: "Logging middleware",
+    category: "compliance-logging",
+    pattern: /\b(?:logging[Mm]iddleware|requestLogger|morgan)\b/,
+    confidence: "low",
+  },
+
+  // --- compliance-oversight ---
+  {
+    id: "compliance-oversight-review",
+    name: "Human review flow",
+    category: "compliance-oversight",
+    pattern: /\b(?:human[_-]?review|manual[_-]?review|approval[_-]?flow|review[_-]?gate)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-oversight-approve-reject",
+    name: "Approval/rejection mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:onApprove|onReject|handleApproval|approveAction|rejectAction)\b/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-oversight-override",
+    name: "Override mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:override[_-]?ai|human[_-]?override|manual[_-]?override)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-bias ---
+  {
+    id: "compliance-bias-fairness",
+    name: "Fairness/bias testing",
+    category: "compliance-bias",
+    pattern: /\b(?:fairness[_-]?test|bias[_-]?test|disparate[_-]?impact|demographic[_-]?parity)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-bias-benchmark",
+    name: "Bias benchmark reference",
+    category: "compliance-bias",
+    pattern: /\bCrowS[_-]?Pairs\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-bias-euconform",
+    name: "EuConform bias utilities",
+    category: "compliance-bias",
+    pattern: /\bfrom\s+['"]@euconform\/core.*bias/,
+    confidence: "medium",
+  },
+
+  // --- compliance-data ---
+  {
+    id: "compliance-data-quality",
+    name: "Data quality checks",
+    category: "compliance-data",
+    pattern: /\b(?:data[_-]?quality|data[_-]?validation|dataset[_-]?doc|data[_-]?lineage)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-data-pii",
+    name: "PII handling / anonymization",
+    category: "compliance-data",
+    pattern: /\b(?:pii[_-]?filter|anonymi[sz]e|pseudonymi[sz]e|redact[_-]?pii)\b/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-data-gdpr",
+    name: "GDPR reference",
+    category: "compliance-data",
+    pattern: /\bGDPR\b|data[_-]?protection[_-]?regulation/i,
+    confidence: "low",
+  },
+
+  // --- compliance-reporting ---
+  {
+    id: "compliance-reporting-json",
+    name: "JSON export capability",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:exportJSON|downloadJSON|writeJSONFile|saveJSONReport|exportAuditJSON|exportAnnexJSON|generateAnnexJson)\b|(?:writeFile(?:Sync)?|saveAs|download)\s*\([^)]*(?:report|audit|annex|compliance)[^)]*\.json/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-reporting-pdf",
+    name: "PDF export capability",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:jspdf|pdf[_-]?lib|pdfmake|generatePDF|exportPDF|downloadPDF|renderPDF|generateAnnexPdf)\b|puppeteer.*\.pdf/i,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-reporting-report",
+    name: "Report generation",
+    category: "compliance-reporting",
+    pattern:
+      /\b(?:generateReport|buildReport|exportReport|downloadReport|createReport|annex[_-]?iv[_-]?report|compliance[_-]?report|audit[_-]?report)\b/i,
+    confidence: "medium",
+  },
+
+  // --- compliance-incident ---
+  {
+    id: "compliance-incident-sentry",
+    name: "Sentry error reporting",
+    category: "compliance-incident",
+    pattern: /\bfrom\s+['"]@sentry\/|\bSentry\.init\b|\brequire\(\s*['"]@sentry\//,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-incident-boundary",
+    name: "Error boundary",
+    category: "compliance-incident",
+    pattern: /\bErrorBoundary\b|componentDidCatch/,
+    confidence: "medium",
+  },
+  {
+    id: "compliance-incident-response",
+    name: "Incident response hook",
+    category: "compliance-incident",
+    pattern: /\b(?:incident[_-]?report|incident[_-]?response|useIncident|alerting[_-]?hook)\b/i,
+    confidence: "medium",
+  },
+];
+
+function canEvaluateRule(rule: ComplianceRule, file: DetectorContext["file"]): boolean {
+  if (!IMPLEMENTATION_PROVENANCE.has(file.provenance)) return false;
+  if (rule.category === "compliance-disclosure") return isUserFacingPath(file.relativePath);
+  if (rule.requiresUserFacingPath) return isUserFacingPath(file.relativePath);
+  return true;
+}
+
+function gatherEvidence(
+  lines: string[],
+  pattern: RegExp,
+  filePath: string,
+  maxItems: number
+): SignalEvidence[] {
+  const evidence: SignalEvidence[] = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= maxItems) break;
+    }
+  }
+  return evidence;
+}
+
+export function detectCompliance(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+
+  const signalMap = new Map<string, DetectedSignal>();
+
+  for (const rule of rules) {
+    if (!canEvaluateRule(rule, file)) continue;
+
+    const evidence = gatherEvidence(ctx.lines, rule.pattern, file.relativePath, 3);
+    if (evidence.length === 0) continue;
+
+    const existing = signalMap.get(rule.id);
+    if (existing) {
+      existing.evidence.push(...evidence);
+    } else {
+      signalMap.set(rule.id, {
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+
+  return Array.from(signalMap.values());
+}

package/src/scanner/detectors/config-detector.ts

@@ -0,0 +1,316 @@
+import type {
+  ConfidenceLevel,
+  DetectedSignal,
+  DetectorContext,
+  SignalCategory,
+  SignalEvidence,
+} from "../../evidence/types";
+
+// ---------------------------------------------------------------------------
+// .env file detection — variable names only, never values
+// ---------------------------------------------------------------------------
+
+interface EnvKeyRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const envKeyRules: EnvKeyRule[] = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI API key",
+    category: "ai-provider",
+    pattern: /^OPENAI_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic API key",
+    category: "ai-provider",
+    pattern: /^ANTHROPIC_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-azure-openai",
+    name: "Azure OpenAI key",
+    category: "ai-provider",
+    pattern: /^AZURE_OPENAI_/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-google-ai",
+    name: "Google AI key",
+    category: "ai-provider",
+    pattern: /^(?:GOOGLE_AI_API_KEY|GEMINI_API_KEY)\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere API key",
+    category: "ai-provider",
+    pattern: /^COHERE_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-replicate",
+    name: "Replicate API token",
+    category: "ai-provider",
+    pattern: /^REPLICATE_API_TOKEN\b/,
+    confidence: "high",
+  },
+  {
+    id: "ai-provider-huggingface",
+    name: "HuggingFace token",
+    category: "ai-provider",
+    pattern: /^HUGGINGFACE_TOKEN\b|^HF_TOKEN\b/,
+    confidence: "high",
+  },
+  {
+    id: "local-inference-ollama",
+    name: "Ollama host config",
+    category: "local-inference",
+    pattern: /^OLLAMA_HOST\b|^OLLAMA_BASE_URL\b/,
+    confidence: "high",
+  },
+  {
+    id: "rag-pinecone",
+    name: "Pinecone API key",
+    category: "rag",
+    pattern: /^PINECONE_API_KEY\b/,
+    confidence: "high",
+  },
+  {
+    id: "rag-weaviate",
+    name: "Weaviate config",
+    category: "rag",
+    pattern: /^WEAVIATE_/,
+    confidence: "high",
+  },
+  {
+    id: "rag-chroma",
+    name: "ChromaDB config",
+    category: "rag",
+    pattern: /^CHROMA_/,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Docker Compose detection
+// ---------------------------------------------------------------------------
+
+interface DockerServiceRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const dockerServiceRules: DockerServiceRule[] = [
+  {
+    id: "local-inference-ollama-docker",
+    name: "Ollama Docker service",
+    category: "local-inference",
+    pattern: /\bollama\/ollama\b|image:\s*ollama/,
+    confidence: "high",
+  },
+  {
+    id: "rag-chromadb-docker",
+    name: "ChromaDB Docker service",
+    category: "rag",
+    pattern: /\bchromadb\/chroma\b|image:\s*chroma/,
+    confidence: "high",
+  },
+  {
+    id: "rag-weaviate-docker",
+    name: "Weaviate Docker service",
+    category: "rag",
+    pattern: /\bsemitechnologies\/weaviate\b|image:\s*weaviate/,
+    confidence: "high",
+  },
+  {
+    id: "rag-redis-vector",
+    name: "Redis with vector module",
+    category: "rag",
+    pattern: /redis\/redis-stack|redisearch|redis-stack-server/,
+    confidence: "high",
+  },
+  {
+    id: "rag-qdrant-docker",
+    name: "Qdrant Docker service",
+    category: "rag",
+    pattern: /\bqdrant\/qdrant\b|image:\s*qdrant/,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Dockerfile detection
+// ---------------------------------------------------------------------------
+
+interface DockerfileRule {
+  id: string;
+  name: string;
+  category: SignalCategory;
+  pattern: RegExp;
+  confidence: ConfidenceLevel;
+}
+
+const dockerfileRules: DockerfileRule[] = [
+  {
+    id: "local-inference-pip-ai",
+    name: "AI pip packages in Dockerfile",
+    category: "local-inference",
+    pattern:
+      /pip\s+install\s+.*\b(?:torch|tensorflow|transformers|langchain|llama[-_]?cpp|vllm|onnxruntime)\b/,
+    confidence: "high",
+  },
+  {
+    id: "local-inference-model-download",
+    name: "Model download in Dockerfile",
+    category: "local-inference",
+    pattern:
+      /\b(?:huggingface-cli\s+download|wget\s+.*(?:\.gguf|\.safetensors|\.bin)|COPY\s+.*(?:model|weights))\b/i,
+    confidence: "high",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// File matching helpers
+// ---------------------------------------------------------------------------
+
+function isEnvExample(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^\.env\.(?:example|sample)$/.test(basename);
+}
+
+function isDockerCompose(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^docker-compose/.test(basename);
+}
+
+function isDockerfile(relativePath: string): boolean {
+  const basename = relativePath.split("/").pop() ?? "";
+  return /^Dockerfile/.test(basename);
+}
+
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+
+export function detectConfig(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  const signals: DetectedSignal[] = [];
+
+  const lines = ctx.lines;
+
+  if (isEnvExample(file.relativePath)) {
+    detectEnvKeys(file.relativePath, lines, signals);
+  } else if (isDockerCompose(file.relativePath)) {
+    detectDockerServices(file.relativePath, lines, signals);
+  } else if (isDockerfile(file.relativePath)) {
+    detectDockerfilePatterns(file.relativePath, lines, signals);
+  }
+
+  return signals;
+}
+
+function extractEnvVarName(rawLine: string): string | null {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#")) return null;
+  const eqIndex = line.indexOf("=");
+  return eqIndex >= 0 ? line.slice(0, eqIndex).trim() : line.trim();
+}
+
+function detectEnvKeys(relativePath: string, lines: string[], signals: DetectedSignal[]): void {
+  for (const rule of envKeyRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const varName = extractEnvVarName(lines[i] ?? "");
+      if (varName && rule.pattern.test(varName)) {
+        evidence.push({ file: relativePath, line: i + 1, snippet: varName });
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}
+
+function detectDockerServices(
+  relativePath: string,
+  lines: string[],
+  signals: DetectedSignal[]
+): void {
+  for (const rule of dockerServiceRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120),
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}
+
+function detectDockerfilePatterns(
+  relativePath: string,
+  lines: string[],
+  signals: DetectedSignal[]
+): void {
+  for (const rule of dockerfileRules) {
+    const evidence: SignalEvidence[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120),
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence,
+      });
+    }
+  }
+}

package/src/scanner/detectors/framework-detector.ts

@@ -0,0 +1,163 @@
+import type {
+  ConfidenceLevel,
+  DetectedSignal,
+  DetectorContext,
+  SignalEvidence,
+} from "../../evidence/types";
+import { EXTENDED_EXTENSIONS } from "./shared";
+
+interface FrameworkRule {
+  name: string;
+  category: "framework" | "runtime";
+  /** Match against file name (basename) */
+  configPattern?: RegExp;
+  /** Match against file content (line-level) */
+  importPattern?: RegExp;
+  configConfidence: ConfidenceLevel;
+  importConfidence: ConfidenceLevel;
+}
+
+const rules: FrameworkRule[] = [
+  // Frameworks
+  {
+    name: "nextjs",
+    category: "framework",
+    configPattern: /^next\.config\./,
+    importPattern: /\bfrom\s+['"]next[\/'"]|\brequire\(\s*['"]next['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "react",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]react['"]|\brequire\(\s*['"]react['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "express",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]express['"]|\brequire\(\s*['"]express['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "fastify",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]fastify['"]|\brequire\(\s*['"]fastify['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "nestjs",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]@nestjs\/|\brequire\(\s*['"]@nestjs\//,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "hono",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]hono['"]|\brequire\(\s*['"]hono['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "elysia",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]elysia['"]|\brequire\(\s*['"]elysia['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "vite",
+    category: "framework",
+    configPattern: /^vite\.config\./,
+    importPattern: /\bfrom\s+['"]vite['"]|\brequire\(\s*['"]vite['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  // Runtimes
+  {
+    name: "nodejs",
+    category: "runtime",
+    importPattern:
+      /\bfrom\s+['"]node:(?:fs|http|path|crypto|stream)['"]|\bfrom\s+['"](?:fs|http|net|dgram)['"]|\brequire\(\s*['"](?:fs|http|path|crypto)['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "bun",
+    category: "runtime",
+    importPattern: /\bBun\.serve\b|\bBun\.file\b|\bBun\.write\b/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+  {
+    name: "deno",
+    category: "runtime",
+    importPattern: /\bDeno\.serve\b|\bDeno\.readFile\b|\bDeno\.env\b/,
+    configConfidence: "high",
+    importConfidence: "medium",
+  },
+];
+
+const CONFIG_NAME_PATTERN = /^(next|vite)\.config\./;
+
+function shouldProcess(file: { extension: string; relativePath: string }): boolean {
+  if (EXTENDED_EXTENSIONS.has(file.extension)) return true;
+  const basename = file.relativePath.split("/").pop() ?? "";
+  return CONFIG_NAME_PATTERN.test(basename);
+}
+
+function findImportEvidence(lines: string[], pattern: RegExp, filePath: string): SignalEvidence[] {
+  const evidence: SignalEvidence[] = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= 3) break;
+    }
+  }
+  return evidence;
+}
+
+export function detectFrameworks(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!shouldProcess(file)) return [];
+
+  const basename = file.relativePath.split("/").pop() ?? "";
+  const seen = new Set<string>();
+  const signals: DetectedSignal[] = [];
+
+  for (const rule of rules) {
+    if (rule.configPattern?.test(basename) && !seen.has(rule.name)) {
+      seen.add(rule.name);
+      signals.push({
+        id: `${rule.category}-${rule.name}`,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.configConfidence,
+        evidence: [
+          { file: file.relativePath, line: 1, snippet: `Config file detected: ${basename}` },
+        ],
+      });
+    }
+
+    if (!rule.importPattern) continue;
+    const evidence = findImportEvidence(ctx.lines, rule.importPattern, file.relativePath);
+    if (evidence.length > 0 && !seen.has(rule.name)) {
+      seen.add(rule.name);
+      signals.push({
+        id: `${rule.category}-${rule.name}`,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.importConfidence,
+        evidence,
+      });
+    }
+  }
+
+  return signals;
+}