@everystack/cli 0.3.3 → 0.3.5

package/src/cli/commands/security-probe.ts

@@ -0,0 +1,213 @@
+/**
+ * `everystack security:probe --stage <name>` — live black-box security probe.
+ *
+ * Config-free. Two instruments meeting in the middle:
+ *   1. White-box introspection: reads the live DB catalog (grants, columns, RLS)
+ *      via the ops-Lambda `db:query` path to learn what the deployed app exposes.
+ *   2. Black-box probing: hits the deployed router URL and asserts the surface
+ *      behaves safely against that discovered truth.
+ *
+ * No fixtures, no config — the plan is derived from the database itself. When the
+ * v3 Model lands, the plan source moves from catalog to the Model's abilities and
+ * this command becomes the generated `diff(declared, live)` red-team.
+ */
+
+import {
+  buildProbePlan,
+  assessRlsCoverage,
+  assessColumnExposure,
+  assessLimitCap,
+  assessInjection,
+  assessEmbedDepth,
+  summarizeProbe,
+  type Catalog,
+  type CatalogTable,
+  type CatalogColumn,
+  type CatalogGrant,
+  type ProbeResult,
+} from '../security-probe.js';
+import { resolveConfig, opsFunction } from '../config.js';
+import { invokeAction } from '../aws.js';
+import { step, info, fail, success, warn } from '../output.js';
+
+const SYS_SCHEMAS = "('pg_catalog','information_schema','pg_toast')";
+
+const TABLES_SQL = `
+  SELECT n.nspname AS schema, c.relname AS "table", c.relrowsecurity AS rls_enabled
+  FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+  WHERE c.relkind = 'r' AND n.nspname NOT IN ${SYS_SCHEMAS}`;
+
+const COLUMNS_SQL = `
+  SELECT table_schema AS schema, table_name AS "table", column_name AS "column", data_type
+  FROM information_schema.columns
+  WHERE table_schema NOT IN ${SYS_SCHEMAS}`;
+
+const GRANTS_SQL = `
+  SELECT table_schema AS schema, table_name AS "table", grantee, privilege_type AS privilege
+  FROM information_schema.role_table_grants
+  WHERE table_schema NOT IN ${SYS_SCHEMAS}`;
+
+async function catalogQuery(region: string, fn: string, sql: string): Promise<any[]> {
+  const result: any = await invokeAction(region, fn, 'db:query', { sql });
+  if (result?.error) throw new Error(`Catalog query failed: ${result.error}`);
+  return result?.rows ?? [];
+}
+
+function toCatalog(tables: any[], columns: any[], grants: any[]): Catalog {
+  return {
+    tables: tables.map(
+      (r): CatalogTable => ({ schema: r.schema, table: r.table, rlsEnabled: r.rls_enabled === true }),
+    ),
+    columns: columns.map(
+      (r): CatalogColumn => ({ schema: r.schema, table: r.table, column: r.column, dataType: r.data_type }),
+    ),
+    grants: grants.map(
+      (r): CatalogGrant => ({ schema: r.schema, table: r.table, grantee: r.grantee, privilege: r.privilege }),
+    ),
+  };
+}
+
+interface GetResult {
+  status: number;
+  rows: Record<string, unknown>[];
+}
+
+async function apiGet(base: string, pathAndQuery: string): Promise<GetResult> {
+  const res = await fetch(`${base}${pathAndQuery}`, { redirect: 'follow' });
+  let rows: Record<string, unknown>[] = [];
+  try {
+    const body = await res.json();
+    if (Array.isArray(body)) rows = body;
+    else if (Array.isArray((body as any)?.data)) rows = (body as any).data;
+  } catch {
+    // non-JSON body
+  }
+  return { status: res.status, rows };
+}
+
+export interface ProbeRunOptions {
+  region: string;
+  opsFn: string;
+  base: string;
+  maxLimit?: number;
+}
+
+/** Result-producing core, shared by the command wrapper and the `audit` capstone. */
+export async function runSecurityProbe(opts: ProbeRunOptions): Promise<ProbeResult[]> {
+  const { region, opsFn, base } = opts;
+
+  step('Introspecting database catalog (grants, columns, RLS)...');
+  const [t, c, g] = await Promise.all([
+    catalogQuery(region, opsFn, TABLES_SQL),
+    catalogQuery(region, opsFn, COLUMNS_SQL),
+    catalogQuery(region, opsFn, GRANTS_SQL),
+  ]);
+  const plan = buildProbePlan(toCatalog(t, c, g));
+  info(
+    `Surface: ${plan.anonReadableTables.length} anon-readable, ${plan.authReadableTables.length} auth-readable table(s).`,
+  );
+
+  const results: ProbeResult[] = [];
+  const maxLimit = opts.maxLimit ?? 10000;
+
+  // 1. RLS coverage — pure, from the catalog (no HTTP).
+  results.push(...assessRlsCoverage(plan));
+
+  // 2. Sensitive-column exposure — anon GET each readable table that has them.
+  step('Probing anon column exposure...');
+  for (const table of plan.anonReadableTables) {
+    const sensitive = plan.sensitiveColumns[table];
+    if (!sensitive?.length) continue;
+    try {
+      const { status, rows } = await apiGet(base, `/api/${table}?limit=5`);
+      if (status === 404) {
+        warn(`/api/${table} → 404 (route naming differs from DB table; skipped)`);
+        continue;
+      }
+      results.push(assessColumnExposure(table, rows, sensitive));
+    } catch (err: any) {
+      warn(`column-exposure ${table} inconclusive: ${err.message}`);
+    }
+  }
+
+  // 3/4/5 — pick a representative anon-readable table for the protocol probes.
+  const probeTable = plan.anonReadableTables[0];
+  if (probeTable) {
+    step(`Probing query protocol on /api/${probeTable}...`);
+    try {
+      const cap = await apiGet(base, `/api/${probeTable}?limit=999999999`);
+      results.push(assessLimitCap(cap.status, cap.rows.length, maxLimit));
+    } catch (err: any) {
+      warn(`limit-cap inconclusive: ${err.message}`);
+    }
+
+    const jsonCol = plan.jsonbColumns[probeTable]?.[0];
+    if (jsonCol) {
+      try {
+        const payload = encodeURIComponent("' OR '1'='1");
+        const inj = await apiGet(base, `/api/${probeTable}?${jsonCol}->>x=eq.${payload}`);
+        results.push(assessInjection(inj.status));
+      } catch (err: any) {
+        warn(`json-path-injection inconclusive: ${err.message}`);
+      }
+    }
+
+    try {
+      const deep = 'select=*,a(*,b(*,c(*,d(*,e(*)))))';
+      const depth = await apiGet(base, `/api/${probeTable}?${deep}`);
+      results.push(assessEmbedDepth(depth.status));
+    } catch (err: any) {
+      warn(`embed-depth inconclusive: ${err.message}`);
+    }
+  }
+
+  return results;
+}
+
+/** Print probe results; returns the number of failures (for exit-code logic). */
+export function reportProbeResults(results: ProbeResult[]): number {
+  for (const r of results) {
+    const tag = `[${r.severity}]`;
+    if (r.pass) success(`${tag} ${r.name} — ${r.detail}`);
+    else fail(`${tag} ${r.name} — ${r.detail}`);
+  }
+  const s = summarizeProbe(results);
+  console.log('');
+  const summary = `security:probe — ${s.pass} passed, ${s.fail} failed (${s.critical} critical)`;
+  if (s.fail > 0) fail(summary);
+  else success(summary);
+  return s.fail;
+}
+
+export async function securityProbeCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  if (!base) {
+    fail('No router URL to probe. Pass --host or ensure the stage has a deployed URL.');
+    process.exit(1);
+  }
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}, URL: ${base}`);
+
+  let results: ProbeResult[];
+  try {
+    results = await runSecurityProbe({
+      region: config.region,
+      opsFn: opsFunction(config),
+      base,
+      maxLimit: flags.maxLimit ? Number(flags.maxLimit) : undefined,
+    });
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  console.log('');
+  process.exit(reportProbeResults(results) > 0 ? 1 : 0);
+}

package/src/cli/commands/security.ts

@@ -104,10 +104,18 @@ async function runCatalogAudit(flags: Record<string, string>, waivers: Waivers):
   step('Resolving deployed config...');
   const config = await resolveConfig(flags.stage);
   info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  return auditDeployedSql(config.region, opsFunction(config), waivers);
+}
 
+/** Catalog-audit core, shared by the command and the `audit` capstone. */
+export async function auditDeployedSql(
+  region: string,
+  opsFn: string,
+  waivers: Waivers = {},
+): Promise<AuditReport> {
   step('Introspecting database catalog (functions + relations)...');
-  const fnRows = await catalogQuery(config.region, opsFunction(config), FUNCTIONS_SQL);
-  const relRows = await catalogQuery(config.region, opsFunction(config), RELATIONS_SQL);
+  const fnRows = await catalogQuery(region, opsFn, FUNCTIONS_SQL);
+  const relRows = await catalogQuery(region, opsFn, RELATIONS_SQL);
 
   const functions: FunctionDescriptor[] = fnRows.map(catalogFunctionToDescriptor);
   const views: ViewDescriptor[] = relRows.map(catalogRelationToDescriptor);
@@ -125,7 +133,7 @@ async function catalogQuery(region: string, fn: string, sql: string): Promise<an
 // Waivers + reporting.
 // ---------------------------------------------------------------------------
 
-async function loadWaivers(flag?: string): Promise<Waivers> {
+export async function loadWaivers(flag?: string): Promise<Waivers> {
   const candidates = flag ? [flag] : WAIVER_FILES;
   for (const candidate of candidates) {
     const abs = path.resolve(candidate);
@@ -141,7 +149,7 @@ async function loadWaivers(flag?: string): Promise<Waivers> {
   return {};
 }
 
-function printReport(report: AuditReport, instrument: 'static' | 'catalog'): void {
+export function printReport(report: AuditReport, instrument: 'static' | 'catalog'): void {
   const reds = [
     ...report.functions.filter((f) => f.severity === 'red'),
     ...report.views.filter((v) => v.severity === 'red'),

package/src/cli/commands/ui-audit.ts

@@ -0,0 +1,76 @@
+/**
+ * `everystack ui:audit [dir]` — source-side UI design-bloat audit.
+ *
+ * The local, actionable half of the design-bloat loop (the remote half rides in
+ * `bundle:audit`). It parses the app's `.tsx` source into the component model and
+ * runs the source-side checks: styles copy-pasted across call sites, hardcoded
+ * colors that should be tokens, raw primitives that reimplement a ui component,
+ * oversized components, and duplicated JSX. Every finding carries `file:line`
+ * occurrences and a fix the agent can apply, then verifies by re-running.
+ *
+ * Advisory by design — refactoring is taste, so this never gates (exit 0 even with
+ * findings). Config-free: defaults derived from the model, no per-app setup.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { discoverComponents } from '../component-model.js';
+import { auditComponents } from '../component-audit.js';
+import { resolveUiBloatBudget } from '../ui-bloat.js';
+import { summarize, type AuditFinding } from '../bundle-audit.js';
+import { fail, info, step, success, warn } from '../output.js';
+
+export interface UiAuditResult {
+  findings: AuditFinding[];
+  componentCount: number;
+}
+
+/** Result-producing core, shared by the command and the `audit` capstone. */
+export function runUiAudit(dir: string, flags: Record<string, string> = {}): UiAuditResult {
+  const root = path.resolve(dir);
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`${dir} is not a directory — pass the app source dir (defaults to .).`);
+  }
+  const components = discoverComponents(root);
+  const findings = auditComponents(components, resolveUiBloatBudget(flags));
+  return { findings, componentCount: components.length };
+}
+
+/** Print ui:audit findings; returns the number of advisory warnings. */
+export function reportUiAudit(result: UiAuditResult): number {
+  const { findings, componentCount } = result;
+  if (findings.length === 0) {
+    success(`ui:audit — clean. No design bloat across ${componentCount} component(s).`);
+    return 0;
+  }
+  for (const f of findings) {
+    warn(`[${f.check}] ${f.source}: ${f.detail}`);
+    if (f.fix) info(`  fix: ${f.fix.summary}`);
+    if (f.occurrences && f.occurrences.length > 1) {
+      info(`  at: ${f.occurrences.length} sites`);
+    }
+  }
+  console.log('');
+  const { warn: warns } = summarize(findings);
+  warn(`ui:audit — ${warns} advisory finding(s) across ${componentCount} component(s) (advisory; does not gate)`);
+  return warns;
+}
+
+export async function uiAuditCommand(
+  positional: string | undefined,
+  flags: Record<string, string>,
+): Promise<void> {
+  const dir = positional || flags.dir || '.';
+  step(`Scanning components under ${dir} ...`);
+  let result: UiAuditResult;
+  try {
+    result = runUiAudit(dir, flags);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+  console.log('');
+  reportUiAudit(result);
+  // Advisory only — refactoring is taste, so this never gates the build.
+  process.exit(0);
+}