@everystack/cli 0.3.3 → 0.3.5

package/src/cli/security-probe.ts

@@ -0,0 +1,243 @@
+/**
+ * Live security probe — pure plan-builder + assertion engine for
+ * `everystack security:probe`.
+ *
+ * Config-free by INTROSPECTION: the command reads the live DB catalog (grants,
+ * columns, RLS) through the ops-Lambda `db:query` path that `security:audit
+ * --stage` already uses, and this module turns that catalog into a ProbePlan —
+ * which tables are anon/auth-readable, which columns are sensitive, where RLS is
+ * off. The HTTP probes then test the deployed surface against that discovered
+ * truth. Nothing is hand-declared.
+ *
+ * Forward path: when the v3 Model lands, the Model's `abilities` become the
+ * oracle and the same assertions become `diff(declared, live)` — this engine is
+ * reused unchanged; only the source of the plan moves from catalog to Model.
+ */
+
+// --- Catalog shapes (rows returned by the introspection SQL) ----------------
+
+export interface CatalogColumn {
+  schema: string;
+  table: string;
+  column: string;
+  dataType: string;
+}
+
+export interface CatalogGrant {
+  schema: string;
+  table: string;
+  grantee: string; // 'anon' | 'authenticated' | 'PUBLIC' | ...
+  privilege: string; // 'SELECT' | 'INSERT' | ...
+}
+
+export interface CatalogTable {
+  schema: string;
+  table: string;
+  rlsEnabled: boolean;
+}
+
+export interface Catalog {
+  tables: CatalogTable[];
+  columns: CatalogColumn[];
+  grants: CatalogGrant[];
+}
+
+// --- Universal sensitive-column heuristic (app-agnostic) --------------------
+
+const SENSITIVE_PATTERNS: RegExp[] = [
+  /pass(word)?/i,
+  /secret/i,
+  /(^|_)token$/i,
+  /(^|_)hash$/i,
+  /salt/i,
+  /(^|_)key$/i,
+  /api[_-]?key/i,
+  /private[_-]?key/i,
+  /stripe/i,
+  /session[_-]?id/i,
+  /refresh[_-]?token/i,
+  /reset[_-]?password/i,
+  /(^|_)ip(_address)?$/i,
+  /sign_in_ip/i,
+  /distinct_id/i,
+  /(^|_)otp(_|$)/i,
+];
+
+export function isSensitiveColumn(name: string): boolean {
+  return SENSITIVE_PATTERNS.some((re) => re.test(name));
+}
+
+// --- Probe plan -------------------------------------------------------------
+
+export interface ProbePlan {
+  anonReadableTables: string[];
+  authReadableTables: string[];
+  sensitiveColumns: Record<string, string[]>; // table → sensitive columns
+  jsonbColumns: Record<string, string[]>;
+  tablesWithoutRls: string[]; // readable tables with RLS disabled
+  userTable: string | null; // most-sensitive table (heuristic target)
+}
+
+const ANON_GRANTEES = new Set(['anon', 'PUBLIC', 'public']);
+
+export function buildProbePlan(catalog: Catalog): ProbePlan {
+  const selectGrant = (grantee: (g: string) => boolean): Set<string> => {
+    const s = new Set<string>();
+    for (const g of catalog.grants) {
+      if (g.privilege.toUpperCase() === 'SELECT' && grantee(g.grantee)) {
+        s.add(g.table);
+      }
+    }
+    return s;
+  };
+  const anonReadable = selectGrant((g) => ANON_GRANTEES.has(g));
+  const authReadable = selectGrant((g) => g === 'authenticated');
+
+  const sensitiveColumns: Record<string, string[]> = {};
+  const jsonbColumns: Record<string, string[]> = {};
+  for (const c of catalog.columns) {
+    if (isSensitiveColumn(c.column)) {
+      (sensitiveColumns[c.table] ||= []).push(c.column);
+    }
+    if (/json/i.test(c.dataType)) {
+      (jsonbColumns[c.table] ||= []).push(c.column);
+    }
+  }
+
+  const rlsByTable = new Map(catalog.tables.map((t) => [t.table, t.rlsEnabled]));
+  const readable = new Set([...anonReadable, ...authReadable]);
+  const tablesWithoutRls = [...readable].filter((t) => rlsByTable.get(t) === false).sort();
+
+  // Heuristic user-table target: the readable table with the most sensitive cols.
+  let userTable: string | null = null;
+  let max = 0;
+  for (const t of readable) {
+    const n = (sensitiveColumns[t] || []).length;
+    if (n > max) {
+      max = n;
+      userTable = t;
+    }
+  }
+
+  return {
+    anonReadableTables: [...anonReadable].sort(),
+    authReadableTables: [...authReadable].sort(),
+    sensitiveColumns,
+    jsonbColumns,
+    tablesWithoutRls,
+    userTable,
+  };
+}
+
+// --- Probe assertions (pure; over HTTP responses) ---------------------------
+
+export type Severity = 'critical' | 'high' | 'medium';
+
+export interface ProbeResult {
+  id: string;
+  name: string;
+  severity: Severity;
+  pass: boolean;
+  detail: string;
+}
+
+/** Readable tables MUST have RLS — without it, the JS role map is the only guard. */
+export function assessRlsCoverage(plan: ProbePlan): ProbeResult[] {
+  if (plan.tablesWithoutRls.length === 0) {
+    return [
+      {
+        id: 'rls-coverage',
+        name: 'RLS enabled on all client-readable tables',
+        severity: 'critical',
+        pass: true,
+        detail: `${plan.anonReadableTables.length + plan.authReadableTables.length} readable table(s), all RLS-protected`,
+      },
+    ];
+  }
+  return plan.tablesWithoutRls.map((t) => ({
+    id: `rls-coverage:${t}`,
+    name: `RLS on ${t}`,
+    severity: 'critical' as const,
+    pass: false,
+    detail: `${t} is client-readable but has ROW LEVEL SECURITY disabled — every row is exposed`,
+  }));
+}
+
+/** An anon GET response must not contain sensitive column values. */
+export function assessColumnExposure(
+  table: string,
+  rows: Record<string, unknown>[],
+  sensitiveCols: string[],
+): ProbeResult {
+  const leaked = new Set<string>();
+  for (const row of rows) {
+    for (const col of sensitiveCols) {
+      if (col in row && row[col] !== null && row[col] !== undefined) leaked.add(col);
+    }
+  }
+  return {
+    id: `column-exposure:${table}`,
+    name: `No sensitive columns exposed on ${table}`,
+    severity: 'critical',
+    pass: leaked.size === 0,
+    detail:
+      leaked.size === 0
+        ? `${sensitiveCols.length} sensitive column(s) withheld`
+        : `exposed sensitive column(s): ${[...leaked].join(', ')}`,
+  };
+}
+
+/** ?limit must be capped — an unbounded result set is a DoS / exfil amplifier. */
+export function assessLimitCap(
+  status: number,
+  returnedCount: number,
+  maxLimit = 10000,
+): ProbeResult {
+  const pass = status === 400 || returnedCount <= maxLimit;
+  return {
+    id: 'limit-cap',
+    name: 'Unbounded ?limit is rejected or clamped',
+    severity: 'medium',
+    pass,
+    detail: pass
+      ? `capped (status ${status}, ${returnedCount} rows)`
+      : `returned ${returnedCount} rows (> ${maxLimit}) — no cap`,
+  };
+}
+
+/** A crafted JSON-path filter must not reach the DB (500) — 400/empty-200 is safe. */
+export function assessInjection(status: number): ProbeResult {
+  const pass = status < 500;
+  return {
+    id: 'json-path-injection',
+    name: 'JSON-path injection payload is rejected, not executed',
+    severity: 'high',
+    pass,
+    detail: pass ? `safe (status ${status})` : `status ${status} — payload reached the database`,
+  };
+}
+
+/** A deeply nested embed must be rejected (400), not executed or timed out. */
+export function assessEmbedDepth(status: number): ProbeResult {
+  const pass = status === 400 || status === 414;
+  return {
+    id: 'embed-depth',
+    name: 'Over-deep relation embed is rejected',
+    severity: 'medium',
+    pass,
+    detail: pass ? `rejected (status ${status})` : `status ${status} — deep embed not capped`,
+  };
+}
+
+export function summarizeProbe(results: ProbeResult[]): {
+  pass: number;
+  fail: number;
+  critical: number;
+} {
+  const failed = results.filter((r) => !r.pass);
+  return {
+    pass: results.filter((r) => r.pass).length,
+    fail: failed.length,
+    critical: failed.filter((r) => r.severity === 'critical').length,
+  };
+}

package/src/cli/ui-bloat.ts

@@ -0,0 +1,198 @@
+/**
+ * Bundle UI-bloat audit — pure scanners for the remote `bundle:audit` (Brick 5a).
+ *
+ * The weight scanner (bundle-weight.ts) answers "is the bundle too big / is data
+ * leaking into it?" This answers "is the *frontend* bloated — the same component
+ * shape hand-written N times instead of reused, the same color hardcoded hundreds
+ * of times instead of a token?" It is the universal, gate-to-prod half of the
+ * design-bloat loop: it runs on the shipped bundle, needs no repo, and is blind to
+ * which ui package was intended — it measures *repetition*, not conformance.
+ *
+ * Empirically grounded against a real deployed bundle: `className` does not survive
+ * (build-time tailwind compiles it away) and component identities are mangled, so
+ * the only surviving anchor is the inline `style:{}` object literal. Two truths make
+ * it work:
+ *   - Real reuse (a component rendered N times via `.map`) compiles to ONE call
+ *     site; copy-paste compiles to N identical sites. So the occurrence count of an
+ *     identical `style:{}` literal IS the copy-paste count (Metro does not dedupe
+ *     inline object literals).
+ *   - App design styling references a theme token or a hardcoded hex; bare
+ *     structural styling (`flex:1`) is library noise. Filtering on token-or-hex
+ *     biases the scan to the builder's own code without needing module paths.
+ *
+ * Advisory only. Refactoring is taste (the governance ceiling), so every finding is
+ * `warn` — even at the gate. The stick is that it *shows up* at the gate, never that
+ * it blocks the deploy.
+ *
+ * Everything here is pure: it takes bundle text and returns findings, so the
+ * governance MCP imports it directly. It cannot give locations (the bundle is
+ * mangled, pathless) — that is the local source auditor's job; this proves magnitude.
+ */
+
+import type { AuditFinding } from './bundle-audit.js';
+
+/** Thresholds for the design-bloat gates. All counts are occurrences in the bundle. */
+export interface UiBloatBudget {
+  /** A `style:{}` shape hand-written at this many distinct call sites is an
+   *  un-extracted component. */
+  styleRepeatWarn: number;
+  /** A single hardcoded hex color repeated this many times should be a token. */
+  colorRepeatWarn: number;
+  /** This many *distinct* hardcoded hex values is an ad-hoc palette with no token
+   *  system. */
+  paletteWarn: number;
+  /** Cap on findings per check, so a bloated bundle yields a readable list. */
+  topN: number;
+}
+
+/**
+ * Defaults from the real-bundle measurement, not round numbers: shapes repeated
+ * ≥10× were the clear extract-me set; a single gray hex appeared 470× past a token
+ * that existed; the ad-hoc palette ran to ~300 distinct values. The thresholds sit
+ * just below those so the signal is caught without noise. Overridable via flags.
+ */
+export const DEFAULT_UI_BLOAT_BUDGET: UiBloatBudget = {
+  styleRepeatWarn: 8,
+  colorRepeatWarn: 12,
+  paletteWarn: 24,
+  topN: 12,
+};
+
+const HEX = /'#[0-9a-fA-F]{3,8}'/g;
+// A flat inline style literal: `style:{ … }` with no nested braces. Nested styles
+// (`style:{a:{…}}`) are intentionally out of scope for the count-only remote pass.
+const STYLE_LITERAL = /style:\{[^{}]{4,400}\}/g;
+// A mangled module/theme reference: `a.text`, `p.textSecondary` → folded to `X.`
+// so the same token counts as one shape regardless of its minified alias.
+const MANGLED_REF = /[A-Za-z_$][A-Za-z0-9_$]*\./g;
+
+/**
+ * Canonical form of a style literal for grouping: strip all whitespace and fold any
+ * `ident.prop` reference to `X.prop` (mangled bundle aliases AND source theme refs
+ * like `theme.border` collapse to the same shape). Shared by the remote bundle
+ * scanner and the source-side auditor so both group styles identically.
+ */
+export function canonicalizeStyle(raw: string): string {
+  return raw.replace(/\s+/g, '').replace(MANGLED_REF, 'X.');
+}
+
+/** True if a style literal is app *design* styling (references a token or a hex),
+ *  rather than bare structural layout that libraries emit. */
+export function isDesignStyle(literal: string): boolean {
+  return /X\./.test(literal) || /#[0-9a-fA-F]{3,8}/.test(literal);
+}
+
+/**
+ * Extract and normalize the design `style:{}` literals from bundle text. Mangled
+ * aliases are folded to `X.`; bare structural styling is dropped. Order-preserving,
+ * so the length is the occurrence (copy-paste) count.
+ */
+export function extractStyleLiterals(text: string): string[] {
+  const out: string[] = [];
+  const m = text.match(STYLE_LITERAL);
+  if (!m) return out;
+  for (const raw of m) {
+    const norm = canonicalizeStyle(raw);
+    if (isDesignStyle(norm)) out.push(norm);
+  }
+  return out;
+}
+
+/** A short, safe preview of a style literal for the finding detail. */
+function preview(literal: string, max = 80): string {
+  return literal.length <= max ? literal : `${literal.slice(0, max)}…}`;
+}
+
+/**
+ * Flag `style:{}` shapes hand-written at many distinct call sites — each is a
+ * component that should be extracted once and reused. Count-only (no locations);
+ * the local source auditor pins the `file:line`s.
+ */
+export function scanRepeatedStyles(
+  text: string,
+  source: string,
+  budget: UiBloatBudget = DEFAULT_UI_BLOAT_BUDGET,
+): AuditFinding[] {
+  const counts = new Map<string, number>();
+  for (const lit of extractStyleLiterals(text)) {
+    counts.set(lit, (counts.get(lit) ?? 0) + 1);
+  }
+  return [...counts.entries()]
+    .filter(([, n]) => n >= budget.styleRepeatWarn)
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, budget.topN)
+    .map(([lit, n]) => ({
+      severity: 'warn' as const,
+      check: 'ui-repeated-style' as const,
+      source,
+      detail: `a style is hand-written at ${n} distinct call sites (${preview(lit)}) — extract a component and reuse it instead of repeating the markup`,
+    }));
+}
+
+/**
+ * Flag hardcoded hex colors: a single value repeated past the budget (it should be
+ * a theme token), and — separately — an ad-hoc palette of many distinct hardcoded
+ * values (no token system). Both are token-violation smells.
+ */
+export function scanHardcodedColors(
+  text: string,
+  source: string,
+  budget: UiBloatBudget = DEFAULT_UI_BLOAT_BUDGET,
+): AuditFinding[] {
+  const counts = new Map<string, number>();
+  for (const lit of text.match(STYLE_LITERAL) ?? []) {
+    for (const hex of lit.match(HEX) ?? []) {
+      const v = hex.slice(1, -1); // strip the surrounding quotes
+      counts.set(v, (counts.get(v) ?? 0) + 1);
+    }
+  }
+  if (counts.size === 0) return [];
+
+  const findings: AuditFinding[] = [...counts.entries()]
+    .filter(([, n]) => n >= budget.colorRepeatWarn)
+    .sort((a, b) => b[1] - a[1])
+    .slice(0, budget.topN)
+    .map(([hex, n]) => ({
+      severity: 'warn' as const,
+      check: 'ui-hardcoded-color' as const,
+      source,
+      detail: `${hex} is hardcoded ${n} times — replace it with a theme token so it can change in one place (and support dark mode)`,
+    }));
+
+  if (counts.size >= budget.paletteWarn) {
+    findings.push({
+      severity: 'warn',
+      check: 'ui-hardcoded-color',
+      source,
+      detail: `${counts.size} distinct hardcoded hex colors are inlined across the bundle — this is an ad-hoc palette; define a token set instead of scattering raw colors`,
+    });
+  }
+  return findings;
+}
+
+/** The combined remote UI-bloat entry — what the command and the MCP call. */
+export function scanBundleUiBloat(
+  text: string,
+  source: string,
+  budget: UiBloatBudget = DEFAULT_UI_BLOAT_BUDGET,
+): AuditFinding[] {
+  return [...scanRepeatedStyles(text, source, budget), ...scanHardcodedColors(text, source, budget)];
+}
+
+/** Resolve a budget from CLI flags, falling back to the defaults. */
+export function resolveUiBloatBudget(
+  flags: Record<string, string>,
+  base: UiBloatBudget = DEFAULT_UI_BLOAT_BUDGET,
+): UiBloatBudget {
+  const num = (key: string): number | undefined => {
+    const raw = flags[key];
+    if (raw == null) return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+  };
+  return {
+    ...base,
+    styleRepeatWarn: num('ui-repeat') ?? base.styleRepeatWarn,
+    colorRepeatWarn: num('ui-color-repeat') ?? base.colorRepeatWarn,
+  };
+}