@grafema/core 0.1.0-alpha.1

package/src/plugins/validation/DataFlowValidator.ts

@@ -0,0 +1,233 @@
+/**
+ * DataFlowValidator - проверяет что все переменные прослеживаются до листовых узлов
+ *
+ * ПРАВИЛО: Каждая переменная должна иметь путь до листового узла через ASSIGNED_FROM рёбра
+ *
+ * ЛИСТОВЫЕ УЗЛЫ:
+ * - LITERAL: примитивные значения
+ * - EXTERNAL_STDIO: console.log/error
+ * - EXTERNAL_DATABASE: database queries
+ * - EXTERNAL_NETWORK: HTTP requests
+ * - EXTERNAL_FILESYSTEM: fs.readFile
+ * - EVENT_LISTENER: события
+ */
+
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+import type { NodeRecord } from '@grafema/types';
+
+/**
+ * Edge structure
+ */
+interface EdgeRecord {
+  type: string;
+  src: string;
+  dst: string;
+  [key: string]: unknown;
+}
+
+/**
+ * Data flow issue
+ */
+interface DataFlowIssue {
+  type: string;
+  severity: string;
+  message: string;
+  variable: string;
+  file?: string;
+  line?: number;
+  chain?: string[];
+}
+
+/**
+ * Path finding result
+ */
+interface PathResult {
+  found: boolean;
+  chain: string[];
+}
+
+/**
+ * Validation summary
+ */
+interface ValidationSummary {
+  total: number;
+  validated: number;
+  issues: number;
+  byType: Record<string, number>;
+}
+
+export class DataFlowValidator extends Plugin {
+  get metadata(): PluginMetadata {
+    return {
+      name: 'DataFlowValidator',
+      phase: 'VALIDATION',
+      priority: 100,
+      creates: {
+        nodes: [],
+        edges: []
+      }
+    };
+  }
+
+  async execute(context: PluginContext): Promise<PluginResult> {
+    const { graph } = context;
+
+    console.log('[DataFlowValidator] Starting data flow validation...');
+
+    // Check if graph supports getAllEdges
+    if (!graph.getAllEdges) {
+      console.log('[DataFlowValidator] Graph does not support getAllEdges, skipping validation');
+      return createSuccessResult({ nodes: 0, edges: 0 }, { skipped: true });
+    }
+
+    // Получаем все переменные
+    const allNodes = await graph.getAllNodes();
+    const allEdges = await graph.getAllEdges() as EdgeRecord[];
+
+    const variables = allNodes.filter(n =>
+      n.type === 'VARIABLE_DECLARATION' || n.type === 'CONSTANT'
+    );
+
+    console.log(`[DataFlowValidator] Found ${variables.length} variables to validate`);
+
+    const issues: DataFlowIssue[] = [];
+    const leafTypes = new Set([
+      'LITERAL',
+      'EXTERNAL_STDIO',
+      'EXTERNAL_DATABASE',
+      'EXTERNAL_NETWORK',
+      'EXTERNAL_FILESYSTEM',
+      'EVENT_LISTENER',
+      'CLASS',          // NewExpression - конструкторы классов
+      'FUNCTION',       // Arrow functions и function expressions
+      'METHOD_CALL',    // Вызовы методов (промежуточные узлы)
+      'CALL_SITE'       // Вызовы функций (промежуточные узлы)
+    ]);
+
+    for (const variable of variables) {
+      // Проверяем наличие ASSIGNED_FROM ребра
+      const assignment = allEdges.find(e =>
+        e.type === 'ASSIGNED_FROM' && e.src === variable.id
+      );
+
+      if (!assignment) {
+        issues.push({
+          type: 'MISSING_ASSIGNMENT',
+          severity: 'WARNING',
+          message: `Variable "${variable.name}" (${variable.file}:${variable.line}) has no ASSIGNED_FROM edge`,
+          variable: variable.name as string,
+          file: variable.file,
+          line: variable.line as number | undefined
+        });
+        continue;
+      }
+
+      // Проверяем что источник существует
+      const source = allNodes.find(n => n.id === assignment.dst);
+      if (!source) {
+        issues.push({
+          type: 'BROKEN_REFERENCE',
+          severity: 'ERROR',
+          message: `Variable "${variable.name}" references non-existent node ${assignment.dst}`,
+          variable: variable.name as string,
+          file: variable.file,
+          line: variable.line as number | undefined
+        });
+        continue;
+      }
+
+      // Проверяем путь до листового узла
+      const path = this.findPathToLeaf(variable, allNodes, allEdges, leafTypes);
+      if (!path.found) {
+        issues.push({
+          type: 'NO_LEAF_NODE',
+          severity: 'WARNING',
+          message: `Variable "${variable.name}" (${variable.file}:${variable.line}) does not trace to a leaf node. Chain: ${path.chain.join(' -> ')}`,
+          variable: variable.name as string,
+          file: variable.file,
+          line: variable.line as number | undefined,
+          chain: path.chain
+        });
+      }
+    }
+
+    // Группируем issues по типу
+    const summary: ValidationSummary = {
+      total: variables.length,
+      validated: variables.length - issues.length,
+      issues: issues.length,
+      byType: {}
+    };
+
+    for (const issue of issues) {
+      if (!summary.byType[issue.type]) {
+        summary.byType[issue.type] = 0;
+      }
+      summary.byType[issue.type]++;
+    }
+
+    console.log('[DataFlowValidator] Summary:', summary);
+
+    // Выводим issues
+    if (issues.length > 0) {
+      console.log(`[DataFlowValidator] Found ${issues.length} issues:`);
+      for (const issue of issues) {
+        const level = issue.severity === 'ERROR' ? '❌' : '⚠️';
+        console.log(`  ${level} [${issue.type}] ${issue.message}`);
+      }
+    }
+
+    return createSuccessResult(
+      { nodes: 0, edges: 0 },
+      { summary, issues }
+    );
+  }
+
+  /**
+   * Находит путь от переменной до листового узла
+   */
+  private findPathToLeaf(
+    startNode: NodeRecord,
+    allNodes: NodeRecord[],
+    allEdges: EdgeRecord[],
+    leafTypes: Set<string>,
+    visited: Set<string> = new Set(),
+    chain: string[] = []
+  ): PathResult {
+    // Защита от циклов
+    if (visited.has(startNode.id)) {
+      return { found: false, chain: [...chain, `${startNode.type}:${startNode.name} (CYCLE)`] };
+    }
+
+    visited.add(startNode.id);
+    chain.push(`${startNode.type}:${startNode.name}`);
+
+    // Проверяем что это листовой узел
+    if (leafTypes.has(startNode.type)) {
+      return { found: true, chain };
+    }
+
+    // Ищем ASSIGNED_FROM ребро
+    const assignment = allEdges.find(e =>
+      e.type === 'ASSIGNED_FROM' && e.src === startNode.id
+    );
+
+    if (!assignment) {
+      // Для METHOD_CALL и CALL_SITE - это промежуточные узлы, но можем считать их leaf для первой версии
+      if (startNode.type === 'METHOD_CALL' || startNode.type === 'CALL_SITE') {
+        return { found: true, chain: [...chain, '(intermediate node)'] };
+      }
+
+      return { found: false, chain: [...chain, '(no assignment)'] };
+    }
+
+    // Продолжаем по цепочке
+    const nextNode = allNodes.find(n => n.id === assignment.dst);
+    if (!nextNode) {
+      return { found: false, chain: [...chain, '(broken reference)'] };
+    }
+
+    return this.findPathToLeaf(nextNode, allNodes, allEdges, leafTypes, visited, chain);
+  }
+}

package/src/plugins/validation/EvalBanValidator.ts

@@ -0,0 +1,175 @@
+/**
+ * EvalBanValidator - запрещает использование eval и Function
+ *
+ * Security инвариант: код не должен использовать динамическое выполнение.
+ *
+ * Детектирует:
+ * - eval("code") - прямой вызов eval
+ * - new Function("code") - конструктор Function
+ * - Function("code") - вызов Function без new
+ * - window.eval("code") - eval через window
+ * - globalThis.eval("code") - eval через globalThis
+ * - Aliased eval: const e = eval; e("code") - через AliasTracker
+ *
+ * ПРАВИЛА (Datalog):
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "eval").
+ * violation(X) :- node(X, "CALL"), attr(X, "name", "Function").
+ * violation(X) :- node(X, "CALL"), attr(X, "method", "eval").
+ */
+
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import type { PluginContext, PluginResult, PluginMetadata } from '../Plugin.js';
+import type { BaseNodeRecord } from '@grafema/types';
+
+/**
+ * Eval ban issue
+ */
+interface EvalBanIssue {
+  type: string;
+  severity: string;
+  message: string;
+  nodeId: string;
+  file?: string;
+  line?: number;
+  object?: string;
+}
+
+/**
+ * Extended node with call properties
+ */
+interface CallNode extends BaseNodeRecord {
+  method?: string;
+  object?: string;
+}
+
+/**
+ * Validation summary
+ */
+interface ValidationSummary {
+  evalCalls: number;
+  functionCalls: number;
+  methodEvalCalls: number;
+  aliasedEvalCalls: number;
+  totalViolations: number;
+  timeSeconds: string;
+}
+
+export class EvalBanValidator extends Plugin {
+  get metadata(): PluginMetadata {
+    return {
+      name: 'EvalBanValidator',
+      phase: 'VALIDATION',
+      priority: 95, // Высокий приоритет - security check
+      creates: {
+        nodes: [],
+        edges: []
+      }
+    };
+  }
+
+  async execute(context: PluginContext): Promise<PluginResult> {
+    const { graph } = context;
+
+    console.log('[EvalBanValidator] Checking for eval/Function usage...');
+    const startTime = Date.now();
+
+    const issues: EvalBanIssue[] = [];
+
+    // ОПТИМИЗАЦИЯ: вместо Datalog (медленный full scan), используем прямые graph queries
+    // Datalog зависает на больших графах из-за отсутствия индексов
+
+    // 1. Прямой вызов eval("code") - ищем все CALL ноды с name="eval"
+    console.log('[EvalBanValidator] Searching for eval() calls...');
+    const evalStart = Date.now();
+    let evalCount = 0;
+
+    for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+      if (node.name === 'eval') {
+        evalCount++;
+        issues.push({
+          type: 'EVAL_USAGE',
+          severity: 'ERROR',
+          message: `Direct eval() call at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+          nodeId: node.id,
+          file: node.file,
+          line: node.line as number | undefined
+        });
+      }
+    }
+    console.log(`[EvalBanValidator] eval() search took ${Date.now() - evalStart}ms, found ${evalCount} violations`);
+
+    // 2. Вызов Function("code") или new Function("code")
+    console.log('[EvalBanValidator] Searching for Function() calls...');
+    const funcStart = Date.now();
+    let funcCount = 0;
+
+    for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+      if (node.name === 'Function') {
+        funcCount++;
+        issues.push({
+          type: 'FUNCTION_CONSTRUCTOR',
+          severity: 'ERROR',
+          message: `Function() constructor at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+          nodeId: node.id,
+          file: node.file,
+          line: node.line as number | undefined
+        });
+      }
+    }
+    console.log(`[EvalBanValidator] Function() search took ${Date.now() - funcStart}ms, found ${funcCount} violations`);
+
+    // 3. Method call: window.eval, globalThis.eval, this.eval
+    // Note: METHOD_CALL was merged into CALL - method calls have 'method' attribute
+    console.log('[EvalBanValidator] Searching for method eval() calls...');
+    const methodStart = Date.now();
+    let methodCount = 0;
+
+    for await (const node of graph.queryNodes({ nodeType: 'CALL' })) {
+      const callNode = node as CallNode;
+      // Method calls have 'method' attribute (e.g., window.eval())
+      if (callNode.method === 'eval' && callNode.object) {
+        methodCount++;
+        const objectName = callNode.object;
+        issues.push({
+          type: 'EVAL_METHOD',
+          severity: 'ERROR',
+          message: `${objectName}.eval() call at ${node.file}:${node.line || '?'} - dynamic code execution is forbidden`,
+          nodeId: node.id,
+          file: node.file,
+          line: node.line as number | undefined,
+          object: objectName
+        });
+      }
+    }
+    console.log(`[EvalBanValidator] method eval() search took ${Date.now() - methodStart}ms, found ${methodCount} violations`);
+
+    // 4. Aliased eval - SKIP for now (complex Datalog query causes OOM)
+    console.log('[EvalBanValidator] Skipping aliased eval detection (requires optimized implementation)');
+
+    const totalTime = ((Date.now() - startTime) / 1000).toFixed(1);
+    const summary: ValidationSummary = {
+      evalCalls: evalCount,
+      functionCalls: funcCount,
+      methodEvalCalls: methodCount,
+      aliasedEvalCalls: 0, // Skipped for now
+      totalViolations: issues.length,
+      timeSeconds: totalTime
+    };
+
+    console.log('[EvalBanValidator] Summary:', summary);
+
+    if (issues.length > 0) {
+      console.log('[EvalBanValidator] ❌ Security violations found:');
+      for (const issue of issues) {
+        console.log(`  🚫 ${issue.message}`);
+      }
+    } else {
+      console.log('[EvalBanValidator] ✅ No eval/Function usage detected');
+    }
+
+    return createSuccessResult(
+      { nodes: 0, edges: 0 },  // created - validator doesn't create nodes/edges
+      { summary, issues }       // metadata
+    );
+  }
+}

package/src/plugins/validation/GraphConnectivityValidator.ts

@@ -0,0 +1,201 @@
+/**
+ * GraphConnectivityValidator - проверяет что все узлы связаны с корневыми узлами
+ * Находит "островки" - узлы которые не имеют путей до SERVICE/MODULE
+ */
+
+import { Plugin, createSuccessResult } from '../Plugin.js';
+import type { PluginContext, PluginMetadata, PluginResult } from '../Plugin.js';
+import type { NodeRecord } from '@grafema/types';
+
+/**
+ * Edge structure
+ */
+interface EdgeRecord {
+  src: string;
+  dst: string;
+  [key: string]: unknown;
+}
+
+/**
+ * Unreachable node info for manifest
+ */
+interface UnreachableNodeInfo {
+  id: string;
+  type: string;
+  name?: string;
+}
+
+/**
+ * Validation result in manifest
+ */
+interface ValidationResult {
+  unreachableNodes?: UnreachableNodeInfo[];
+  hasErrors: boolean;
+  totalNodes: number;
+  reachableNodes: number;
+  unreachableCount?: number;
+  unreachableByType?: Record<string, number>;
+}
+
+/**
+ * Extended manifest with validation field
+ */
+interface ManifestWithValidation {
+  validation?: ValidationResult;
+  [key: string]: unknown;
+}
+
+export class GraphConnectivityValidator extends Plugin {
+  get metadata(): PluginMetadata {
+    return {
+      name: 'GraphConnectivityValidator',
+      phase: 'VALIDATION',
+      priority: 100,
+      creates: {
+        nodes: [],
+        edges: []
+      }
+    };
+  }
+
+  async execute(context: PluginContext): Promise<PluginResult> {
+    const { graph, manifest } = context;
+    const manifestWithValidation = manifest as ManifestWithValidation;
+
+    console.log('[GraphConnectivityValidator] Starting connectivity validation...');
+
+    // Получаем все узлы
+    const allNodes = await graph.getAllNodes();
+    console.log(`[GraphConnectivityValidator] Total nodes: ${allNodes.length}`);
+
+    // Находим корневые узлы (SERVICE, MODULE)
+    const rootTypes = ['SERVICE', 'MODULE', 'PROJECT'];
+    const rootNodes = allNodes.filter(n => rootTypes.includes(n.type));
+    console.log(`[GraphConnectivityValidator] Root nodes: ${rootNodes.length}`);
+
+    if (rootNodes.length === 0) {
+      console.warn('[GraphConnectivityValidator] No root nodes found!');
+      return createSuccessResult({ nodes: 0, edges: 0 }, { skipped: true, reason: 'No root nodes' });
+    }
+
+    // Check if graph supports getAllEdges
+    if (!graph.getAllEdges) {
+      console.log('[GraphConnectivityValidator] Graph does not support getAllEdges, skipping validation');
+      return createSuccessResult({ nodes: 0, edges: 0 }, { skipped: true, reason: 'No getAllEdges support' });
+    }
+
+    // Собираем все ребра
+    const allEdges = await graph.getAllEdges();
+    console.log(`[GraphConnectivityValidator] Total edges: ${allEdges.length}`);
+
+    // Строим карты смежности (обе направления)
+    const adjacencyOut = new Map<string, string[]>(); // nodeId -> [targetIds]
+    const adjacencyIn = new Map<string, string[]>();  // nodeId -> [sourceIds]
+
+    for (const edge of allEdges) {
+      // Outgoing edges
+      if (!adjacencyOut.has(edge.src)) {
+        adjacencyOut.set(edge.src, []);
+      }
+      adjacencyOut.get(edge.src)!.push(edge.dst);
+
+      // Incoming edges
+      if (!adjacencyIn.has(edge.dst)) {
+        adjacencyIn.set(edge.dst, []);
+      }
+      adjacencyIn.get(edge.dst)!.push(edge.src);
+    }
+
+    // BFS от корневых узлов для поиска достижимых узлов
+    const reachable = new Set<string>();
+    const queue: string[] = [...rootNodes.map(n => n.id)];
+
+    while (queue.length > 0) {
+      const nodeId = queue.shift()!;
+
+      if (reachable.has(nodeId)) continue;
+      reachable.add(nodeId);
+
+      // Добавляем все связанные узлы (в обоих направлениях)
+      const outgoing = adjacencyOut.get(nodeId) || [];
+      const incoming = adjacencyIn.get(nodeId) || [];
+
+      for (const targetId of [...outgoing, ...incoming]) {
+        if (!reachable.has(targetId)) {
+          queue.push(targetId);
+        }
+      }
+    }
+
+    // Находим недостижимые узлы
+    const unreachable = allNodes.filter(n => !reachable.has(n.id));
+
+    if (unreachable.length > 0) {
+      // ЯРКОЕ ПРЕДУПРЕЖДЕНИЕ В КОНСОЛИ
+      console.error('\n' + '='.repeat(80));
+      console.error('⚠️  GRAPH VALIDATION ERROR: DISCONNECTED NODES FOUND');
+      console.error('='.repeat(80));
+      console.error(`Found ${unreachable.length} unreachable nodes (${((unreachable.length / allNodes.length) * 100).toFixed(1)}% of total)`);
+      console.error(`These nodes are not connected to the main graph (SERVICE/MODULE/PROJECT level)`);
+      console.error('');
+
+      // Группируем по типам для читаемости
+      const byType: Record<string, NodeRecord[]> = {};
+      for (const node of unreachable) {
+        if (!byType[node.type]) byType[node.type] = [];
+        byType[node.type].push(node);
+      }
+
+      for (const [type, nodes] of Object.entries(byType)) {
+        console.error(`  ${type}: ${nodes.length} nodes`);
+        // Показываем первые 5 для каждого типа
+        for (const node of nodes.slice(0, 5)) {
+          console.error(`    - ${node.name || node.id}`);
+
+          // Показываем связи этого узла
+          const out = adjacencyOut.get(node.id) || [];
+          const incoming = adjacencyIn.get(node.id) || [];
+          if (out.length > 0 || incoming.length > 0) {
+            console.error(`      Edges: ${incoming.length} incoming, ${out.length} outgoing`);
+          }
+        }
+        if (nodes.length > 5) {
+          console.error(`    ... and ${nodes.length - 5} more`);
+        }
+      }
+
+      console.error('');
+      console.error('💡 ACTION REQUIRED: Fix analysis plugins to ensure all nodes are connected');
+      console.error('   Anonymous functions, callbacks, and method calls should be linked to parent nodes');
+      console.error('='.repeat(80) + '\n');
+
+      // Сохраняем информацию в manifest для дальнейшего использования
+      if (!manifestWithValidation.validation) manifestWithValidation.validation = {} as ValidationResult;
+      manifestWithValidation.validation.unreachableNodes = unreachable.map(n => ({
+        id: n.id,
+        type: n.type,
+        name: n.name
+      }));
+      manifestWithValidation.validation.hasErrors = true;
+      manifestWithValidation.validation.totalNodes = allNodes.length;
+      manifestWithValidation.validation.reachableNodes = reachable.size;
+      manifestWithValidation.validation.unreachableCount = unreachable.length;
+      manifestWithValidation.validation.unreachableByType = Object.fromEntries(
+        Object.entries(byType).map(([type, nodes]) => [type, nodes.length])
+      );
+    } else {
+      console.log('[GraphConnectivityValidator] ✅ All nodes are reachable from root nodes');
+      if (!manifestWithValidation.validation) manifestWithValidation.validation = {} as ValidationResult;
+      manifestWithValidation.validation.hasErrors = false;
+      manifestWithValidation.validation.totalNodes = allNodes.length;
+      manifestWithValidation.validation.reachableNodes = reachable.size;
+    }
+
+    console.log(`[GraphConnectivityValidator] Validation complete: ${reachable.size}/${allNodes.length} nodes reachable`);
+
+    return createSuccessResult(
+      { nodes: 0, edges: 0 },
+      { totalNodes: allNodes.length, reachableNodes: reachable.size }
+    );
+  }
+}