@kevinrabun/judges 2.2.0 → 2.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -16
- package/dist/evaluators/accessibility.d.ts.map +1 -1
- package/dist/evaluators/accessibility.js +32 -0
- package/dist/evaluators/accessibility.js.map +1 -1
- package/dist/evaluators/agent-instructions.d.ts.map +1 -1
- package/dist/evaluators/agent-instructions.js +59 -0
- package/dist/evaluators/agent-instructions.js.map +1 -1
- package/dist/evaluators/ai-code-safety.d.ts +9 -0
- package/dist/evaluators/ai-code-safety.d.ts.map +1 -0
- package/dist/evaluators/ai-code-safety.js +511 -0
- package/dist/evaluators/ai-code-safety.js.map +1 -0
- package/dist/evaluators/api-design.d.ts.map +1 -1
- package/dist/evaluators/api-design.js +31 -16
- package/dist/evaluators/api-design.js.map +1 -1
- package/dist/evaluators/authentication.d.ts.map +1 -1
- package/dist/evaluators/authentication.js +68 -10
- package/dist/evaluators/authentication.js.map +1 -1
- package/dist/evaluators/backwards-compatibility.d.ts.map +1 -1
- package/dist/evaluators/backwards-compatibility.js +25 -3
- package/dist/evaluators/backwards-compatibility.js.map +1 -1
- package/dist/evaluators/caching.d.ts.map +1 -1
- package/dist/evaluators/caching.js +25 -4
- package/dist/evaluators/caching.js.map +1 -1
- package/dist/evaluators/ci-cd.d.ts.map +1 -1
- package/dist/evaluators/ci-cd.js +34 -12
- package/dist/evaluators/ci-cd.js.map +1 -1
- package/dist/evaluators/cloud-readiness.d.ts.map +1 -1
- package/dist/evaluators/cloud-readiness.js +26 -0
- package/dist/evaluators/cloud-readiness.js.map +1 -1
- package/dist/evaluators/code-structure.d.ts.map +1 -1
- package/dist/evaluators/code-structure.js +17 -0
- package/dist/evaluators/code-structure.js.map +1 -1
- package/dist/evaluators/compliance.d.ts.map +1 -1
- package/dist/evaluators/compliance.js +34 -5
- package/dist/evaluators/compliance.js.map +1 -1
- package/dist/evaluators/concurrency.d.ts.map +1 -1
- package/dist/evaluators/concurrency.js +20 -0
- package/dist/evaluators/concurrency.js.map +1 -1
- package/dist/evaluators/configuration-management.d.ts.map +1 -1
- package/dist/evaluators/configuration-management.js +50 -11
- package/dist/evaluators/configuration-management.js.map +1 -1
- package/dist/evaluators/cost-effectiveness.d.ts.map +1 -1
- package/dist/evaluators/cost-effectiveness.js +26 -0
- package/dist/evaluators/cost-effectiveness.js.map +1 -1
- package/dist/evaluators/cybersecurity.d.ts.map +1 -1
- package/dist/evaluators/cybersecurity.js +140 -0
- package/dist/evaluators/cybersecurity.js.map +1 -1
- package/dist/evaluators/data-security.d.ts.map +1 -1
- package/dist/evaluators/data-security.js +105 -0
- package/dist/evaluators/data-security.js.map +1 -1
- package/dist/evaluators/data-sovereignty.d.ts.map +1 -1
- package/dist/evaluators/data-sovereignty.js +85 -0
- package/dist/evaluators/data-sovereignty.js.map +1 -1
- package/dist/evaluators/database.d.ts.map +1 -1
- package/dist/evaluators/database.js +33 -9
- package/dist/evaluators/database.js.map +1 -1
- package/dist/evaluators/dependency-health.d.ts.map +1 -1
- package/dist/evaluators/dependency-health.js +71 -9
- package/dist/evaluators/dependency-health.js.map +1 -1
- package/dist/evaluators/documentation.d.ts.map +1 -1
- package/dist/evaluators/documentation.js +20 -0
- package/dist/evaluators/documentation.js.map +1 -1
- package/dist/evaluators/error-handling.d.ts.map +1 -1
- package/dist/evaluators/error-handling.js +89 -24
- package/dist/evaluators/error-handling.js.map +1 -1
- package/dist/evaluators/ethics-bias.d.ts.map +1 -1
- package/dist/evaluators/ethics-bias.js +20 -0
- package/dist/evaluators/ethics-bias.js.map +1 -1
- package/dist/evaluators/index.d.ts +2 -1
- package/dist/evaluators/index.d.ts.map +1 -1
- package/dist/evaluators/index.js +56 -2
- package/dist/evaluators/index.js.map +1 -1
- package/dist/evaluators/internationalization.d.ts.map +1 -1
- package/dist/evaluators/internationalization.js +43 -0
- package/dist/evaluators/internationalization.js.map +1 -1
- package/dist/evaluators/logging-privacy.d.ts.map +1 -1
- package/dist/evaluators/logging-privacy.js +66 -30
- package/dist/evaluators/logging-privacy.js.map +1 -1
- package/dist/evaluators/maintainability.d.ts.map +1 -1
- package/dist/evaluators/maintainability.js +38 -17
- package/dist/evaluators/maintainability.js.map +1 -1
- package/dist/evaluators/observability.d.ts.map +1 -1
- package/dist/evaluators/observability.js +20 -0
- package/dist/evaluators/observability.js.map +1 -1
- package/dist/evaluators/performance.d.ts.map +1 -1
- package/dist/evaluators/performance.js +30 -0
- package/dist/evaluators/performance.js.map +1 -1
- package/dist/evaluators/portability.d.ts.map +1 -1
- package/dist/evaluators/portability.js +22 -0
- package/dist/evaluators/portability.js.map +1 -1
- package/dist/evaluators/rate-limiting.d.ts.map +1 -1
- package/dist/evaluators/rate-limiting.js +33 -10
- package/dist/evaluators/rate-limiting.js.map +1 -1
- package/dist/evaluators/reliability.d.ts.map +1 -1
- package/dist/evaluators/reliability.js +20 -0
- package/dist/evaluators/reliability.js.map +1 -1
- package/dist/evaluators/scalability.d.ts.map +1 -1
- package/dist/evaluators/scalability.js +24 -0
- package/dist/evaluators/scalability.js.map +1 -1
- package/dist/evaluators/shared.d.ts.map +1 -1
- package/dist/evaluators/shared.js +4 -24
- package/dist/evaluators/shared.js.map +1 -1
- package/dist/evaluators/software-practices.d.ts.map +1 -1
- package/dist/evaluators/software-practices.js +47 -0
- package/dist/evaluators/software-practices.js.map +1 -1
- package/dist/evaluators/testing.d.ts.map +1 -1
- package/dist/evaluators/testing.js +20 -0
- package/dist/evaluators/testing.js.map +1 -1
- package/dist/evaluators/ux.d.ts.map +1 -1
- package/dist/evaluators/ux.js +24 -0
- package/dist/evaluators/ux.js.map +1 -1
- package/dist/evaluators/v2.d.ts.map +1 -1
- package/dist/evaluators/v2.js +6 -4
- package/dist/evaluators/v2.js.map +1 -1
- package/dist/index.js +25 -1
- package/dist/index.js.map +1 -1
- package/dist/judges/ai-code-safety.d.ts +3 -0
- package/dist/judges/ai-code-safety.d.ts.map +1 -0
- package/dist/judges/ai-code-safety.js +45 -0
- package/dist/judges/ai-code-safety.js.map +1 -0
- package/dist/judges/index.d.ts.map +1 -1
- package/dist/judges/index.js +2 -0
- package/dist/judges/index.js.map +1 -1
- package/dist/language-patterns.js +1 -1
- package/dist/language-patterns.js.map +1 -1
- package/dist/reports/public-repo-report.d.ts +3 -1
- package/dist/reports/public-repo-report.d.ts.map +1 -1
- package/dist/reports/public-repo-report.js +41 -0
- package/dist/reports/public-repo-report.js.map +1 -1
- package/dist/types.d.ts +24 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +2 -2
- package/server.json +3 -3
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { getLangFamily } from "./shared.js";
|
|
1
|
+
import { getLangLineNumbers, getLangFamily } from "./shared.js";
|
|
2
|
+
import * as LP from "../language-patterns.js";
|
|
2
3
|
export function analyzeApiDesign(code, language) {
|
|
3
4
|
const findings = [];
|
|
4
5
|
const lines = code.split("\n");
|
|
@@ -21,6 +22,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
21
22
|
lineNumbers: verbInUrlLines,
|
|
22
23
|
recommendation: "Use noun-based URLs (e.g., POST /users instead of POST /createUser). Let HTTP methods convey the action.",
|
|
23
24
|
reference: "REST API Design Best Practices",
|
|
25
|
+
suggestedFix: "Rename the endpoint to a noun-based path (e.g., change '/createUser' to '/users') and use the appropriate HTTP method (POST) to express the action.",
|
|
26
|
+
confidence: 0.85,
|
|
24
27
|
});
|
|
25
28
|
}
|
|
26
29
|
// Detect missing error response handling
|
|
@@ -43,6 +46,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
43
46
|
lineNumbers: noErrorHandlingLines,
|
|
44
47
|
recommendation: "Always set appropriate HTTP status codes for error responses. Use 400 for bad requests, 404 for not found, 500 for server errors.",
|
|
45
48
|
reference: "RFC 7231 - HTTP/1.1 Semantics and Content",
|
|
49
|
+
suggestedFix: "Add `res.status(4xx|5xx)` before `res.json()` in every error/catch path so clients receive the correct HTTP status code.",
|
|
50
|
+
confidence: 0.8,
|
|
46
51
|
});
|
|
47
52
|
}
|
|
48
53
|
// Detect overly broad API responses (returning everything)
|
|
@@ -61,6 +66,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
61
66
|
lineNumbers: selectAllLines,
|
|
62
67
|
recommendation: "Explicitly select only the fields needed for the API response. Use DTOs or view models to shape the output.",
|
|
63
68
|
reference: "API Security Best Practices",
|
|
69
|
+
suggestedFix: "Replace `SELECT *` with an explicit column list (e.g., `SELECT id, name, email`) and map the result through a DTO before returning it.",
|
|
70
|
+
confidence: 0.85,
|
|
64
71
|
});
|
|
65
72
|
}
|
|
66
73
|
// Detect missing pagination
|
|
@@ -82,21 +89,13 @@ export function analyzeApiDesign(code, language) {
|
|
|
82
89
|
lineNumbers: listEndpointLines,
|
|
83
90
|
recommendation: "Implement pagination using limit/offset, cursor-based, or page-based approaches. Include total count and navigation links.",
|
|
84
91
|
reference: "REST API Design: Pagination",
|
|
92
|
+
suggestedFix: "Accept `page` and `limit` query parameters, apply them to the database query (e.g., `.skip().limit()`), and return `{ data, total, page }` in the response.",
|
|
93
|
+
confidence: 0.8,
|
|
85
94
|
});
|
|
86
95
|
}
|
|
87
|
-
// Detect missing API versioning (multi-language)
|
|
88
|
-
const routeRegLines =
|
|
89
|
-
|
|
90
|
-
lines.forEach((line, i) => {
|
|
91
|
-
if (/\/v\d+\//i.test(line) || /api-version|x-api-version/i.test(line)) {
|
|
92
|
-
hasVersioning = true;
|
|
93
|
-
}
|
|
94
|
-
if (/app\.(get|post|put|patch|delete)\s*\(\s*["'`]\//i.test(line) || /router\.(get|post|put|patch|delete)/i.test(line)
|
|
95
|
-
|| /@(Get|Post|Put|Delete|Patch)Mapping/i.test(line) || /@app\.(get|post|put|delete)\s*\(/i.test(line)
|
|
96
|
-
|| /http\.HandleFunc/i.test(line) || /#\[(?:get|post|put|delete)\s*\(/i.test(line)) {
|
|
97
|
-
routeRegLines.push(i + 1);
|
|
98
|
-
}
|
|
99
|
-
});
|
|
96
|
+
// Detect missing API versioning (multi-language route detection)
|
|
97
|
+
const routeRegLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
|
|
98
|
+
const hasVersioning = /\/v\d+\//i.test(code) || /api-version|x-api-version/i.test(code);
|
|
100
99
|
if (routeRegLines.length > 2 && !hasVersioning) {
|
|
101
100
|
findings.push({
|
|
102
101
|
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
@@ -106,6 +105,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
106
105
|
lineNumbers: routeRegLines.slice(0, 3),
|
|
107
106
|
recommendation: "Add API versioning via URL path (/v1/resource), header (X-API-Version), or query parameter.",
|
|
108
107
|
reference: "API Versioning Best Practices",
|
|
108
|
+
suggestedFix: "Prefix all route paths with a version segment (e.g., `/v1/users`) or mount the router under a `/v1` base path.",
|
|
109
|
+
confidence: 0.7,
|
|
109
110
|
});
|
|
110
111
|
}
|
|
111
112
|
// Detect inconsistent response format
|
|
@@ -131,6 +132,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
131
132
|
lineNumbers: withoutData.map((f) => f.line),
|
|
132
133
|
recommendation: "Adopt a consistent response envelope (e.g., { data, meta, errors }) across all endpoints.",
|
|
133
134
|
reference: "JSON:API Specification / API Response Standards",
|
|
135
|
+
suggestedFix: "Wrap all successful responses in a standard envelope (e.g., `res.json({ data: result })`) and error responses in `{ error: { message, code } }`.",
|
|
136
|
+
confidence: 0.75,
|
|
134
137
|
});
|
|
135
138
|
}
|
|
136
139
|
// Missing content-type validation
|
|
@@ -150,6 +153,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
150
153
|
lineNumbers: bodyParsingLines.slice(0, 5),
|
|
151
154
|
recommendation: "Use body-parsing middleware (express.json()) and validate Content-Type headers. Reject requests with unexpected content types.",
|
|
152
155
|
reference: "API Security: Content-Type Validation",
|
|
156
|
+
suggestedFix: "Add `app.use(express.json())` and a middleware that returns 415 Unsupported Media Type when the Content-Type header is not `application/json`.",
|
|
157
|
+
confidence: 0.7,
|
|
153
158
|
});
|
|
154
159
|
}
|
|
155
160
|
// Sensitive data in URL/query parameters
|
|
@@ -171,10 +176,12 @@ export function analyzeApiDesign(code, language) {
|
|
|
171
176
|
lineNumbers: sensitiveInUrlLines,
|
|
172
177
|
recommendation: "Pass sensitive data in request headers (Authorization) or request body, never in URLs or query parameters.",
|
|
173
178
|
reference: "OWASP API Security Top 10 / CWE-598",
|
|
179
|
+
suggestedFix: "Move the sensitive value from the URL/query string into the `Authorization` header or the request body and update the route accordingly.",
|
|
180
|
+
confidence: 0.95,
|
|
174
181
|
});
|
|
175
182
|
}
|
|
176
|
-
// Missing rate limiting (
|
|
177
|
-
const hasRoutes2 =
|
|
183
|
+
// Missing rate limiting (reuse LP.HTTP_ROUTE route detection)
|
|
184
|
+
const hasRoutes2 = routeRegLines.length > 0;
|
|
178
185
|
const hasRateLimit = /rate.?limit|throttle|express-rate-limit|rateLimit|slowDown|@RateLimiter|Bucket4j|x-ratelimit|golang\.org\/x\/time\/rate/i.test(code);
|
|
179
186
|
if (hasRoutes2 && !hasRateLimit && routeRegLines.length > 3) {
|
|
180
187
|
findings.push({
|
|
@@ -184,6 +191,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
184
191
|
description: "APIs without rate limiting are vulnerable to abuse, denial-of-service attacks, and excessive resource consumption.",
|
|
185
192
|
recommendation: "Add rate limiting middleware (express-rate-limit, bottleneck). Consider different limits for authenticated vs unauthenticated users.",
|
|
186
193
|
reference: "OWASP API Security: Unrestricted Resource Consumption",
|
|
194
|
+
suggestedFix: "Install `express-rate-limit` and apply `rateLimit({ windowMs: 15*60*1000, max: 100 })` as middleware on your API router.",
|
|
195
|
+
confidence: 0.7,
|
|
187
196
|
});
|
|
188
197
|
}
|
|
189
198
|
// GraphQL: no query depth/complexity limiting
|
|
@@ -197,6 +206,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
197
206
|
description: "GraphQL APIs without depth or complexity limits are vulnerable to denial-of-service via deeply nested or expensive queries.",
|
|
198
207
|
recommendation: "Add graphql-depth-limit and graphql-query-complexity middleware. Set reasonable maxDepth (e.g., 10) and cost limits.",
|
|
199
208
|
reference: "GraphQL Security: Query Complexity Analysis",
|
|
209
|
+
suggestedFix: "Add `depthLimit(10)` and `createComplexityLimitRule(1000)` as validation rules in your GraphQL server configuration.",
|
|
210
|
+
confidence: 0.7,
|
|
200
211
|
});
|
|
201
212
|
}
|
|
202
213
|
// Missing CORS configuration
|
|
@@ -209,6 +220,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
209
220
|
description: "APIs consumed by browsers need proper CORS configuration. Missing CORS will block cross-origin requests.",
|
|
210
221
|
recommendation: "Configure CORS with specific allowed origins (not '*' in production). Use the cors middleware in Express.",
|
|
211
222
|
reference: "MDN: Cross-Origin Resource Sharing (CORS)",
|
|
223
|
+
suggestedFix: "Install the `cors` package and add `app.use(cors({ origin: 'https://yourdomain.com' }))` with an explicit allow-list of origins.",
|
|
224
|
+
confidence: 0.7,
|
|
212
225
|
});
|
|
213
226
|
}
|
|
214
227
|
// Missing request ID in responses
|
|
@@ -221,6 +234,8 @@ export function analyzeApiDesign(code, language) {
|
|
|
221
234
|
description: "Returning a unique request ID in API responses helps clients reference specific requests when reporting issues.",
|
|
222
235
|
recommendation: "Generate a UUID for each request and return it in a X-Request-ID response header. Include it in all log entries.",
|
|
223
236
|
reference: "API Observability: Request Correlation",
|
|
237
|
+
suggestedFix: "Add a middleware that generates a UUID via `crypto.randomUUID()`, sets `res.setHeader('X-Request-ID', id)`, and attaches it to the request context for logging.",
|
|
238
|
+
confidence: 0.7,
|
|
224
239
|
});
|
|
225
240
|
}
|
|
226
241
|
return findings;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-design.js","sourceRoot":"","sources":["../../src/evaluators/api-design.ts"],"names":[],"mappings":"AACA,OAAO,
|
|
1
|
+
{"version":3,"file":"api-design.js","sourceRoot":"","sources":["../../src/evaluators/api-design.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAE9C,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,mCAAmC;IACnC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2FAA2F;YACxG,WAAW,EAAE,cAAc;YAC3B,cAAc,EAAE,0GAA0G;YAC1H,SAAS,EAAE,gCAAgC;YAC3C,YAAY,EAAE,qJAAqJ;YACnK,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,kDAAkD;YAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1F,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxF,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,gDAAgD;YACvD,WAAW,EAAE,8GAA8G;YAC3H,WAAW,EAAE,oBAAoB;YACjC,cAAc,EAAE,mIAAmI;YACnJ,SAAS,EAAE,2CAA2C;YACtD,YAAY,EAAE,0HAA0H;YACxI,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/H,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,+GAA+G;YAC5H,WAAW,EAAE,cAAc;YAC3B,cAAc,EAAE,6GAA6G;YAC7H,SAAS,EAAE,6BAA6B;YACxC,YAAY,EAAE,wIAAwI;YACtJ,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChG,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,uDAAuD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,iGAAiG;YAC9G,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,4HAA4H;YAC5I,SAAS,EAAE,6BAA6B;YACxC,YAAY,EAAE,6JAA6J;YAC3K,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,kEAAkE;YAC/E,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,cAAc,EAAE,6FAA6F;YAC7G,SAAS,EAAE,+BAA+B;YAC1C,YAAY,EAAE,gHAAgH;YAC9H,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,MAAM,WAAW,GAA4D,EAAE,CAAC;IAChF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzE,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;gBACpC,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,qIAAqI;YAClJ,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3C,cAAc,EAAE,2FAA2F;YAC3G,SAAS,EAAE,iDAAiD;YAC5D,YAAY,EAAE,kJAAkJ;YAChK,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,mDAAmD;YAC1D,WAAW,EAAE,wGAAwG;YACrH,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,cAAc,EAAE,gIAAgI;YAChJ,SAAS,EAAE,uCAAuC;YAClD,YAAY,EAAE,gJAAgJ;YAC9J,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnG,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,mIAAmI;YAChJ,WAAW,EAAE,mBAAmB;YAChC,cAAc,EAAE,4GAA4G;YAC5H,SAAS,EAAE,qCAAqC;YAChD,YAAY,EAAE,0IAA0I;YACxJ,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,0HAA0H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3J,IAAI,UAAU,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,oHAAoH;YACjI,cAAc,EAAE,sIAAsI;YACtJ,SAAS,EAAE,uDAAuD;YAClE,YAAY,EAAE,0HAA0H;YACxI,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,+CAA+C;YACtD,WAAW,EAAE,6HAA6H;YAC1I,cAAc,EAAE,sHAAsH;YACtI,SAAS,EAAE,6CAA6C;YACxD,YAAY,EAAE,sHAAsH;YACpI,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,MAAM,OAAO,GAAG,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,UAAU,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,0GAA0G;YACvH,cAAc,EAAE,2GAA2G;YAC3H,SAAS,EAAE,2CAA2C;YACtD,YAAY,EAAE,kIAAkI;YAChJ,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,UAAU,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,iHAAiH;YAC9H,cAAc,EAAE,kHAAkH;YAClI,SAAS,EAAE,wCAAwC;YACnD,YAAY,EAAE,iKAAiK;YAC/K,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/evaluators/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAgJtC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/evaluators/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAgJtC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA8O/E"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { getLineNumbers, getLangFamily } from "./shared.js";
|
|
1
|
+
import { getLineNumbers, getLangLineNumbers, getLangFamily } from "./shared.js";
|
|
2
|
+
import * as LP from "../language-patterns.js";
|
|
2
3
|
function isLikelyPlaceholderCredentialValue(value) {
|
|
3
4
|
const normalized = value.trim().toLowerCase();
|
|
4
5
|
const exactPlaceholders = new Set([
|
|
@@ -127,19 +128,24 @@ export function analyzeAuthentication(code, language) {
|
|
|
127
128
|
lineNumbers: credentialLines,
|
|
128
129
|
recommendation: "Use environment variables or a secrets manager (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault). Never commit credentials to version control.",
|
|
129
130
|
reference: "OWASP: Credential Management / CWE-798",
|
|
131
|
+
suggestedFix: "Replace hardcoded credentials with environment variables: process.env.SECRET_NAME (Node.js), os.environ['SECRET_NAME'] (Python), or inject from a secrets manager.",
|
|
132
|
+
confidence: 0.9,
|
|
130
133
|
});
|
|
131
134
|
}
|
|
132
|
-
// No auth middleware on routes
|
|
133
|
-
const
|
|
134
|
-
const
|
|
135
|
+
// No auth middleware on routes (multi-language)
|
|
136
|
+
const routeLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
|
|
137
|
+
const hasRoutes = routeLines.length > 0;
|
|
138
|
+
const hasAuthMiddleware = /(?:authenticate|authorize|requireAuth|ensureAuth|isAuthenticated|verifyToken|passport\.authenticate|jwt\.verify|auth\(\)|protect|guard|requireLogin|@login_required|@requires_auth|@Authorize|@PreAuthorize|@Secured)/gi.test(code);
|
|
135
139
|
if (hasRoutes && !hasAuthMiddleware && code.split("\n").length > 20) {
|
|
136
140
|
findings.push({
|
|
137
141
|
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
138
142
|
severity: "high",
|
|
139
143
|
title: "API routes without authentication middleware",
|
|
140
144
|
description: "API endpoints are defined without any visible authentication middleware. Any client can access these endpoints without proving their identity.",
|
|
141
|
-
recommendation: "Apply authentication middleware to routes that require it. Use
|
|
145
|
+
recommendation: "Apply authentication middleware to routes that require it. Use framework-specific auth guards: Express middleware, Python decorators (@login_required), Java annotations (@PreAuthorize), or Go middleware.",
|
|
142
146
|
reference: "OWASP API Security Top 10: API2 — Broken Authentication",
|
|
147
|
+
suggestedFix: "Add auth middleware: app.use(authenticateJWT) (Express), @login_required (Django/Flask), @PreAuthorize (Spring), or middleware.Auth(handler) (Go).",
|
|
148
|
+
confidence: 0.7,
|
|
143
149
|
});
|
|
144
150
|
}
|
|
145
151
|
// Token in query parameters
|
|
@@ -154,10 +160,13 @@ export function analyzeAuthentication(code, language) {
|
|
|
154
160
|
lineNumbers: tokenQueryLines,
|
|
155
161
|
recommendation: "Pass tokens in the Authorization header (Bearer scheme) or in httpOnly cookies. Never use query parameters for sensitive credentials.",
|
|
156
162
|
reference: "OWASP: Transport Layer Security / RFC 6750",
|
|
163
|
+
suggestedFix: "Read tokens from the Authorization header instead: const token = req.headers.authorization?.replace('Bearer ', '');",
|
|
164
|
+
confidence: 0.9,
|
|
157
165
|
});
|
|
158
166
|
}
|
|
159
|
-
// Weak password hashing
|
|
160
|
-
const
|
|
167
|
+
// Weak password hashing (multi-language)
|
|
168
|
+
const weakHashByLang = getLangLineNumbers(code, language, LP.WEAK_HASH);
|
|
169
|
+
const weakHashLines = weakHashByLang.length > 0 ? weakHashByLang : getWeakCredentialHashLines(code);
|
|
161
170
|
if (weakHashLines.length > 0) {
|
|
162
171
|
findings.push({
|
|
163
172
|
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
@@ -167,6 +176,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
167
176
|
lineNumbers: weakHashLines,
|
|
168
177
|
recommendation: "Use bcrypt, scrypt, or Argon2 for password hashing. These algorithms are intentionally slow and include salt by default.",
|
|
169
178
|
reference: "OWASP Password Storage Cheat Sheet / NIST 800-63b",
|
|
179
|
+
suggestedFix: "Replace with bcrypt/argon2: bcrypt.hash(password, 12) (JS), bcrypt.hashpw(password, bcrypt.gensalt()) (Python), Argon2::default().hash_password() (Rust), BCrypt.HashPassword() (C#).",
|
|
180
|
+
confidence: 0.9,
|
|
170
181
|
});
|
|
171
182
|
}
|
|
172
183
|
// No RBAC / authorization checks
|
|
@@ -179,6 +190,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
179
190
|
description: "No role or permission checks found. Without authorization, any authenticated user could access any resource, including admin functions.",
|
|
180
191
|
recommendation: "Implement role-based access control (RBAC) or attribute-based access control (ABAC). Check permissions at each endpoint or resource access.",
|
|
181
192
|
reference: "OWASP API Security Top 10: API5 — Broken Function Level Authorization",
|
|
193
|
+
suggestedFix: "Add role-based middleware: const requireRole = (role) => (req, res, next) => { if (req.user.role !== role) return res.status(403).json({ error: 'Forbidden' }); next(); };",
|
|
194
|
+
confidence: 0.7,
|
|
182
195
|
});
|
|
183
196
|
}
|
|
184
197
|
// JWT without verification
|
|
@@ -193,11 +206,12 @@ export function analyzeAuthentication(code, language) {
|
|
|
193
206
|
description: "JWT tokens are being created but no verification logic is visible. Tokens could be tampered with or forged without the server detecting it.",
|
|
194
207
|
recommendation: "Always verify JWT tokens on every request: check signature, expiration (exp), issuer (iss), and audience (aud).",
|
|
195
208
|
reference: "RFC 7519: JWT / OWASP JWT Cheat Sheet",
|
|
209
|
+
suggestedFix: "Add JWT verification: const payload = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'], issuer: 'myapp', audience: 'myapp' });",
|
|
210
|
+
confidence: 0.8,
|
|
196
211
|
});
|
|
197
212
|
}
|
|
198
|
-
// Disabled TLS / certificate validation
|
|
199
|
-
const
|
|
200
|
-
const tlsLines = getLineNumbers(code, tlsDisabledPattern);
|
|
213
|
+
// Disabled TLS / certificate validation (multi-language)
|
|
214
|
+
const tlsLines = getLangLineNumbers(code, language, LP.TLS_DISABLED);
|
|
201
215
|
if (tlsLines.length > 0) {
|
|
202
216
|
findings.push({
|
|
203
217
|
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
@@ -207,6 +221,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
207
221
|
lineNumbers: tlsLines,
|
|
208
222
|
recommendation: "Never disable TLS verification in production. Fix certificate issues properly. Use CA bundles for self-signed certs in development only.",
|
|
209
223
|
reference: "CWE-295: Improper Certificate Validation",
|
|
224
|
+
suggestedFix: "Remove TLS bypass: delete rejectUnauthorized:false (JS), verify=False (Python), InsecureSkipVerify:true (Go), danger_accept_invalid_certs(true) (Rust), TrustAllCerts (Java).",
|
|
225
|
+
confidence: 0.9,
|
|
210
226
|
});
|
|
211
227
|
}
|
|
212
228
|
// No session expiration / no token expiry
|
|
@@ -220,6 +236,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
220
236
|
description: "Session middleware is used without visible expiration settings. Sessions that never expire allow stolen session tokens to be used indefinitely.",
|
|
221
237
|
recommendation: "Set session maxAge (e.g., 30 minutes for sensitive apps). Implement idle timeout. Invalidate sessions on password change or logout.",
|
|
222
238
|
reference: "OWASP Session Management Cheat Sheet",
|
|
239
|
+
suggestedFix: "Set session expiry: app.use(session({ cookie: { maxAge: 30 * 60 * 1000 }, rolling: true })); and invalidate sessions on password change.",
|
|
240
|
+
confidence: 0.7,
|
|
223
241
|
});
|
|
224
242
|
}
|
|
225
243
|
// Weak password policy — no complexity enforcement
|
|
@@ -233,6 +251,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
233
251
|
description: "User registration logic without visible password policy. Users can set weak passwords like '123456' or 'password', which are trivially guessable.",
|
|
234
252
|
recommendation: "Enforce minimum password length (12+ chars), check against known breached passwords (HaveIBeenPwned API), and use a strength estimator like zxcvbn.",
|
|
235
253
|
reference: "NIST 800-63b / OWASP Password Guidelines",
|
|
254
|
+
suggestedFix: "Enforce password policy: if (password.length < 12) throw new Error('Min 12 chars'); and check against breached passwords via the HaveIBeenPwned API.",
|
|
255
|
+
confidence: 0.7,
|
|
236
256
|
});
|
|
237
257
|
}
|
|
238
258
|
// No account lockout after failed attempts
|
|
@@ -246,6 +266,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
246
266
|
description: "Login logic without account lockout or rate limiting. Attackers can brute-force passwords by trying unlimited login attempts.",
|
|
247
267
|
recommendation: "Implement progressive delays or temporary lockout after 5-10 failed attempts. Use rate limiting on login endpoints. Consider CAPTCHA for repeated failures.",
|
|
248
268
|
reference: "OWASP Brute Force Prevention / CWE-307",
|
|
269
|
+
suggestedFix: "Add rate limiting and lockout: after 5 failed attempts, lock the account for 15 minutes. Use express-rate-limit on the login endpoint.",
|
|
270
|
+
confidence: 0.7,
|
|
249
271
|
});
|
|
250
272
|
}
|
|
251
273
|
// Cookie without Secure and HttpOnly flags
|
|
@@ -261,6 +283,8 @@ export function analyzeAuthentication(code, language) {
|
|
|
261
283
|
lineNumbers: cookieLines,
|
|
262
284
|
recommendation: "Set cookies with { secure: true, httpOnly: true, sameSite: 'strict' }. Use Secure for all auth cookies. HttpOnly prevents JavaScript access.",
|
|
263
285
|
reference: "OWASP Secure Cookie Best Practices / CWE-614",
|
|
286
|
+
suggestedFix: "Add security flags: res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict' });",
|
|
287
|
+
confidence: 0.8,
|
|
264
288
|
});
|
|
265
289
|
}
|
|
266
290
|
// No CSRF protection
|
|
@@ -274,6 +298,40 @@ export function analyzeAuthentication(code, language) {
|
|
|
274
298
|
description: "POST endpoints with session-based auth but no CSRF tokens. Attackers can craft pages that submit forms on behalf of authenticated users.",
|
|
275
299
|
recommendation: "Use CSRF tokens (csurf middleware, Django CSRF, Rails authenticity_token). Set SameSite=Strict on cookies. Use custom headers for API calls.",
|
|
276
300
|
reference: "OWASP CSRF Prevention Cheat Sheet / CWE-352",
|
|
301
|
+
suggestedFix: "Add CSRF middleware: app.use(csrf({ cookie: { sameSite: 'strict' } })); and include the token in forms: <input type='hidden' name='_csrf' value='{{csrfToken}}'>.",
|
|
302
|
+
confidence: 0.8,
|
|
303
|
+
});
|
|
304
|
+
}
|
|
305
|
+
// Session fixation — no session regeneration after login
|
|
306
|
+
const hasLoginHandler = /(?:login|signin|sign.?in|authenticate)\s*(?:=|=>|\(|async)|(?:\.post|\.get|\.put)\s*\(\s*["'][^"']*(?:login|signin|sign.?in|auth)["']/gi.test(code);
|
|
307
|
+
const hasSessionUsage = /req\.session|session\[|session\./gi.test(code);
|
|
308
|
+
const hasSessionRegen = /session\.regenerate|regenerateSession|session\.cycle|rotate.*session|new.*session|session\.create/gi.test(code);
|
|
309
|
+
if (hasLoginHandler && hasSessionUsage && !hasSessionRegen && code.split("\n").length > 10) {
|
|
310
|
+
findings.push({
|
|
311
|
+
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
312
|
+
severity: "high",
|
|
313
|
+
title: "No session regeneration after authentication",
|
|
314
|
+
description: "Login handler uses sessions but does not regenerate the session ID after successful authentication. This enables session fixation attacks where an attacker pre-sets the session ID.",
|
|
315
|
+
recommendation: "Call req.session.regenerate() (Express), session.cycle() (Phoenix), or equivalent immediately after successful login. This invalidates the pre-authentication session ID.",
|
|
316
|
+
reference: "OWASP Session Fixation — CWE-384",
|
|
317
|
+
suggestedFix: "Regenerate session after login: req.session.regenerate((err) => { req.session.userId = user.id; res.redirect('/dashboard'); });",
|
|
318
|
+
confidence: 0.8,
|
|
319
|
+
});
|
|
320
|
+
}
|
|
321
|
+
// No MFA/2FA consideration in authentication flows
|
|
322
|
+
const hasAuthFlow = /(?:login|signin|sign.?in|authenticate|password.*reset|change.*password)\s*(?:\(|=>|=|async)|(?:\.post|\.get|\.put)\s*\(\s*["'][^"']*(?:login|signin|sign.?in|auth|password)["']/gi.test(code);
|
|
323
|
+
const hasProtectedOps = /(?:transfer|payment|withdraw|approve|delete.*account|change.*email|wire|payout)/gi.test(code);
|
|
324
|
+
const hasMfa = /(?:mfa|2fa|two.?factor|totp|otp|authenticator|verification.?code|sms.?code|security.?code|second.?factor)/gi.test(code);
|
|
325
|
+
if ((hasAuthFlow || hasProtectedOps) && !hasMfa && code.split("\n").length > 40) {
|
|
326
|
+
findings.push({
|
|
327
|
+
ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
|
|
328
|
+
severity: "medium",
|
|
329
|
+
title: "No MFA/2FA consideration in authentication flow",
|
|
330
|
+
description: "Authentication or sensitive operation flow with no references to multi-factor authentication. Password-only auth is insufficient for protecting high-value operations.",
|
|
331
|
+
recommendation: "Implement or integrate MFA (TOTP, WebAuthn, SMS). At minimum, support optional MFA for users and require it for admin/sensitive operations. Consider FIDO2/WebAuthn for phishing-resistant auth.",
|
|
332
|
+
reference: "NIST 800-63B / OWASP MFA Cheat Sheet",
|
|
333
|
+
suggestedFix: "Integrate TOTP-based MFA: const verified = speakeasy.totp.verify({ secret: user.mfaSecret, token: req.body.totpCode }); and require MFA for admin and sensitive operations.",
|
|
334
|
+
confidence: 0.7,
|
|
277
335
|
});
|
|
278
336
|
}
|
|
279
337
|
return findings;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/evaluators/authentication.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,aAAa,EAAE,MAAM,aAAa,CAAC;AAGhF,SAAS,kCAAkC,CAAC,KAAa;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAChC,MAAM;QACN,SAAS;QACT,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,UAAU;QACV,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,QAAQ;QACR,UAAU;QACV,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,mGAAmG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kCAAkC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,kHAAkH,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAEpF,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,8CAA8C,CAAC,IAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,iBAAiB,GAAG,sGAAsG,CAAC;IAEjI,MAAM,2BAA2B,GAAG,kFAAkF,CAAC;IACvH,MAAM,wBAAwB,GAAG,oDAAoD,CAAC;IACtF,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,kBAAkB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,MAAM,4BAA4B,GAChC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;YACzC,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,IAAI,iBAAiB,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvD,YAAY,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,eAAe,GAAG,+EAA+E,CAAC;IACxG,MAAM,kBAAkB,GAAG,6EAA6E,CAAC;IAEzG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,wBAAwB;IACxB,MAAM,eAAe,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,SAAS,eAAe,CAAC,MAAM,iKAAiK;YAC7M,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,sJAAsJ;YACtK,SAAS,EAAE,wCAAwC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,wJAAwJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9L,IAAI,SAAS,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,8CAA8C;YACrD,WAAW,EAAE,gJAAgJ;YAC7J,cAAc,EAAE,gKAAgK;YAChL,SAAS,EAAE,yDAAyD;SACrE,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,iBAAiB,GAAG,oEAAoE,CAAC;IAC/F,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6CAA6C;YACpD,WAAW,EAAE,0JAA0J;YACvK,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,uIAAuI;YACvJ,SAAS,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,2IAA2I;YACxJ,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,0HAA0H;YAC1I,SAAS,EAAE,mDAAmD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,YAAY,GAAG,kGAAkG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnI,IAAI,SAAS,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uDAAuD;YAC9D,WAAW,EAAE,yIAAyI;YACtJ,cAAc,EAAE,6IAA6I;YAC7J,SAAS,EAAE,uEAAuE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,6IAA6I;YAC1J,cAAc,EAAE,iHAAiH;YACjI,SAAS,EAAE,uCAAuC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,MAAM,kBAAkB,GAAG,8HAA8H,CAAC;IAC1J,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,wJAAwJ;YACrK,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,0IAA0I;YAC1J,SAAS,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,iJAAiJ;YAC9J,cAAc,EAAE,qIAAqI;YACrJ,SAAS,EAAE,sCAAsC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,mBAAmB,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,MAAM,iBAAiB,GAAG,kHAAkH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxJ,IAAI,mBAAmB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EAAE,mJAAmJ;YAChK,cAAc,EAAE,qJAAqJ;YACrK,SAAS,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,gGAAgG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gDAAgD;YACvD,WAAW,EAAE,+HAA+H;YAC5I,cAAc,EAAE,6JAA6J;YAC7K,SAAS,EAAE,wCAAwC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,aAAa,GAAG,2DAA2D,CAAC;IAClF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,2CAA2C;YAClD,WAAW,EAAE,yIAAyI;YACtJ,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,8CAA8C;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,0IAA0I;YACvJ,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,6CAA6C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
1
|
+
{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/evaluators/authentication.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAE9C,SAAS,kCAAkC,CAAC,KAAa;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAChC,MAAM;QACN,SAAS;QACT,MAAM;QACN,OAAO;QACP,SAAS;QACT,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,KAAK;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,UAAU;QACV,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,QAAQ;QACR,UAAU;QACV,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,mGAAmG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kCAAkC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,kHAAkH,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAEpF,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,8CAA8C,CAAC,IAAY;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,iBAAiB,GAAG,sGAAsG,CAAC;IAEjI,MAAM,2BAA2B,GAAG,kFAAkF,CAAC;IACvH,MAAM,wBAAwB,GAAG,oDAAoD,CAAC;IACtF,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,kBAAkB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,MAAM,4BAA4B,GAChC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;YACzC,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,IAAI,iBAAiB,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvD,YAAY,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,eAAe,GAAG,+EAA+E,CAAC;IACxG,MAAM,kBAAkB,GAAG,6EAA6E,CAAC;IAEzG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,wBAAwB;IACxB,MAAM,eAAe,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,SAAS,eAAe,CAAC,MAAM,iKAAiK;YAC7M,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,sJAAsJ;YACtK,SAAS,EAAE,wCAAwC;YACnD,YAAY,EAAE,oKAAoK;YAClL,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,MAAM,iBAAiB,GAAG,yNAAyN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/P,IAAI,SAAS,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,8CAA8C;YACrD,WAAW,EAAE,gJAAgJ;YAC7J,cAAc,EAAE,6MAA6M;YAC7N,SAAS,EAAE,yDAAyD;YACpE,YAAY,EAAE,oJAAoJ;YAClK,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,iBAAiB,GAAG,oEAAoE,CAAC;IAC/F,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,6CAA6C;YACpD,WAAW,EAAE,0JAA0J;YACvK,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,uIAAuI;YACvJ,SAAS,EAAE,4CAA4C;YACvD,YAAY,EAAE,qHAAqH;YACnI,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACpG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,2IAA2I;YACxJ,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,0HAA0H;YAC1I,SAAS,EAAE,mDAAmD;YAC9D,YAAY,EAAE,uLAAuL;YACrM,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,YAAY,GAAG,kGAAkG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnI,IAAI,SAAS,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uDAAuD;YAC9D,WAAW,EAAE,yIAAyI;YACtJ,cAAc,EAAE,6IAA6I;YAC7J,SAAS,EAAE,uEAAuE;YAClF,YAAY,EAAE,4KAA4K;YAC1L,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,6IAA6I;YAC1J,cAAc,EAAE,iHAAiH;YACjI,SAAS,EAAE,uCAAuC;YAClD,YAAY,EAAE,iJAAiJ;YAC/J,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,wJAAwJ;YACrK,WAAW,EAAE,QAAQ;YACrB,cAAc,EAAE,0IAA0I;YAC1J,SAAS,EAAE,0CAA0C;YACrD,YAAY,EAAE,+KAA+K;YAC7L,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,iJAAiJ;YAC9J,cAAc,EAAE,qIAAqI;YACrJ,SAAS,EAAE,sCAAsC;YACjD,YAAY,EAAE,0IAA0I;YACxJ,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,mBAAmB,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,MAAM,iBAAiB,GAAG,kHAAkH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxJ,IAAI,mBAAmB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EAAE,mJAAmJ;YAChK,cAAc,EAAE,qJAAqJ;YACrK,SAAS,EAAE,0CAA0C;YACrD,YAAY,EAAE,sJAAsJ;YACpK,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,UAAU,GAAG,gGAAgG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/H,IAAI,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gDAAgD;YACvD,WAAW,EAAE,+HAA+H;YAC5I,cAAc,EAAE,6JAA6J;YAC7K,SAAS,EAAE,wCAAwC;YACnD,YAAY,EAAE,wIAAwI;YACtJ,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,aAAa,GAAG,2DAA2D,CAAC;IAClF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,2CAA2C;YAClD,WAAW,EAAE,yIAAyI;YACtJ,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,8CAA8C;YACzD,YAAY,EAAE,yGAAyG;YACvH,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,0IAA0I;YACvJ,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,6CAA6C;YACxD,YAAY,EAAE,mKAAmK;YACjL,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,eAAe,GAAG,yIAAyI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7K,MAAM,eAAe,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,qGAAqG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzI,IAAI,eAAe,IAAI,eAAe,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,8CAA8C;YACrD,WAAW,EAAE,sLAAsL;YACnM,cAAc,EAAE,2KAA2K;YAC3L,SAAS,EAAE,kCAAkC;YAC7C,YAAY,EAAE,iIAAiI;YAC/I,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,mLAAmL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnN,MAAM,eAAe,GAAG,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,6GAA6G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxI,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,iDAAiD;YACxD,WAAW,EAAE,wKAAwK;YACrL,cAAc,EAAE,kMAAkM;YAClN,SAAS,EAAE,sCAAsC;YACjD,YAAY,EAAE,6KAA6K;YAC3L,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"backwards-compatibility.d.ts","sourceRoot":"","sources":["../../src/evaluators/backwards-compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"backwards-compatibility.d.ts","sourceRoot":"","sources":["../../src/evaluators/backwards-compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAgLvF"}
|
|
@@ -1,11 +1,13 @@
|
|
|
1
|
-
import { getLineNumbers, getLangFamily } from "./shared.js";
|
|
1
|
+
import { getLineNumbers, getLangLineNumbers, getLangFamily } from "./shared.js";
|
|
2
|
+
import * as LP from "../language-patterns.js";
|
|
2
3
|
export function analyzeBackwardsCompatibility(code, language) {
|
|
3
4
|
const findings = [];
|
|
4
5
|
let ruleNum = 1;
|
|
5
6
|
const prefix = "COMPAT";
|
|
6
7
|
const lang = getLangFamily(language);
|
|
7
|
-
// No API versioning
|
|
8
|
-
const
|
|
8
|
+
// No API versioning (multi-language route detection)
|
|
9
|
+
const routeLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
|
|
10
|
+
const hasApiRoutes = routeLines.length > 0 && /\/api\//i.test(code);
|
|
9
11
|
const hasVersioning = /\/api\/v\d|\/v\d\/|api-version|x-api-version|accept-version/gi.test(code);
|
|
10
12
|
if (hasApiRoutes && !hasVersioning) {
|
|
11
13
|
findings.push({
|
|
@@ -15,6 +17,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
15
17
|
description: "API routes are defined under /api/ without a version prefix (e.g., /api/v1/). Without versioning, any changes to the API risk breaking existing consumers.",
|
|
16
18
|
recommendation: "Add version prefixes to API routes: /api/v1/users. This allows old and new versions to coexist during migration. Use URL, header, or query param versioning.",
|
|
17
19
|
reference: "API Versioning Best Practices / RESTful API Design",
|
|
20
|
+
suggestedFix: "Replace `/api/` prefixes with `/api/v1/` in all route definitions and add a versioning middleware or router namespace.",
|
|
21
|
+
confidence: 0.7,
|
|
18
22
|
});
|
|
19
23
|
}
|
|
20
24
|
// Deprecated API indicators without deprecation headers
|
|
@@ -28,6 +32,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
28
32
|
description: "Code is marked as deprecated in comments or annotations but no HTTP deprecation headers (Deprecation, Sunset) are set. API consumers won't know features are being retired.",
|
|
29
33
|
recommendation: "Set HTTP Deprecation and Sunset headers on deprecated endpoints. Document alternatives. Communicate timeline to consumers.",
|
|
30
34
|
reference: "RFC 8594: The Sunset HTTP Header / API Lifecycle Management",
|
|
35
|
+
suggestedFix: "Add `res.set('Deprecation', 'true')` and `res.set('Sunset', '<date>')` headers to each deprecated endpoint's response.",
|
|
36
|
+
confidence: 0.75,
|
|
31
37
|
});
|
|
32
38
|
}
|
|
33
39
|
// Direct field deletion in response objects
|
|
@@ -42,6 +48,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
42
48
|
lineNumbers: deleteLines,
|
|
43
49
|
recommendation: "Instead of deleting fields, use a response DTO/mapper that explicitly selects which fields to include. Version the API when removing fields.",
|
|
44
50
|
reference: "Backwards-Compatible API Evolution",
|
|
51
|
+
suggestedFix: "Replace `delete obj.field` with a DTO mapper (e.g., `pick(obj, ['allowed', 'fields'])`) so removed fields are controlled by the versioned schema.",
|
|
52
|
+
confidence: 0.8,
|
|
45
53
|
});
|
|
46
54
|
}
|
|
47
55
|
// Response type changes (sending different structures)
|
|
@@ -56,6 +64,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
56
64
|
lineNumbers: responseLines.slice(0, 5),
|
|
57
65
|
recommendation: "Use a consistent response envelope across all endpoints. Define response schemas (OpenAPI/Swagger) to enforce contracts.",
|
|
58
66
|
reference: "API Contract Design / JSON:API Specification",
|
|
67
|
+
suggestedFix: "Wrap all `res.json()` calls in a shared helper like `sendResponse(res, { data, meta })` to enforce a uniform envelope.",
|
|
68
|
+
confidence: 0.75,
|
|
59
69
|
});
|
|
60
70
|
}
|
|
61
71
|
// No semver in package version
|
|
@@ -70,6 +80,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
70
80
|
lineNumbers: packageVersionLines,
|
|
71
81
|
recommendation: "Document backwards compatibility policy. Use semver: major bumps for breaking changes, minor for features, patch for fixes.",
|
|
72
82
|
reference: "Semantic Versioning (semver.org)",
|
|
83
|
+
suggestedFix: "Promote the version to a stable `1.0.0` (or higher) once the API is production-ready, and add a CHANGELOG documenting compatibility guarantees.",
|
|
84
|
+
confidence: 0.9,
|
|
73
85
|
});
|
|
74
86
|
}
|
|
75
87
|
// Renamed or removed exports
|
|
@@ -84,6 +96,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
84
96
|
lineNumbers: commentedExportLines,
|
|
85
97
|
recommendation: "Re-export removed symbols as deprecated wrappers. Mark them @deprecated with a migration guide. Remove only in the next major version.",
|
|
86
98
|
reference: "Semantic Versioning / API Deprecation Lifecycle",
|
|
99
|
+
suggestedFix: "Uncomment the export and re-export it as a thin deprecated wrapper (e.g., `/** @deprecated Use newName instead */ export const oldName = newName;`).",
|
|
100
|
+
confidence: 0.8,
|
|
87
101
|
});
|
|
88
102
|
}
|
|
89
103
|
// Changed function signatures — optional to required parameter
|
|
@@ -98,6 +112,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
98
112
|
lineNumbers: sigChangeLines,
|
|
99
113
|
recommendation: "Keep required parameters before optional ones. Use options objects for functions with many parameters to allow adding fields without breaking callers.",
|
|
100
114
|
reference: "API Design: Function Signature Evolution",
|
|
115
|
+
suggestedFix: "Reorder parameters so all required params precede optional ones, or refactor to accept a single options object (e.g., `fn(opts: { required: string; optional?: number })`).",
|
|
116
|
+
confidence: 0.75,
|
|
101
117
|
});
|
|
102
118
|
}
|
|
103
119
|
// Enum/union type removals
|
|
@@ -112,6 +128,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
112
128
|
description: "Enums with deprecated or removed values detected. Removing enum values is a breaking change for anything serializing or deserializing these values.",
|
|
113
129
|
recommendation: "Never remove enum values in minor releases. Mark values as deprecated. If numeric, keep the slot allocated. Provide migration mapping for removed values.",
|
|
114
130
|
reference: "Breaking Changes in Enums / Protocol Buffers Reserved Fields",
|
|
131
|
+
suggestedFix: "Keep the deprecated enum value with a `/** @deprecated */` annotation and add a `reserved` comment for its numeric slot instead of deleting it.",
|
|
132
|
+
confidence: 0.75,
|
|
115
133
|
});
|
|
116
134
|
}
|
|
117
135
|
// Changing HTTP methods on endpoints (POST mapping doing DELETE work, etc.)
|
|
@@ -126,6 +144,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
126
144
|
lineNumbers: deleteViaPostLines,
|
|
127
145
|
recommendation: "Use appropriate HTTP methods: DELETE for removal, PUT/PATCH for updates. If migrating methods, keep the old method working during a deprecation period.",
|
|
128
146
|
reference: "RESTful API Design / HTTP Method Semantics",
|
|
147
|
+
suggestedFix: "Change `app.post('/resource', deleteHandler)` to `app.delete('/resource', deleteHandler)` and keep the old POST route temporarily for backwards compatibility.",
|
|
148
|
+
confidence: 0.8,
|
|
129
149
|
});
|
|
130
150
|
}
|
|
131
151
|
// Breaking serialization changes (renaming JSON fields)
|
|
@@ -140,6 +160,8 @@ export function analyzeBackwardsCompatibility(code, language) {
|
|
|
140
160
|
lineNumbers: fieldRenameLines,
|
|
141
161
|
recommendation: "Include both old and new field names during a transition period. Mark the old field as deprecated. Remove only in the next major version.",
|
|
142
162
|
reference: "API Versioning / Backwards-Compatible JSON Evolution",
|
|
163
|
+
suggestedFix: "Emit both the old and new field names in responses (e.g., `{ oldName: value, newName: value }`) until the next major version removes the old name.",
|
|
164
|
+
confidence: 0.75,
|
|
143
165
|
});
|
|
144
166
|
}
|
|
145
167
|
return findings;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"backwards-compatibility.js","sourceRoot":"","sources":["../../src/evaluators/backwards-compatibility.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,
|
|
1
|
+
{"version":3,"file":"backwards-compatibility.js","sourceRoot":"","sources":["../../src/evaluators/backwards-compatibility.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAE9C,MAAM,UAAU,6BAA6B,CAAC,IAAY,EAAE,QAAgB;IAC1E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,QAAQ,CAAC;IACxB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAErC,qDAAqD;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,IAAI,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,4JAA4J;YACzK,cAAc,EAAE,8JAA8J;YAC9K,SAAS,EAAE,oDAAoD;YAC/D,YAAY,EAAE,wHAAwH;YACtI,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,MAAM,aAAa,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,aAAa,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,iDAAiD;YACxD,WAAW,EAAE,6KAA6K;YAC1L,cAAc,EAAE,4HAA4H;YAC5I,SAAS,EAAE,6DAA6D;YACxE,YAAY,EAAE,wHAAwH;YACtI,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;IACjD,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC7D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,kJAAkJ;YAC/J,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,oCAAoC;YAC/C,YAAY,EAAE,mJAAmJ;YACjK,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;IAC3D,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,yDAAyD;YAChE,WAAW,EAAE,SAAS,aAAa,CAAC,MAAM,2KAA2K;YACrN,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,cAAc,EAAE,0HAA0H;YAC1I,SAAS,EAAE,8CAA8C;YACzD,YAAY,EAAE,wHAAwH;YACtI,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,MAAM,qBAAqB,GAAG,sDAAsD,CAAC;IACrF,MAAM,mBAAmB,GAAG,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACxE,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,oEAAoE;YAC3E,WAAW,EAAE,qHAAqH;YAClI,WAAW,EAAE,mBAAmB;YAChC,cAAc,EAAE,6HAA6H;YAC7I,SAAS,EAAE,kCAAkC;YAC7C,YAAY,EAAE,iJAAiJ;YAC/J,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,oEAAoE,CAAC;IACpG,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC1E,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wDAAwD;YAC/D,WAAW,EAAE,SAAS,oBAAoB,CAAC,MAAM,iHAAiH;YAClK,WAAW,EAAE,oBAAoB;YACjC,cAAc,EAAE,wIAAwI;YACxJ,SAAS,EAAE,iDAAiD;YAC5D,YAAY,EAAE,sJAAsJ;YACpK,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,4BAA4B,GAAG,qCAAqC,CAAC;IAC3E,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC1E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,oFAAoF;YAC3F,WAAW,EAAE,4GAA4G;YACzH,WAAW,EAAE,cAAc;YAC3B,cAAc,EAAE,wJAAwJ;YACxK,SAAS,EAAE,0CAA0C;YACrD,YAAY,EAAE,6KAA6K;YAC3L,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,WAAW,GAAG,yBAAyB,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,wBAAwB,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,qJAAqJ;YAClK,cAAc,EAAE,2JAA2J;YAC3K,SAAS,EAAE,8DAA8D;YACzE,YAAY,EAAE,iJAAiJ;YAC/J,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;IAC9E,MAAM,kBAAkB,GAAG,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACtE,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,oDAAoD;YAC3D,WAAW,EAAE,mKAAmK;YAChL,WAAW,EAAE,kBAAkB;YAC/B,cAAc,EAAE,yJAAyJ;YACzK,SAAS,EAAE,4CAA4C;YACvD,YAAY,EAAE,gKAAgK;YAC9K,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;IACjG,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uDAAuD;YAC9D,WAAW,EAAE,SAAS,gBAAgB,CAAC,MAAM,uHAAuH;YACpK,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,2IAA2I;YAC3J,SAAS,EAAE,sDAAsD;YACjE,YAAY,EAAE,oJAAoJ;YAClK,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"caching.d.ts","sourceRoot":"","sources":["../../src/evaluators/caching.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"caching.d.ts","sourceRoot":"","sources":["../../src/evaluators/caching.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA+KxE"}
|