@ngocsangairvds/vsaf 3.2.13 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/integration/conftest.py

@@ -1,107 +0,0 @@
-"""Integration test fixtures — session-scoped Postgres via testcontainers or env DSN."""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-
-import psycopg
-import pytest
-
-_docker_available: bool | None = None
-
-
-def _check_docker() -> bool:
-    global _docker_available
-    if _docker_available is None:
-        _docker_available = shutil.which("docker") is not None
-        if _docker_available:
-            try:
-                subprocess.run(
-                    ["docker", "info"],
-                    capture_output=True,
-                    timeout=5,
-                    check=True,
-                )
-            except (subprocess.CalledProcessError, subprocess.TimeoutExpired, FileNotFoundError):
-                _docker_available = False
-    return _docker_available
-
-
-@pytest.fixture(scope="session")
-def pg_container():
-    """Session-scoped PostgreSQL container with pgvector.
-
-    Skips if Docker is not available or VDS_AUDIT_STATE_DSN is already set.
-    """
-    if os.environ.get("VDS_AUDIT_STATE_DSN"):
-        yield None
-        return
-
-    if not _check_docker():
-        pytest.skip("Docker not available for testcontainers")
-
-    try:
-        from testcontainers.postgres import PostgresContainer
-    except ModuleNotFoundError:
-        pytest.skip("testcontainers optional dependency not installed; run with test-integration extras")
-
-    with PostgresContainer(
-        image="pgvector/pgvector:pg18",
-        dbname="audit_test",
-        user="test",
-        password="test",
-    ) as container:
-        yield container
-
-
-@pytest.fixture(scope="session")
-def pg_dsn(pg_container) -> str:
-    """Return a PostgreSQL DSN, from container or environment."""
-    env_dsn = os.environ.get("VDS_AUDIT_STATE_DSN")
-    if env_dsn:
-        return env_dsn
-
-    host = pg_container.get_container_host_ip()
-    port = pg_container.get_exposed_port(5432)
-    return f"postgresql://test:test@{host}:{port}/audit_test"
-
-
-@pytest.fixture(scope="session")
-def initialized_pg(pg_dsn: str):
-    """Initialize the audit_state schema once per session via Alembic.
-
-    P4 / TSK-4.1.8: ``PostgresStateStore.init_schema()`` is retired.  Schema
-    bootstrap is owned by ``audit_orchestrator/alembic/versions/0001_*.py``.
-    Mirror the pattern used by ``progress_report_orchestrator``'s integration
-    tests — invoke ``alembic upgrade head`` programmatically against the
-    testcontainer DSN so integration tests exercise the real migration code.
-    """
-    import pathlib
-
-    from alembic import command
-    from alembic.config import Config
-    from vds_audit_orchestrator.state.store import PostgresStateStore
-
-    repo_root = pathlib.Path(__file__).resolve().parents[2]  # audit_orchestrator/
-    cfg = Config(str(repo_root / "alembic.ini"))
-    cfg.set_main_option("script_location", str(repo_root / "alembic"))
-    cfg.attributes["configure_logger"] = False
-    # env.py honours -x db=<dsn> first (testcontainer DSN, no env coupling).
-    cfg.cmd_opts = type("Opts", (), {"x": [f"db={pg_dsn}"]})()  # type: ignore[attr-defined]
-    command.upgrade(cfg, "head")
-
-    store = PostgresStateStore(pg_dsn)
-    yield store
-    store.close()
-
-
-@pytest.fixture
-def db_connection(pg_dsn: str):
-    """Per-test database connection."""
-    conn = psycopg.connect(pg_dsn, autocommit=True)
-    try:
-        yield conn
-    finally:
-        conn.close()

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/expected_outcomes.md

@@ -1,50 +0,0 @@
-# Expected Test Outcomes
-
-## Mock Repository Security Findings
-
-The mock repository contains the following intentional security issues:
-
-### CRITICAL Severity
-1. **config.py** - Hardcoded password: `DATABASE_PASSWORD = "super_secret_password_123!"`
-2. **config.py** - Hardcoded API key: `API_KEY = "sk-1234567890abcdef"`
-3. **config.py** - Hardcoded JWT secret: `JWT_SECRET = "my_jwt_signing_key_very_secret"`
-
-### HIGH Severity
-4. **db.py** - SQL injection via string concatenation: `"SELECT * FROM users WHERE name = " + user_input`
-5. **auth.py** - SSL verification disabled: `SSL_VERIFY = False`
-6. **auth.py** - Auth bypass comment: `# TODO: bypass auth for testing`
-
-### MEDIUM Severity
-7. **auth.py** - Debug mode enabled: `DEBUG = True`
-8. **auth.py** - CORS allows all origins: `CORS_ALLOW_ORIGIN = "*"`
-
-## Expected Scanner Results
-
-When running SecurityPatternScanner on the mock repository:
-- Should find 3 CRITICAL findings (hardcoded secrets)
-- Should find 3 HIGH findings (SQL injection, SSL disabled, auth bypass)
-- Should find 2 MEDIUM findings (debug mode, CORS)
-- All findings should have file paths relative to mock_audit_repo/
-- No findings should reference files outside the mock repository
-
-## Expected Evidence Matching
-
-When running EvidenceMatcher:
-- Security-related rows should match BRD, SRS, and security.md
-- Documentation rows should match their respective doc types
-- Each row should have max 5 matched documents
-- Each row should have max 5 matched code files
-
-## Expected Batch Processing
-
-When running BatchRowProcessor with 10 rows and batch_size=2:
-- Should create 5 batches
-- Checkpoint should be created after each batch
-- Resume should skip completed batches
-- All 10 rows should be evaluated
-
-## Expected Evidence Readiness Gate
-
-- With mock_evidence directory: Should pass (5 docs, 5 code files)
-- With empty directory: Should fail with clear message
-- With multi-project without selection: Should fail with project list

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/auth.py

@@ -1,27 +0,0 @@
-# Mock authentication module for testing
-
-
-# HIGH: SSL verification disabled
-SSL_VERIFY = False
-
-# MEDIUM: Debug mode enabled (check if production)
-DEBUG = True
-
-
-def authenticate_user(username, password):
-    """Authenticate user with password."""
-    # TODO: bypass auth for testing
-    # HIGH: Auth bypass comment detected
-    return True
-
-
-def validate_token(token):
-    """Validate JWT token."""
-    # This is safe code
-    if not token:
-        return False
-    return len(token) > 10
-
-
-# MEDIUM: CORS allows all origins
-CORS_ALLOW_ORIGIN = "*"

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/config.py

@@ -1,16 +0,0 @@
-# Mock config file with security issues for testing
-# This file contains intentional security patterns for scanner testing
-
-# CRITICAL: Hardcoded password (should be detected by scanner)
-DATABASE_PASSWORD = "super_secret_password_123!"
-
-# CRITICAL: Hardcoded API key
-API_KEY = "sk-1234567890abcdef"
-
-# CRITICAL: Hardcoded JWT secret
-JWT_SECRET = "my_jwt_signing_key_very_secret"
-
-# Safe configuration (should not trigger)
-DATABASE_HOST = "localhost"
-DATABASE_PORT = 5432
-DEBUG = False

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/db.py

@@ -1,24 +0,0 @@
-# Mock database module with SQL injection vulnerability for testing
-
-
-def get_user_by_name(cursor, user_input):
-    """HIGH: SQL injection via string concatenation."""
-    # This should be detected by the scanner
-    query = "SELECT * FROM users WHERE name = " + user_input
-    cursor.execute(query)
-    return cursor.fetchone()
-
-
-def get_user_by_id(cursor, user_id):
-    """Safe: Parameterized query."""
-    query = "SELECT * FROM users WHERE id = %s"
-    cursor.execute(query, (user_id,))
-    return cursor.fetchone()
-
-
-def search_users(cursor, search_term):
-    """HIGH: Raw query with format string."""
-    # This should be detected by the scanner
-    query = f"SELECT * FROM users WHERE name LIKE '%{search_term}%'"
-    cursor.execute(query)
-    return cursor.fetchall()

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/main.py

@@ -1,18 +0,0 @@
-# Mock main module - safe code for testing
-
-
-def main():
-    """Main entry point."""
-    print("Hello World")
-    return 0
-
-
-def process_data(data):
-    """Process input data safely."""
-    if not data:
-        return []
-    return [item.strip() for item in data]
-
-
-if __name__ == "__main__":
-    main()

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/src/__init__.py

@@ -1 +0,0 @@
-# Mock src package

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_audit_repo/src/utils.py

@@ -1,22 +0,0 @@
-# Mock utilities module - safe code
-
-
-def format_date(date_obj):
-    """Format date object to string."""
-    return date_obj.strftime("%Y-%m-%d")
-
-
-def validate_email(email):
-    """Validate email format."""
-    import re
-
-    pattern = r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"
-    return bool(re.match(pattern, email))
-
-
-def sanitize_input(user_input):
-    """Sanitize user input."""
-    if not user_input:
-        return ""
-    # Remove potentially dangerous characters
-    return user_input.replace("<", "&lt;").replace(">", "&gt;")

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_checklist_template.json

@@ -1,110 +0,0 @@
-{
-  "template_id": "mock-audit-template",
-  "version": "1.0.0",
-  "sections": [
-    {
-      "id": "SEC-1",
-      "name": "Security",
-      "checks": [
-        {
-          "id": "SEC-1.1",
-          "name": "No Hardcoded Secrets",
-          "description": "Source code must not contain hardcoded passwords, API keys, or secrets",
-          "severity": "critical",
-          "category": "security",
-          "disambiguation_hint": "Treat test fixtures under tests/fixtures as non-production unless referenced by runtime config."
-        },
-        {
-          "id": "SEC-1.2",
-          "name": "SQL Injection Prevention",
-          "description": "All database queries must use parameterized queries to prevent SQL injection",
-          "severity": "critical",
-          "category": "security",
-          "disambiguation_hint": "Count prepared statements in data-access code; ignore static migration SQL files."
-        },
-        {
-          "id": "SEC-1.3",
-          "name": "SSL/TLS Configuration",
-          "description": "SSL verification must be enabled for all external connections",
-          "severity": "high",
-          "category": "security",
-          "disambiguation_hint": "Evaluate outbound HTTP client configuration only; skip internal localhost health probes."
-        }
-      ]
-    },
-    {
-      "id": "DOC-1",
-      "name": "Documentation",
-      "checks": [
-        {
-          "id": "DOC-1.1",
-          "name": "BRD Exists",
-          "description": "Business Requirements Document must exist and be up to date",
-          "severity": "medium",
-          "category": "documentation",
-          "disambiguation_hint": "Accept BRD in Confluence or docs/ directory when it maps to current service scope."
-        },
-        {
-          "id": "DOC-1.2",
-          "name": "SRS Exists",
-          "description": "Software Requirements Specification must exist and be complete",
-          "severity": "medium",
-          "category": "documentation",
-          "disambiguation_hint": "Prefer latest versioned SRS page; ignore archived snapshots with older release labels."
-        },
-        {
-          "id": "DOC-1.3",
-          "name": "Design Document Exists",
-          "description": "System Design Document must exist with architecture details",
-          "severity": "medium",
-          "category": "documentation",
-          "disambiguation_hint": "Use architecture diagrams and sequence flows tied to the target repository, not platform-wide generic docs."
-        }
-      ]
-    },
-    {
-      "id": "TEST-1",
-      "name": "Testing",
-      "checks": [
-        {
-          "id": "TEST-1.1",
-          "name": "Test Plan Exists",
-          "description": "Test Plan Document must exist with test strategy",
-          "severity": "medium",
-          "category": "testing",
-          "disambiguation_hint": "Prioritize integration and regression strategy coverage; do not treat ad-hoc QA notes as formal test plan."
-        },
-        {
-          "id": "TEST-1.2",
-          "name": "Security Testing",
-          "description": "Security testing must be documented and performed regularly",
-          "severity": "high",
-          "category": "testing",
-          "disambiguation_hint": "Evidence must include execution cadence and findings closure, not only scanner setup screenshots."
-        }
-      ]
-    },
-    {
-      "id": "CODE-1",
-      "name": "Code Quality",
-      "checks": [
-        {
-          "id": "CODE-1.1",
-          "name": "Input Validation",
-          "description": "All user inputs must be validated and sanitized",
-          "severity": "high",
-          "category": "code_quality",
-          "disambiguation_hint": "Focus on external request boundaries (controller/API layer); internal DTO mapping alone is insufficient."
-        },
-        {
-          "id": "CODE-1.2",
-          "name": "Error Handling",
-          "description": "Proper error handling must be implemented throughout the codebase",
-          "severity": "medium",
-          "category": "code_quality",
-          "disambiguation_hint": "Assess consistent error contracts and logging context for production paths; ignore prototype/demo modules."
-        }
-      ]
-    }
-  ]
-}

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/code_evidence_pack.json

@@ -1,40 +0,0 @@
-{
-  "repo_path": "mock-audit-repo",
-  "files": [
-    {
-      "file_path": "config.py",
-      "content": "# Mock config file with security issues\nDATABASE_PASSWORD = \"super_secret_password_123!\"\nAPI_KEY = \"sk-1234567890abcdef\"\nJWT_SECRET = \"my_jwt_signing_key_very_secret\"\nDATABASE_HOST = \"localhost\"\nDATABASE_PORT = 5432\nDEBUG = False",
-      "original_lines": 7,
-      "original_bytes": 250,
-      "priority": 1
-    },
-    {
-      "file_path": "db.py",
-      "content": "# Mock database module\ndef get_user_by_name(cursor, user_input):\n    query = \"SELECT * FROM users WHERE name = \" + user_input\n    cursor.execute(query)\n    return cursor.fetchone()",
-      "original_lines": 5,
-      "original_bytes": 180,
-      "priority": 1
-    },
-    {
-      "file_path": "auth.py",
-      "content": "# Mock authentication module\nSSL_VERIFY = False\nDEBUG = True\nCORS_ALLOW_ORIGIN = \"*\"\ndef authenticate_user(username, password):\n    # TODO: bypass auth for testing\n    return True",
-      "original_lines": 7,
-      "original_bytes": 200,
-      "priority": 1
-    },
-    {
-      "file_path": "main.py",
-      "content": "# Mock main module - safe code\ndef main():\n    print(\"Hello World\")\n    return 0",
-      "original_lines": 4,
-      "original_bytes": 80,
-      "priority": 2
-    },
-    {
-      "file_path": "src/utils.py",
-      "content": "# Mock utilities module - safe code\ndef format_date(date_obj):\n    return date_obj.strftime(\"%Y-%m-%d\")\ndef validate_email(email):\n    import re\n    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$'\n    return bool(re.match(pattern, email))",
-      "original_lines": 7,
-      "original_bytes": 220,
-      "priority": 2
-    }
-  ]
-}

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/manifest.json

@@ -1,49 +0,0 @@
-{
-  "project": {
-    "project_name": "mock-audit-project",
-    "page_id": "12345",
-    "page_url": "http://confluence/page/12345",
-    "documents": [
-      {
-        "title": "Business Requirements Document",
-        "source_path": "brd.md",
-        "doc_type": "BRD",
-        "role": "PO",
-        "url": "http://confluence/brd",
-        "source": "confluence"
-      },
-      {
-        "title": "Software Requirements Specification",
-        "source_path": "srs.md",
-        "doc_type": "SRS",
-        "role": "BA",
-        "url": "http://confluence/srs",
-        "source": "confluence"
-      },
-      {
-        "title": "System Design Document",
-        "source_path": "design.md",
-        "doc_type": "DESIGN",
-        "role": "SA",
-        "url": "http://confluence/design",
-        "source": "confluence"
-      },
-      {
-        "title": "Test Plan Document",
-        "source_path": "test.md",
-        "doc_type": "TEST",
-        "role": "QA",
-        "url": "http://confluence/test",
-        "source": "confluence"
-      },
-      {
-        "title": "Security Guidelines",
-        "source_path": "security.md",
-        "doc_type": "OTHER",
-        "role": "SA",
-        "url": "http://confluence/security",
-        "source": "confluence"
-      }
-    ]
-  }
-}

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/projects/mock-audit-project/brd.md

@@ -1,19 +0,0 @@
-# Business Requirements Document
-
-## Overview
-This document describes the business requirements for the mock audit project.
-
-## Authentication Requirements
-- Users must authenticate using JWT tokens
-- Password policy must enforce minimum 8 characters
-- Session timeout after 30 minutes of inactivity
-
-## Data Security Requirements
-- All sensitive data must be encrypted at rest
-- API keys must not be hardcoded in source code
-- Database connections must use SSL
-
-## Audit Trail Requirements
-- All user actions must be logged
-- Logs must be retained for 90 days
-- Log access must be restricted to authorized personnel

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/projects/mock-audit-project/design.md

@@ -1,32 +0,0 @@
-# System Design Document
-
-## Architecture Overview
-The system follows a microservices architecture with the following components:
-
-### API Gateway
-- Handles authentication and authorization
-- Routes requests to appropriate services
-- Implements rate limiting
-
-### User Service
-- Manages user accounts and profiles
-- Handles password reset flows
-- Integrates with external identity providers
-
-### Database Layer
-- PostgreSQL for persistent storage
-- Redis for caching and sessions
-- Connection pooling for performance
-
-## Security Design
-
-### Authentication Flow
-1. User submits credentials
-2. System validates against database
-3. JWT token issued on success
-4. Token included in subsequent requests
-
-### Data Protection
-- AES-256 encryption for sensitive data
-- TLS 1.3 for data in transit
-- Key rotation every 90 days

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/projects/mock-audit-project/security.md

@@ -1,23 +0,0 @@
-# Security Guidelines
-
-## Secure Coding Practices
-
-### Secrets Management
-- Never hardcode passwords, API keys, or secrets
-- Use environment variables or secret management services
-- Rotate secrets regularly
-
-### Input Validation
-- Validate all user inputs on server side
-- Use parameterized queries for database operations
-- Sanitize outputs to prevent XSS
-
-### Authentication
-- Use strong password policies
-- Implement multi-factor authentication
-- Use secure session management
-
-## Vulnerability Management
-- Regular dependency updates
-- Automated security scanning
-- Incident response procedures

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/projects/mock-audit-project/srs.md

@@ -1,25 +0,0 @@
-# Software Requirements Specification
-
-## Functional Requirements
-
-### FR-001: User Authentication
-- System shall authenticate users via username and password
-- System shall issue JWT tokens upon successful authentication
-- System shall validate tokens on each API request
-
-### FR-002: Data Validation
-- System shall validate all user inputs
-- System shall sanitize inputs to prevent SQL injection
-- System shall escape HTML to prevent XSS attacks
-
-### FR-003: Error Handling
-- System shall log all errors with stack traces
-- System shall return user-friendly error messages
-- System shall not expose internal details in error responses
-
-## Non-Functional Requirements
-
-### NFR-001: Security
-- All API endpoints must use HTTPS
-- Passwords must be hashed using bcrypt
-- API rate limiting must be implemented

package/tools/vds-scripts/audit_orchestrator/tests/integration/fixtures/mock_evidence/projects/mock-audit-project/test.md

@@ -1,30 +0,0 @@
-# Test Plan Document
-
-## Test Strategy
-
-### Unit Testing
-- All business logic must have unit tests
-- Minimum 80% code coverage required
-- Tests must be automated in CI/CD pipeline
-
-### Integration Testing
-- API endpoints must have integration tests
-- Database operations must be tested
-- External service integrations must be mocked
-
-### Security Testing
-- OWASP Top 10 vulnerabilities must be tested
-- Penetration testing quarterly
-- Dependency vulnerability scanning weekly
-
-## Test Cases
-
-### TC-001: Authentication
-- Valid credentials return JWT token
-- Invalid credentials return 401 error
-- Expired tokens are rejected
-
-### TC-002: Input Validation
-- SQL injection attempts are blocked
-- XSS attempts are sanitized
-- Invalid data formats return 400 error