@oculum/scanner 1.0.11 → 1.0.13

package/src/__tests__/score/framework-scoring.test.ts

@@ -0,0 +1,275 @@
+/**
+ * Tests for framework adjustment rules in the confidence scoring system.
+ */
+
+import { FRAMEWORK_RULES } from '../../score/adjustments'
+import type { AdjustmentContext } from '../../score/types'
+import type { Vulnerability } from '../../shared/types'
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.tsx',
+    lineNumber: 10,
+    lineContent: '<div>{userData}</div>',
+    severity: 'medium',
+    category: 'xss',
+    title: 'Test finding',
+    description: 'Test',
+    confidence: 'medium',
+    layer: 2,
+    baseConfidence: 0.50,
+    ...overrides,
+  }
+}
+
+function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
+  return {
+    file: {
+      isTestFile: false,
+      isExampleFile: false,
+      isDocFile: false,
+      isScannerCode: false,
+      isToolingDir: false,
+      isServerOnly: false,
+      isClientBundled: false,
+    },
+    project: {
+      hasAuthMiddleware: false,
+      hasTypeScript: true,
+      orm: null,
+      validationLib: null,
+    },
+    lineContent: '<div>{userData}</div>',
+    filePath: 'src/app.tsx',
+    ...overrides,
+  }
+}
+
+function findRule(name: string) {
+  return FRAMEWORK_RULES.find(r => r.name === name)
+}
+
+describe('Framework Adjustment Rules', () => {
+  it('has exactly 3 rules', () => {
+    expect(FRAMEWORK_RULES).toHaveLength(3)
+  })
+
+  describe('framework_auto_protects', () => {
+    const rule = findRule('framework_auto_protects')!
+
+    it('fires when safePatternMatch is present (non-ORM)', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX auto-escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('does not fire when no framework context', () => {
+      const ctx = makeContext()
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('does not fire when safePatternMatch is null', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('does not fire when safePatternMatch starts with orm_', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('fires for non-ORM patterns like nextjs_server_component', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'nextjs_server_component_no_dom', reason: 'Server Component' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['nextjs'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('has delta -0.30', () => {
+      expect(rule.delta).toBe(-0.30)
+    })
+
+    it('has source "framework"', () => {
+      expect(rule.source).toBe('framework')
+    })
+  })
+
+  describe('framework_unsafe_pattern', () => {
+    const rule = findRule('framework_unsafe_pattern')!
+
+    it('fires when unsafePatternMatch is present', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: { id: 'react_dangerous_inner_html', reason: 'bypasses escaping' },
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(true)
+    })
+
+    it('does not fire when unsafePatternMatch is null', () => {
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: null,
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(makeFinding(), ctx)).toBe(false)
+    })
+
+    it('has delta +0.10', () => {
+      expect(rule.delta).toBe(+0.10)
+    })
+  })
+
+  describe('orm_safe_query', () => {
+    const rule = findRule('orm_safe_query')!
+
+    it('fires for sql_injection with ORM safe pattern', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('fires for dangerous_function with ORM safe pattern', () => {
+      const finding = makeFinding({ category: 'dangerous_function' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_django_parameterised', reason: 'Django ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['django'],
+          orm: 'django',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('does not fire for non-SQL categories', () => {
+      const finding = makeFinding({ category: 'xss' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does not fire without ORM', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: null,
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does not fire when safe pattern is not ORM-prefixed', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: 'sequelize',
+        },
+      })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('has delta -0.25', () => {
+      expect(rule.delta).toBe(-0.25)
+    })
+  })
+
+  describe('rule interactions', () => {
+    it('ORM patterns: only orm_safe_query fires (not framework_auto_protects)', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'orm_sequelize_parameterised', reason: 'ORM parameterises' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['express'],
+          orm: 'sequelize',
+        },
+      })
+      const autoProtects = findRule('framework_auto_protects')!
+      const ormSafe = findRule('orm_safe_query')!
+      // framework_auto_protects should NOT fire for ORM patterns
+      expect(autoProtects.applies(finding, ctx)).toBe(false)
+      // orm_safe_query should fire
+      expect(ormSafe.applies(finding, ctx)).toBe(true)
+      // Only -0.25, not -0.55
+      expect(ormSafe.delta).toBe(-0.25)
+    })
+
+    it('non-ORM patterns: framework_auto_protects fires normally', () => {
+      const finding = makeFinding({ category: 'xss' })
+      const ctx = makeContext({
+        framework: {
+          safePatternMatch: { id: 'react_jsx_auto_escape', reason: 'JSX escapes' },
+          unsafePatternMatch: null,
+          activeFrameworks: ['react'],
+          orm: null,
+        },
+      })
+      const autoProtects = findRule('framework_auto_protects')!
+      const ormSafe = findRule('orm_safe_query')!
+      // framework_auto_protects fires for non-ORM safe patterns
+      expect(autoProtects.applies(finding, ctx)).toBe(true)
+      // orm_safe_query does NOT fire (wrong category and not ORM-prefixed)
+      expect(ormSafe.applies(finding, ctx)).toBe(false)
+    })
+
+    it('no framework rules fire without framework context', () => {
+      const finding = makeFinding()
+      const ctx = makeContext()
+      for (const rule of FRAMEWORK_RULES) {
+        expect(rule.applies(finding, ctx)).toBe(false)
+      }
+    })
+  })
+})

package/src/__tests__/score/route-scoring.test.ts

@@ -0,0 +1,156 @@
+import { ROUTE_RULES } from '../../score/adjustments'
+import type { AdjustmentContext } from '../../score/types'
+import type { Vulnerability } from '../../shared/types'
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/api/route.ts',
+    lineNumber: 10,
+    lineContent: 'const data = req.body.userId',
+    severity: 'medium',
+    category: 'missing_auth',
+    title: 'Missing authentication',
+    description: 'No auth check',
+    confidence: 'medium',
+    layer: 2,
+    ...overrides,
+  }
+}
+
+function makeContext(overrides: Partial<AdjustmentContext> = {}): AdjustmentContext {
+  return {
+    file: {
+      isTestFile: false,
+      isExampleFile: false,
+      isDocFile: false,
+      isScannerCode: false,
+      isToolingDir: false,
+      isServerOnly: false,
+      isClientBundled: false,
+    },
+    project: { hasAuthMiddleware: false, hasTypeScript: true, orm: null, validationLib: null },
+    lineContent: 'const data = req.body.userId',
+    filePath: 'src/api/route.ts',
+    ...overrides,
+  }
+}
+
+describe('Route Scoring Rules', () => {
+  const findRule = (name: string) => ROUTE_RULES.find(r => r.name === name)!
+
+  describe('no_auth_on_route', () => {
+    const rule = findRule('no_auth_on_route')
+
+    it('fires for auth-related finding without auth on route', () => {
+      const finding = makeFinding({ category: 'missing_auth' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+      expect(rule.delta).toBe(0.15)
+    })
+
+    it('fires for sql_injection without auth', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['POST'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('does NOT fire for non-auth categories', () => {
+      const finding = makeFinding({ category: 'high_entropy_string' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does NOT fire when route has auth', () => {
+      const finding = makeFinding({ category: 'missing_auth' })
+      const ctx = makeContext({ route: { hasAuth: true, isPublic: false, middleware: ['auth'], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does NOT fire when route is public', () => {
+      const finding = makeFinding({ category: 'missing_auth' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: true, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+
+    it('does NOT fire when no route context', () => {
+      const finding = makeFinding({ category: 'missing_auth' })
+      const ctx = makeContext()
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+  })
+
+  describe('has_auth_on_route', () => {
+    const rule = findRule('has_auth_on_route')
+
+    it('fires when route has auth middleware', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: true, isPublic: false, middleware: ['authGuard'], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+      expect(rule.delta).toBe(-0.15)
+    })
+
+    it('does NOT fire when route has no auth', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+  })
+
+  describe('public_route', () => {
+    const rule = findRule('public_route')
+
+    it('fires for missing_auth on public route', () => {
+      const finding = makeFinding({ category: 'missing_auth' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: true, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+      expect(rule.delta).toBe(-0.25)
+    })
+
+    it('does NOT fire for non-missing_auth categories', () => {
+      const finding = makeFinding({ category: 'sql_injection' })
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: true, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+  })
+
+  describe('mutation_route', () => {
+    const rule = findRule('mutation_route')
+
+    it('fires for POST routes', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['POST'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+      expect(rule.delta).toBe(0.05)
+    })
+
+    it('fires for DELETE routes', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['DELETE'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+    })
+
+    it('does NOT fire for GET routes', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+  })
+
+  describe('rate_limited_route', () => {
+    const rule = findRule('rate_limited_route')
+
+    it('fires when route has rate limiting', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: true } })
+      expect(rule.applies(finding, ctx)).toBe(true)
+      expect(rule.delta).toBe(-0.05)
+    })
+
+    it('does NOT fire when no rate limiting', () => {
+      const finding = makeFinding()
+      const ctx = makeContext({ route: { hasAuth: false, isPublic: false, middleware: [], methods: ['GET'], hasRateLimiting: false } })
+      expect(rule.applies(finding, ctx)).toBe(false)
+    })
+  })
+})

package/src/__tests__/score/scoring-integration.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Integration tests for the scoring system
+ */
+
+import { scoreFindings, DEPTH_CONFIGS } from '../../score'
+import type { Vulnerability } from '../../shared/types'
+import type { ContextEngineResult } from '../../model/taint-types'
+
+const PROJECT_CONTEXT: ContextEngineResult = {
+  projectContext: {
+    summary: 'Test project',
+    auth: {
+      hasGlobalMiddleware: false,
+      authProvider: null,
+      protectedPaths: [],
+      publicPaths: [],
+      throwingHelpers: [],
+    },
+    dataAccess: {
+      orm: null,
+      hasRLS: false,
+    },
+    frameworks: {
+      primary: null,
+      usesTypeScript: true,
+    },
+    secrets: {
+      hasEnvConfig: false,
+      secretPatterns: [],
+    },
+  } as any,
+  fileTaintAnalyses: new Map(),
+}
+
+function makeFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-1',
+    filePath: 'src/app.ts',
+    lineNumber: 10,
+    lineContent: 'const x = 1',
+    severity: 'medium',
+    category: 'hardcoded_secret',
+    title: 'Test finding',
+    description: 'Test',
+    confidence: 'medium',
+    layer: 1,
+    baseConfidence: 0.50,
+    ...overrides,
+  }
+}
+
+describe('scoreFindings', () => {
+  it('scores a batch of findings', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', baseConfidence: 0.70, category: 'hardcoded_secret' }),
+      makeFinding({ id: 'f2', baseConfidence: 0.30, category: 'high_entropy_string' }),
+      makeFinding({ id: 'f3', baseConfidence: 0.15, category: 'ai_pattern' }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+
+    expect(scored).toHaveLength(3)
+    // Each finding has a confidence_score
+    for (const s of scored) {
+      expect(s.confidence_score).toBeDefined()
+      expect(s.confidence_score.score).toBeGreaterThanOrEqual(0)
+      expect(s.confidence_score.score).toBeLessThanOrEqual(1)
+      expect(['surface', 'validate', 'suppress']).toContain(s.confidence_score.routing)
+    }
+  })
+
+  it('all findings get valid confidence_score', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1' }),
+      makeFinding({ id: 'f2', baseConfidence: undefined }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+
+    expect(scored[0].confidence_score.base).toBe(0.50)
+    expect(scored[1].confidence_score.base).toBe(0.35) // default
+  })
+
+  it('test file findings get negative adjustments', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({
+        id: 'f1',
+        baseConfidence: 0.50,
+        filePath: 'src/__tests__/auth.test.ts',
+      }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+
+    expect(scored[0].confidence_score.adjustments.length).toBeGreaterThan(0)
+    expect(scored[0].confidence_score.score).toBeLessThan(0.50)
+    // test_file rule gives -0.35, so 0.50 - 0.35 = 0.15 (may also get scanner_code)
+    const testFileAdj = scored[0].confidence_score.adjustments.find(a => a.factor === 'test_file')
+    expect(testFileAdj).toBeDefined()
+    expect(testFileAdj!.delta).toBe(-0.35)
+  })
+
+  it('experimental-equivalent detectors route to suppress', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', baseConfidence: 0.15, category: 'ai_pattern' }),
+      makeFinding({ id: 'f2', baseConfidence: 0.10, category: 'security_bypass' }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+
+    // 0.15 < validateThreshold(0.20) → suppress
+    expect(scored[0].confidence_score.routing).toBe('suppress')
+    // 0.10 < validateThreshold(0.20) → suppress
+    expect(scored[1].confidence_score.routing).toBe('suppress')
+  })
+
+  it('high-confidence findings route to surface', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', baseConfidence: 0.70, category: 'hardcoded_secret' }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+    expect(scored[0].confidence_score.routing).toBe('surface')
+  })
+
+  it('medium-confidence findings route to validate in verified depth', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', baseConfidence: 0.50, category: 'config_audit' }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'verified', PROJECT_CONTEXT)
+    expect(scored[0].confidence_score.routing).toBe('validate')
+  })
+
+  it('local depth only surfaces high-confidence findings', () => {
+    const findings: Vulnerability[] = [
+      makeFinding({ id: 'f1', baseConfidence: 0.70 }),
+      makeFinding({ id: 'f2', baseConfidence: 0.50 }),
+      makeFinding({ id: 'f3', baseConfidence: 0.20 }),
+    ]
+
+    const { scored } = scoreFindings(findings, 'local', PROJECT_CONTEXT)
+
+    expect(scored[0].confidence_score.routing).toBe('surface')
+    expect(scored[1].confidence_score.routing).toBe('suppress') // No AI in local
+    expect(scored[2].confidence_score.routing).toBe('suppress')
+  })
+})
+
+describe('DEPTH_CONFIGS', () => {
+  it('local has AI disabled', () => {
+    expect(DEPTH_CONFIGS.local.aiEnabled).toBe(false)
+    expect(DEPTH_CONFIGS.local.surfaceThreshold).toBe(0.70)
+  })
+
+  it('verified has AI enabled', () => {
+    expect(DEPTH_CONFIGS.verified.aiEnabled).toBe(true)
+    expect(DEPTH_CONFIGS.verified.validateThreshold).toBe(0.20)
+  })
+
+  it('deep has lowest validate threshold', () => {
+    expect(DEPTH_CONFIGS.deep.aiEnabled).toBe(true)
+    expect(DEPTH_CONFIGS.deep.validateThreshold).toBe(0.10)
+  })
+})