@oculum/scanner 1.0.9 → 1.0.11

package/src/baseline/__tests__/manager.test.ts

@@ -0,0 +1,225 @@
+/**
+ * Baseline Manager Tests
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
+import { BaselineManager } from '../manager'
+import type { ScanResult } from '../../types'
+import type { BaselineData } from '../types'
+
+describe('BaselineManager', () => {
+  let testDir: string
+  let manager: BaselineManager
+
+  beforeEach(() => {
+    // Create a unique temp directory for each test
+    testDir = join(tmpdir(), `baseline-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+    mkdirSync(testDir, { recursive: true })
+    manager = new BaselineManager({ projectPath: testDir })
+  })
+
+  afterEach(() => {
+    // Clean up test directory
+    try {
+      rmSync(testDir, { recursive: true, force: true })
+    } catch {
+      // Ignore cleanup errors
+    }
+  })
+
+  describe('loadBaseline', () => {
+    it('should return found: false when no baseline exists', () => {
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.baseline).toBeUndefined()
+      expect(result.error).toBeUndefined()
+    })
+
+    it('should load a valid baseline', () => {
+      // Create a valid baseline file
+      const baseline: BaselineData = {
+        version: 1,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        commit: 'abc1234',
+        branch: 'main',
+        findings: [
+          {
+            hash: 'abcd1234abcd1234',
+            filePath: 'src/test.ts',
+            lineNumber: 10,
+            category: 'hardcoded_secret',
+            severity: 'critical',
+            title: 'Hardcoded API key',
+          },
+        ],
+        stats: {
+          total: 1,
+          critical: 1,
+          high: 0,
+          medium: 0,
+          low: 0,
+          info: 0,
+        },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(true)
+      expect(result.baseline).toEqual(baseline)
+      expect(result.error).toBeUndefined()
+    })
+
+    it('should return error for invalid JSON', () => {
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), 'not valid json')
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('Failed to parse baseline')
+    })
+
+    it('should return error for unsupported version', () => {
+      const baseline = {
+        version: 99,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        findings: [],
+        stats: { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('Unsupported baseline version')
+    })
+
+    it('should return error when findings array is missing', () => {
+      const baseline = {
+        version: 1,
+        createdAt: '2024-01-15T10:00:00.000Z',
+        stats: { total: 0, critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      }
+
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), JSON.stringify(baseline))
+
+      const result = manager.loadBaseline()
+      expect(result.found).toBe(false)
+      expect(result.error).toContain('missing findings array')
+    })
+  })
+
+  describe('saveBaseline', () => {
+    it('should save a baseline from scan result', () => {
+      const scanResult: ScanResult = {
+        repoName: 'test/repo',
+        repoUrl: 'https://github.com/test/repo',
+        branch: 'main',
+        filesScanned: 10,
+        filesSkipped: 2,
+        vulnerabilities: [
+          {
+            filePath: 'src/test.ts',
+            lineNumber: 10,
+            category: 'hardcoded_secret',
+            severity: 'critical',
+            title: 'Hardcoded API key',
+            description: 'Test description',
+            confidence: 'high',
+            layer: 1,
+            lineContent: 'const API_KEY = "sk-1234567890"',
+          },
+        ],
+        severityCounts: { critical: 1, high: 0, medium: 0, low: 0, info: 0 },
+        categoryCounts: {},
+        hasBlockingIssues: true,
+        scanDuration: 1000,
+        timestamp: '2024-01-15T10:00:00.000Z',
+      }
+
+      const result = manager.saveBaseline(scanResult, { scanDepth: 'cheap' })
+
+      expect(result.success).toBe(true)
+      expect(existsSync(result.path)).toBe(true)
+
+      // Verify saved content
+      const content = readFileSync(result.path, 'utf-8')
+      const baseline = JSON.parse(content) as BaselineData
+
+      expect(baseline.version).toBe(1)
+      expect(baseline.findings).toHaveLength(1)
+      expect(baseline.findings[0].title).toBe('Hardcoded API key')
+      expect(baseline.stats.critical).toBe(1)
+      expect(baseline.scanDepth).toBe('cheap')
+    })
+
+    it('should create .oculum directory if it does not exist', () => {
+      const scanResult: ScanResult = {
+        repoName: 'test/repo',
+        repoUrl: 'https://github.com/test/repo',
+        branch: 'main',
+        filesScanned: 0,
+        filesSkipped: 0,
+        vulnerabilities: [],
+        severityCounts: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+        categoryCounts: {},
+        hasBlockingIssues: false,
+        scanDuration: 100,
+        timestamp: '2024-01-15T10:00:00.000Z',
+      }
+
+      expect(existsSync(join(testDir, '.oculum'))).toBe(false)
+
+      const result = manager.saveBaseline(scanResult)
+
+      expect(result.success).toBe(true)
+      expect(existsSync(join(testDir, '.oculum'))).toBe(true)
+    })
+  })
+
+  describe('clearBaseline', () => {
+    it('should return success with existed: false when no baseline exists', () => {
+      const result = manager.clearBaseline()
+      expect(result.success).toBe(true)
+      expect(result.existed).toBe(false)
+    })
+
+    it('should delete existing baseline', () => {
+      // Create baseline file
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), '{}')
+
+      expect(existsSync(join(testDir, '.oculum/baseline.json'))).toBe(true)
+
+      const result = manager.clearBaseline()
+
+      expect(result.success).toBe(true)
+      expect(result.existed).toBe(true)
+      expect(existsSync(join(testDir, '.oculum/baseline.json'))).toBe(false)
+    })
+  })
+
+  describe('hasBaseline', () => {
+    it('should return false when no baseline exists', () => {
+      expect(manager.hasBaseline()).toBe(false)
+    })
+
+    it('should return true when baseline exists', () => {
+      mkdirSync(join(testDir, '.oculum'), { recursive: true })
+      writeFileSync(join(testDir, '.oculum/baseline.json'), '{}')
+
+      expect(manager.hasBaseline()).toBe(true)
+    })
+  })
+
+  describe('getBaselinePath', () => {
+    it('should return correct path', () => {
+      expect(manager.getBaselinePath()).toBe(join(testDir, '.oculum/baseline.json'))
+    })
+  })
+})

package/src/baseline/diff.ts

@@ -0,0 +1,135 @@
+/**
+ * Baseline Diff Computation
+ * Computes the difference between current findings and a baseline
+ */
+
+import type { Vulnerability, SeverityCounts, VulnerabilitySeverity } from '../types'
+import type { BaselineData, BaselineFinding, DiffResult } from './types'
+import { computeFindingHash } from '../suppression/hash'
+
+/**
+ * Compute severity counts from baseline findings
+ */
+function computeBaselineSeverityCounts(findings: BaselineFinding[]): SeverityCounts {
+  const counts: SeverityCounts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 }
+
+  for (const finding of findings) {
+    const severity = finding.severity as VulnerabilitySeverity
+    if (severity in counts) {
+      counts[severity]++
+    }
+  }
+
+  return counts
+}
+
+/**
+ * Compute severity counts from vulnerabilities
+ */
+function computeVulnerabilitySeverityCounts(vulnerabilities: Vulnerability[]): SeverityCounts {
+  const counts: SeverityCounts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 }
+
+  for (const vuln of vulnerabilities) {
+    if (vuln.severity in counts) {
+      counts[vuln.severity]++
+    }
+  }
+
+  return counts
+}
+
+/**
+ * Compute the diff between current scan findings and a baseline
+ *
+ * Uses finding hashes for comparison, which are computed from:
+ * - Normalized file path
+ * - Normalized line content
+ * - Category
+ *
+ * This means findings are considered the same even if:
+ * - Line numbers changed (code moved)
+ * - Minor whitespace changes occurred
+ *
+ * @param currentFindings - Vulnerabilities from the current scan
+ * @param baseline - The baseline to compare against
+ * @returns DiffResult with new, fixed, and existing findings
+ */
+export function computeDiff(
+  currentFindings: Vulnerability[],
+  baseline: BaselineData
+): DiffResult {
+  // Build hash set from baseline for O(1) lookup
+  const baselineHashes = new Set(baseline.findings.map(f => f.hash))
+
+  // Build hash map from current findings
+  const currentHashMap = new Map<string, Vulnerability>()
+  for (const finding of currentFindings) {
+    const hash = computeFindingHash(finding)
+    currentHashMap.set(hash, finding)
+  }
+
+  // Compute new findings (in current, not in baseline)
+  const newFindings: Vulnerability[] = []
+  for (const finding of currentFindings) {
+    const hash = computeFindingHash(finding)
+    if (!baselineHashes.has(hash)) {
+      newFindings.push(finding)
+    }
+  }
+
+  // Compute fixed findings (in baseline, not in current)
+  const fixedFindings: BaselineFinding[] = []
+  for (const baselineFinding of baseline.findings) {
+    if (!currentHashMap.has(baselineFinding.hash)) {
+      fixedFindings.push(baselineFinding)
+    }
+  }
+
+  // Compute existing findings (in both)
+  const existingFindings: Vulnerability[] = []
+  for (const finding of currentFindings) {
+    const hash = computeFindingHash(finding)
+    if (baselineHashes.has(hash)) {
+      existingFindings.push(finding)
+    }
+  }
+
+  return {
+    new: newFindings,
+    fixed: fixedFindings,
+    existing: existingFindings,
+    stats: {
+      newCount: newFindings.length,
+      fixedCount: fixedFindings.length,
+      existingCount: existingFindings.length,
+      newBySeverity: computeVulnerabilitySeverityCounts(newFindings),
+      fixedBySeverity: computeBaselineSeverityCounts(fixedFindings),
+    },
+  }
+}
+
+/**
+ * Check if a diff has any new blocking issues (critical or high severity)
+ */
+export function hasNewBlockingIssues(diff: DiffResult): boolean {
+  return diff.stats.newBySeverity.critical > 0 || diff.stats.newBySeverity.high > 0
+}
+
+/**
+ * Format a summary string for the diff
+ */
+export function formatDiffSummary(diff: DiffResult): string {
+  const parts: string[] = []
+
+  if (diff.stats.newCount > 0) {
+    parts.push(`${diff.stats.newCount} new`)
+  }
+  if (diff.stats.fixedCount > 0) {
+    parts.push(`${diff.stats.fixedCount} fixed`)
+  }
+  if (diff.stats.existingCount > 0) {
+    parts.push(`${diff.stats.existingCount} existing`)
+  }
+
+  return parts.join(', ')
+}

package/src/baseline/index.ts

@@ -0,0 +1,29 @@
+/**
+ * Baseline Module
+ * Provides baseline/diff mode functionality for tracking security improvements
+ */
+
+// Types
+export type {
+  BaselineFinding,
+  BaselineData,
+  DiffResult,
+  BaselineDiff,
+} from './types'
+export { BASELINE_FILE_PATH, OCULUM_DIR } from './types'
+
+// Manager
+export {
+  BaselineManager,
+  type BaselineManagerOptions,
+  type LoadBaselineResult,
+  type SaveBaselineResult,
+  type ClearBaselineResult,
+} from './manager'
+
+// Diff computation
+export {
+  computeDiff,
+  hasNewBlockingIssues,
+  formatDiffSummary,
+} from './diff'

package/src/baseline/manager.ts

@@ -0,0 +1,230 @@
+/**
+ * Baseline Manager
+ * Handles loading, saving, and clearing baseline files
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'fs'
+import { join, dirname } from 'path'
+import { execFileSync } from 'child_process'
+import type { ScanResult, ScanDepth, Vulnerability } from '../types'
+import type { BaselineData, BaselineFinding } from './types'
+import { BASELINE_FILE_PATH, OCULUM_DIR } from './types'
+import { computeFindingHash } from '../suppression/hash'
+
+export interface BaselineManagerOptions {
+  /** Project root path */
+  projectPath: string
+}
+
+export interface LoadBaselineResult {
+  /** Whether a baseline was found */
+  found: boolean
+  /** The baseline data (if found) */
+  baseline?: BaselineData
+  /** Error message (if failed to load) */
+  error?: string
+}
+
+export interface SaveBaselineResult {
+  /** Whether the save was successful */
+  success: boolean
+  /** Path where baseline was saved */
+  path: string
+  /** Error message (if failed) */
+  error?: string
+}
+
+export interface ClearBaselineResult {
+  /** Whether the clear was successful */
+  success: boolean
+  /** Whether a baseline existed before clearing */
+  existed: boolean
+  /** Error message (if failed) */
+  error?: string
+}
+
+/**
+ * Get current git commit SHA (short form)
+ */
+function getGitCommit(projectPath: string): string | undefined {
+  try {
+    const result = execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      cwd: projectPath,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    return result.toString().trim()
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Get current git branch name
+ */
+function getGitBranch(projectPath: string): string | undefined {
+  try {
+    const result = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+      cwd: projectPath,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    return result.toString().trim()
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Convert a Vulnerability to a BaselineFinding
+ */
+function toBaselineFinding(vuln: Vulnerability): BaselineFinding {
+  return {
+    hash: computeFindingHash(vuln),
+    filePath: vuln.filePath,
+    lineNumber: vuln.lineNumber,
+    category: vuln.category,
+    severity: vuln.severity,
+    title: vuln.title,
+  }
+}
+
+/**
+ * Manages baseline files for diff mode
+ */
+export class BaselineManager {
+  private projectPath: string
+  private baselinePath: string
+
+  constructor(options: BaselineManagerOptions | string) {
+    // Support both old string arg and new options object
+    if (typeof options === 'string') {
+      this.projectPath = options
+    } else {
+      this.projectPath = options.projectPath
+    }
+    this.baselinePath = join(this.projectPath, BASELINE_FILE_PATH)
+  }
+
+  /**
+   * Get the full path to the baseline file
+   */
+  getBaselinePath(): string {
+    return this.baselinePath
+  }
+
+  /**
+   * Load baseline from .oculum/baseline.json
+   */
+  loadBaseline(): LoadBaselineResult {
+    if (!existsSync(this.baselinePath)) {
+      return { found: false }
+    }
+
+    try {
+      const content = readFileSync(this.baselinePath, 'utf-8')
+      const baseline = JSON.parse(content) as BaselineData
+
+      // Basic validation
+      if (baseline.version !== 1) {
+        return {
+          found: false,
+          error: `Unsupported baseline version: ${baseline.version}. Expected version 1.`,
+        }
+      }
+
+      if (!Array.isArray(baseline.findings)) {
+        return {
+          found: false,
+          error: 'Invalid baseline: missing findings array',
+        }
+      }
+
+      return { found: true, baseline }
+    } catch (err) {
+      return {
+        found: false,
+        error: `Failed to parse baseline: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Save current scan result as baseline
+   */
+  saveBaseline(
+    scanResult: ScanResult,
+    options?: { commit?: string; branch?: string; scanDepth?: ScanDepth }
+  ): SaveBaselineResult {
+    try {
+      // Ensure .oculum directory exists
+      const oculumDir = join(this.projectPath, OCULUM_DIR)
+      if (!existsSync(oculumDir)) {
+        mkdirSync(oculumDir, { recursive: true })
+      }
+
+      // Get git info if not provided
+      const commit = options?.commit ?? getGitCommit(this.projectPath)
+      const branch = options?.branch ?? getGitBranch(this.projectPath)
+
+      // Convert vulnerabilities to baseline findings
+      const findings = scanResult.vulnerabilities.map(toBaselineFinding)
+
+      // Build baseline data
+      const baseline: BaselineData = {
+        version: 1,
+        createdAt: new Date().toISOString(),
+        commit,
+        branch,
+        scanDepth: options?.scanDepth,
+        findings,
+        stats: {
+          total: findings.length,
+          critical: scanResult.severityCounts.critical,
+          high: scanResult.severityCounts.high,
+          medium: scanResult.severityCounts.medium,
+          low: scanResult.severityCounts.low,
+          info: scanResult.severityCounts.info,
+        },
+      }
+
+      // Write to file
+      writeFileSync(this.baselinePath, JSON.stringify(baseline, null, 2))
+
+      return { success: true, path: this.baselinePath }
+    } catch (err) {
+      return {
+        success: false,
+        path: this.baselinePath,
+        error: `Failed to save baseline: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Clear (delete) the baseline file
+   */
+  clearBaseline(): ClearBaselineResult {
+    const existed = existsSync(this.baselinePath)
+
+    if (!existed) {
+      return { success: true, existed: false }
+    }
+
+    try {
+      unlinkSync(this.baselinePath)
+      return { success: true, existed: true }
+    } catch (err) {
+      return {
+        success: false,
+        existed: true,
+        error: `Failed to clear baseline: ${err instanceof Error ? err.message : 'Unknown error'}`,
+      }
+    }
+  }
+
+  /**
+   * Check if a baseline exists
+   */
+  hasBaseline(): boolean {
+    return existsSync(this.baselinePath)
+  }
+}