@opensip-cli/checks-universal 0.1.0

package/dist/checks/resilience/cache-ttl-validation.js

@@ -0,0 +1,222 @@
+// @fitness-ignore-file duplicate-implementation-detection -- reviewed: pattern is architecturally justified or false positive
+// @fitness-ignore-file unused-config-options -- Config options reserved for future use or environment-specific
+/**
+ * @fileoverview Cache TTL validation check
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { isDigit } from './_helpers/config-validation.js';
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+const MIN_TTL_SECONDS = 5; // Minimum 5 seconds to avoid thundering herd
+const MAX_TTL_SECONDS = 86_400; // Maximum 24 hours for general data
+const MAX_FINANCIAL_TTL_SECONDS = 60; // Maximum 1 minute for financial data
+// =============================================================================
+// DATA TYPE DETECTION
+// =============================================================================
+/**
+ * Check if line contains financial data keywords.
+ */
+function isFinancialDataLine(line) {
+    const lowerLine = line.toLowerCase();
+    const hasMoneyTerms = lowerLine.includes('balance') || lowerLine.includes('wallet') || lowerLine.includes('payment');
+    const hasTransactionTerms = lowerLine.includes('transaction') ||
+        lowerLine.includes('escrow') ||
+        lowerLine.includes('price');
+    const hasAccountingTerms = lowerLine.includes('amount') || lowerLine.includes('credit') || lowerLine.includes('debit');
+    return hasMoneyTerms || hasTransactionTerms || hasAccountingTerms;
+}
+/**
+ * Check if line contains sensitive data keywords.
+ */
+function isSensitiveDataLine(line) {
+    const lowerLine = line.toLowerCase();
+    const hasSessionTerms = lowerLine.includes('session') || lowerLine.includes('token');
+    const hasAuthTerms = lowerLine.includes('auth') || lowerLine.includes('permission') || lowerLine.includes('role');
+    return hasSessionTerms || hasAuthTerms;
+}
+/**
+ * Check if line should be skipped (non-cache pattern).
+ */
+function isNonCachePattern(line) {
+    const lowerLine = line.toLowerCase();
+    const isMapOperation = line.includes('Map()') && line.includes('.set');
+    const isCollectionInit = line.includes('new Map') || line.includes('new Set');
+    const isMetricsOperation = lowerLine.includes('metrics.set') || lowerLine.includes('gauge.set');
+    return isMapOperation || isCollectionInit || isMetricsOperation;
+}
+/**
+ * Check if file contains cache-related patterns.
+ */
+function hasCachePatterns(content) {
+    const lowerContent = content.toLowerCase();
+    return (lowerContent.includes('cache') || lowerContent.includes('redis') || lowerContent.includes('ttl'));
+}
+// =============================================================================
+// TTL PARSING
+// =============================================================================
+/**
+ * Parse TTL value from a line using string matching.
+ */
+function parseTtlFromLine(line) {
+    logger.debug({
+        evt: 'fitness.checks.cache_ttl_validation.parse_ttl_from_line',
+        msg: 'Parsing TTL value from line using string matching',
+    });
+    const lowerLine = line.toLowerCase();
+    const ttlIndex = lowerLine.indexOf('ttl');
+    if (ttlIndex === -1)
+        return null;
+    const afterTtl = line.slice(Math.max(0, ttlIndex + 3));
+    let i = 0;
+    // Skip whitespace
+    while (i < afterTtl.length && (afterTtl[i] === ' ' || afterTtl[i] === '\t')) {
+        i++;
+    }
+    // Check for = or :
+    if (afterTtl[i] !== '=' && afterTtl[i] !== ':') {
+        return null;
+    }
+    i++;
+    // Skip whitespace
+    while (i < afterTtl.length && (afterTtl[i] === ' ' || afterTtl[i] === '\t')) {
+        i++;
+    }
+    // Parse digits
+    const digitStart = i;
+    while (i < afterTtl.length && isDigit(afterTtl[i])) {
+        i++;
+    }
+    if (digitStart === i) {
+        return null; // No digits found
+    }
+    // @fitness-ignore-next-line numeric-validation -- substring is guaranteed digit-only by isDigit loop above
+    const ttlValue = Number.parseInt(afterTtl.slice(digitStart, i), 10);
+    return {
+        ttl: ttlValue,
+        matchText: `ttl${afterTtl.slice(0, Math.max(0, i))}`,
+    };
+}
+/**
+ * Detect TTL violation type based on value and data type.
+ */
+function detectTtlViolation(ttl, isFinancialData, isSensitiveData) {
+    logger.debug({
+        evt: 'fitness.checks.cache_ttl_validation.detect_ttl_violation',
+        msg: 'Detecting TTL violation type based on value and data type',
+    });
+    // TTL too short
+    if (ttl < MIN_TTL_SECONDS) {
+        return {
+            message: `TTL of ${ttl}s is too short, may cause thundering herd`,
+            severity: 'warning',
+            suggestion: `Increase TTL to at least ${MIN_TTL_SECONDS}s to prevent thundering herd when cache expires simultaneously for many requests.`,
+            patternId: 'ttl-too-short',
+        };
+    }
+    // Financial data with long TTL
+    if (isFinancialData && ttl > MAX_FINANCIAL_TTL_SECONDS) {
+        return {
+            message: `Financial data cached with ${ttl}s TTL may cause stale data`,
+            severity: 'error',
+            suggestion: `Reduce TTL to ${MAX_FINANCIAL_TTL_SECONDS}s or less for financial data. Stale financial data can cause incorrect balances, payments, or escrow issues.`,
+            patternId: 'financial-ttl-too-long',
+        };
+    }
+    // Sensitive data with long TTL
+    if (isSensitiveData && ttl > MAX_TTL_SECONDS / 4) {
+        return {
+            message: `Sensitive data cached with ${ttl}s TTL may cause auth issues`,
+            severity: 'warning',
+            suggestion: `Consider reducing TTL to ${MAX_TTL_SECONDS / 4}s or less for sensitive data like sessions, tokens, or permissions to prevent stale authorization state.`,
+            patternId: 'sensitive-ttl-too-long',
+        };
+    }
+    // General data with excessive TTL
+    if (!isFinancialData && !isSensitiveData && ttl > MAX_TTL_SECONDS) {
+        return {
+            message: `TTL of ${ttl}s exceeds maximum recommended (${MAX_TTL_SECONDS}s)`,
+            severity: 'warning',
+            suggestion: `Reduce TTL to ${MAX_TTL_SECONDS}s (24 hours) or add a comment justifying the longer TTL for this specific use case.`,
+            patternId: 'ttl-too-long',
+        };
+    }
+    return null;
+}
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: resilience/cache-ttl-validation
+ *
+ * Validates cache TTL values to prevent:
+ * - Thundering herd (TTL too short)
+ * - Stale data issues (TTL too long for sensitive data)
+ * - Financial data cached inappropriately
+ */
+export const cacheTtlValidation = defineCheck({
+    id: 'a4d3b82d-d599-4ff1-be42-1313b1c11a70',
+    slug: 'cache-ttl-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    confidence: 'medium',
+    description: 'Validate cache TTL values for appropriate caching behavior',
+    longDescription: `**Purpose:** Validates that cache TTL values fall within safe ranges, with stricter limits for financial and sensitive data.
+
+**Detects:**
+- TTL assignments (\`ttl = N\` or \`ttl: N\`) in files containing cache/redis/ttl keywords
+- TTL < 5s (thundering herd risk)
+- TTL > 60s for financial data lines containing \`balance\`, \`wallet\`, \`payment\`, \`transaction\`, \`escrow\`, \`price\`, \`amount\`, \`credit\`, \`debit\`
+- TTL > 21600s for sensitive data lines containing \`session\`, \`token\`, \`auth\`, \`permission\`, \`role\`
+- TTL > 86400s (24h) for general data
+- Skips non-cache patterns like \`new Map()\`, \`new Set()\`, and metrics operations
+
+**Why it matters:** Incorrect TTLs cause thundering herd problems (too short) or serve dangerously stale financial/auth data (too long).
+
+**Scope:** General best practice. Analyzes each file individually via string parsing.`,
+    tags: ['resilience', 'cache', 'performance'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Test fixtures intentionally exercise TTL boundary cases (too short,
+        // too long, financial TTLs) to verify detection logic.
+        if (isTestFile(filePath))
+            return [];
+        logger.debug({
+            evt: 'fitness.checks.cache_ttl_validation.analyze',
+            msg: 'Analyzing file for cache TTL validation violations',
+        });
+        const violations = [];
+        // Skip files that don't have cache patterns
+        if (!hasCachePatterns(content)) {
+            return violations;
+        }
+        const lines = content.split('\n');
+        for (const [i, line] of lines.entries()) {
+            if (!line || isNonCachePattern(line)) {
+                continue;
+            }
+            const ttlResult = parseTtlFromLine(line);
+            if (!ttlResult)
+                continue;
+            const { ttl, matchText } = ttlResult;
+            const isFinancialData = isFinancialDataLine(line);
+            const isSensitiveData = isSensitiveDataLine(line);
+            const violation = detectTtlViolation(ttl, isFinancialData, isSensitiveData);
+            if (!violation)
+                continue;
+            const lineNumber = i + 1;
+            violations.push({
+                line: lineNumber,
+                column: 0,
+                message: violation.message,
+                severity: violation.severity,
+                suggestion: violation.suggestion,
+                match: matchText,
+                type: violation.patternId,
+                filePath,
+            });
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=cache-ttl-validation.js.map

package/dist/checks/resilience/cache-ttl-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-ttl-validation.js","sourceRoot":"","sources":["../../../src/checks/resilience/cache-ttl-validation.ts"],"names":[],"mappings":"AAAA,8HAA8H;AAC9H,+GAA+G;AAC/G;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AAEpF,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,6CAA6C;AACxE,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,oCAAoC;AACpE,MAAM,yBAAyB,GAAG,EAAE,CAAC,CAAC,sCAAsC;AAE5E,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,aAAa,GACjB,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,mBAAmB,GACvB,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QACjC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,kBAAkB,GACtB,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9F,OAAO,aAAa,IAAI,mBAAmB,IAAI,kBAAkB,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,YAAY,GAChB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,eAAe,IAAI,YAAY,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9E,MAAM,kBAAkB,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChG,OAAO,cAAc,IAAI,gBAAgB,IAAI,kBAAkB,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;GAEG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,yDAAyD;QAC9D,GAAG,EAAE,mDAAmD;KACzD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,kBAAkB;IAClB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,mBAAmB;IACnB,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,EAAE,CAAC;IAEJ,kBAAkB;IAClB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,eAAe;IACf,MAAM,UAAU,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,CAAC,EAAE,CAAC;IACN,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACjC,CAAC;IAED,2GAA2G;IAC3G,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;AACJ,CAAC;AAaD;;GAEG;AACH,SAAS,kBAAkB,CACzB,GAAW,EACX,eAAwB,EACxB,eAAwB;IAExB,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,0DAA0D;QAC/D,GAAG,EAAE,2DAA2D;KACjE,CAAC,CAAC;IACH,gBAAgB;IAChB,IAAI,GAAG,GAAG,eAAe,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,UAAU,GAAG,2CAA2C;YACjE,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,4BAA4B,eAAe,mFAAmF;YAC1I,SAAS,EAAE,eAAe;SAC3B,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,eAAe,IAAI,GAAG,GAAG,yBAAyB,EAAE,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,8BAA8B,GAAG,4BAA4B;YACtE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,iBAAiB,yBAAyB,8GAA8G;YACpK,SAAS,EAAE,wBAAwB;SACpC,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,eAAe,IAAI,GAAG,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,8BAA8B,GAAG,6BAA6B;YACvE,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,4BAA4B,eAAe,GAAG,CAAC,0GAA0G;YACrK,SAAS,EAAE,wBAAwB;SACpC,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,IAAI,GAAG,GAAG,eAAe,EAAE,CAAC;QAClE,OAAO;YACL,OAAO,EAAE,UAAU,GAAG,kCAAkC,eAAe,IAAI;YAC3E,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,iBAAiB,eAAe,qFAAqF;YACjI,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IAErE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,4DAA4D;IACzE,eAAe,EAAE;;;;;;;;;;;;sFAYmE;IACpF,IAAI,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC;IAC5C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,sEAAsE;QACtE,uDAAuD;QACvD,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,6CAA6C;YAClD,GAAG,EAAE,oDAAoD;SAC1D,CAAC,CAAC;QACH,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;YACrC,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,SAAS,CAAC,SAAS;gBACzB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/catch-clause-safety.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Catch clause safety check
+ */
+/**
+ * Check: resilience/catch-clause-safety
+ *
+ * Detects unsafe catch clause patterns:
+ * - `as Error` casts without instanceof guard
+ * - `catch(e: any)` explicit any annotation
+ */
+export declare const catchClauseSafety: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=catch-clause-safety.d.ts.map

package/dist/checks/resilience/catch-clause-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catch-clause-safety.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/catch-clause-safety.ts"],"names":[],"mappings":"AACA;;GAEG;AA2FH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,sCAoB5B,CAAC"}

package/dist/checks/resilience/catch-clause-safety.js

@@ -0,0 +1,110 @@
+// @fitness-ignore-file catch-clause-safety -- check definition contains pattern examples in description strings
+/**
+ * @fileoverview Catch clause safety check
+ */
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+/**
+ * Analyze catch clauses for unsafe patterns
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- Inherent complexity: multi-pattern catch clause analysis tracking brace depth, instanceof checks, and rethrow patterns
+function analyzeCatchSafety(content, filePath) {
+    const violations = [];
+    // Test fixtures intentionally use `catch (e: any)` and unguarded
+    // `as Error` casts to exercise detection logic.
+    if (isTestFile(filePath))
+        return violations;
+    const lines = content.split('\n');
+    // Quick check: skip files without catch
+    if (!content.includes('catch'))
+        return violations;
+    let inCatchBlock = false;
+    let catchBlockStart = 0;
+    let braceDepth = 0;
+    let catchHasInstanceofCheck = false;
+    let catchVarName = '';
+    for (const [i, line_] of lines.entries()) {
+        const line = line_ ?? '';
+        const trimmed = line.trim();
+        // Skip comments
+        if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        // Detect catch clause entry
+        const catchMatch = /\bcatch\s*\(\s*(\w+)(?:\s*:\s*(\w+))?\s*\)/.exec(line);
+        if (catchMatch) {
+            inCatchBlock = true;
+            catchBlockStart = i;
+            braceDepth = 0;
+            catchHasInstanceofCheck = false;
+            catchVarName = catchMatch[1] ?? 'error';
+            const typeAnnotation = catchMatch[2];
+            // Check for explicit `any` annotation: catch (e: any)
+            if (typeAnnotation === 'any') {
+                violations.push({
+                    line: i + 1,
+                    message: '`catch` variable explicitly typed as `any` — use `unknown` for type safety',
+                    severity: 'warning',
+                    suggestion: `Change \`catch (${catchVarName}: any)\` to \`catch (${catchVarName})\` (TypeScript defaults to unknown with useUnknownInCatchVariables)`,
+                    type: 'catch-any-annotation',
+                    match: trimmed.slice(0, 120),
+                });
+            }
+        }
+        if (inCatchBlock) {
+            // Track brace depth
+            for (const char of line) {
+                if (char === '{')
+                    braceDepth++;
+                if (char === '}')
+                    braceDepth--;
+            }
+            // Check for instanceof Error guard
+            if (line.includes('instanceof Error')) {
+                catchHasInstanceofCheck = true;
+            }
+            // Check for unsafe `as Error` cast
+            if (line.includes('as Error') && !catchHasInstanceofCheck) {
+                violations.push({
+                    line: i + 1,
+                    message: 'Unsafe `as Error` cast in catch block without `instanceof Error` guard — caught value may not be an Error',
+                    severity: 'warning',
+                    suggestion: `Use \`if (${catchVarName} instanceof Error)\` guard or normalize the error with a toError() utility`,
+                    type: 'unsafe-error-cast',
+                    match: trimmed.slice(0, 120),
+                });
+            }
+            // Exit catch block when braces close
+            if (braceDepth <= 0 && i > catchBlockStart) {
+                inCatchBlock = false;
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Check: resilience/catch-clause-safety
+ *
+ * Detects unsafe catch clause patterns:
+ * - `as Error` casts without instanceof guard
+ * - `catch(e: any)` explicit any annotation
+ */
+export const catchClauseSafety = defineCheck({
+    id: 'b0bae498-e01a-4eeb-ab5e-ab18776e3111',
+    slug: 'catch-clause-safety',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    description: 'Detects unsafe catch clause patterns: as Error casts without instanceof, catch(e: any)',
+    longDescription: `**Purpose:** Detects unsafe catch clause patterns that can cause runtime errors when the caught value is not actually an Error instance.
+
+**Detects:**
+- \`as Error\` type casts inside catch blocks without a preceding \`instanceof Error\` guard
+- \`catch (e: any)\` explicit any annotations instead of using unknown
+
+**Why it matters:** Caught values in JavaScript can be anything (string, number, object), not just Error instances. Unsafe casts can cause secondary runtime errors that mask the original problem.
+
+**Scope:** Production code. Analyzes each file individually via regex-based line scanning.`,
+    tags: ['errors', 'resilience', 'type-safety'],
+    fileTypes: ['ts', 'tsx'],
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    analyze: analyzeCatchSafety,
+});
+//# sourceMappingURL=catch-clause-safety.js.map

package/dist/checks/resilience/catch-clause-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catch-clause-safety.js","sourceRoot":"","sources":["../../../src/checks/resilience/catch-clause-safety.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AAEpF;;GAEG;AACH,kLAAkL;AAClL,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAC3D,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,iEAAiE;IACjE,gDAAgD;IAChD,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,wCAAwC;IACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,UAAU,CAAC;IAElD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gBAAgB;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElE,4BAA4B;QAC5B,MAAM,UAAU,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,GAAG,IAAI,CAAC;YACpB,eAAe,GAAG,CAAC,CAAC;YACpB,UAAU,GAAG,CAAC,CAAC;YACf,uBAAuB,GAAG,KAAK,CAAC;YAChC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;YACxC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAErC,sDAAsD;YACtD,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,4EAA4E;oBACrF,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,mBAAmB,YAAY,wBAAwB,YAAY,sEAAsE;oBACrJ,IAAI,EAAE,sBAAsB;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,oBAAoB;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,IAAI,KAAK,GAAG;oBAAE,UAAU,EAAE,CAAC;gBAC/B,IAAI,IAAI,KAAK,GAAG;oBAAE,UAAU,EAAE,CAAC;YACjC,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtC,uBAAuB,GAAG,IAAI,CAAC;YACjC,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC1D,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EACL,2GAA2G;oBAC7G,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,aAAa,YAAY,4EAA4E;oBACjH,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;YAED,qCAAqC;YACrC,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC;gBAC3C,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,WAAW,EACT,wFAAwF;IAC1F,eAAe,EAAE;;;;;;;;2FAQwE;IACzF,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC;IAC7C,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC"}

package/dist/checks/resilience/dangerous-config-defaults.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Dangerous configuration defaults check
+ */
+/**
+ * Check: resilience/dangerous-config-defaults
+ *
+ * Detects potentially dangerous configuration defaults that could
+ * compromise security or reliability.
+ */
+export declare const dangerousConfigDefaults: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=dangerous-config-defaults.d.ts.map

package/dist/checks/resilience/dangerous-config-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-config-defaults.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/dangerous-config-defaults.ts"],"names":[],"mappings":"AAGA;;GAEG;AAmTH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,sCAuDlC,CAAC"}