@orionscanner/cli 0.1.0

package/src/orion/engine/test_coverage/engine.py

@@ -0,0 +1,445 @@
+"""Test coverage heuristics engine - finds untested code and test quality issues."""
+import ast
+import re
+from pathlib import Path
+from typing import Dict, List, Set, Optional, Tuple
+from collections import defaultdict
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class TestCoverageEngine:
+    name = "test_coverage"
+    version = "1.0.0"
+
+    TEST_FILE_PATTERNS = [
+        "test_*.py",
+        "*_test.py",
+        "tests/*.py",
+        "test/**/*.py",
+    ]
+
+    EXCLUDED_DIRS = {"__pycache__", ".git", ".venv", "venv", "env", "node_modules", "dist", "build", "migrations"}
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
+        path = Path(filepath)
+        for part in path.parts:
+            if part in self.EXCLUDED_DIRS:
+                return True
+        if config.toggles.get("exclude"):
+            for pattern in config.toggles["exclude"]:
+                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
+                    return True
+        return False
+
+    def _is_test_file(self, filepath: str) -> bool:
+        path = Path(filepath)
+        name = path.name
+        return (
+            name.startswith("test_") or
+            name.endswith("_test.py") or
+            "tests" in path.parts or
+            "test" in path.parts
+        )
+
+    def _is_source_file(self, filepath: str) -> bool:
+        path = Path(filepath)
+        return path.suffix == ".py" and not self._is_test_file(filepath)
+
+    def _get_module_name(self, filepath: str, project_root: str) -> Optional[str]:
+        try:
+            path = Path(filepath).relative_to(Path(project_root))
+        except ValueError:
+            return None
+
+        if path.suffix == ".py":
+            path = path.with_suffix("")
+
+        parts = list(path.parts)
+        if parts and parts[-1] == "__init__":
+            parts = parts[:-1]
+
+        return ".".join(parts) if parts else None
+
+    def _extract_test_functions(self, content: str) -> List[Dict]:
+        """Extract test functions from test file."""
+        tests = []
+        try:
+            tree = ast.parse(content)
+            for node in ast.walk(tree):
+                if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                    if node.name.startswith("test_"):
+                        # Check for assertions
+                        has_assert = False
+                        mock_targets = []
+                        for n in ast.walk(node):
+                            if isinstance(n, ast.Assert):
+                                has_assert = True
+                            elif isinstance(n, ast.Call):
+                                # Check for mock.patch, unittest.mock, etc.
+                                if isinstance(n.func, ast.Attribute):
+                                    if n.func.attr in ("patch", "patch_object", "MagicMock", "Mock", "AsyncMock"):
+                                        if n.args:
+                                            for arg in n.args:
+                                                if isinstance(arg, ast.Constant):
+                                                    mock_targets.append(arg.value)
+                                elif isinstance(n.func, ast.Name):
+                                    if n.func.id in ("patch", "MagicMock", "Mock", "AsyncMock"):
+                                        if n.args:
+                                            for arg in n.args:
+                                                if isinstance(arg, ast.Constant):
+                                                    mock_targets.append(arg.value)
+                            elif isinstance(n, ast.With):
+                                for item in n.items:
+                                    if isinstance(item.context_expr, ast.Call):
+                                        if isinstance(item.context_expr.func, ast.Attribute):
+                                            if item.context_expr.func.attr in ("patch", "patch_object"):
+                                                if item.context_expr.args:
+                                                    for arg in item.context_expr.args:
+                                                        if isinstance(arg, ast.Constant):
+                                                            mock_targets.append(arg.value)
+
+                        tests.append({
+                            "name": node.name,
+                            "line": node.lineno,
+                            "end_line": getattr(node, 'end_lineno', node.lineno),
+                            "has_assert": has_assert,
+                            "mock_targets": mock_targets,
+                            "line_count": getattr(node, 'end_lineno', node.lineno) - node.lineno + 1,
+                        })
+        except SyntaxError:
+            pass
+        return tests
+
+    def _extract_source_symbols(self, content: str) -> Dict[str, List[Dict]]:
+        """Extract public functions/classes from source file."""
+        symbols = {"functions": [], "classes": [], "methods": []}
+        try:
+            tree = ast.parse(content)
+            for node in ast.walk(tree):
+                if isinstance(node, ast.FunctionDef):
+                    if not node.name.startswith("_"):
+                        symbols["functions"].append({
+                            "name": node.name,
+                            "line": node.lineno,
+                            "end_line": getattr(node, 'end_lineno', node.lineno),
+                            "args": [arg.arg for arg in node.args.args],
+                        })
+                elif isinstance(node, ast.AsyncFunctionDef):
+                    if not node.name.startswith("_"):
+                        symbols["functions"].append({
+                            "name": node.name,
+                            "line": node.lineno,
+                            "end_line": getattr(node, 'end_lineno', node.lineno),
+                            "args": [arg.arg for arg in node.args.args],
+                        })
+                elif isinstance(node, ast.ClassDef):
+                    if not node.name.startswith("_"):
+                        methods = []
+                        for item in node.body:
+                            if isinstance(item, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                                if not item.name.startswith("_"):
+                                    methods.append({
+                                        "name": item.name,
+                                        "line": item.lineno,
+                                        "end_line": getattr(item, 'end_lineno', item.lineno),
+                                    })
+                        symbols["classes"].append({
+                            "name": node.name,
+                            "line": node.lineno,
+                            "end_line": getattr(node, 'end_lineno', node.lineno),
+                            "methods": methods,
+                        })
+        except SyntaxError:
+            pass
+        return symbols
+
+    def _extract_imports(self, content: str) -> List[str]:
+        imports = []
+        try:
+            tree = ast.parse(content)
+            for node in ast.walk(tree):
+                if isinstance(node, ast.Import):
+                    for alias in node.names:
+                        imports.append(alias.name)
+                elif isinstance(node, ast.ImportFrom):
+                    if node.module:
+                        for alias in node.names:
+                            imports.append(f"{node.module}.{alias.name}")
+        except SyntaxError:
+            pass
+        return imports
+
+    def _map_tests_to_source(self, test_files: Dict[str, List[Dict]], source_files: Dict[str, Dict]) -> Dict[str, Set[str]]:
+        """Map test functions to source symbols they likely test."""
+        mapping = defaultdict(set)  # source_symbol -> set of test names
+
+        for test_file, tests in test_files.items():
+            for test in tests:
+                test_name = test["name"]
+                # Heuristic 1: naming convention test_foo -> foo
+                match = re.match(r"test_(\w+)", test_name)
+                if match:
+                    target = match.group(1)
+                    for src_file, symbols in source_files.items():
+                        for func in symbols["functions"]:
+                            if func["name"] == target or func["name"].endswith("_" + target):
+                                mapping[f"{src_file}:{func['name']}"].add(f"{test_file}:{test_name}")
+                        for cls in symbols["classes"]:
+                            if cls["name"].lower() == target or cls["name"].lower() == target.capitalize():
+                                mapping[f"{src_file}:{cls['name']}"].add(f"{test_file}:{test_name}")
+                                for method in cls["methods"]:
+                                    mapping[f"{src_file}:{cls['name']}.{method['name']}"].add(f"{test_file}:{test_name}")
+
+                # Heuristic 2: mock targets
+                for mock_target in test.get("mock_targets", []):
+                    for src_file, symbols in source_files.items():
+                        for func in symbols["functions"]:
+                            if mock_target.endswith(func["name"]) or func["name"] in mock_target:
+                                mapping[f"{src_file}:{func['name']}"].add(f"{test_file}:{test_name}")
+                        for cls in symbols["classes"]:
+                            if mock_target.endswith(cls["name"]) or cls["name"] in mock_target:
+                                mapping[f"{src_file}:{cls['name']}"].add(f"{test_file}:{test_name}")
+                                for method in cls["methods"]:
+                                    if mock_target.endswith(method["name"]):
+                                        mapping[f"{src_file}:{cls['name']}.{method['name']}"].add(f"{test_file}:{test_name}")
+
+                # Heuristic 3: imports in test file
+                try:
+                    test_ir = test_files.get(test_file, {})
+                except:
+                    pass
+
+        return mapping
+
+    def _check_conftest(self, all_files: Dict[str, OrionIR], project_root: str) -> List[Finding]:
+        findings = []
+        test_dirs = set()
+        for filepath in all_files:
+            path = Path(filepath)
+            if self._is_test_file(filepath):
+                test_dirs.add(str(path.parent))
+
+        for test_dir in test_dirs:
+            conftest_path = Path(test_dir) / "conftest.py"
+            if not conftest_path.exists():
+                # Check if there are test files in this dir
+                has_tests = any(
+                    self._is_test_file(f) and str(Path(f).parent) == test_dir
+                    for f in all_files
+                )
+                if has_tests:
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="low",
+                        title=f"Missing conftest.py in test directory",
+                        description=f"Test directory '{test_dir}' has tests but no conftest.py for shared fixtures",
+                        location=str(conftest_path),
+                        metadata={
+                            "rule": "missing_conftest",
+                            "directory": test_dir,
+                        },
+                    ))
+        return findings
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        project_root = ir.metadata.get("project_root", ".")
+        all_files = ir.metadata.get("all_files", {})
+
+        if not all_files:
+            return EngineResult(engine=self.name, ok=True, metrics={"mode": "single_file"})
+
+        # Separate test and source files
+        test_files_content = {}
+        source_files_content = {}
+
+        for filepath, file_ir in all_files.items():
+            if self._should_exclude(filepath, config):
+                continue
+
+            try:
+                content = file_ir.content.decode("utf-8", errors="replace")
+            except Exception:
+                continue
+
+            if self._is_test_file(filepath):
+                test_files_content[filepath] = content
+            elif self._is_source_file(filepath):
+                source_files_content[filepath] = content
+
+        # Extract test functions
+        test_functions = {}
+        for filepath, content in test_files_content.items():
+            tests = self._extract_test_functions(content)
+            if tests:
+                test_functions[filepath] = tests
+
+        # Extract source symbols
+        source_symbols = {}
+        for filepath, content in source_files_content.items():
+            symbols = self._extract_source_symbols(content)
+            if symbols["functions"] or symbols["classes"]:
+                source_symbols[filepath] = symbols
+
+        # Map tests to source
+        test_to_source = self._map_tests_to_source(test_functions, source_symbols)
+
+        all_findings = []
+
+        # 1. Find untested public functions/classes
+        for src_file, symbols in source_symbols.items():
+            for func in symbols["functions"]:
+                key = f"{src_file}:{func['name']}"
+                if key not in test_to_source:
+                    all_findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Untested public function: {func['name']}",
+                        description=f"Public function '{func['name']}' has no corresponding test",
+                        location=f"{src_file}:{func['line']}",
+                        metadata={
+                            "rule": "untested_function",
+                            "untested_function": func["name"],
+                            "file": src_file,
+                            "line": func["line"],
+                            "type": "function",
+                        },
+                    ))
+
+            for cls in symbols["classes"]:
+                key = f"{src_file}:{cls['name']}"
+                if key not in test_to_source:
+                    all_findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Untested public class: {cls['name']}",
+                        description=f"Public class '{cls['name']}' has no corresponding test",
+                        location=f"{src_file}:{cls['line']}",
+                        metadata={
+                            "rule": "untested_class",
+                            "untested_function": cls["name"],
+                            "file": src_file,
+                            "line": cls["line"],
+                            "type": "class",
+                        },
+                    ))
+                for method in cls["methods"]:
+                    key = f"{src_file}:{cls['name']}.{method['name']}"
+                    if key not in test_to_source:
+                        all_findings.append(Finding(
+                            engine=self.name,
+                            severity="low",
+                            title=f"Untested public method: {cls['name']}.{method['name']}",
+                            description=f"Public method '{cls['name']}.{method['name']}' has no corresponding test",
+                            location=f"{src_file}:{method['line']}",
+                            metadata={
+                                "rule": "untested_method",
+                                "untested_function": f"{cls['name']}.{method['name']}",
+                                "file": src_file,
+                                "line": method["line"],
+                                "type": "method",
+                            },
+                        ))
+
+        # 2. Test files with no assertions
+        for test_file, tests in test_functions.items():
+            for test in tests:
+                if not test["has_assert"] and test["mock_targets"]:
+                    all_findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Test only mocks, no assertions: {test['name']}",
+                        description=f"Test '{test['name']}' uses mocks but has no assertions",
+                        location=f"{test_file}:{test['line']}",
+                        metadata={
+                            "rule": "test_only_mocks",
+                            "test": test["name"],
+                            "file": test_file,
+                            "line": test["line"],
+                            "mocks": test["mock_targets"],
+                        },
+                    ))
+                elif not test["has_assert"] and not test["mock_targets"]:
+                    all_findings.append(Finding(
+                        engine=self.name,
+                        severity="low",
+                        title=f"Test has no assertions: {test['name']}",
+                        description=f"Test '{test['name']}' has no assertions",
+                        location=f"{test_file}:{test['line']}",
+                        metadata={
+                            "rule": "test_no_assertions",
+                            "test": test["name"],
+                            "file": test_file,
+                            "line": test["line"],
+                        },
+                    ))
+
+        # 3. Long test functions (likely integration tests)
+        for test_file, tests in test_functions.items():
+            for test in tests:
+                if test["line_count"] > 50:
+                    all_findings.append(Finding(
+                        engine=self.name,
+                        severity="low",
+                        title=f"Long test function: {test['name']} ({test['line_count']} lines)",
+                        description=f"Test function exceeds 50 lines - likely an integration test",
+                        location=f"{test_file}:{test['line']}",
+                        metadata={
+                            "rule": "long_test_function",
+                            "test": test["name"],
+                            "file": test_file,
+                            "line": test["line"],
+                            "line_count": test["line_count"],
+                        },
+                    ))
+
+        # 4. Missing conftest.py
+        all_findings.extend(self._check_conftest(all_files, project_root))
+
+        # 5. Test files that don't import any source code
+        for test_file, content in test_files_content.items():
+            imports = self._extract_imports(content)
+            imports_source = any(
+                any(src_file.replace("/", ".").replace(".py", "") in imp for src_file in source_files_content)
+                for imp in imports
+            )
+            if not imports_source and test_functions.get(test_file):
+                all_findings.append(Finding(
+                    engine=self.name,
+                    severity="low",
+                    title=f"Test file doesn't import source code: {Path(test_file).name}",
+                    description=f"Test file may not be testing actual source code",
+                    location=test_file,
+                    metadata={
+                        "rule": "test_no_source_imports",
+                        "file": test_file,
+                        "imports": imports,
+                    },
+                ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=all_findings,
+            ok=True,
+            metrics={
+                "source_files": len(source_files_content),
+                "test_files": len(test_files_content),
+                "test_functions": sum(len(t) for t in test_functions.values()),
+                "source_functions": sum(len(s["functions"]) for s in source_symbols.values()),
+                "source_classes": sum(len(s["classes"]) for s in source_symbols.values()),
+                "mapped_tests": len(test_to_source),
+                "findings_count": len(all_findings),
+            },
+        )
+
+
+Engine = TestCoverageEngine

package/src/orion/engine/threat_model/engine.py

@@ -0,0 +1,126 @@
+"""ThreatPulse™ - Automated In-House STRIDE & Trust Boundary Threat Modeling Engine.
+
+100% Proprietary In-House IP for Commercial Architecture & Threat Governance.
+"""
+
+import ast
+import re
+from pathlib import Path
+from typing import List, Dict, Any, Set
+
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class ThreatModelEngine:
+    name = "threat_model"
+    version = "1.0.0"
+
+    ENTRYPOINT_PATTERNS = [
+        re.compile(r"@(?:app|router|blueprint)\.(?:route|get|post|put|delete|patch)\s*\(", re.IGNORECASE),
+        re.compile(r"def\s+(?:handle_|process_|on_|api_|webhook_)[a-zA-Z0-9_]*\s*\(", re.IGNORECASE),
+        re.compile(r"(?:express|fastify|koa)\.(?:get|post|put|delete|use)\s*\(", re.IGNORECASE),
+    ]
+
+    UNAUTHENTICATED_PATTERNS = [
+        re.compile(r"@(?:allow_anonymous|public_route|no_auth|skip_auth|permit_all)", re.IGNORECASE),
+        re.compile(r"auth(?:entication)?\s*=\s*(?:False|None|0|'none'|\"none\")", re.IGNORECASE),
+    ]
+
+    DATA_STORE_PATTERNS = [
+        re.compile(r"(?:db|database|session|cursor|repository)\.(?:execute|query|raw|commit|save|delete)\s*\(", re.IGNORECASE),
+        re.compile(r"(?:mongoose|prisma|typeorm|sequelize)\.(?:find|create|update|delete)\s*\(", re.IGNORECASE),
+    ]
+
+    EXTERNAL_IO_PATTERNS = [
+        re.compile(r"(?:requests|httpx|urllib|fetch|axios)\.(?:get|post|put|delete|request)\s*\(", re.IGNORECASE),
+        re.compile(r"(?:socket|boto3|azure|gcp|sns|sqs|kafka|redis)\.", re.IGNORECASE),
+    ]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=45, max_memory_mb=128)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        filepath = ir.metadata.get("path", "unknown")
+        findings: List[Finding] = []
+
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+
+        lines = content.splitlines()
+
+        # 1. Unauthenticated Public Entrypoints (STRIDE: Spoofing / Elevation of Privilege)
+        for i, line in enumerate(lines, 1):
+            for pat in self.UNAUTHENTICATED_PATTERNS:
+                if pat.search(line):
+                    snippet = line.strip()
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"STRIDE Threat: Unauthenticated Entrypoint Boundary",
+                        description=f"Publicly accessible entrypoint '{snippet}' bypasses authentication middleware, creating risk of Elevation of Privilege or Spoofing",
+                        location=f"{filepath}:{i}",
+                        metadata={
+                            "threat_category": "STRIDE-Elevation-Of-Privilege",
+                            "trust_boundary": "External-to-Internal",
+                            "cwe": "CWE-306",
+                            "snippet": snippet,
+                            "confidence": 0.85,
+                        },
+                    ))
+
+        # 2. Raw Database Queries across Boundaries (STRIDE: Tampering / Information Disclosure)
+        for i, line in enumerate(lines, 1):
+            for pat in self.DATA_STORE_PATTERNS:
+                if pat.search(line) and ("where" in line.lower() or "select" in line.lower() or "exec" in line.lower()):
+                    snippet = line.strip()
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"STRIDE Threat: Direct Data Store Trust Crossing",
+                        description=f"Direct persistence query '{snippet}' crosses data boundary without ORM abstraction layer",
+                        location=f"{filepath}:{i}",
+                        metadata={
+                            "threat_category": "STRIDE-Tampering",
+                            "trust_boundary": "Application-to-DataStore",
+                            "cwe": "CWE-89",
+                            "snippet": snippet,
+                            "confidence": 0.80,
+                        },
+                    ))
+
+        # 3. External Network & Integration Boundaries (STRIDE: Denial of Service / Repudiation)
+        for i, line in enumerate(lines, 1):
+            for pat in self.EXTERNAL_IO_PATTERNS:
+                if pat.search(line) and "timeout" not in line.lower():
+                    snippet = line.strip()
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="low",
+                        title=f"STRIDE Threat: Unbounded External Service Call",
+                        description=f"External network call without explicit timeout creates cascading Denial of Service risk across microservice boundaries",
+                        location=f"{filepath}:{i}",
+                        metadata={
+                            "threat_category": "STRIDE-Denial-Of-Service",
+                            "trust_boundary": "Internal-to-External-ThirdParty",
+                            "cwe": "CWE-400",
+                            "snippet": snippet,
+                            "confidence": 0.75,
+                        },
+                    ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={"file": filepath, "threat_checks_completed": 3, "findings_count": len(findings)},
+        )
+
+
+Engine = ThreatModelEngine