@preflight-agent/cli 0.1.0

package/dist/checks/api.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runApiChecks = runApiChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runApiChecks(dir) {
+    const results = [];
+    const apiFiles = await (0, glob_1.glob)(`${dir}/src/app/api/**/*.ts`, {
+        ignore: ['**/node_modules/**']
+    });
+    if (apiFiles.length === 0) {
+        const altFiles = await (0, glob_1.glob)(`${dir}/pages/api/**/*.ts`, { ignore: ['**/node_modules/**'] });
+        if (altFiles.length === 0) {
+            results.push({ status: 'warn', message: 'No API routes found \u2014 skipping API checks' });
+            return results;
+        }
+        apiFiles.push(...altFiles);
+    }
+    let validatedRoutes = 0;
+    const unvalidatedRoutes = [];
+    for (const file of apiFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const hasPOST = content.includes('POST') || content.includes('req.body') || content.includes('request.json()');
+        const hasValidation = content.includes('z.object') ||
+            content.includes('yup.object') ||
+            content.includes('v.object') ||
+            content.includes('.parse(') ||
+            content.includes('.safeParse(') ||
+            content.includes('.validate(');
+        if (hasPOST && hasValidation) {
+            validatedRoutes++;
+        }
+        else if (hasPOST && !hasValidation) {
+            unvalidatedRoutes.push(path_1.default.relative(dir, file));
+        }
+    }
+    if (unvalidatedRoutes.length === 0) {
+        results.push({ status: 'pass', message: 'Input validation (Zod/Yup) found on POST routes' });
+    }
+    else {
+        results.push({
+            status: 'warn',
+            message: `${unvalidatedRoutes.length} POST route${unvalidatedRoutes.length > 1 ? 's' : ''} missing input validation`,
+        });
+        for (const route of unvalidatedRoutes.slice(0, 2)) {
+            results.push({ status: 'warn', message: 'No input validation detected', file: route });
+        }
+    }
+    const allFiles = await (0, glob_1.glob)(`${dir}/src/**/*.ts`, { ignore: ['**/node_modules/**'] });
+    const hasRateLimit = allFiles.some(file => {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        return (content.includes('ratelimit') ||
+            content.includes('rate-limit') ||
+            content.includes('upstash') ||
+            content.includes('redis') ||
+            content.includes('limiter'));
+    });
+    results.push(hasRateLimit
+        ? { status: 'pass', message: 'Rate limiting detected' }
+        : { status: 'warn', message: 'No rate limiting found \u2014 your API is open to abuse' });
+    return results;
+}

package/dist/checks/auth.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuthChecks = runAuthChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runAuthChecks(dir) {
+    const results = [];
+    const middlewarePaths = [
+        path_1.default.join(dir, 'middleware.ts'),
+        path_1.default.join(dir, 'src/middleware.ts'),
+        path_1.default.join(dir, 'middleware.js'),
+    ];
+    const hasMiddleware = middlewarePaths.some(fs_1.default.existsSync);
+    if (hasMiddleware) {
+        results.push({ status: 'pass', message: 'Auth middleware file found' });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No middleware.ts found \u2014 protected routes may be unsecured' });
+    }
+    const envExamplePath = path_1.default.join(dir, '.env.example');
+    if (fs_1.default.existsSync(envExamplePath)) {
+        const envExample = fs_1.default.readFileSync(envExamplePath, 'utf-8');
+        const hasAuthSecret = envExample.includes('JWT_SECRET') ||
+            envExample.includes('NEXTAUTH_SECRET') ||
+            envExample.includes('AUTH_SECRET');
+        if (hasAuthSecret) {
+            results.push({ status: 'pass', message: 'Auth secret documented in .env.example' });
+        }
+        else {
+            results.push({ status: 'warn', message: 'No JWT_SECRET or NEXTAUTH_SECRET in .env.example' });
+        }
+    }
+    const apiFiles = await (0, glob_1.glob)(`${dir}/src/app/api/**/*.ts`, { ignore: ['**/node_modules/**'] });
+    const suspiciousRoutes = [];
+    for (const file of apiFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const hasAuthCheck = content.includes('getServerSession') ||
+            content.includes('auth()') ||
+            content.includes('verifyToken') ||
+            content.includes('supabase.auth') ||
+            content.includes('requireAuth') ||
+            content.includes('middleware');
+        const looksPrivate = content.includes('userId') ||
+            content.includes('user_id') ||
+            content.includes('DELETE') ||
+            content.includes('UPDATE') ||
+            file.includes('/admin/') ||
+            file.includes('/user/') ||
+            file.includes('/profile/');
+        if (looksPrivate && !hasAuthCheck) {
+            suspiciousRoutes.push(path_1.default.relative(dir, file));
+        }
+    }
+    if (suspiciousRoutes.length > 0) {
+        for (const route of suspiciousRoutes.slice(0, 3)) {
+            results.push({
+                status: 'warn',
+                message: 'No auth check detected in route that may require it',
+                file: route,
+            });
+        }
+    }
+    else if (apiFiles.length > 0) {
+        results.push({ status: 'pass', message: 'Auth checks found in API routes' });
+    }
+    return results;
+}

package/dist/checks/database.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDatabaseChecks = runDatabaseChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runDatabaseChecks(dir) {
+    const results = [];
+    const migrationFiles = await (0, glob_1.glob)(`${dir}/**/*.sql`, {
+        ignore: ['**/node_modules/**']
+    });
+    const supabaseDirs = [
+        path_1.default.join(dir, 'supabase'),
+        path_1.default.join(dir, 'src/supabase'),
+    ];
+    const hasSupabaseDir = supabaseDirs.some(fs_1.default.existsSync);
+    if (hasSupabaseDir || migrationFiles.length > 0) {
+        let hasRLS = false;
+        for (const file of migrationFiles) {
+            const content = fs_1.default.readFileSync(file, 'utf-8');
+            if (content.toLowerCase().includes('row level security') || content.toLowerCase().includes('enable rls')) {
+                hasRLS = true;
+                break;
+            }
+        }
+        results.push(hasRLS
+            ? { status: 'pass', message: 'Row Level Security (RLS) enabled in migrations' }
+            : { status: 'fail', message: 'No RLS policies found in SQL migrations \u2014 your database may be fully open' });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No SQL migrations found \u2014 skipping RLS check' });
+    }
+    const envExamplePath = path_1.default.join(dir, '.env.example');
+    if (fs_1.default.existsSync(envExamplePath)) {
+        const env = fs_1.default.readFileSync(envExamplePath, 'utf-8');
+        if (env.includes('DATABASE_URL') || env.includes('SUPABASE_URL') || env.includes('NEXT_PUBLIC_SUPABASE_URL')) {
+            results.push({ status: 'pass', message: 'Database URL documented in .env.example' });
+        }
+        else {
+            results.push({ status: 'warn', message: 'No database URL found in .env.example' });
+        }
+    }
+    return results;
+}

package/dist/checks/graphql.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGraphqlChecks = runGraphqlChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runGraphqlChecks(dir) {
+    const results = [];
+    const gqlFiles = await (0, glob_1.glob)(`${dir}/**/*.{graphql,gql}`, { ignore: ['**/node_modules/**'] });
+    const gqlTsFiles = await (0, glob_1.glob)(`${dir}/src/**/*.ts`, { ignore: ['**/node_modules/**'] });
+    const allGqlFiles = [...gqlFiles, ...gqlTsFiles.filter(f => {
+            const content = fs_1.default.readFileSync(f, 'utf-8');
+            return content.includes('graphql') || content.includes('GraphQL') || content.includes('gql`') || content.includes('apollo') || content.includes('urql');
+        })];
+    if (allGqlFiles.length === 0) {
+        results.push({ status: 'warn', message: 'No GraphQL files detected \u2014 skipping GraphQL checks' });
+        return results;
+    }
+    let hasDepthLimit = false;
+    let depthFile;
+    for (const file of allGqlFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('depthLimit') ||
+            content.includes('queryDepth') ||
+            content.includes('maxDepth') ||
+            content.includes('validationRules') ||
+            content.includes('complexity')) {
+            hasDepthLimit = true;
+            depthFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    if (hasDepthLimit) {
+        results.push({ status: 'pass', message: 'GraphQL query depth limiting found', file: depthFile });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No GraphQL depth limiting found \u2014 malicious queries can exhaust your server' });
+    }
+    let hasAuth = false;
+    let authFile;
+    for (const file of allGqlFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('context') && (content.includes('token') ||
+            content.includes('auth') ||
+            content.includes('session') ||
+            content.includes('bearer'))) {
+            hasAuth = true;
+            authFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    if (hasAuth) {
+        results.push({ status: 'pass', message: 'GraphQL authentication context found', file: authFile });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No GraphQL auth context detected \u2014 your GraphQL endpoint may be public' });
+    }
+    let introspectionDisabled = false;
+    for (const file of allGqlFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('introspection') && (content.includes('false') || content.includes('disabled') || content.includes('0'))) {
+            introspectionDisabled = true;
+            break;
+        }
+    }
+    results.push(introspectionDisabled
+        ? { status: 'pass', message: 'GraphQL introspection disabled in production' }
+        : { status: 'warn', message: 'GraphQL introspection may be enabled \u2014 attackers can discover your entire schema' });
+    return results;
+}

package/dist/checks/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVulnerabilityChecks = exports.runRealtimeChecks = exports.runGraphqlChecks = exports.runWebChecks = exports.runApiChecks = exports.runDatabaseChecks = exports.runPaymentChecks = exports.runAuthChecks = exports.runSecurityChecks = void 0;
+var security_1 = require("./security");
+Object.defineProperty(exports, "runSecurityChecks", { enumerable: true, get: function () { return security_1.runSecurityChecks; } });
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "runAuthChecks", { enumerable: true, get: function () { return auth_1.runAuthChecks; } });
+var payments_1 = require("./payments");
+Object.defineProperty(exports, "runPaymentChecks", { enumerable: true, get: function () { return payments_1.runPaymentChecks; } });
+var database_1 = require("./database");
+Object.defineProperty(exports, "runDatabaseChecks", { enumerable: true, get: function () { return database_1.runDatabaseChecks; } });
+var api_1 = require("./api");
+Object.defineProperty(exports, "runApiChecks", { enumerable: true, get: function () { return api_1.runApiChecks; } });
+var web_1 = require("./web");
+Object.defineProperty(exports, "runWebChecks", { enumerable: true, get: function () { return web_1.runWebChecks; } });
+var graphql_1 = require("./graphql");
+Object.defineProperty(exports, "runGraphqlChecks", { enumerable: true, get: function () { return graphql_1.runGraphqlChecks; } });
+var realtime_1 = require("./realtime");
+Object.defineProperty(exports, "runRealtimeChecks", { enumerable: true, get: function () { return realtime_1.runRealtimeChecks; } });
+var vulnerabilities_1 = require("./vulnerabilities");
+Object.defineProperty(exports, "runVulnerabilityChecks", { enumerable: true, get: function () { return vulnerabilities_1.runVulnerabilityChecks; } });

package/dist/checks/payments.js

@@ -0,0 +1,76 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPaymentChecks = runPaymentChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runPaymentChecks(dir) {
+    const results = [];
+    const webhookFiles = await (0, glob_1.glob)(`${dir}/**/{webhook,webhooks,mpesa,stripe,payment}/**/*.{ts,tsx,js}`, { ignore: ['**/node_modules/**', '**/.next/**'] });
+    const apiFiles = await (0, glob_1.glob)(`${dir}/src/app/api/**/*.ts`, { ignore: ['**/node_modules/**'] });
+    const allFiles = [...new Set([...webhookFiles, ...apiFiles])];
+    const paymentRelatedFiles = allFiles.filter(f => /webhook|stripe|mpesa|payment|daraja|stk/i.test(f));
+    if (paymentRelatedFiles.length === 0) {
+        results.push({ status: 'warn', message: 'No payment-related files detected \u2014 skipping payment checks' });
+        return results;
+    }
+    let hasSignatureValidation = false;
+    let signatureFile;
+    for (const file of paymentRelatedFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('constructEvent') ||
+            content.includes('stripe.webhooks') ||
+            content.includes('X-Mpesa-Signature') ||
+            content.includes('validateWebhook') ||
+            content.includes('verifySignature') ||
+            content.includes('crypto.timingSafeEqual') ||
+            content.includes('hmac')) {
+            hasSignatureValidation = true;
+            signatureFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    if (hasSignatureValidation) {
+        results.push({ status: 'pass', message: 'Webhook signature validation found', file: signatureFile });
+    }
+    else {
+        const firstFile = path_1.default.relative(dir, paymentRelatedFiles[0]);
+        results.push({
+            status: 'fail',
+            message: 'No webhook signature validation found \u2014 anyone can fake payment events',
+            file: firstFile,
+        });
+    }
+    let hasErrorHandling = false;
+    for (const file of paymentRelatedFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('try') && content.includes('catch')) {
+            hasErrorHandling = true;
+            break;
+        }
+    }
+    if (hasErrorHandling) {
+        results.push({ status: 'pass', message: 'Error handling (try/catch) found in payment routes' });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No try/catch found in payment files \u2014 unhandled failures will crash' });
+    }
+    let hasIdempotency = false;
+    for (const file of paymentRelatedFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('idempotencyKey') ||
+            content.includes('idempotency_key') ||
+            content.includes('TransactionID') ||
+            content.includes('CheckoutRequestID')) {
+            hasIdempotency = true;
+            break;
+        }
+    }
+    results.push(hasIdempotency
+        ? { status: 'pass', message: 'Idempotency keys found in payment flow' }
+        : { status: 'warn', message: 'No idempotency keys detected \u2014 duplicate payments may occur' });
+    return results;
+}

package/dist/checks/realtime.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRealtimeChecks = runRealtimeChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runRealtimeChecks(dir) {
+    const results = [];
+    const tsFiles = await (0, glob_1.glob)(`${dir}/src/**/*.ts`, { ignore: ['**/node_modules/**', '**/.next/**'] });
+    const realtimeFiles = tsFiles.filter(f => {
+        const content = fs_1.default.readFileSync(f, 'utf-8');
+        return (content.includes('websocket') ||
+            content.includes('WebSocket') ||
+            content.includes('ws://') ||
+            content.includes('wss://') ||
+            content.includes('socket') ||
+            content.includes('subscription') ||
+            content.includes('realtime') ||
+            content.includes('supabase') && content.includes('channel') ||
+            content.includes('broadcast') ||
+            content.includes('presence'));
+    });
+    if (realtimeFiles.length === 0) {
+        results.push({ status: 'warn', message: 'No real-time features detected \u2014 skipping real-time checks' });
+        return results;
+    }
+    let hasCleanup = false;
+    let cleanupFile;
+    for (const file of realtimeFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('unsubscribe') ||
+            content.includes('unmount') ||
+            content.includes('cleanup') ||
+            content.includes('disconnect') ||
+            content.includes('removeChannel') ||
+            content.includes('destroy') ||
+            content.includes('close()')) {
+            hasCleanup = true;
+            cleanupFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    if (hasCleanup) {
+        results.push({ status: 'pass', message: 'Real-time connection cleanup found', file: cleanupFile });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No real-time cleanup detected \u2014 connections may leak and cause memory issues' });
+    }
+    let hasReconnect = false;
+    for (const file of realtimeFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('reconnect') ||
+            content.includes('retry') ||
+            content.includes('backoff')) {
+            hasReconnect = true;
+            break;
+        }
+    }
+    results.push(hasReconnect
+        ? { status: 'pass', message: 'Reconnection logic found for real-time connections' }
+        : { status: 'warn', message: 'No reconnection logic detected \u2014 temporary network issues will drop connections permanently' });
+    let hasAuth = false;
+    for (const file of realtimeFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('token') ||
+            content.includes('auth') && (content.includes('channel') || content.includes('socket')) ||
+            content.includes('accessToken')) {
+            hasAuth = true;
+            break;
+        }
+    }
+    results.push(hasAuth
+        ? { status: 'pass', message: 'Authentication found on real-time connections' }
+        : { status: 'warn', message: 'No authentication detected on real-time channels \u2014 anyone can connect' });
+    return results;
+}

package/dist/checks/security.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecurityChecks = runSecurityChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+const DANGEROUS_PATTERNS = [
+    { pattern: /supabase.*service_role/i, label: 'Supabase service role key' },
+    { pattern: /sk-[a-zA-Z0-9]{20,}/, label: 'OpenAI API key' },
+    { pattern: /STRIPE_SECRET_KEY/, label: 'Stripe secret key' },
+    { pattern: /ANTHROPIC_API_KEY/, label: 'Anthropic API key' },
+    { pattern: /Consumer_Secret/i, label: 'M-Pesa consumer secret' },
+];
+const CLIENT_SIDE_DIRS = ['components', 'app', 'pages', 'src/app', 'src/pages', 'src/components', 'src/lib'];
+async function runSecurityChecks(dir) {
+    const results = [];
+    const gitignorePath = path_1.default.join(dir, '.gitignore');
+    if (fs_1.default.existsSync(gitignorePath)) {
+        const gitignore = fs_1.default.readFileSync(gitignorePath, 'utf-8');
+        if (gitignore.includes('.env')) {
+            results.push({ status: 'pass', message: '.env is gitignored' });
+        }
+        else {
+            results.push({ status: 'fail', message: '.env is NOT gitignored \u2014 your secrets will be committed' });
+        }
+    }
+    else {
+        results.push({ status: 'warn', message: 'No .gitignore found' });
+    }
+    const envExamplePath = path_1.default.join(dir, '.env.example');
+    if (fs_1.default.existsSync(envExamplePath)) {
+        results.push({ status: 'pass', message: '.env.example exists' });
+    }
+    else {
+        results.push({ status: 'warn', message: 'No .env.example \u2014 collaborators won\'t know what vars to set' });
+    }
+    const clientFiles = [];
+    for (const clientDir of CLIENT_SIDE_DIRS) {
+        const fullDir = path_1.default.join(dir, clientDir);
+        if (fs_1.default.existsSync(fullDir)) {
+            const files = await (0, glob_1.glob)(`${fullDir}/**/*.{ts,tsx,js,jsx}`, { ignore: ['**/node_modules/**'] });
+            clientFiles.push(...files);
+        }
+    }
+    for (const file of clientFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const lines = content.split('\n');
+        for (const { pattern, label } of DANGEROUS_PATTERNS) {
+            for (let i = 0; i < lines.length; i++) {
+                if (pattern.test(lines[i]) && !lines[i].trim().startsWith('//') && !lines[i].trim().startsWith('*')) {
+                    const relativePath = path_1.default.relative(dir, file);
+                    results.push({
+                        status: 'fail',
+                        message: `${label} found in client-side code`,
+                        file: relativePath,
+                        line: i + 1,
+                    });
+                }
+            }
+        }
+    }
+    if (clientFiles.length > 0 && !results.some(r => r.status === 'fail' && r.message.includes('found in client-side'))) {
+        results.push({ status: 'pass', message: 'No dangerous secrets found in client-side code' });
+    }
+    return results;
+}