@qa-ai-stlc/runner-security 0.0.0-stage → 1.7.0

package/dist/checks/secrets-check.js

@@ -0,0 +1,113 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { scanForSecrets } from '@qa-ai-stlc/core';
+import { buildFinding } from '../finding.js';
+import { MAX_CITED_LINES_PER_FILE, isTestOrFixturePath, scannableLines } from './code-check-support.js';
+// Shapes `scanForSecrets` does not cover. A hard-coded fallback such as `process.env.X ?? 'literal'`
+// still ships the literal whenever the variable is unset, so it counts the same as a plain literal.
+const LOCAL_SECRET_PATTERNS = [
+    { name: 'private-key', regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/u },
+    {
+        name: 'hardcoded-secret',
+        regex: /\b\w*secret\w*["']?\s*[:=]\s*(?:[^'"\n]*(?:\?\?|\|\|)\s*)?["']([^"'\s]{8,})["']/iu,
+        literalGroup: 1,
+    },
+];
+// Names of environment variables (`QA_ADMIN_PASSWORD`) are how the project is told to hold a secret,
+// not a secret.
+const ENVIRONMENT_VARIABLE_NAME = /^[A-Z][A-Z0-9_]*$/u;
+const PROVIDER_SHAPED = new Set([
+    'aws-access-key-id',
+    'github-token',
+    'slack-token',
+    'private-key',
+]);
+function findHits(lineText) {
+    const names = scanForSecrets(lineText).map(({ pattern }) => pattern);
+    for (const { name, regex, literalGroup } of LOCAL_SECRET_PATTERNS) {
+        const match = regex.exec(lineText);
+        const literal = literalGroup === undefined ? undefined : match?.[literalGroup];
+        if (match !== null && (literal === undefined || !ENVIRONMENT_VARIABLE_NAME.test(literal))) {
+            names.push(name);
+        }
+    }
+    return names.map((pattern) => ({ pattern, line: 0 }));
+}
+function confidenceFor(pattern, isTestPath) {
+    if (isTestPath) {
+        return 'low';
+    }
+    return PROVIDER_SHAPED.has(pattern) ? 'high' : 'medium';
+}
+function severityFor(pattern, isTestPath) {
+    if (isTestPath) {
+        return 'minor';
+    }
+    return PROVIDER_SHAPED.has(pattern) ? 'critical' : 'major';
+}
+/**
+ * Looks through the source checkout for credentials committed with the code. Only the kind of
+ * secret and where it sits are reported, never the value, so the audit result and the defect draft
+ * carry no credential themselves. A match in test code or sample data is reported with low
+ * confidence. A clean result is `passed` only when every file was read: a truncated or partly
+ * skipped scan cannot show that nothing is there.
+ */
+export const secretsCheck = {
+    checkClass: 'secrets',
+    run: async ({ source }) => {
+        if (source === undefined) {
+            return { status: 'skipped', note: 'No source.path is configured.', findings: [] };
+        }
+        const scan = await source.scan();
+        const findings = [];
+        for (const file of scan.files) {
+            if (/(?:^|\/)(?:package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json)$/u.test(file.path)) {
+                continue;
+            }
+            const linesByPattern = new Map();
+            for (const line of scannableLines(file.text)) {
+                for (const hit of findHits(line.text)) {
+                    linesByPattern.set(hit.pattern, [...(linesByPattern.get(hit.pattern) ?? []), line.number]);
+                }
+            }
+            const isTestPath = isTestOrFixturePath(file.path);
+            for (const [pattern, lines] of linesByPattern) {
+                findings.push(buildFinding({
+                    idParts: ['secrets', pattern, file.path],
+                    checkClass: 'secrets',
+                    riskArea: 'Credential exposure in source',
+                    confidence: confidenceFor(pattern, isTestPath),
+                    severityProposal: severityFor(pattern, isTestPath),
+                    title: `A ${pattern.replaceAll('-', ' ')} is committed in ${file.path}`,
+                    steps: [`Open ${file.path}`, `Read line ${String(lines[0])}`],
+                    expectedResult: 'Credentials are read from the environment or a secret manager and never committed with the code',
+                    actualResult: `${file.path} holds a ${pattern.replaceAll('-', ' ')} on ${String(lines.length)} line(s); the value is not repeated here`,
+                    remediation: 'Remove the value from the code and its history, rotate it, and read it from an environment variable or a secret manager.',
+                    regressionCheck: `Run a secret scanner over the repository and assert it reports nothing in ${file.path}`,
+                    requestIndexes: [],
+                    codeReferences: lines
+                        .slice(0, MAX_CITED_LINES_PER_FILE)
+                        .map((lineNumber) => ({ path: file.path, line: lineNumber })),
+                }));
+            }
+        }
+        return { ...outcomeFor(scan, findings.length), findings };
+    },
+};
+function outcomeFor(scan, findingCount) {
+    const summary = `Read ${String(scan.files.length)} file(s) for known secret shapes.`;
+    if (findingCount > 0) {
+        return { status: 'passed', note: summary };
+    }
+    if (scan.files.length === 0) {
+        return { status: 'uncertain', note: 'The source checkout has no readable text file.' };
+    }
+    if (scan.isTruncated || scan.skippedCount > 0) {
+        return {
+            status: 'uncertain',
+            note: `${summary} ${scan.isTruncated ? 'The file limit stopped the scan early. ' : ''}${String(scan.skippedCount)} binary or oversized file(s) were not read.`,
+        };
+    }
+    return { status: 'passed', note: summary };
+}
+//# sourceMappingURL=secrets-check.js.map

package/dist/checks/secrets-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-check.js","sourceRoot":"","sources":["../../src/checks/secrets-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AASxG,qGAAqG;AACrG,oGAAoG;AACpG,MAAM,qBAAqB,GAAkC;IAC3D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,yEAAyE,EAAE;IACzG;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,mFAAmF;QAC1F,YAAY,EAAE,CAAC;KAChB;CACF,CAAC;AAEF,qGAAqG;AACrG,gBAAgB;AAChB,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,mBAAmB;IACnB,cAAc;IACd,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAOH,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACrE,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,qBAAqB,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,UAAmB;IACzD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,UAAmB;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,UAAU,EAAE,SAAS;IACrB,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAiC,EAAE;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IACE,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAClG,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CACX,YAAY,CAAC;oBACX,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;oBACxC,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,+BAA+B;oBACzC,UAAU,EAAE,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC;oBAC9C,gBAAgB,EAAE,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC;oBAClD,KAAK,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE;oBACvE,KAAK,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,EAAE,aAAa,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,cAAc,EACZ,iGAAiG;oBACnG,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,YAAY,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C;oBACvI,WAAW,EACT,0HAA0H;oBAC5H,eAAe,EAAE,6EAA6E,IAAI,CAAC,IAAI,EAAE;oBACzG,cAAc,EAAE,EAAE;oBAClB,cAAc,EAAE,KAAK;yBAClB,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC;yBAClC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;iBAChE,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;CACF,CAAC;AAEF,SAAS,UAAU,CACjB,IAA0G,EAC1G,YAAoB;IAEpB,MAAM,OAAO,GAAG,QAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC;IACrF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,6CAA6C;SAC/J,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}

package/dist/checks/session-check.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityCheck } from '../security-check.js';
+/**
+ * Checks that signing out ends the session on the server. With a signed-in identity it confirms
+ * the session works, signs out through the path the authorization names, then replays the old
+ * session cookie: a page that still opens means the session outlives its sign-out and a stolen
+ * cookie stays usable. Sign-out is a POST only if the authorization lists it as a mutation, a GET
+ * otherwise. This ends the identity's session, so it runs after the checks that use it.
+ */
+export declare const sessionCheck: SecurityCheck;
+//# sourceMappingURL=session-check.d.ts.map

package/dist/checks/session-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-check.d.ts","sourceRoot":"","sources":["../../src/checks/session-check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAKhF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,aA4E1B,CAAC"}

package/dist/checks/session-check.js

@@ -0,0 +1,87 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { fetchPage } from '../fetch-page.js';
+import { buildFinding } from '../finding.js';
+import { isAccepted, sessionHeaders } from './session-pages.js';
+const DEFAULT_PAGE = '/';
+/**
+ * Checks that signing out ends the session on the server. With a signed-in identity it confirms
+ * the session works, signs out through the path the authorization names, then replays the old
+ * session cookie: a page that still opens means the session outlives its sign-out and a stolen
+ * cookie stays usable. Sign-out is a POST only if the authorization lists it as a mutation, a GET
+ * otherwise. This ends the identity's session, so it runs after the checks that use it.
+ */
+export const sessionCheck = {
+    checkClass: 'session',
+    run: async ({ probe, authorization, identities }) => {
+        const { logoutPath, restrictedRoutes } = authorization;
+        if (logoutPath === undefined) {
+            return { status: 'skipped', note: 'The authorization names no sign-out path.', findings: [] };
+        }
+        const session = identities.byRole('low') ?? identities.all()[0];
+        if (session === undefined) {
+            const failures = identities.describeFailures();
+            return failures === undefined
+                ? { status: 'skipped', note: 'The check needs a signed-in identity.', findings: [] }
+                : { status: 'blocked', note: `The check needs a signed-in identity (${failures})`, findings: [] };
+        }
+        const { baseUrl } = authorization.environment;
+        const headers = sessionHeaders(session);
+        // Only a page that a signed-in visitor opens and an anonymous one does not can show whether the
+        // session still counts; on a public page an old cookie would "still work" with no flaw at all.
+        let indicator;
+        for (const candidate of [...restrictedRoutes, DEFAULT_PAGE]) {
+            const signedIn = await fetchPage(probe, baseUrl, candidate, { headers });
+            if (!isAccepted(signedIn)) {
+                continue;
+            }
+            const anonymous = await fetchPage(probe, baseUrl, candidate);
+            if (!isAccepted(anonymous)) {
+                indicator = { page: candidate, firstResponseIndex: signedIn.response.requestIndex };
+                break;
+            }
+        }
+        if (indicator === undefined) {
+            return {
+                status: 'uncertain',
+                note: 'No page tells a signed-in visitor from an anonymous one, so the end of the session could not be judged.',
+                findings: [],
+            };
+        }
+        const { page, firstResponseIndex } = indicator;
+        const method = authorization.allowedMutations.find((mutation) => mutation.path === logoutPath)?.method ?? 'GET';
+        const signOut = await probe.request({ method, path: logoutPath, headers });
+        const after = await fetchPage(probe, baseUrl, page, { headers });
+        if (!isAccepted(after)) {
+            return {
+                status: 'passed',
+                note: `The old session was refused on ${page} after signing out.`,
+                findings: [],
+            };
+        }
+        return {
+            status: 'passed',
+            findings: [
+                buildFinding({
+                    idParts: ['session', 'logout-not-invalidated'],
+                    checkClass: 'session',
+                    riskArea: 'Session management',
+                    confidence: 'high',
+                    severityProposal: 'major',
+                    title: 'A session stays valid after signing out',
+                    steps: [
+                        `Sign in and open ${page}`,
+                        `Sign out with ${method} ${logoutPath}`,
+                        `Open ${page} again with the session cookie from before signing out`,
+                    ],
+                    expectedResult: 'The old session cookie is refused or sent to sign in',
+                    actualResult: `${page} still answered ${String(after.response.status)} for the old session`,
+                    remediation: 'End the session on the server when the user signs out, not only in the browser.',
+                    regressionCheck: `Assert that a session cookie from before ${logoutPath} is refused afterwards`,
+                    requestIndexes: [firstResponseIndex, signOut.requestIndex, after.response.requestIndex],
+                }),
+            ],
+        };
+    },
+};
+//# sourceMappingURL=session-check.js.map

package/dist/checks/session-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-check.js","sourceRoot":"","sources":["../../src/checks/session-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC,UAAU,EAAE,SAAS;IACrB,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,EAAiC,EAAE;QACjF,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;QACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,2CAA2C,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC/C,OAAO,QAAQ,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,uCAAuC,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACpF,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,yCAAyC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACtG,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,SAAqF,CAAC;QAC1F,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,gBAAgB,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,SAAS,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACpF,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,yGAAyG;gBAC/G,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,SAAS,CAAC;QAE/C,MAAM,MAAM,GACV,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC;QACnG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,kCAAkC,IAAI,qBAAqB;gBACjE,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE;gBACR,YAAY,CAAC;oBACX,OAAO,EAAE,CAAC,SAAS,EAAE,wBAAwB,CAAC;oBAC9C,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,UAAU,EAAE,MAAM;oBAClB,gBAAgB,EAAE,OAAO;oBACzB,KAAK,EAAE,yCAAyC;oBAChD,KAAK,EAAE;wBACL,oBAAoB,IAAI,EAAE;wBAC1B,iBAAiB,MAAM,IAAI,UAAU,EAAE;wBACvC,QAAQ,IAAI,wDAAwD;qBACrE;oBACD,cAAc,EAAE,sDAAsD;oBACtE,YAAY,EAAE,GAAG,IAAI,mBAAmB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB;oBAC3F,WAAW,EAAE,iFAAiF;oBAC9F,eAAe,EAAE,4CAA4C,UAAU,wBAAwB;oBAC/F,cAAc,EAAE,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;iBACxF,CAAC;aACH;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/session-pages.d.ts

@@ -0,0 +1,11 @@
+import type { FetchedPage } from '../fetch-page.js';
+import type { IdentitySession } from '../identity-sessions.js';
+/** The request headers that replay a signed-in session; they carry a credential and are never logged. */
+export declare function sessionHeaders(session: IdentitySession): Readonly<Record<string, string>>;
+/** Whether `page` is a real page of the application rather than a failure or a sign-in page. */
+export declare function isAccepted(page: FetchedPage): boolean;
+/** Whether `page` is the page that was asked for, after any same-origin redirects. */
+export declare function reachedRoute(page: FetchedPage, route: string): boolean;
+/** Whether a redirect location leads to a sign-in page. */
+export declare function isSignInLocation(location: string | undefined): boolean;
+//# sourceMappingURL=session-pages.d.ts.map

package/dist/checks/session-pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-pages.d.ts","sourceRoot":"","sources":["../../src/checks/session-pages.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM/D,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEzF;AAMD,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAIrD;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE"}

package/dist/checks/session-pages.js

@@ -0,0 +1,25 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+// A page that asks the visitor to sign in. Applications name it differently, so this is a broad
+// reading of the path, used only to tell "the application let me in" from "it sent me to sign in".
+const SIGN_IN_PATH = /login|signin|sign-in|sso|auth/iu;
+/** The request headers that replay a signed-in session; they carry a credential and are never logged. */
+export function sessionHeaders(session) {
+    return { cookie: session.cookieHeader };
+}
+function pathnameOf(path) {
+    return new URL(path, 'http://placeholder.invalid').pathname;
+}
+/** Whether `page` is a real page of the application rather than a failure or a sign-in page. */
+export function isAccepted(page) {
+    return (page.response.status >= 200 && page.response.status < 300 && !SIGN_IN_PATH.test(pathnameOf(page.path)));
+}
+/** Whether `page` is the page that was asked for, after any same-origin redirects. */
+export function reachedRoute(page, route) {
+    return isAccepted(page) && pathnameOf(page.path) === pathnameOf(route);
+}
+/** Whether a redirect location leads to a sign-in page. */
+export function isSignInLocation(location) {
+    return location !== undefined && SIGN_IN_PATH.test(pathnameOf(location));
+}
+//# sourceMappingURL=session-pages.js.map

package/dist/checks/session-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-pages.js","sourceRoot":"","sources":["../../src/checks/session-pages.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAKtC,gGAAgG;AAChG,mGAAmG;AACnG,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAEvD,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACvG,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,IAAiB,EAAE,KAAa;IAC3D,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,OAAO,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/cookie-flags.d.ts

@@ -0,0 +1,14 @@
+export interface CookieFlags {
+    readonly name: string;
+    readonly isHttpOnly: boolean;
+    readonly isSecure: boolean;
+    /** Lower-cased `lax`, `strict` or `none`; `undefined` when the cookie names no SameSite policy. */
+    readonly sameSite: string | undefined;
+}
+/**
+ * Reads the name and protective attributes from one `Set-Cookie` header value. The value itself is
+ * never read into the result: a session cookie must not reach a finding, a log or evidence.
+ */
+export declare function parseSetCookie(header: string): CookieFlags | undefined;
+export declare function looksLikeSessionCookie(name: string): boolean;
+//# sourceMappingURL=cookie-flags.d.ts.map

package/dist/cookie-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-flags.d.ts","sourceRoot":"","sources":["../src/cookie-flags.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CActE;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/cookie-flags.js

@@ -0,0 +1,28 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Reads the name and protective attributes from one `Set-Cookie` header value. The value itself is
+ * never read into the result: a session cookie must not reach a finding, a log or evidence.
+ */
+export function parseSetCookie(header) {
+    const [pair = '', ...attributes] = header.split(';').map((part) => part.trim());
+    const name = pair.slice(0, Math.max(pair.indexOf('='), 0)).trim();
+    if (name.length === 0) {
+        return undefined;
+    }
+    const lowered = attributes.map((attribute) => attribute.toLowerCase());
+    const sameSiteAttribute = lowered.find((attribute) => attribute.startsWith('samesite='));
+    return {
+        name,
+        isHttpOnly: lowered.includes('httponly'),
+        isSecure: lowered.includes('secure'),
+        sameSite: sameSiteAttribute?.slice('samesite='.length),
+    };
+}
+// A cookie that carries a login. Names differ by framework, so this is a deliberately broad guess
+// used only to rank severity, never to decide whether something is reported.
+const SESSION_COOKIE_NAME = /sess|sid|token|auth|jwt|login/iu;
+export function looksLikeSessionCookie(name) {
+    return SESSION_COOKIE_NAME.test(name);
+}
+//# sourceMappingURL=cookie-flags.js.map

package/dist/cookie-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-flags.js","sourceRoot":"","sources":["../src/cookie-flags.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAUtC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/default-checks.d.ts

@@ -0,0 +1,4 @@
+import type { SecurityCheck } from './security-check.js';
+/** Every check this version implements. A class the authorization lists but is absent here is reported `skipped`. */
+export declare const DEFAULT_SECURITY_CHECKS: readonly SecurityCheck[];
+//# sourceMappingURL=default-checks.d.ts.map

package/dist/default-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-checks.d.ts","sourceRoot":"","sources":["../src/default-checks.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,qHAAqH;AACrH,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAY3D,CAAC"}

package/dist/default-checks.js

@@ -0,0 +1,28 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { authzCheck } from './checks/authz-check.js';
+import { configurationCheck } from './checks/configuration-check.js';
+import { cookiesCheck } from './checks/cookies-check.js';
+import { corsCheck } from './checks/cors-check.js';
+import { csrfCheck } from './checks/csrf-check.js';
+import { dependenciesCheck } from './checks/dependencies-check.js';
+import { encodingCheck } from './checks/encoding-check.js';
+import { errorsCheck } from './checks/errors-check.js';
+import { headersCheck } from './checks/headers-check.js';
+import { secretsCheck } from './checks/secrets-check.js';
+import { sessionCheck } from './checks/session-check.js';
+/** Every check this version implements. A class the authorization lists but is absent here is reported `skipped`. */
+export const DEFAULT_SECURITY_CHECKS = [
+    headersCheck,
+    cookiesCheck,
+    corsCheck,
+    csrfCheck,
+    authzCheck,
+    sessionCheck,
+    errorsCheck,
+    encodingCheck,
+    dependenciesCheck,
+    secretsCheck,
+    configurationCheck,
+];
+//# sourceMappingURL=default-checks.js.map

package/dist/default-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-checks.js","sourceRoot":"","sources":["../src/default-checks.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD,qHAAqH;AACrH,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAC/D,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,kBAAkB;CACnB,CAAC"}

package/dist/fetch-page.d.ts

@@ -0,0 +1,19 @@
+import type { ProbeResponse, SecurityProbe } from './security-probe.js';
+export interface FetchedPage {
+    /** The last response reached; for a page that redirected, the page it redirected to. */
+    readonly response: ProbeResponse;
+    /** The path that produced `response`. */
+    readonly path: string;
+    /** Every response on the way, first request first. */
+    readonly chain: readonly ProbeResponse[];
+}
+/**
+ * GETs `path`, following a redirect only while it stays on the audited origin, one request at a
+ * time through the probe (so each hop meets the same limits as any other request). A redirect
+ * to another host is not followed: that response is the page.
+ */
+export declare function fetchPage(probe: SecurityProbe, baseUrl: string, path: string, options?: {
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly maxHops?: number;
+}): Promise<FetchedPage>;
+//# sourceMappingURL=fetch-page.d.ts.map

package/dist/fetch-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-page.d.ts","sourceRoot":"","sources":["../src/fetch-page.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKxE,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AASD;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/F,OAAO,CAAC,WAAW,CAAC,CAoBtB"}

package/dist/fetch-page.js

@@ -0,0 +1,36 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const DEFAULT_MAX_HOPS = 3;
+/** The path and query of a redirect target when it stays on the audited origin, else `undefined`. */
+function sameOriginTarget(location, currentPath, baseUrl) {
+    const base = new URL(baseUrl);
+    const target = new URL(location, new URL(currentPath, base));
+    return target.origin === base.origin ? `${target.pathname}${target.search}` : undefined;
+}
+/**
+ * GETs `path`, following a redirect only while it stays on the audited origin, one request at a
+ * time through the probe (so each hop meets the same limits as any other request). A redirect
+ * to another host is not followed: that response is the page.
+ */
+export async function fetchPage(probe, baseUrl, path, options = {}) {
+    const chain = [];
+    let currentPath = path;
+    for (let hop = 0;; hop += 1) {
+        const response = await probe.request({
+            method: 'GET',
+            path: currentPath,
+            ...(options.headers !== undefined ? { headers: options.headers } : {}),
+        });
+        chain.push(response);
+        const location = response.headers.location;
+        const next = REDIRECT_STATUSES.has(response.status) && location !== undefined
+            ? sameOriginTarget(location, currentPath, baseUrl)
+            : undefined;
+        if (next === undefined || hop >= (options.maxHops ?? DEFAULT_MAX_HOPS)) {
+            return { response, path: currentPath, chain };
+        }
+        currentPath = next;
+    }
+}
+//# sourceMappingURL=fetch-page.js.map

package/dist/fetch-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-page.js","sourceRoot":"","sources":["../src/fetch-page.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAItC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,QAAgB,EAAE,WAAmB,EAAE,OAAe;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAoB,EACpB,OAAe,EACf,IAAY,EACZ,UAA8F,EAAE;IAEhG,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;YACjB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GACR,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,SAAS;YAC9D,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/finding.d.ts

@@ -0,0 +1,8 @@
+import type { SecurityFinding } from '@qa-ai-stlc/schemas';
+/** A finding id is part of a draft's id and file name, so it is reduced to a plain slug. */
+export declare function findingId(...parts: readonly string[]): string;
+export type FindingInput = Omit<SecurityFinding, 'id'> & {
+    readonly idParts: readonly string[];
+};
+export declare function buildFinding({ idParts, ...rest }: FindingInput): SecurityFinding;
+//# sourceMappingURL=finding.d.ts.map

package/dist/finding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.d.ts","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,4FAA4F;AAC5F,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAM7D;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjG,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,YAAY,GAAG,eAAe,CAEhF"}

package/dist/finding.js

@@ -0,0 +1,14 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/** A finding id is part of a draft's id and file name, so it is reduced to a plain slug. */
+export function findingId(...parts) {
+    return parts
+        .join('-')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, '-')
+        .replace(/^-+|-+$/gu, '');
+}
+export function buildFinding({ idParts, ...rest }) {
+    return { id: findingId(...idParts), ...rest };
+}
+//# sourceMappingURL=finding.js.map

package/dist/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../src/finding.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAItC,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,GAAG,KAAwB;IACnD,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAgB;IAC7D,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/identity-sessions.d.ts

@@ -0,0 +1,42 @@
+import { type EngineContext, type StorageState } from '@qa-ai-stlc/core';
+import type { SecurityAuthorization } from '@qa-ai-stlc/schemas';
+import type { CookieFlags } from './cookie-flags.js';
+type Role = SecurityAuthorization['identities'][number]['role'];
+/** One identity's signed-in browser session, reduced to what the audit's HTTP requests need. */
+export interface IdentitySession {
+    readonly name: string;
+    readonly role: Role;
+    /** Every cookie of the session that applies to the audited host, with its protective flags. */
+    readonly cookies: readonly CookieFlags[];
+    /** The `Cookie` header that replays the session. It holds credentials: never log or record it. */
+    readonly cookieHeader: string;
+}
+/** The identities the authorization names, signed in, plus the reason any of them could not be. */
+export declare class IdentitySessions {
+    private readonly sessions;
+    private readonly failures;
+    constructor(sessions: ReadonlyMap<string, IdentitySession>, failures: ReadonlyMap<string, string>);
+    all(): readonly IdentitySession[];
+    /** The first signed-in identity with `role`. */
+    byRole(role: Role): IdentitySession | undefined;
+    /** Why identities are missing, for a check that cannot run without them. */
+    describeFailures(): string | undefined;
+}
+export declare const NO_IDENTITY_SESSIONS: IdentitySessions;
+/** Reduces a storage state to the session the audit replays; exported for tests. */
+export declare function toIdentitySession(name: string, role: Role, storageState: StorageState, baseUrl: string, nowMs: number): IdentitySession;
+export interface OpenIdentitySessionsOptions {
+    /** Endpoints of Chrome instances the operator is already signed into, by identity name (`cdp-attach` identities). */
+    readonly cdpEndpointUrls?: Readonly<Record<string, string>>;
+    /** Supplies a storage state instead of signing in; for tests. */
+    readonly storageStateFor?: (name: string) => Promise<StorageState | undefined>;
+}
+/**
+ * Signs in the identities the authorization names. A saved storage state is used when there is
+ * one; otherwise the identity signs in through the same `authenticate()` the explorer uses, and a
+ * scripted login whose page is outside the authorized origin is refused before the browser starts.
+ * An identity that cannot sign in is reported, not fatal: the checks that need it say `blocked`.
+ */
+export declare function openIdentitySessions(context: EngineContext, authorization: SecurityAuthorization, options?: OpenIdentitySessionsOptions): Promise<IdentitySessions>;
+export {};
+//# sourceMappingURL=identity-sessions.d.ts.map

package/dist/identity-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-sessions.d.ts","sourceRoot":"","sources":["../src/identity-sessions.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,IAAI,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAGhE,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,mGAAmG;AACnG,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAC9C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAGxD,GAAG,IAAI,SAAS,eAAe,EAAE;IAIjC,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,GAAG,SAAS;IAI/C,4EAA4E;IAC5E,gBAAgB,IAAI,MAAM,GAAG,SAAS;CAMvC;AAED,eAAO,MAAM,oBAAoB,kBAA6C,CAAC;AAqB/E,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,eAAe,CAWjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,qHAAqH;IACrH,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAChF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,qBAAqB,EACpC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAuC3B"}

package/dist/identity-sessions.js

@@ -0,0 +1,102 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { AuthSessionStore, QaError, QaStore, authenticate, isUrlAllowed, loadConfig, } from '@qa-ai-stlc/core';
+/** The identities the authorization names, signed in, plus the reason any of them could not be. */
+export class IdentitySessions {
+    sessions;
+    failures;
+    constructor(sessions, failures) {
+        this.sessions = sessions;
+        this.failures = failures;
+    }
+    all() {
+        return [...this.sessions.values()];
+    }
+    /** The first signed-in identity with `role`. */
+    byRole(role) {
+        return this.all().find((session) => session.role === role);
+    }
+    /** Why identities are missing, for a check that cannot run without them. */
+    describeFailures() {
+        if (this.failures.size === 0) {
+            return undefined;
+        }
+        return [...this.failures].map(([name, reason]) => `${name}: ${reason}`).join('; ');
+    }
+}
+export const NO_IDENTITY_SESSIONS = new IdentitySessions(new Map(), new Map());
+function isForHost(cookie, hostname) {
+    const domain = cookie.domain.replace(/^\./u, '');
+    return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+function isLive(cookie, nowMs) {
+    // Playwright marks a session cookie with an expiry of -1.
+    return cookie.expires === -1 || cookie.expires * 1000 > nowMs;
+}
+function toFlags(cookie) {
+    return {
+        name: cookie.name,
+        isHttpOnly: cookie.httpOnly,
+        isSecure: cookie.secure,
+        sameSite: cookie.sameSite.toLowerCase(),
+    };
+}
+/** Reduces a storage state to the session the audit replays; exported for tests. */
+export function toIdentitySession(name, role, storageState, baseUrl, nowMs) {
+    const { hostname } = new URL(baseUrl);
+    const applicable = storageState.cookies.filter((cookie) => isForHost(cookie, hostname) && isLive(cookie, nowMs));
+    return {
+        name,
+        role,
+        cookies: applicable.map(toFlags),
+        cookieHeader: applicable.map((cookie) => `${cookie.name}=${cookie.value}`).join('; '),
+    };
+}
+/**
+ * Signs in the identities the authorization names. A saved storage state is used when there is
+ * one; otherwise the identity signs in through the same `authenticate()` the explorer uses, and a
+ * scripted login whose page is outside the authorized origin is refused before the browser starts.
+ * An identity that cannot sign in is reported, not fatal: the checks that need it say `blocked`.
+ */
+export async function openIdentitySessions(context, authorization, options = {}) {
+    const config = await loadConfig(context);
+    const environment = config.environments[authorization.environment.name];
+    const store = new QaStore({ projectRoot: context.projectRoot, fs: context.fs });
+    const savedSessions = new AuthSessionStore(store);
+    const sessions = new Map();
+    const failures = new Map();
+    for (const { name, role } of authorization.identities) {
+        const identity = config.identities[name];
+        try {
+            if (identity === undefined) {
+                throw new QaError('SECURITY_IDENTITY_UNKNOWN', `"${name}" is not a configured identity`);
+            }
+            const storageState = (await (options.storageStateFor ?? ((identityName) => savedSessions.load(identityName)))(name)) ??
+                (await signIn(context, authorization, name, identity, options, environment?.tlsInsecure === true));
+            sessions.set(name, toIdentitySession(name, role, storageState, authorization.environment.baseUrl, context.clock.now().getTime()));
+        }
+        catch (error) {
+            if (!(error instanceof QaError)) {
+                throw error;
+            }
+            context.logger.error('A security audit identity could not sign in', {
+                code: error.code,
+                identity: name,
+            });
+            failures.set(name, error.message);
+        }
+    }
+    return new IdentitySessions(sessions, failures);
+}
+async function signIn(context, authorization, name, identity, options, tlsInsecure) {
+    const { baseUrl, allowlist } = authorization.environment;
+    if (identity.loginUrl !== undefined && !isUrlAllowed(identity.loginUrl, allowlist, baseUrl)) {
+        throw new QaError('SECURITY_IDENTITY_LOGIN_OUTSIDE_ALLOWLIST', `The sign-in page of "${name}" is outside the authorized origin`, { remediation: 'Authorize the environment the sign-in page belongs to, or sign in with cdp-attach.' });
+    }
+    const cdpEndpointUrl = options.cdpEndpointUrls?.[name];
+    return authenticate(context.browserLauncher, identity, context.env, {
+        ...(cdpEndpointUrl !== undefined ? { cdpEndpointUrl } : {}),
+        ...(tlsInsecure ? { tlsInsecure: true } : {}),
+    });
+}
+//# sourceMappingURL=identity-sessions.js.map