@qodfy/core 0.1.4 → 0.1.5

package/dist/index.js

@@ -41,6 +41,16 @@ var aiKeywords = [
   "streamText",
   "useChat"
 ];
+var ignoredEnvVariables = /* @__PURE__ */ new Set([
+  "CI",
+  "HOME",
+  "NODE_ENV",
+  "PORT",
+  "PWD",
+  "VERCEL",
+  "VERCEL_ENV",
+  "VERCEL_URL"
+]);
 var hardcodedSecretPatterns = [
   {
     label: "OpenAI API key",
@@ -75,7 +85,8 @@ var hardcodedSecretPatterns = [
     pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g
   }
 ];
-var LARGE_FILE_WARNING_BYTES = 15e3;
+var LARGE_FILE_WARNING_BYTES = 40 * 1024;
+var LARGE_FILE_REPORT_LIMIT = 10;
 var MAX_FILE_SIZE_BYTES = 500 * 1024;
 async function scanProject(projectPath) {
   const startTime = Date.now();
@@ -162,9 +173,10 @@ async function scanProject(projectPath) {
     return isApiRoute(file);
   });
   const apiRouteSet = new Set(apiRoutes);
-  const envExampleWarningKeys = /* @__PURE__ */ new Set();
+  const missingEnvUsages = /* @__PURE__ */ new Map();
   const clientSecretWarningKeys = /* @__PURE__ */ new Set();
   const hardcodedSecretWarningKeys = /* @__PURE__ */ new Set();
+  const largeFileCandidates = [];
   let aiFiles = 0;
   let largeFiles = 0;
   for (const file of files) {
@@ -203,12 +215,9 @@ async function scanProject(projectPath) {
     const content = fileResult.content;
     if (statResult.size > LARGE_FILE_WARNING_BYTES) {
       largeFiles++;
-      issues.push({
-        severity: "info",
-        title: "Large file detected",
-        message: "Large files are harder to maintain and often appear in AI-generated codebases.",
-        file: relativeFile,
-        suggestion: "Consider splitting this file into smaller modules if it mixes unrelated responsibilities."
+      largeFileCandidates.push({
+        relativeFile,
+        size: statResult.size
       });
     }
     const usesAI = aiKeywords.some(
@@ -229,6 +238,8 @@ async function scanProject(projectPath) {
     }
     const isStripeWebhook = isStripeWebhookRoute(relativeFile, content);
     const hasStripeSignatureVerification = hasStripeWebhookSignatureVerification(content);
+    const isClerkWebhook = isClerkWebhookRoute(relativeFile, content);
+    const hasClerkSignatureVerification = hasClerkWebhookSignatureVerification(content);
     if (isStripeWebhook && !hasStripeSignatureVerification) {
       issues.push({
         severity: "critical",
@@ -238,6 +249,15 @@ async function scanProject(projectPath) {
         suggestion: "Use stripe.webhooks.constructEvent with the raw request body, Stripe-Signature header, and STRIPE_WEBHOOK_SECRET."
       });
     }
+    if (isClerkWebhook && !hasClerkSignatureVerification) {
+      issues.push({
+        severity: "critical",
+        title: "Clerk webhook may be missing signature verification",
+        message: "This Clerk webhook route does not appear to verify the webhook signature before handling the event.",
+        file: relativeFile,
+        suggestion: "Use svix Webhook(...).verify(...) with CLERK_WEBHOOK_SECRET and Clerk webhook headers."
+      });
+    }
     for (const secretMatch of getHardcodedSecretMatches(content)) {
       const warningKey = `${relativeFile}:${secretMatch.label}`;
       if (hardcodedSecretWarningKeys.has(warningKey)) {
@@ -254,7 +274,7 @@ async function scanProject(projectPath) {
     }
     if (apiRouteSet.has(file)) {
       const hasAuth = content.includes("auth(") || content.includes("getServerSession") || content.includes("currentUser") || content.includes("clerkClient") || content.includes("session");
-      if (!hasAuth && !isStripeWebhook) {
+      if (!hasAuth && !isStripeWebhook && !isClerkWebhook) {
         issues.push({
           severity: "warning",
           title: "API route may be missing authentication",
@@ -267,25 +287,17 @@ async function scanProject(projectPath) {
     const usedEnvVariables = getUsedEnvVariables(content);
     if (envExampleVariables) {
       for (const variableName of usedEnvVariables) {
-        if (!envExampleVariables.has(variableName)) {
-          const warningKey = `${relativeFile}:${variableName}`;
-          if (envExampleWarningKeys.has(warningKey)) {
-            continue;
-          }
-          envExampleWarningKeys.add(warningKey);
-          issues.push({
-            severity: "warning",
-            title: "Environment variable missing from .env.example",
-            message: `${variableName} is used in ${relativeFile} but is not documented in .env.example.`,
-            file: relativeFile,
-            suggestion: `Add ${variableName}= to .env.example without including a real value.`
-          });
+        if (shouldIgnoreEnvVariable(variableName) || envExampleVariables.has(variableName)) {
+          continue;
         }
+        const filesUsingVariable = missingEnvUsages.get(variableName) ?? /* @__PURE__ */ new Set();
+        filesUsingVariable.add(relativeFile);
+        missingEnvUsages.set(variableName, filesUsingVariable);
       }
     }
     if (isClientSideFile(relativeFile, content)) {
       for (const variableName of usedEnvVariables) {
-        if (!variableName.startsWith("NEXT_PUBLIC_")) {
+        if (!variableName.startsWith("NEXT_PUBLIC_") && !shouldIgnoreEnvVariable(variableName)) {
           const warningKey = `${relativeFile}:${variableName}`;
           if (clientSecretWarningKeys.has(warningKey)) {
             continue;
@@ -302,9 +314,29 @@ async function scanProject(projectPath) {
       }
     }
   }
+  for (const largeFile of getReportedLargeFiles(largeFileCandidates)) {
+    issues.push({
+      severity: "info",
+      title: "Large file detected",
+      message: "Large files are harder to maintain and often appear in AI-generated codebases.",
+      file: largeFile.relativeFile,
+      suggestion: "Consider splitting this file into smaller modules if it mixes unrelated responsibilities."
+    });
+  }
+  for (const [variableName, filesUsingVariable] of getSortedMissingEnvUsages(missingEnvUsages)) {
+    const files2 = [...filesUsingVariable].sort();
+    issues.push({
+      severity: "warning",
+      title: "Environment variable missing from .env.example",
+      message: getMissingEnvMessage(variableName, files2),
+      file: files2.length === 1 ? files2[0] : void 0,
+      suggestion: `Add ${variableName}= to .env.example without including a real value.`
+    });
+  }
   const criticalCount = issues.filter((issue) => issue.severity === "critical").length;
   const warningCount = issues.filter((issue) => issue.severity === "warning").length;
-  const score = Math.max(0, 100 - criticalCount * 20 - warningCount * 8);
+  const warningPenalty = Math.min(warningCount * 5, 50);
+  const score = Math.max(0, 100 - criticalCount * 20 - warningPenalty);
   return {
     projectPath: resolvedProjectPath,
     isNextProject,
@@ -454,6 +486,31 @@ function getUsedEnvVariables(content) {
   }
   return variables;
 }
+function shouldIgnoreEnvVariable(variableName) {
+  return ignoredEnvVariables.has(variableName);
+}
+function getReportedLargeFiles(largeFileCandidates) {
+  return [...largeFileCandidates].sort((a, b) => b.size - a.size).slice(0, LARGE_FILE_REPORT_LIMIT);
+}
+function getSortedMissingEnvUsages(missingEnvUsages) {
+  return [...missingEnvUsages.entries()].sort(
+    ([leftVariable], [rightVariable]) => leftVariable.localeCompare(rightVariable)
+  );
+}
+function getMissingEnvMessage(variableName, files) {
+  if (files.length === 1) {
+    return `${variableName} is used in ${files[0]} but is not documented in .env.example.`;
+  }
+  return `${variableName} is used in ${files.length} files but is not documented in .env.example. Files: ${formatFileList(files)}.`;
+}
+function formatFileList(files) {
+  const filesToShow = files.slice(0, 5);
+  const remainingCount = files.length - filesToShow.length;
+  if (remainingCount <= 0) {
+    return filesToShow.join(", ");
+  }
+  return `${filesToShow.join(", ")} and ${remainingCount} more`;
+}
 function parseDestructuredEnvNames(destructuredContent) {
   const variables = [];
   for (const part of destructuredContent.split(",")) {
@@ -489,6 +546,14 @@ function isStripeWebhookRoute(relativeFile, content) {
 function hasStripeWebhookSignatureVerification(content) {
   return content.includes("stripe.webhooks.constructEvent") || content.includes("webhooks.constructEvent") || content.includes("constructEvent(");
 }
+function isClerkWebhookRoute(relativeFile, content) {
+  const normalizedFile = relativeFile.toLowerCase();
+  const normalizedContent = content.toLowerCase();
+  return (normalizedContent.includes("clerk") || normalizedContent.includes("clerk_webhook_secret")) && (normalizedFile.includes("webhook") || normalizedContent.includes("webhook"));
+}
+function hasClerkWebhookSignatureVerification(content) {
+  return content.includes("new Webhook(") || content.includes(".verify(") || content.includes("svix");
+}
 function isPackageJsonObject(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qodfy/core",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Scanner engine for Qodfy, an open-source launch readiness scanner for AI-built apps.",
   "keywords": [
     "qodfy",