@qodfy/core 0.1.4 → 0.1.6

package/dist/index.js

@@ -41,6 +41,16 @@ var aiKeywords = [
   "streamText",
   "useChat"
 ];
+var ignoredEnvVariables = /* @__PURE__ */ new Set([
+  "CI",
+  "HOME",
+  "NODE_ENV",
+  "PORT",
+  "PWD",
+  "VERCEL",
+  "VERCEL_ENV",
+  "VERCEL_URL"
+]);
 var hardcodedSecretPatterns = [
   {
     label: "OpenAI API key",
@@ -75,7 +85,8 @@ var hardcodedSecretPatterns = [
     pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g
   }
 ];
-var LARGE_FILE_WARNING_BYTES = 15e3;
+var LARGE_FILE_WARNING_BYTES = 40 * 1024;
+var LARGE_FILE_REPORT_LIMIT = 10;
 var MAX_FILE_SIZE_BYTES = 500 * 1024;
 async function scanProject(projectPath) {
   const startTime = Date.now();
@@ -162,9 +173,10 @@ async function scanProject(projectPath) {
     return isApiRoute(file);
   });
   const apiRouteSet = new Set(apiRoutes);
-  const envExampleWarningKeys = /* @__PURE__ */ new Set();
+  const missingEnvUsages = /* @__PURE__ */ new Map();
   const clientSecretWarningKeys = /* @__PURE__ */ new Set();
   const hardcodedSecretWarningKeys = /* @__PURE__ */ new Set();
+  const largeFileCandidates = [];
   let aiFiles = 0;
   let largeFiles = 0;
   for (const file of files) {
@@ -203,12 +215,9 @@ async function scanProject(projectPath) {
     const content = fileResult.content;
     if (statResult.size > LARGE_FILE_WARNING_BYTES) {
       largeFiles++;
-      issues.push({
-        severity: "info",
-        title: "Large file detected",
-        message: "Large files are harder to maintain and often appear in AI-generated codebases.",
-        file: relativeFile,
-        suggestion: "Consider splitting this file into smaller modules if it mixes unrelated responsibilities."
+      largeFileCandidates.push({
+        relativeFile,
+        size: statResult.size
       });
     }
     const usesAI = aiKeywords.some(
@@ -227,15 +236,14 @@ async function scanProject(projectPath) {
         });
       }
     }
-    const isStripeWebhook = isStripeWebhookRoute(relativeFile, content);
-    const hasStripeSignatureVerification = hasStripeWebhookSignatureVerification(content);
-    if (isStripeWebhook && !hasStripeSignatureVerification) {
+    const webhookRouteInfo = apiRouteSet.has(file) ? getWebhookRouteInfo(relativeFile, content) : null;
+    if (webhookRouteInfo && !hasWebhookSignatureVerification(content, webhookRouteInfo.provider)) {
       issues.push({
-        severity: "critical",
-        title: "Stripe webhook may be missing signature verification",
-        message: "This Stripe webhook route does not appear to verify the Stripe signature before handling the event.",
+        severity: webhookRouteInfo.confidence === "high" ? "critical" : "warning",
+        title: "Webhook route may be missing signature verification",
+        message: "This webhook route appears to handle external events, but Qodfy could not find signature verification before the event is handled.",
         file: relativeFile,
-        suggestion: "Use stripe.webhooks.constructEvent with the raw request body, Stripe-Signature header, and STRIPE_WEBHOOK_SECRET."
+        suggestion: getWebhookSignatureSuggestion(webhookRouteInfo.provider)
       });
     }
     for (const secretMatch of getHardcodedSecretMatches(content)) {
@@ -254,7 +262,7 @@ async function scanProject(projectPath) {
     }
     if (apiRouteSet.has(file)) {
       const hasAuth = content.includes("auth(") || content.includes("getServerSession") || content.includes("currentUser") || content.includes("clerkClient") || content.includes("session");
-      if (!hasAuth && !isStripeWebhook) {
+      if (!hasAuth && !webhookRouteInfo) {
         issues.push({
           severity: "warning",
           title: "API route may be missing authentication",
@@ -267,25 +275,17 @@ async function scanProject(projectPath) {
     const usedEnvVariables = getUsedEnvVariables(content);
     if (envExampleVariables) {
       for (const variableName of usedEnvVariables) {
-        if (!envExampleVariables.has(variableName)) {
-          const warningKey = `${relativeFile}:${variableName}`;
-          if (envExampleWarningKeys.has(warningKey)) {
-            continue;
-          }
-          envExampleWarningKeys.add(warningKey);
-          issues.push({
-            severity: "warning",
-            title: "Environment variable missing from .env.example",
-            message: `${variableName} is used in ${relativeFile} but is not documented in .env.example.`,
-            file: relativeFile,
-            suggestion: `Add ${variableName}= to .env.example without including a real value.`
-          });
+        if (shouldIgnoreEnvVariable(variableName) || envExampleVariables.has(variableName)) {
+          continue;
         }
+        const filesUsingVariable = missingEnvUsages.get(variableName) ?? /* @__PURE__ */ new Set();
+        filesUsingVariable.add(relativeFile);
+        missingEnvUsages.set(variableName, filesUsingVariable);
       }
     }
     if (isClientSideFile(relativeFile, content)) {
       for (const variableName of usedEnvVariables) {
-        if (!variableName.startsWith("NEXT_PUBLIC_")) {
+        if (!variableName.startsWith("NEXT_PUBLIC_") && !shouldIgnoreEnvVariable(variableName)) {
           const warningKey = `${relativeFile}:${variableName}`;
           if (clientSecretWarningKeys.has(warningKey)) {
             continue;
@@ -302,9 +302,29 @@ async function scanProject(projectPath) {
       }
     }
   }
+  for (const largeFile of getReportedLargeFiles(largeFileCandidates)) {
+    issues.push({
+      severity: "info",
+      title: "Large file detected",
+      message: "Large files are harder to maintain and often appear in AI-generated codebases.",
+      file: largeFile.relativeFile,
+      suggestion: "Consider splitting this file into smaller modules if it mixes unrelated responsibilities."
+    });
+  }
+  for (const [variableName, filesUsingVariable] of getSortedMissingEnvUsages(missingEnvUsages)) {
+    const files2 = [...filesUsingVariable].sort();
+    issues.push({
+      severity: "warning",
+      title: "Environment variable missing from .env.example",
+      message: getMissingEnvMessage(variableName, files2),
+      file: files2.length === 1 ? files2[0] : void 0,
+      suggestion: `Add ${variableName}= to .env.example without including a real value.`
+    });
+  }
   const criticalCount = issues.filter((issue) => issue.severity === "critical").length;
   const warningCount = issues.filter((issue) => issue.severity === "warning").length;
-  const score = Math.max(0, 100 - criticalCount * 20 - warningCount * 8);
+  const warningPenalty = Math.min(warningCount * 5, 50);
+  const score = Math.max(0, 100 - criticalCount * 20 - warningPenalty);
   return {
     projectPath: resolvedProjectPath,
     isNextProject,
@@ -454,6 +474,31 @@ function getUsedEnvVariables(content) {
   }
   return variables;
 }
+function shouldIgnoreEnvVariable(variableName) {
+  return ignoredEnvVariables.has(variableName);
+}
+function getReportedLargeFiles(largeFileCandidates) {
+  return [...largeFileCandidates].sort((a, b) => b.size - a.size).slice(0, LARGE_FILE_REPORT_LIMIT);
+}
+function getSortedMissingEnvUsages(missingEnvUsages) {
+  return [...missingEnvUsages.entries()].sort(
+    ([leftVariable], [rightVariable]) => leftVariable.localeCompare(rightVariable)
+  );
+}
+function getMissingEnvMessage(variableName, files) {
+  if (files.length === 1) {
+    return `${variableName} is used in ${files[0]} but is not documented in .env.example.`;
+  }
+  return `${variableName} is used in ${files.length} files but is not documented in .env.example. Files: ${formatFileList(files)}.`;
+}
+function formatFileList(files) {
+  const filesToShow = files.slice(0, 5);
+  const remainingCount = files.length - filesToShow.length;
+  if (remainingCount <= 0) {
+    return filesToShow.join(", ");
+  }
+  return `${filesToShow.join(", ")} and ${remainingCount} more`;
+}
 function parseDestructuredEnvNames(destructuredContent) {
   const variables = [];
   for (const part of destructuredContent.split(",")) {
@@ -479,15 +524,83 @@ function isClientSideFile(relativeFile, content) {
   return fileName.includes(".client.") || /(^|\n)\s*["']use client["'];?/.test(content);
 }
 function isApiRoute(filePath) {
-  return filePath.includes(`${path.sep}app${path.sep}api${path.sep}`) || filePath.includes(`${path.sep}pages${path.sep}api${path.sep}`);
+  const normalizedFile = normalizePath(filePath);
+  const sourceFileExtension = "(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)";
+  return new RegExp(`/app/api(?:/.+)?/route\\.${sourceFileExtension}$`).test(normalizedFile) || new RegExp(`/pages/api/.+\\.${sourceFileExtension}$`).test(normalizedFile);
 }
-function isStripeWebhookRoute(relativeFile, content) {
+function getWebhookRouteInfo(relativeFile, content) {
   const normalizedFile = relativeFile.toLowerCase();
   const normalizedContent = content.toLowerCase();
-  return normalizedContent.includes("stripe") && (normalizedFile.includes("webhook") || normalizedContent.includes("webhook") || normalizedContent.includes("stripe.webhooks"));
+  const normalizedRouteContext = `${normalizedFile}
+${normalizedContent}`;
+  const pathLooksLikeWebhook = normalizedFile.includes("webhook") || normalizedFile.includes("callback");
+  const contentStronglySuggestsWebhook = normalizedContent.includes("stripe.webhooks") || normalizedContent.includes("constructevent(") || normalizedContent.includes("stripe-signature") || normalizedContent.includes("stripe_webhook_secret") || normalizedContent.includes("clerk_webhook_secret") || normalizedContent.includes("svix") || normalizedContent.includes("x-github-event") || normalizedContent.includes("x-hub-signature") || normalizedContent.includes("x-shopify-hmac-sha256") || normalizedContent.includes("resend") && normalizedContent.includes("webhook") || normalizedContent.includes("webhook_secret") || normalizedContent.includes("webhooksecret") || normalizedContent.includes("webhook") && (normalizedContent.includes("signature") || normalizedContent.includes("secret") || normalizedContent.includes("event"));
+  if (!pathLooksLikeWebhook && !contentStronglySuggestsWebhook) {
+    return null;
+  }
+  const provider = getWebhookProvider(normalizedRouteContext);
+  return {
+    provider,
+    confidence: provider === "unknown" ? "likely" : "high"
+  };
+}
+function getWebhookProvider(normalizedRouteContext) {
+  if (normalizedRouteContext.includes("stripe-signature") || normalizedRouteContext.includes("stripe_webhook_secret") || normalizedRouteContext.includes("stripe.webhooks") || normalizedRouteContext.includes("constructevent(") || normalizedRouteContext.includes("stripe") && normalizedRouteContext.includes("webhook")) {
+    return "stripe";
+  }
+  if (normalizedRouteContext.includes("resend") && normalizedRouteContext.includes("webhook")) {
+    return "resend";
+  }
+  if (normalizedRouteContext.includes("clerk_webhook_secret") || normalizedRouteContext.includes("clerk") && normalizedRouteContext.includes("webhook")) {
+    return "clerk";
+  }
+  if (normalizedRouteContext.includes("x-github-event") || normalizedRouteContext.includes("x-hub-signature")) {
+    return "github";
+  }
+  if (normalizedRouteContext.includes("x-shopify-hmac-sha256")) {
+    return "shopify";
+  }
+  return "unknown";
+}
+function hasWebhookSignatureVerification(content, provider) {
+  const normalizedContent = content.toLowerCase();
+  if (provider === "stripe") {
+    return normalizedContent.includes("stripe.webhooks.constructevent") || normalizedContent.includes("webhooks.constructevent") || normalizedContent.includes("constructevent(");
+  }
+  if (provider === "clerk") {
+    return (normalizedContent.includes("new webhook(") || normalizedContent.includes("webhook(") || normalizedContent.includes("svix")) && (normalizedContent.includes(".verify(") || normalizedContent.includes("verify(") || normalizedContent.includes("verifywebhook"));
+  }
+  if (provider === "github") {
+    return (normalizedContent.includes("x-hub-signature") || normalizedContent.includes("x-hub-signature-256")) && hasHmacOrVerifyCall(normalizedContent);
+  }
+  if (provider === "shopify") {
+    return normalizedContent.includes("x-shopify-hmac-sha256") && hasHmacOrVerifyCall(normalizedContent);
+  }
+  if (provider === "resend") {
+    return normalizedContent.includes("verifywebhook") || (normalizedContent.includes("new webhook(") || normalizedContent.includes("webhook(") || normalizedContent.includes("svix")) && hasHmacOrVerifyCall(normalizedContent);
+  }
+  return normalizedContent.includes("constructevent(") || normalizedContent.includes("verifywebhook") || normalizedContent.includes("signature") && hasHmacOrVerifyCall(normalizedContent) || normalizedContent.includes("webhook") && normalizedContent.includes("verify(");
 }
-function hasStripeWebhookSignatureVerification(content) {
-  return content.includes("stripe.webhooks.constructEvent") || content.includes("webhooks.constructEvent") || content.includes("constructEvent(");
+function hasHmacOrVerifyCall(normalizedContent) {
+  return normalizedContent.includes("verify(") || normalizedContent.includes(".verify(") || normalizedContent.includes("verifywebhook") || normalizedContent.includes("createhmac") || normalizedContent.includes("timingsafeequal") || normalizedContent.includes("subtle.verify");
+}
+function getWebhookSignatureSuggestion(provider) {
+  if (provider === "stripe") {
+    return "Use stripe.webhooks.constructEvent(...) with the Stripe signature header before handling the event.";
+  }
+  if (provider === "clerk") {
+    return "Verify the event with Svix before handling it.";
+  }
+  if (provider === "github") {
+    return "Verify the GitHub signature using the raw request body, X-Hub-Signature-256 header, and webhook secret.";
+  }
+  if (provider === "shopify") {
+    return "Verify the Shopify HMAC using the raw request body, X-Shopify-Hmac-Sha256 header, and webhook secret.";
+  }
+  if (provider === "resend") {
+    return "Verify the Resend webhook signature before handling the event.";
+  }
+  return "Verify the provider signature using the raw request body and signature header before trusting the event.";
 }
 function isPackageJsonObject(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qodfy/core",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Scanner engine for Qodfy, an open-source launch readiness scanner for AI-built apps.",
   "keywords": [
     "qodfy",