@testsmith/api-spector 0.2.2 → 0.2.3

package/bin/cli.js

@@ -12,9 +12,10 @@ function printHelp() {
   console.log('')
   console.log('  Usage:')
   console.log('    api-spector ui                            Launch the app')
-  console.log('    api-spector run    --workspace <path>     Run tests from CLI')
-  console.log('    api-spector mock   --workspace <path>     Start mock servers from CLI')
-  console.log('    api-spector record --upstream <url>       Record API traffic as mock stubs')
+  console.log('    api-spector run      --workspace <path>   Run tests from CLI')
+  console.log('    api-spector mock     --workspace <path>   Start mock servers from CLI')
+  console.log('    api-spector record   --upstream <url>     Record API traffic as mock stubs')
+  console.log('    api-spector contract list|run             Manage & run pinned contract snapshots')
   console.log('')
   console.log('  Options:')
   console.log('    api-spector agents init <name>            Initialize AI agent files')
@@ -69,6 +70,13 @@ if (cmd === '--help' || cmd === '-h') {
     env: process.env,
   })
   proc.on('close', code => process.exit(code ?? 0))
+} else if (cmd === 'contract') {
+  const contractPath = path.join(__dirname, '..', 'out', 'main', 'contract.js')
+  const proc = spawn(process.execPath, [contractPath, ...rest], {
+    stdio: 'inherit',
+    env: process.env,
+  })
+  proc.on('close', code => process.exit(code ?? 0))
 } else {
   console.error(`API Spector — unknown command: "${cmd}"`)
   printHelp()

package/out/main/chunks/auth-builder-B7-LgcGr.js

@@ -0,0 +1,373 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+const crypto = require("crypto");
+const promises = require("fs/promises");
+const path = require("path");
+const dayjs = require("dayjs");
+const vm = require("vm");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const vm__namespace = /* @__PURE__ */ _interopNamespaceDefault(vm);
+const MASTER_KEY_ENV = "API_SPECTOR_MASTER_KEY";
+let secretStore = {};
+let secretStorePath = null;
+async function initSecretStore(userDataPath) {
+  secretStorePath = path.join(userDataPath, "secrets.json");
+  try {
+    const raw = await promises.readFile(secretStorePath, "utf8");
+    secretStore = JSON.parse(raw);
+  } catch {
+    secretStore = {};
+  }
+}
+async function persistSecretStore() {
+  if (!secretStorePath) return;
+  await promises.writeFile(secretStorePath, JSON.stringify(secretStore, null, 2), "utf8");
+}
+function getSafeStorage() {
+  try {
+    const { safeStorage } = require("electron");
+    if (typeof safeStorage?.isEncryptionAvailable === "function") return safeStorage;
+    return null;
+  } catch {
+    return null;
+  }
+}
+function registerSecretHandlers(ipc) {
+  ipc.handle("secret:checkMasterKey", () => {
+    return { set: Boolean(process.env[MASTER_KEY_ENV]) };
+  });
+  ipc.handle("secret:setMasterKey", (_e, value) => {
+    process.env[MASTER_KEY_ENV] = value;
+  });
+  ipc.handle("secret:set", async (_e, ref, value) => {
+    const ss = getSafeStorage();
+    if (!ss || !ss.isEncryptionAvailable()) {
+      throw new Error("OS encryption is not available — set the secret via environment variable instead");
+    }
+    secretStore[ref] = ss.encryptString(value).toString("base64");
+    await persistSecretStore();
+  });
+}
+function decryptSecret(encrypted, salt, iv, password) {
+  const saltBuf = Buffer.from(salt, "base64");
+  const ivBuf = Buffer.from(iv, "base64");
+  const encBuf = Buffer.from(encrypted, "base64");
+  const key = crypto.pbkdf2Sync(password, saltBuf, 1e5, 32, "sha256");
+  const authTag = encBuf.subarray(encBuf.length - 16);
+  const ciphertext = encBuf.subarray(0, encBuf.length - 16);
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, ivBuf);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+async function getSecret(ref) {
+  const stored = secretStore[ref];
+  if (stored) {
+    const ss = getSafeStorage();
+    if (ss && ss.isEncryptionAvailable()) {
+      try {
+        return ss.decryptString(Buffer.from(stored, "base64"));
+      } catch {
+      }
+    }
+  }
+  return process.env[ref] ?? null;
+}
+let _fakerCache = null;
+async function getFaker() {
+  if (!_fakerCache) _fakerCache = await import("@faker-js/faker");
+  return _fakerCache.faker;
+}
+let _exprContext = null;
+async function buildDynamicVars() {
+  const faker = await getFaker();
+  const now = dayjs();
+  _exprContext = { faker, dayjs };
+  return {
+    $uuid: faker.string.uuid(),
+    $timestamp: String(Date.now()),
+    $isoTimestamp: now.toISOString(),
+    $randomInt: String(faker.number.int({ min: 0, max: 1e3 })),
+    $randomFloat: String(faker.number.float({ min: 0, max: 1e3, fractionDigits: 2 })),
+    $randomBoolean: String(faker.datatype.boolean()),
+    $randomEmail: faker.internet.email(),
+    $randomUsername: faker.internet.username(),
+    $randomPassword: faker.internet.password(),
+    $randomFullName: faker.person.fullName(),
+    $randomFirstName: faker.person.firstName(),
+    $randomLastName: faker.person.lastName(),
+    $randomWord: faker.lorem.word(),
+    $randomPhrase: faker.lorem.sentence(),
+    $randomUrl: faker.internet.url(),
+    $randomIp: faker.internet.ip(),
+    $randomHexColor: faker.color.rgb({ format: "hex", casing: "lower" })
+  };
+}
+function interpolate(str, vars) {
+  return str.replace(/\{\{([^}]+)\}\}/g, (match, key) => {
+    const trimmed = key.trim();
+    if (trimmed in vars) return vars[trimmed];
+    if (_exprContext && (trimmed.includes(".") || trimmed.includes("("))) {
+      try {
+        const result = vm__namespace.runInNewContext(trimmed, _exprContext);
+        if (result !== void 0 && result !== null) return String(result);
+      } catch {
+      }
+    }
+    return match;
+  });
+}
+function buildUrl(baseUrl, params, vars) {
+  const templateTokens = /* @__PURE__ */ new Set();
+  baseUrl.replace(/\{\{([^}]+)\}\}/g, (_m, name) => {
+    templateTokens.add(String(name).trim());
+    return "";
+  });
+  const enabled = (params ?? []).filter((p) => p.enabled && p.key);
+  const pathRows = [];
+  const queryRows = [];
+  for (const p of enabled) {
+    const isPath = p.paramType === "path" || templateTokens.has(p.key);
+    if (isPath) pathRows.push(p);
+    else queryRows.push(p);
+  }
+  const mergedVars = pathRows.length ? {
+    ...vars,
+    ...Object.fromEntries(pathRows.map((p) => [p.key, interpolate(p.value, vars)]))
+  } : vars;
+  const url = interpolate(baseUrl, mergedVars);
+  if (!queryRows.length) return url;
+  const sep = url.includes("?") ? "&" : "?";
+  const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");
+  return url + sep + qs;
+}
+async function buildEnvVars(environment) {
+  const vars = {};
+  if (!environment) return vars;
+  const masterKey = process.env["API_SPECTOR_MASTER_KEY"];
+  for (const v of environment.variables) {
+    if (!v.enabled) continue;
+    if (v.envRef) {
+      const envValue = process.env[v.envRef];
+      if (envValue !== void 0) vars[v.key] = envValue;
+    } else if (v.secret && v.secretEncrypted && v.secretSalt && v.secretIv) {
+      if (masterKey) {
+        try {
+          vars[v.key] = decryptSecret(v.secretEncrypted, v.secretSalt, v.secretIv, masterKey);
+        } catch {
+        }
+      }
+      if (vars[v.key] === void 0 && process.env[v.key] !== void 0) {
+        vars[v.key] = process.env[v.key];
+      }
+    } else if (v.secret) {
+      if (process.env[v.key] !== void 0) {
+        vars[v.key] = process.env[v.key];
+      }
+    } else {
+      vars[v.key] = v.value;
+    }
+  }
+  return vars;
+}
+function mergeVars(envVars, collectionVars, globals, localVars = {}, dynamicVars = {}) {
+  return { ...dynamicVars, ...globals, ...collectionVars, ...envVars, ...localVars };
+}
+async function buildAuthHeaders(auth, vars) {
+  const headers = {};
+  if (auth.type === "bearer") {
+    let token = auth.token ?? "";
+    if (!token && auth.tokenSecretRef) token = await getSecret(auth.tokenSecretRef) ?? "";
+    token = interpolate(token, vars);
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+  }
+  if (auth.type === "basic") {
+    let password = auth.password ?? "";
+    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+    password = interpolate(password, vars);
+    const username = interpolate(auth.username ?? "", vars);
+    headers["Authorization"] = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
+  }
+  if (auth.type === "apikey" && auth.apiKeyIn === "header") {
+    let value = auth.apiKeyValue ?? "";
+    if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
+    value = interpolate(value, vars);
+    headers[auth.apiKeyName ?? "X-API-Key"] = value;
+  }
+  if (auth.type === "oauth2") {
+    const now = Date.now();
+    if (auth.oauth2CachedToken && auth.oauth2TokenExpiry && auth.oauth2TokenExpiry > now + 5e3) {
+      headers["Authorization"] = `Bearer ${auth.oauth2CachedToken}`;
+    }
+  }
+  return headers;
+}
+async function buildApiKeyParam(auth, vars) {
+  if (auth.type !== "apikey" || auth.apiKeyIn !== "query") return null;
+  let value = auth.apiKeyValue ?? "";
+  if (!value && auth.apiKeySecretRef) value = await getSecret(auth.apiKeySecretRef) ?? "";
+  value = interpolate(value, vars);
+  return { key: auth.apiKeyName ?? "apikey", value };
+}
+function parseDigestChallenge(wwwAuth) {
+  const extract = (key) => {
+    const m = new RegExp(`${key}="([^"]*)"`, "i").exec(wwwAuth);
+    return m ? m[1] : "";
+  };
+  const extractUnquoted = (key) => {
+    const m = new RegExp(`${key}=([^,\\s]+)`, "i").exec(wwwAuth);
+    return m ? m[1] : "";
+  };
+  return {
+    realm: extract("realm"),
+    nonce: extract("nonce"),
+    qop: extract("qop") || extractUnquoted("qop") || void 0,
+    algorithm: extract("algorithm") || extractUnquoted("algorithm") || "MD5",
+    opaque: extract("opaque") || void 0
+  };
+}
+function md5(s) {
+  return crypto.createHash("md5").update(s).digest("hex");
+}
+function buildDigestAuthHeader(challenge, username, password, method, uri) {
+  const { realm, nonce, qop, algorithm, opaque } = challenge;
+  const algo = (algorithm ?? "MD5").toUpperCase();
+  const ha1 = algo === "MD5-SESS" ? md5(`${md5(`${username}:${realm}:${password}`)}:${nonce}:`) : md5(`${username}:${realm}:${password}`);
+  const ha2 = md5(`${method}:${uri}`);
+  let response;
+  let nc;
+  let cnonce;
+  if (qop === "auth" || qop === "auth-int") {
+    nc = "00000001";
+    cnonce = crypto.randomBytes(8).toString("hex");
+    response = md5(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha2}`);
+  } else {
+    response = md5(`${ha1}:${nonce}:${ha2}`);
+  }
+  let header = `Digest username="${username}", realm="${realm}", nonce="${nonce}", uri="${uri}", response="${response}"`;
+  if (qop) header += `, qop=${qop}`;
+  if (nc) header += `, nc=${nc}`;
+  if (cnonce) header += `, cnonce="${cnonce}"`;
+  if (opaque) header += `, opaque="${opaque}"`;
+  if (algo !== "MD5") header += `, algorithm=${algo}`;
+  return header;
+}
+async function performDigestAuth(url, method, auth, vars, fetchFn) {
+  const probeResp = await fetchFn(url, { method, headers: {} });
+  if (probeResp.status !== 401) return null;
+  const wwwAuth = probeResp.headers.get("www-authenticate") ?? "";
+  if (!wwwAuth.toLowerCase().startsWith("digest")) return null;
+  const challenge = parseDigestChallenge(wwwAuth);
+  let password = auth.password ?? "";
+  if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+  password = interpolate(password, vars);
+  const username = interpolate(auth.username ?? "", vars);
+  let uri = "/";
+  try {
+    uri = new URL(url).pathname + (new URL(url).search ?? "");
+  } catch {
+  }
+  return buildDigestAuthHeader(challenge, username, password, method, uri);
+}
+async function performNtlmRequest(_url, _method, _auth, _vars) {
+  throw new Error(
+    'NTLM auth is not yet implemented. Add "httpntlm" to package.json dependencies and implement performNtlmRequest in auth-builder.ts.'
+  );
+}
+async function fetchOAuth2Token(auth, vars) {
+  const flow = auth.oauth2Flow ?? "client_credentials";
+  if (flow === "authorization_code") {
+    throw new Error("authorization_code flow requires the oauth2:startFlow IPC call from the renderer.");
+  }
+  if (flow === "implicit") {
+    throw new Error("implicit flow cannot be performed server-side — tokens must be obtained via the browser redirect.");
+  }
+  const tokenUrl = interpolate(auth.oauth2TokenUrl ?? "", vars);
+  if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required.");
+  const clientId = interpolate(auth.oauth2ClientId ?? "", vars);
+  let clientSecret = auth.oauth2ClientSecret ?? "";
+  if (!clientSecret && auth.oauth2ClientSecretRef) {
+    clientSecret = await getSecret(auth.oauth2ClientSecretRef) ?? "";
+  }
+  clientSecret = interpolate(clientSecret, vars);
+  const params = new URLSearchParams();
+  params.set("grant_type", flow === "password" ? "password" : "client_credentials");
+  params.set("client_id", clientId);
+  params.set("client_secret", clientSecret);
+  if (auth.oauth2Scopes) params.set("scope", auth.oauth2Scopes);
+  if (flow === "password") {
+    let password = auth.password ?? "";
+    if (!password && auth.passwordSecretRef) password = await getSecret(auth.passwordSecretRef) ?? "";
+    password = interpolate(password, vars);
+    params.set("username", interpolate(auth.username ?? "", vars));
+    params.set("password", password);
+  }
+  const { fetch: nodeFetch } = await import("undici");
+  const resp = await nodeFetch(tokenUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  if (!resp.ok) {
+    const body = await resp.text();
+    throw new Error(`OAuth 2.0 token request failed (${resp.status}): ${body}`);
+  }
+  const json = await resp.json();
+  const accessToken = String(json["access_token"] ?? "");
+  if (!accessToken) throw new Error("OAuth 2.0: token response missing access_token.");
+  const expiresIn = Number(json["expires_in"] ?? 3600);
+  const expiresAt = Date.now() + expiresIn * 1e3;
+  return {
+    accessToken,
+    expiresAt,
+    refreshToken: json["refresh_token"] ? String(json["refresh_token"]) : void 0
+  };
+}
+exports.buildApiKeyParam = buildApiKeyParam;
+exports.buildAuthHeaders = buildAuthHeaders;
+exports.buildDynamicVars = buildDynamicVars;
+exports.buildEnvVars = buildEnvVars;
+exports.buildUrl = buildUrl;
+exports.fetchOAuth2Token = fetchOAuth2Token;
+exports.getSecret = getSecret;
+exports.initSecretStore = initSecretStore;
+exports.interpolate = interpolate;
+exports.mergeVars = mergeVars;
+exports.performDigestAuth = performDigestAuth;
+exports.performNtlmRequest = performNtlmRequest;
+exports.registerSecretHandlers = registerSecretHandlers;