@vibecheckai/cli 3.0.3 → 3.0.5

package/bin/runners/lib/contracts/route-contract.js

@@ -0,0 +1,199 @@
+/**
+ * Route Contract Builder
+ * Builds routes.json contract from truthpack
+ */
+
+"use strict";
+
+const crypto = require("crypto");
+
+function sha256(text) {
+  return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+
+/**
+ * Build routes contract from truthpack
+ */
+function buildRouteContract(truthpack) {
+  const contract = {
+    version: "1.0.0",
+    generatedAt: new Date().toISOString(),
+    routes: []
+  };
+
+  const serverRoutes = truthpack?.routes?.server || [];
+
+  for (const route of serverRoutes) {
+    const routeSpec = {
+      id: `route_${sha256(route.method + "_" + route.path)}`,
+      method: route.method,
+      path: route.path,
+      handler: route.handler || "unknown",
+      auth: inferAuthRequirement(route, truthpack),
+      roles: inferRoles(route, truthpack),
+      confidence: route.confidence || "med",
+      evidence: route.evidence || []
+    };
+
+    contract.routes.push(routeSpec);
+  }
+
+  // Deterministic output: sort routes by method + path
+  contract.routes.sort((a, b) => {
+    const keyA = `${a.method}_${a.path}`;
+    const keyB = `${b.method}_${b.path}`;
+    return keyA.localeCompare(keyB);
+  });
+
+  return contract;
+}
+
+/**
+ * Infer auth requirement from route and truthpack
+ */
+function inferAuthRequirement(route, truthpack) {
+  const authPatterns = truthpack?.auth?.nextMatcherPatterns || [];
+  const path = route.path;
+
+  // Check if path matches any protected pattern
+  for (const pattern of authPatterns) {
+    if (matchesPattern(path, pattern)) {
+      return "required";
+    }
+  }
+
+  // Check for auth hooks in Fastify
+  if (route.hooks?.includes("onRequest") || route.hooks?.includes("preHandler")) {
+    return "required";
+  }
+
+  // Check for public API patterns
+  if (path.includes("/public/") || path.includes("/health") || path.includes("/status")) {
+    return "none";
+  }
+
+  return "optional";
+}
+
+/**
+ * Infer roles from route metadata
+ */
+function inferRoles(route, truthpack) {
+  const roles = [];
+
+  // Check for admin patterns in path
+  if (route.path.includes("/admin")) {
+    roles.push("admin");
+  }
+
+  // Check handler for role patterns
+  const handler = route.handler || "";
+  if (handler.includes("admin")) {
+    roles.push("admin");
+  }
+
+  return roles.length > 0 ? roles : undefined;
+}
+
+function matchesPattern(path, pattern) {
+  // Simple pattern matching
+  const normPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
+  try {
+    const rx = new RegExp(`^${normPattern}`, "i");
+    return rx.test(path);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validate code against route contract
+ */
+function validateAgainstRouteContract(contract, clientRefs) {
+  const violations = [];
+  const contractPaths = new Map(contract.routes.map(r => [`${r.method}_${r.path}`, r]));
+
+  for (const ref of clientRefs) {
+    const key = `${ref.method}_${ref.path}`;
+    const wildcardKey = `*_${ref.path}`;
+
+    if (!contractPaths.has(key) && !contractPaths.has(wildcardKey)) {
+      // Check parameterized match
+      const match = findParameterizedMatch(contract.routes, ref.method, ref.path);
+      
+      if (!match) {
+        violations.push({
+          type: "undeclared_route",
+          severity: "BLOCK",
+          route: { method: ref.method, path: ref.path },
+          source: ref.source,
+          message: `Route ${ref.method} ${ref.path} used in client but not declared in contract`,
+          evidence: ref.evidence || []
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function findParameterizedMatch(routes, method, path) {
+  for (const r of routes) {
+    if (r.method !== "*" && r.method !== method) continue;
+    if (matchesParameterized(r.path, path)) return r;
+  }
+  return null;
+}
+
+function matchesParameterized(pattern, actual) {
+  const patternParts = pattern.split("/").filter(Boolean);
+  const actualParts = actual.split("/").filter(Boolean);
+
+  if (patternParts.length !== actualParts.length) return false;
+
+  for (let i = 0; i < patternParts.length; i++) {
+    const p = patternParts[i];
+    if (p.startsWith(":") || p.startsWith("*")) continue;
+    if (p !== actualParts[i]) return false;
+  }
+  return true;
+}
+
+/**
+ * Diff two route contracts
+ */
+function diffRouteContracts(before, after) {
+  const diff = {
+    added: [],
+    removed: [],
+    changed: []
+  };
+
+  const beforeMap = new Map(before.routes.map(r => [r.id, r]));
+  const afterMap = new Map(after.routes.map(r => [r.id, r]));
+
+  for (const [id, route] of afterMap) {
+    if (!beforeMap.has(id)) {
+      diff.added.push(route);
+    } else {
+      const prev = beforeMap.get(id);
+      if (prev.auth !== route.auth || JSON.stringify(prev.roles) !== JSON.stringify(route.roles)) {
+        diff.changed.push({ before: prev, after: route });
+      }
+    }
+  }
+
+  for (const [id, route] of beforeMap) {
+    if (!afterMap.has(id)) {
+      diff.removed.push(route);
+    }
+  }
+
+  return diff;
+}
+
+module.exports = {
+  buildRouteContract,
+  validateAgainstRouteContract,
+  diffRouteContracts
+};