@vibecheckai/cli 3.2.2 → 3.2.4

package/bin/runners/lib/contracts/auth-contract.js

@@ -1,202 +1,202 @@
-/**
- * Auth Contract Builder
- * Builds auth.json contract from truthpack
- */
-
-"use strict";
-
-/**
- * Build auth contract from truthpack
- */
-function buildAuthContract(truthpack) {
-  const contract = {
-    version: "1.0.0",
-    generatedAt: new Date().toISOString(),
-    protectedPatterns: [],
-    publicPatterns: [],
-    roles: [],
-    evidence: []
-  };
-
-  // Extract protected patterns from Next middleware
-  const nextMiddleware = truthpack?.auth?.nextMiddleware || [];
-  const matcherPatterns = truthpack?.auth?.nextMatcherPatterns || [];
-
-  contract.protectedPatterns = [...new Set(matcherPatterns)];
-
-  // Add evidence from middleware files
-  for (const mw of nextMiddleware) {
-    contract.evidence.push({
-      file: mw.file,
-      type: "next_middleware",
-      signals: mw.signalTypes || []
-    });
-  }
-
-  // Extract Fastify auth info
-  const fastify = truthpack?.auth?.fastify || {};
-  if (fastify.hooks?.length) {
-    for (const hook of fastify.hooks) {
-      contract.evidence.push({
-        file: hook.file,
-        type: "fastify_hook",
-        hookType: hook.hookType,
-        line: hook.line
-      });
-    }
-  }
-
-  // Infer roles from truthpack
-  contract.roles = inferRoles(truthpack);
-
-  // Default public patterns
-  contract.publicPatterns = [
-    "/api/health",
-    "/api/status",
-    "/api/public/*",
-    "/_next/*",
-    "/favicon.ico"
-  ];
-
-  // Deterministic output: sort all arrays
-  contract.protectedPatterns.sort();
-  contract.publicPatterns.sort();
-  contract.roles.sort((a, b) => a.name.localeCompare(b.name));
-  for (const role of contract.roles) {
-    if (role.routes) role.routes.sort();
-  }
-
-  return contract;
-}
-
-/**
- * Infer roles from truthpack
- */
-function inferRoles(truthpack) {
-  const roles = [];
-  const routes = truthpack?.routes?.server || [];
-
-  // Check for admin routes
-  const adminRoutes = routes.filter(r => r.path.includes("/admin"));
-  if (adminRoutes.length > 0) {
-    roles.push({
-      name: "admin",
-      routes: adminRoutes.map(r => r.path),
-      evidence: adminRoutes.flatMap(r => r.evidence || [])
-    });
-  }
-
-  // Check for user routes (default authenticated)
-  const userRoutes = routes.filter(r => 
-    !r.path.includes("/admin") && 
-    !r.path.includes("/public") &&
-    !r.path.includes("/health")
-  );
-  if (userRoutes.length > 0) {
-    roles.push({
-      name: "user",
-      routes: userRoutes.map(r => r.path),
-      evidence: []
-    });
-  }
-
-  return roles;
-}
-
-/**
- * Validate auth coverage
- */
-function validateAuthContract(contract, routes, realityResults) {
-  const violations = [];
-
-  // Check that all non-public routes are protected
-  for (const route of routes) {
-    const isPublic = contract.publicPatterns.some(p => matchesPattern(route.path, p));
-    const isProtected = contract.protectedPatterns.some(p => matchesPattern(route.path, p));
-
-    if (!isPublic && !isProtected) {
-      // Check if route looks sensitive
-      if (looksLikeSensitiveRoute(route.path)) {
-        violations.push({
-          type: "unprotected_sensitive",
-          severity: "WARN",
-          route: route.path,
-          message: `Sensitive route ${route.path} not covered by auth patterns`,
-          evidence: route.evidence || []
-        });
-      }
-    }
-  }
-
-  // Check reality results for auth bypass
-  if (realityResults) {
-    for (const result of realityResults) {
-      if (result.type === "AuthCoverage" && result.severity === "BLOCK") {
-        violations.push({
-          type: "auth_bypass",
-          severity: "BLOCK",
-          route: result.page,
-          message: result.title,
-          evidence: []
-        });
-      }
-    }
-  }
-
-  return violations;
-}
-
-function matchesPattern(path, pattern) {
-  const normPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
-  try {
-    const rx = new RegExp(`^${normPattern}`, "i");
-    return rx.test(path);
-  } catch {
-    return false;
-  }
-}
-
-function looksLikeSensitiveRoute(path) {
-  const sensitivePatterns = [
-    /\/api\/users/i,
-    /\/api\/billing/i,
-    /\/api\/payment/i,
-    /\/api\/subscription/i,
-    /\/api\/settings/i,
-    /\/api\/profile/i,
-    /\/api\/account/i,
-    /\/api\/admin/i,
-    /\/api\/webhook/i,
-  ];
-
-  return sensitivePatterns.some(p => p.test(path));
-}
-
-/**
- * Diff two auth contracts
- */
-function diffAuthContracts(before, after) {
-  const diff = {
-    protectedAdded: [],
-    protectedRemoved: [],
-    rolesChanged: []
-  };
-
-  const beforeProtected = new Set(before.protectedPatterns);
-  const afterProtected = new Set(after.protectedPatterns);
-
-  for (const p of afterProtected) {
-    if (!beforeProtected.has(p)) diff.protectedAdded.push(p);
-  }
-  for (const p of beforeProtected) {
-    if (!afterProtected.has(p)) diff.protectedRemoved.push(p);
-  }
-
-  return diff;
-}
-
-module.exports = {
-  buildAuthContract,
-  validateAuthContract,
-  diffAuthContracts
-};
+/**
+ * Auth Contract Builder
+ * Builds auth.json contract from truthpack
+ */
+
+"use strict";
+
+/**
+ * Build auth contract from truthpack
+ */
+function buildAuthContract(truthpack) {
+  const contract = {
+    version: "1.0.0",
+    generatedAt: new Date().toISOString(),
+    protectedPatterns: [],
+    publicPatterns: [],
+    roles: [],
+    evidence: []
+  };
+
+  // Extract protected patterns from Next middleware
+  const nextMiddleware = truthpack?.auth?.nextMiddleware || [];
+  const matcherPatterns = truthpack?.auth?.nextMatcherPatterns || [];
+
+  contract.protectedPatterns = [...new Set(matcherPatterns)];
+
+  // Add evidence from middleware files
+  for (const mw of nextMiddleware) {
+    contract.evidence.push({
+      file: mw.file,
+      type: "next_middleware",
+      signals: mw.signalTypes || []
+    });
+  }
+
+  // Extract Fastify auth info
+  const fastify = truthpack?.auth?.fastify || {};
+  if (fastify.hooks?.length) {
+    for (const hook of fastify.hooks) {
+      contract.evidence.push({
+        file: hook.file,
+        type: "fastify_hook",
+        hookType: hook.hookType,
+        line: hook.line
+      });
+    }
+  }
+
+  // Infer roles from truthpack
+  contract.roles = inferRoles(truthpack);
+
+  // Default public patterns
+  contract.publicPatterns = [
+    "/api/health",
+    "/api/status",
+    "/api/public/*",
+    "/_next/*",
+    "/favicon.ico"
+  ];
+
+  // Deterministic output: sort all arrays
+  contract.protectedPatterns.sort();
+  contract.publicPatterns.sort();
+  contract.roles.sort((a, b) => a.name.localeCompare(b.name));
+  for (const role of contract.roles) {
+    if (role.routes) role.routes.sort();
+  }
+
+  return contract;
+}
+
+/**
+ * Infer roles from truthpack
+ */
+function inferRoles(truthpack) {
+  const roles = [];
+  const routes = truthpack?.routes?.server || [];
+
+  // Check for admin routes
+  const adminRoutes = routes.filter(r => r.path.includes("/admin"));
+  if (adminRoutes.length > 0) {
+    roles.push({
+      name: "admin",
+      routes: adminRoutes.map(r => r.path),
+      evidence: adminRoutes.flatMap(r => r.evidence || [])
+    });
+  }
+
+  // Check for user routes (default authenticated)
+  const userRoutes = routes.filter(r => 
+    !r.path.includes("/admin") && 
+    !r.path.includes("/public") &&
+    !r.path.includes("/health")
+  );
+  if (userRoutes.length > 0) {
+    roles.push({
+      name: "user",
+      routes: userRoutes.map(r => r.path),
+      evidence: []
+    });
+  }
+
+  return roles;
+}
+
+/**
+ * Validate auth coverage
+ */
+function validateAuthContract(contract, routes, realityResults) {
+  const violations = [];
+
+  // Check that all non-public routes are protected
+  for (const route of routes) {
+    const isPublic = contract.publicPatterns.some(p => matchesPattern(route.path, p));
+    const isProtected = contract.protectedPatterns.some(p => matchesPattern(route.path, p));
+
+    if (!isPublic && !isProtected) {
+      // Check if route looks sensitive
+      if (looksLikeSensitiveRoute(route.path)) {
+        violations.push({
+          type: "unprotected_sensitive",
+          severity: "WARN",
+          route: route.path,
+          message: `Sensitive route ${route.path} not covered by auth patterns`,
+          evidence: route.evidence || []
+        });
+      }
+    }
+  }
+
+  // Check reality results for auth bypass
+  if (realityResults) {
+    for (const result of realityResults) {
+      if (result.type === "AuthCoverage" && result.severity === "BLOCK") {
+        violations.push({
+          type: "auth_bypass",
+          severity: "BLOCK",
+          route: result.page,
+          message: result.title,
+          evidence: []
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function matchesPattern(path, pattern) {
+  const normPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
+  try {
+    const rx = new RegExp(`^${normPattern}`, "i");
+    return rx.test(path);
+  } catch {
+    return false;
+  }
+}
+
+function looksLikeSensitiveRoute(path) {
+  const sensitivePatterns = [
+    /\/api\/users/i,
+    /\/api\/billing/i,
+    /\/api\/payment/i,
+    /\/api\/subscription/i,
+    /\/api\/settings/i,
+    /\/api\/profile/i,
+    /\/api\/account/i,
+    /\/api\/admin/i,
+    /\/api\/webhook/i,
+  ];
+
+  return sensitivePatterns.some(p => p.test(path));
+}
+
+/**
+ * Diff two auth contracts
+ */
+function diffAuthContracts(before, after) {
+  const diff = {
+    protectedAdded: [],
+    protectedRemoved: [],
+    rolesChanged: []
+  };
+
+  const beforeProtected = new Set(before.protectedPatterns);
+  const afterProtected = new Set(after.protectedPatterns);
+
+  for (const p of afterProtected) {
+    if (!beforeProtected.has(p)) diff.protectedAdded.push(p);
+  }
+  for (const p of beforeProtected) {
+    if (!afterProtected.has(p)) diff.protectedRemoved.push(p);
+  }
+
+  return diff;
+}
+
+module.exports = {
+  buildAuthContract,
+  validateAuthContract,
+  diffAuthContracts
+};