@vibecheckai/cli 3.2.5 → 3.3.0

package/bin/runners/lib/contracts/route-contract.js

@@ -1,199 +1,199 @@
-/**
- * Route Contract Builder
- * Builds routes.json contract from truthpack
- */
-
-"use strict";
-
-const crypto = require("crypto");
-
-function sha256(text) {
-  return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16);
-}
-
-/**
- * Build routes contract from truthpack
- */
-function buildRouteContract(truthpack) {
-  const contract = {
-    version: "1.0.0",
-    generatedAt: new Date().toISOString(),
-    routes: []
-  };
-
-  const serverRoutes = truthpack?.routes?.server || [];
-
-  for (const route of serverRoutes) {
-    const routeSpec = {
-      id: `route_${sha256(route.method + "_" + route.path)}`,
-      method: route.method,
-      path: route.path,
-      handler: route.handler || "unknown",
-      auth: inferAuthRequirement(route, truthpack),
-      roles: inferRoles(route, truthpack),
-      confidence: route.confidence || "med",
-      evidence: route.evidence || []
-    };
-
-    contract.routes.push(routeSpec);
-  }
-
-  // Deterministic output: sort routes by method + path
-  contract.routes.sort((a, b) => {
-    const keyA = `${a.method}_${a.path}`;
-    const keyB = `${b.method}_${b.path}`;
-    return keyA.localeCompare(keyB);
-  });
-
-  return contract;
-}
-
-/**
- * Infer auth requirement from route and truthpack
- */
-function inferAuthRequirement(route, truthpack) {
-  const authPatterns = truthpack?.auth?.nextMatcherPatterns || [];
-  const path = route.path;
-
-  // Check if path matches any protected pattern
-  for (const pattern of authPatterns) {
-    if (matchesPattern(path, pattern)) {
-      return "required";
-    }
-  }
-
-  // Check for auth hooks in Fastify
-  if (route.hooks?.includes("onRequest") || route.hooks?.includes("preHandler")) {
-    return "required";
-  }
-
-  // Check for public API patterns
-  if (path.includes("/public/") || path.includes("/health") || path.includes("/status")) {
-    return "none";
-  }
-
-  return "optional";
-}
-
-/**
- * Infer roles from route metadata
- */
-function inferRoles(route, truthpack) {
-  const roles = [];
-
-  // Check for admin patterns in path
-  if (route.path.includes("/admin")) {
-    roles.push("admin");
-  }
-
-  // Check handler for role patterns
-  const handler = route.handler || "";
-  if (handler.includes("admin")) {
-    roles.push("admin");
-  }
-
-  return roles.length > 0 ? roles : undefined;
-}
-
-function matchesPattern(path, pattern) {
-  // Simple pattern matching
-  const normPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
-  try {
-    const rx = new RegExp(`^${normPattern}`, "i");
-    return rx.test(path);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Validate code against route contract
- */
-function validateAgainstRouteContract(contract, clientRefs) {
-  const violations = [];
-  const contractPaths = new Map(contract.routes.map(r => [`${r.method}_${r.path}`, r]));
-
-  for (const ref of clientRefs) {
-    const key = `${ref.method}_${ref.path}`;
-    const wildcardKey = `*_${ref.path}`;
-
-    if (!contractPaths.has(key) && !contractPaths.has(wildcardKey)) {
-      // Check parameterized match
-      const match = findParameterizedMatch(contract.routes, ref.method, ref.path);
-      
-      if (!match) {
-        violations.push({
-          type: "undeclared_route",
-          severity: "BLOCK",
-          route: { method: ref.method, path: ref.path },
-          source: ref.source,
-          message: `Route ${ref.method} ${ref.path} used in client but not declared in contract`,
-          evidence: ref.evidence || []
-        });
-      }
-    }
-  }
-
-  return violations;
-}
-
-function findParameterizedMatch(routes, method, path) {
-  for (const r of routes) {
-    if (r.method !== "*" && r.method !== method) continue;
-    if (matchesParameterized(r.path, path)) return r;
-  }
-  return null;
-}
-
-function matchesParameterized(pattern, actual) {
-  const patternParts = pattern.split("/").filter(Boolean);
-  const actualParts = actual.split("/").filter(Boolean);
-
-  if (patternParts.length !== actualParts.length) return false;
-
-  for (let i = 0; i < patternParts.length; i++) {
-    const p = patternParts[i];
-    if (p.startsWith(":") || p.startsWith("*")) continue;
-    if (p !== actualParts[i]) return false;
-  }
-  return true;
-}
-
-/**
- * Diff two route contracts
- */
-function diffRouteContracts(before, after) {
-  const diff = {
-    added: [],
-    removed: [],
-    changed: []
-  };
-
-  const beforeMap = new Map(before.routes.map(r => [r.id, r]));
-  const afterMap = new Map(after.routes.map(r => [r.id, r]));
-
-  for (const [id, route] of afterMap) {
-    if (!beforeMap.has(id)) {
-      diff.added.push(route);
-    } else {
-      const prev = beforeMap.get(id);
-      if (prev.auth !== route.auth || JSON.stringify(prev.roles) !== JSON.stringify(route.roles)) {
-        diff.changed.push({ before: prev, after: route });
-      }
-    }
-  }
-
-  for (const [id, route] of beforeMap) {
-    if (!afterMap.has(id)) {
-      diff.removed.push(route);
-    }
-  }
-
-  return diff;
-}
-
-module.exports = {
-  buildRouteContract,
-  validateAgainstRouteContract,
-  diffRouteContracts
-};
+/**
+ * Route Contract Builder
+ * Builds routes.json contract from truthpack
+ */
+
+"use strict";
+
+const crypto = require("crypto");
+
+function sha256(text) {
+  return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+
+/**
+ * Build routes contract from truthpack
+ */
+function buildRouteContract(truthpack) {
+  const contract = {
+    version: "1.0.0",
+    generatedAt: new Date().toISOString(),
+    routes: []
+  };
+
+  const serverRoutes = truthpack?.routes?.server || [];
+
+  for (const route of serverRoutes) {
+    const routeSpec = {
+      id: `route_${sha256(route.method + "_" + route.path)}`,
+      method: route.method,
+      path: route.path,
+      handler: route.handler || "unknown",
+      auth: inferAuthRequirement(route, truthpack),
+      roles: inferRoles(route, truthpack),
+      confidence: route.confidence || "med",
+      evidence: route.evidence || []
+    };
+
+    contract.routes.push(routeSpec);
+  }
+
+  // Deterministic output: sort routes by method + path
+  contract.routes.sort((a, b) => {
+    const keyA = `${a.method}_${a.path}`;
+    const keyB = `${b.method}_${b.path}`;
+    return keyA.localeCompare(keyB);
+  });
+
+  return contract;
+}
+
+/**
+ * Infer auth requirement from route and truthpack
+ */
+function inferAuthRequirement(route, truthpack) {
+  const authPatterns = truthpack?.auth?.nextMatcherPatterns || [];
+  const path = route.path;
+
+  // Check if path matches any protected pattern
+  for (const pattern of authPatterns) {
+    if (matchesPattern(path, pattern)) {
+      return "required";
+    }
+  }
+
+  // Check for auth hooks in Fastify
+  if (route.hooks?.includes("onRequest") || route.hooks?.includes("preHandler")) {
+    return "required";
+  }
+
+  // Check for public API patterns
+  if (path.includes("/public/") || path.includes("/health") || path.includes("/status")) {
+    return "none";
+  }
+
+  return "optional";
+}
+
+/**
+ * Infer roles from route metadata
+ */
+function inferRoles(route, truthpack) {
+  const roles = [];
+
+  // Check for admin patterns in path
+  if (route.path.includes("/admin")) {
+    roles.push("admin");
+  }
+
+  // Check handler for role patterns
+  const handler = route.handler || "";
+  if (handler.includes("admin")) {
+    roles.push("admin");
+  }
+
+  return roles.length > 0 ? roles : undefined;
+}
+
+function matchesPattern(path, pattern) {
+  // Simple pattern matching
+  const normPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
+  try {
+    const rx = new RegExp(`^${normPattern}`, "i");
+    return rx.test(path);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validate code against route contract
+ */
+function validateAgainstRouteContract(contract, clientRefs) {
+  const violations = [];
+  const contractPaths = new Map(contract.routes.map(r => [`${r.method}_${r.path}`, r]));
+
+  for (const ref of clientRefs) {
+    const key = `${ref.method}_${ref.path}`;
+    const wildcardKey = `*_${ref.path}`;
+
+    if (!contractPaths.has(key) && !contractPaths.has(wildcardKey)) {
+      // Check parameterized match
+      const match = findParameterizedMatch(contract.routes, ref.method, ref.path);
+      
+      if (!match) {
+        violations.push({
+          type: "undeclared_route",
+          severity: "BLOCK",
+          route: { method: ref.method, path: ref.path },
+          source: ref.source,
+          message: `Route ${ref.method} ${ref.path} used in client but not declared in contract`,
+          evidence: ref.evidence || []
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function findParameterizedMatch(routes, method, path) {
+  for (const r of routes) {
+    if (r.method !== "*" && r.method !== method) continue;
+    if (matchesParameterized(r.path, path)) return r;
+  }
+  return null;
+}
+
+function matchesParameterized(pattern, actual) {
+  const patternParts = pattern.split("/").filter(Boolean);
+  const actualParts = actual.split("/").filter(Boolean);
+
+  if (patternParts.length !== actualParts.length) return false;
+
+  for (let i = 0; i < patternParts.length; i++) {
+    const p = patternParts[i];
+    if (p.startsWith(":") || p.startsWith("*")) continue;
+    if (p !== actualParts[i]) return false;
+  }
+  return true;
+}
+
+/**
+ * Diff two route contracts
+ */
+function diffRouteContracts(before, after) {
+  const diff = {
+    added: [],
+    removed: [],
+    changed: []
+  };
+
+  const beforeMap = new Map(before.routes.map(r => [r.id, r]));
+  const afterMap = new Map(after.routes.map(r => [r.id, r]));
+
+  for (const [id, route] of afterMap) {
+    if (!beforeMap.has(id)) {
+      diff.added.push(route);
+    } else {
+      const prev = beforeMap.get(id);
+      if (prev.auth !== route.auth || JSON.stringify(prev.roles) !== JSON.stringify(route.roles)) {
+        diff.changed.push({ before: prev, after: route });
+      }
+    }
+  }
+
+  for (const [id, route] of beforeMap) {
+    if (!afterMap.has(id)) {
+      diff.removed.push(route);
+    }
+  }
+
+  return diff;
+}
+
+module.exports = {
+  buildRouteContract,
+  validateAgainstRouteContract,
+  diffRouteContracts
+};