aegis-audit 2.1.0

package/src/utils/fetcher.js

@@ -0,0 +1,115 @@
+import fs from 'fs';
+import path from 'path';
+import axios from 'axios';
+
+const ETHERSCAN_APIS = {
+  ethereum: 'https://api.etherscan.io/api',
+  base:     'https://api.basescan.org/api',
+  arbitrum: 'https://api.arbiscan.io/api',
+  polygon:  'https://api.polygonscan.com/api',
+  optimism: 'https://api-optimistic.etherscan.io/api',
+  bsc:      'https://api.bscscan.com/api',
+};
+
+export async function fetchSource(target, network = 'ethereum') {
+  const lc = target.toLowerCase();
+
+  // ── Local .sol file ──────────────────────────────────────────────
+  if (lc.endsWith('.sol') || fs.existsSync(target)) {
+    const stat = fs.statSync(target);
+    if (stat.isDirectory()) {
+      return fetchFolder(target);
+    }
+    const code = fs.readFileSync(target, 'utf8');
+    return {
+      type: 'file',
+      name: path.basename(target),
+      source: code,
+      files: [{ name: path.basename(target), code }],
+    };
+  }
+
+  // ── Folder of .sol files ─────────────────────────────────────────
+  if (fs.existsSync(target) && fs.statSync(target).isDirectory()) {
+    return fetchFolder(target);
+  }
+
+  // ── On-chain address ─────────────────────────────────────────────
+  if (/^0x[0-9a-fA-F]{40}$/.test(target)) {
+    return fetchFromChain(target, network);
+  }
+
+  throw new Error(`Cannot resolve target: "${target}"\nExpected: 0x address, .sol file, or folder path`);
+}
+
+function fetchFolder(dir) {
+  const files = [];
+  function walk(d) {
+    for (const f of fs.readdirSync(d)) {
+      const full = path.join(d, f);
+      if (fs.statSync(full).isDirectory()) { walk(full); continue; }
+      if (f.endsWith('.sol')) {
+        files.push({ name: path.relative(dir, full), code: fs.readFileSync(full, 'utf8') });
+      }
+    }
+  }
+  walk(dir);
+  if (files.length === 0) throw new Error(`No .sol files found in ${dir}`);
+  return {
+    type: 'folder',
+    name: path.basename(dir),
+    source: files.map(f => `// === ${f.name} ===\n${f.code}`).join('\n\n'),
+    files,
+  };
+}
+
+async function fetchFromChain(address, network) {
+  const baseUrl = ETHERSCAN_APIS[network.toLowerCase()];
+  if (!baseUrl) throw new Error(`Unknown network: ${network}`);
+
+  // Try without API key first (rate-limited but works for demos)
+  const url = `${baseUrl}?module=contract&action=getsourcecode&address=${address}`;
+
+  const resp = await axios.get(url, { timeout: 15000 });
+  const data = resp.data;
+
+  if (data.status !== '1' || !data.result?.[0]) {
+    throw new Error(`Contract not found on ${network}. Is it verified on Etherscan?`);
+  }
+
+  const result = data.result[0];
+  if (!result.SourceCode || result.SourceCode === '') {
+    throw new Error(`Contract source not verified on ${network}. Upload your .sol file directly instead.`);
+  }
+
+  let files = [];
+  let source = result.SourceCode;
+
+  // Handle multi-file JSON format
+  if (source.startsWith('{{') || source.startsWith('{')) {
+    try {
+      const cleaned = source.startsWith('{{') ? source.slice(1, -1) : source;
+      const parsed  = JSON.parse(cleaned);
+      const sources = parsed.sources || parsed;
+      files = Object.entries(sources).map(([name, obj]) => ({
+        name,
+        code: typeof obj === 'string' ? obj : obj.content,
+      }));
+      source = files.map(f => `// === ${f.name} ===\n${f.code}`).join('\n\n');
+    } catch {
+      files = [{ name: `${address}.sol`, code: source }];
+    }
+  } else {
+    files = [{ name: `${address}.sol`, code: source }];
+  }
+
+  return {
+    type: 'address',
+    name: result.ContractName || address,
+    address,
+    network,
+    compiler: result.CompilerVersion,
+    source,
+    files,
+  };
+}

package/src/utils/secure-config.js

@@ -0,0 +1,110 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// Enterprise config + audit trail
+//  - API key encrypted at rest (AES-256-GCM) with a machine-derived key
+//  - Append-only, hash-chained audit log (tamper-evident) — NIST RV / AU
+//
+// Note: machine-derived encryption protects against casual disk inspection and
+// accidental key commits. It is NOT a substitute for a real secrets manager
+// (Vault, AWS Secrets Manager). Enterprise deployments should set
+// ANTHROPIC_API_KEY via their secrets manager and skip stored keys entirely.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+export const CONFIG_DIR  = path.join(os.homedir(), '.solguard');
+export const CONFIG_FILE = path.join(CONFIG_DIR, 'config.enc');
+export const AUDIT_LOG   = path.join(CONFIG_DIR, 'audit.log');
+
+// Derive a key from stable machine + user attributes. Best-effort obfuscation.
+function machineKey() {
+  const material = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
+  return crypto.createHash('sha256').update(material + '::solguard-v2').digest();
+}
+
+export function saveConfig(obj) {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', machineKey(), iv);
+  const enc = Buffer.concat([cipher.update(JSON.stringify(obj), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const blob = Buffer.concat([iv, tag, enc]).toString('base64');
+  fs.writeFileSync(CONFIG_FILE, blob, { mode: 0o600 });
+}
+
+export function loadConfig() {
+  try {
+    if (!fs.existsSync(CONFIG_FILE)) return {};
+    const blob = Buffer.from(fs.readFileSync(CONFIG_FILE, 'utf8'), 'base64');
+    const iv = blob.subarray(0, 12);
+    const tag = blob.subarray(12, 28);
+    const enc = blob.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', machineKey(), iv);
+    decipher.setAuthTag(tag);
+    const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
+    return JSON.parse(dec.toString('utf8'));
+  } catch {
+    return {};
+  }
+}
+
+// ── Tamper-evident audit log ────────────────────────────────────────────────
+// Each entry includes a hash of the previous entry, forming a chain. Any edit
+// to a past entry breaks every subsequent hash — detectable via verifyAuditLog.
+export function auditAppend(event) {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+
+  let prevHash = 'GENESIS';
+  if (fs.existsSync(AUDIT_LOG)) {
+    const lines = fs.readFileSync(AUDIT_LOG, 'utf8').trim().split('\n').filter(Boolean);
+    if (lines.length) {
+      try { prevHash = JSON.parse(lines[lines.length - 1]).hash; } catch {}
+    }
+  }
+
+  const entry = {
+    ts: new Date().toISOString(),
+    event: event.type,
+    target: event.target ? redactTarget(event.target) : undefined,
+    findings: event.findings,
+    score: event.score,
+    actor: os.userInfo().username,
+    prevHash,
+  };
+  entry.hash = crypto.createHash('sha256')
+    .update(JSON.stringify({ ...entry, hash: undefined }))
+    .digest('hex');
+
+  fs.appendFileSync(AUDIT_LOG, JSON.stringify(entry) + '\n', { mode: 0o600 });
+  return entry.hash;
+}
+
+export function verifyAuditLog() {
+  if (!fs.existsSync(AUDIT_LOG)) return { valid: true, entries: 0 };
+  const lines = fs.readFileSync(AUDIT_LOG, 'utf8').trim().split('\n').filter(Boolean);
+  let prevHash = 'GENESIS';
+  for (let i = 0; i < lines.length; i++) {
+    let entry;
+    try {
+      entry = JSON.parse(lines[i]);
+    } catch {
+      return { valid: false, entries: lines.length, brokenAt: i + 1, reason: 'malformed entry' };
+    }
+    const recomputed = crypto.createHash('sha256')
+      .update(JSON.stringify({ ...entry, hash: undefined }))
+      .digest('hex');
+    if (entry.prevHash !== prevHash || entry.hash !== recomputed) {
+      return { valid: false, entries: lines.length, brokenAt: i + 1, reason: 'hash chain broken' };
+    }
+    prevHash = entry.hash;
+  }
+  return { valid: true, entries: lines.length };
+}
+
+// Don't write full local paths or full addresses to the audit log unnecessarily.
+function redactTarget(t) {
+  if (/^0x[0-9a-fA-F]{40}$/.test(t)) return t.slice(0, 10) + '…' + t.slice(-4);
+  return path.basename(t);
+}