agent-master-devsecops 0.0.0-stage → 3.9.0

package/scripts/atlassian_client.js

@@ -0,0 +1,238 @@
+#!/usr/bin/env node
+/**
+ * scripts/atlassian_client.js
+ * 
+ * Cliente Unificado e Utilitários de Comunicação com APIs REST Atlassian (Jira e Confluence).
+ * Centraliza autenticação, sanitização de domínio, introspecção de git e execução de requisições HTTPS.
+ * 
+ * Governança: Tríade Git + Jira + Confluence (Regra 11 e Regra 15).
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const https = require('node:https');
+const { execSync, execFileSync } = require('node:child_process');
+
+function sanitizeDomain(domainStr) {
+  if (!domainStr) return null;
+  return domainStr.replace(/^https?:\/\//, '').replace(/\/+$/, '');
+}
+
+function resolveMcpConfig() {
+  const homeDir = process.env.USERPROFILE || process.env.HOME || '';
+  const candidatePaths = [
+    path.join(homeDir, '.gemini', 'config', 'mcp_config.json'),
+    path.join(homeDir, '.antigravity', 'config', 'mcp_config.json'),
+    path.resolve(process.cwd(), '.mcp_config.json')
+  ];
+
+  for (const p of candidatePaths) {
+    if (fs.existsSync(p)) {
+      try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+      } catch (_) {}
+    }
+  }
+  return null;
+}
+
+function getAtlassianCredentials(targetDir = process.cwd()) {
+  let token = process.env.ATLASSIAN_API_TOKEN || process.env.JIRA_API_TOKEN || process.env.CONFLUENCE_API_TOKEN || process.env.PAT;
+  let email = process.env.ATLASSIAN_EMAIL || process.env.JIRA_EMAIL || process.env.CONFLUENCE_EMAIL || process.env.CONFLUENCE_USERNAME;
+  let rawDomain = process.env.ATLASSIAN_DOMAIN || process.env.JIRA_DOMAIN || process.env.CONFLUENCE_DOMAIN || process.env.JIRA_BASE_URL || process.env.CONFLUENCE_BASE_URL;
+  let source = (token && email && rawDomain) ? 'environment_variables' : null;
+
+  if (!process.env.IGNORE_LOCAL_ENV && (!token || !email || !rawDomain)) {
+    const isLocalWorkspace = path.resolve(targetDir) === path.resolve(process.cwd());
+    const candidateFiles = isLocalWorkspace
+      ? [
+          path.resolve(targetDir, '.env'),
+          path.resolve(targetDir, '..', '.env'),
+          path.resolve(process.cwd(), '.env'),
+          path.resolve(process.cwd(), '.env.local')
+        ]
+      : [
+          path.resolve(targetDir, '.env'),
+          path.resolve(targetDir, '.env.local')
+        ];
+
+    for (const envPath of candidateFiles) {
+      if (fs.existsSync(envPath)) {
+        try {
+          const raw = fs.readFileSync(envPath, 'utf8');
+          const dMatch = raw.match(/(?:ATLASSIAN_DOMAIN|JIRA_DOMAIN|CONFLUENCE_DOMAIN)=(.*)/);
+          const eMatch = raw.match(/(?:ATLASSIAN_EMAIL|JIRA_EMAIL|CONFLUENCE_EMAIL)=(.*)/);
+          const tMatch = raw.match(/(?:ATLASSIAN_API_TOKEN|JIRA_API_TOKEN|CONFLUENCE_API_TOKEN)=(.*)/);
+          if (dMatch && dMatch[1] && !rawDomain) rawDomain = dMatch[1].trim();
+          if (eMatch && eMatch[1] && !email) email = eMatch[1].trim();
+          if (tMatch && tMatch[1] && !token) token = tMatch[1].trim();
+          if (rawDomain && email && token) {
+            source = source || `local_file:${path.basename(envPath)}`;
+            break;
+          }
+        } catch (_) {}
+      }
+    }
+  }
+
+  const isLocalTarget = path.resolve(targetDir) === path.resolve(process.cwd());
+  if ((!token || !email || !rawDomain) && isLocalTarget) {
+    const mcp = resolveMcpConfig();
+    if (mcp && mcp.mcpServers) {
+      if (mcp.mcpServers.jira && mcp.mcpServers.jira.env) {
+        token = token || mcp.mcpServers.jira.env.JIRA_API_TOKEN;
+        email = email || mcp.mcpServers.jira.env.JIRA_EMAIL;
+        rawDomain = rawDomain || mcp.mcpServers.jira.env.JIRA_BASE_URL;
+        if (token && email && rawDomain) source = source || 'mcp_config:jira';
+      }
+      if (mcp.mcpServers.confluence && mcp.mcpServers.confluence.env) {
+        token = token || mcp.mcpServers.confluence.env.PAT;
+        if (token) source = source || 'mcp_config:confluence';
+      }
+    }
+  }
+
+  const cleanDomain = sanitizeDomain(rawDomain);
+  const isConfigured = Boolean(token && email && cleanDomain);
+  const auth = isConfigured ? Buffer.from(`${email}:${token}`).toString('base64') : null;
+
+  return {
+    domain: cleanDomain,
+    email: email || null,
+    token: token || null,
+    auth,
+    authBase64: auth,
+    isConfigured,
+    source
+  };
+}
+
+function checkGithubAuth(options = {}) {
+  const { globalStateCache } = require('./hot_state_cache.js');
+  const cacheKey = `gh_auth_${process.env.GITHUB_TOKEN || ''}_${process.env.GH_TOKEN || ''}`;
+  if (options && options.forceFresh) {
+    globalStateCache.invalidate(cacheKey);
+  }
+
+  return globalStateCache.wrap(cacheKey, () => {
+    let token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    let isAuthenticated = false;
+    let user = null;
+    let details = '';
+
+    try {
+      const stdout = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+      isAuthenticated = true;
+      details = stdout.trim();
+      const userMatch = stdout.match(/Logged in to [^\s]+ account ([^\s\(\)]+)/i) || stdout.match(/account ([^\s\(\)]+)/i);
+      if (userMatch) user = userMatch[1];
+    } catch (err) {
+      const output = (err.stdout || '') + (err.stderr || '');
+      if (/Logged in to/i.test(output)) {
+        isAuthenticated = true;
+        details = output.trim();
+        const userMatch = output.match(/account ([^\s\(\)]+)/i);
+        if (userMatch) user = userMatch[1];
+      } else if (token) {
+        isAuthenticated = true;
+        user = 'token-authenticated';
+        details = 'Autenticado via GITHUB_TOKEN.';
+      } else {
+        isAuthenticated = false;
+        details = output.trim() || 'Usuário não autenticado no GitHub CLI.';
+      }
+    }
+
+    return {
+      installed: true,
+      authenticated: isAuthenticated,
+      isAuthenticated,
+      token: token || null,
+      user,
+      details
+    };
+  }, 10000); // 10s TTL
+}
+
+function getGitRepositoryUrl() {
+  if (process.env.GITHUB_REPOSITORY) {
+    return `https://github.com/${process.env.GITHUB_REPOSITORY}`;
+  }
+
+  try {
+    const rawRemote = execFileSync('git', ['config', '--get', 'remote.origin.url'], { encoding: 'utf8' }).trim();
+    if (rawRemote.startsWith('git@github.com:')) {
+      return `https://github.com/${rawRemote.replace('git@github.com:', '').replace(/\.git$/, '')}`;
+    } else if (rawRemote.startsWith('https://github.com/')) {
+      return rawRemote.replace(/\.git$/, '');
+    }
+  } catch (_) {}
+
+  return 'https://github.com/ContalApps/agent-master-devsecops';
+}
+
+function getGitMetadata(options = {}) {
+  const { globalStateCache } = require('./hot_state_cache.js');
+  if (options && options.forceFresh) {
+    globalStateCache.invalidate('git_metadata');
+  }
+
+  return globalStateCache.wrap('git_metadata', () => {
+    let sha = '';
+    let branch = '';
+    let message = '';
+
+    try {
+      sha = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+      branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf8' }).trim();
+      message = execFileSync('git', ['log', '-1', '--format=%s', sha], { encoding: 'utf8' }).trim();
+    } catch (_) {}
+
+    return {
+      sha,
+      branch,
+      message,
+      repoUrl: getGitRepositoryUrl()
+    };
+  }, 5000); // 5s TTL
+}
+
+async function requestAtlassian(credentials, method, endpointPath, bodyData = null) {
+  return new Promise((resolve, reject) => {
+    const postData = bodyData ? JSON.stringify(bodyData) : null;
+    const req = https.request({
+      hostname: credentials.domain,
+      path: endpointPath,
+      method,
+      headers: {
+        'Authorization': `Basic ${credentials.auth || credentials.authBase64}`,
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+        ...(postData ? { 'Content-Length': Buffer.byteLength(postData) } : {})
+      }
+    }, res => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try {
+          resolve({ status: res.statusCode, body: data ? JSON.parse(data) : {} });
+        } catch (_) {
+          resolve({ status: res.statusCode, body: data });
+        }
+      });
+    });
+
+    req.on('error', reject);
+    if (postData) req.write(postData);
+    req.end();
+  });
+}
+
+module.exports = {
+  sanitizeDomain,
+  getAtlassianCredentials,
+  checkGithubAuth,
+  getGitRepositoryUrl,
+  getGitMetadata,
+  requestAtlassian
+};

package/scripts/atlassian_sync_action.js

@@ -0,0 +1,269 @@
+#!/usr/bin/env node
+/**
+ * scripts/atlassian_sync_action.js
+ * 
+ * Sincronizador Automático Git ↔ Atlassian via Actions & Local (AGDEV-23 / AGDEV-35).
+ * Conecta automaticamente commits, branches e Pull Requests aos cards do Jira
+ * utilizando a API oficial de Remote Links do Jira Cloud (REST API v3).
+ * 
+ * Blindado pela Regra 15: Imutabilidade de Requisitos & Zero Falhas Silenciosas.
+ */
+
+const { execFileSync } = require('child_process');
+const path = require('path');
+const {
+  getAtlassianConfig,
+  getGitMetadata,
+  getGitRepositoryUrl,
+  validateRule15
+} = require('./credentials_guard');
+
+function getAuth() {
+  const cfg = getAtlassianConfig();
+  return cfg.authBase64;
+}
+
+function extractIssueKeys(text) {
+  if (!text) return [];
+  const matches = text.match(/\b[A-Z]{2,10}-\d+\b/g) || [];
+  return [...new Set(matches.map(k => k.toUpperCase()))];
+}
+
+function extractPrNumber(text) {
+  if (!text) return null;
+  const match = text.match(/#(\d+)\b/) || text.match(/pull request #(\d+)/i);
+  return match ? match[1] : null;
+}
+
+function formatRemoteLinkPayload(url, title, type = 'commit', globalId = null, summary = null) {
+  let iconUrl = 'https://github.githubassets.com/favicons/favicon.png';
+  let relationship = 'causes';
+
+  if (type === 'pr') {
+    relationship = 'relates to';
+  } else if (type === 'branch') {
+    relationship = 'builds';
+  }
+
+  const payload = {
+    relationship,
+    object: {
+      url,
+      title,
+      icon: {
+        url16x16: iconUrl,
+        title: `GitHub ${type.toUpperCase()}`
+      }
+    }
+  };
+
+  if (globalId) {
+    payload.globalId = globalId;
+  }
+  if (summary) {
+    payload.object.summary = summary;
+  }
+
+  return payload;
+}
+
+async function linkUrlToJira(issueKey, url, title, type = 'commit', authOverride = null, globalId = null, summary = null) {
+  const atlassian = getAtlassianConfig();
+  const auth = authOverride || atlassian.authBase64;
+  if (!auth) {
+    return { status: 'FAILED', message: 'Credenciais Atlassian não configuradas no ambiente (Regra 15).' };
+  }
+
+  const cleanDomain = atlassian.domain;
+  if (!cleanDomain) {
+    return { status: 'FAILED', message: 'Domínio Atlassian não configurado para este projeto (Regra 15).' };
+  }
+  const payload = formatRemoteLinkPayload(url, title, type, globalId, summary);
+  const endpoint = `https://${cleanDomain}/rest/api/3/issue/${issueKey}/remotelink`;
+
+  try {
+    const res = await fetch(endpoint, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Basic ${auth}`,
+        'Content-Type': 'application/json',
+        'Accept': 'application/json'
+      },
+      body: JSON.stringify(payload)
+    });
+
+    if (res.ok || res.status === 201 || res.status === 200) {
+      return { status: 'SUCCESS', issueKey, url, type, httpStatus: res.status };
+    } else {
+      const errText = await res.text();
+      return { status: 'FAILED', issueKey, error: `HTTP ${res.status}: ${errText}` };
+    }
+  } catch (err) {
+    return { status: 'ERROR', issueKey, error: err.message };
+  }
+}
+
+async function backfillHistory(limit = 30) {
+  console.log(`[Atlassian Sync] Iniciando sincronização retroativa dos últimos ${limit} commits...`);
+  const atlassian = getAtlassianConfig();
+  if (!atlassian.isConfigured) {
+    throw new Error('Credenciais Atlassian ausentes para sincronização retroativa.');
+  }
+
+  const repoUrl = getGitRepositoryUrl();
+  const repoSlug = repoUrl.replace('https://github.com/', '');
+
+  let rawLog = '';
+  try {
+    rawLog = execFileSync('git', ['log', `-${limit}`, '--format=%H|%s'], { encoding: 'utf8' });
+  } catch (err) {
+    console.error('[Atlassian Sync] Falha ao extrair histórico git:', err.message);
+    return;
+  }
+
+  const lines = rawLog.split('\n').filter(l => l.trim().length > 0);
+  const results = [];
+
+  for (const line of lines) {
+    const [sha, ...subjectParts] = line.split('|');
+    const subject = subjectParts.join('|');
+    const keys = extractIssueKeys(subject);
+    const prNumber = extractPrNumber(subject);
+
+    for (const key of keys) {
+      // 1. Link Commit
+      const commitGlobalId = `system=github&repo=${repoSlug}&type=commit&sha=${sha}`;
+      const commitRes = await linkUrlToJira(
+        key,
+        `${repoUrl}/commit/${sha}`,
+        `GitHub Commit: ${sha.slice(0, 7)} (${subject})`,
+        'commit',
+        atlassian.authBase64,
+        commitGlobalId
+      );
+      results.push({ key, type: 'commit', ref: sha.slice(0, 7), status: commitRes.status });
+
+      // 2. Link PR if present in commit title
+      if (prNumber) {
+        const prGlobalId = `system=github&repo=${repoSlug}&type=pr&id=${prNumber}`;
+        const prRes = await linkUrlToJira(
+          key,
+          `${repoUrl}/pull/${prNumber}`,
+          `GitHub Pull Request #${prNumber}`,
+          'pr',
+          atlassian.authBase64,
+          prGlobalId,
+          subject
+        );
+        results.push({ key, type: 'pr', ref: `#${prNumber}`, status: prRes.status });
+      }
+    }
+  }
+
+  const successCount = results.filter(r => r.status === 'SUCCESS').length;
+  console.log(`[Atlassian Sync] Sincronização retroativa concluída: ${successCount}/${results.length} links processados com sucesso.`);
+  return results;
+}
+
+async function runCli() {
+  const isCI = process.env.GITHUB_ACTIONS === 'true';
+
+  // Validação Compulsória de Requisitos (Regra 15)
+  // Em CI, a ausência de secrets agora é ERRO CRÍTICO para impedir perda silenciosa
+  const validation = validateRule15({ failFast: isCI, requireGitHub: false, requireAtlassian: true });
+  if (!validation.valid) {
+    console.error(`[Atlassian Sync] Falha de validação da Regra 15:\n  ${validation.missing.join(', ')}`);
+    console.error(`  Remediação: ${validation.remediation.join('\n  ')}`);
+    if (isCI) {
+      process.exit(1);
+    }
+    return;
+  }
+
+  const args = process.argv.slice(2);
+  if (args.includes('--retroactive') || args.includes('-r')) {
+    const limitIdx = args.findIndex(a => a === '--retroactive' || a === '-r');
+    const limitVal = parseInt(args[limitIdx + 1], 10) || 30;
+    await backfillHistory(limitVal);
+    return;
+  }
+
+  const atlassian = getAtlassianConfig();
+  const gitMeta = getGitMetadata();
+  const repoUrl = gitMeta.repoUrl;
+  const repoSlug = repoUrl.replace('https://github.com/', '');
+
+  const sha = gitMeta.sha;
+  const branch = gitMeta.branch;
+  const message = gitMeta.message;
+  const prNumber = process.env.PR_NUMBER || extractPrNumber(process.env.PR_TITLE || '') || extractPrNumber(message);
+
+  const combined = `${branch} ${message} ${process.env.PR_TITLE || ''}`;
+  const keys = extractIssueKeys(combined);
+
+  if (keys.length === 0) {
+    console.log('[Atlassian Sync] Nenhuma chave Jira encontrada na branch ou mensagem de commit.');
+    return;
+  }
+
+  console.log(`[Atlassian Sync] Chaves Jira identificadas: ${keys.join(', ')}`);
+
+  for (const key of keys) {
+    if (sha && repoUrl) {
+      const commitGlobalId = `system=github&repo=${repoSlug}&type=commit&sha=${sha}`;
+      const commitRes = await linkUrlToJira(
+        key,
+        `${repoUrl}/commit/${sha}`,
+        `GitHub Commit: ${sha.slice(0, 7)} (${message})`,
+        'commit',
+        atlassian.authBase64,
+        commitGlobalId
+      );
+      console.log(`[Atlassian Sync] Commit ${sha.slice(0, 7)} vinculado a ${key}: ${commitRes.status}`);
+    }
+
+    if (branch && branch !== 'main' && branch !== 'HEAD' && repoUrl) {
+      const branchGlobalId = `system=github&repo=${repoSlug}&type=branch&name=${branch}`;
+      const branchRes = await linkUrlToJira(
+        key,
+        `${repoUrl}/tree/${branch}`,
+        `GitHub Branch: ${branch}`,
+        'branch',
+        atlassian.authBase64,
+        branchGlobalId
+      );
+      console.log(`[Atlassian Sync] Branch ${branch} vinculada a ${key}: ${branchRes.status}`);
+    }
+
+    if (prNumber && repoUrl) {
+      const prGlobalId = `system=github&repo=${repoSlug}&type=pr&id=${prNumber}`;
+      const prRes = await linkUrlToJira(
+        key,
+        `${repoUrl}/pull/${prNumber}`,
+        `GitHub Pull Request #${prNumber}`,
+        'pr',
+        atlassian.authBase64,
+        prGlobalId,
+        process.env.PR_TITLE || message
+      );
+      console.log(`[Atlassian Sync] PR #${prNumber} vinculado a ${key}: ${prRes.status}`);
+    }
+  }
+}
+
+if (require.main === module) {
+  runCli().catch(err => {
+    console.error('[Atlassian Sync] Erro fatal na execução:', err);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  getAuth,
+  extractIssueKeys,
+  extractPrNumber,
+  formatRemoteLinkPayload,
+  linkUrlToJira,
+  backfillHistory,
+  runCli
+};