agent-master-devsecops 0.0.0-stage → 5.1.0

package/scripts/integrations/atlassian_client.js

@@ -0,0 +1,600 @@
+#!/usr/bin/env node
+/**
+ * scripts/integrations/atlassian_client.js
+ * 
+ * Cliente Unificado e Utilitários de Comunicação com APIs REST Atlassian (Jira e Confluence).
+ * Centraliza autenticação, sanitização de domínio, introspecção de git e execução de requisições HTTPS.
+ * 
+ * Governança: Tríade Git + Jira + Confluence (Regra 11 e Regra 15).
+ * Conformidade: OASIS SARIF v2.1.0, Programação Defensiva e Clean Code.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const https = require('node:https');
+const { execFileSync } = require('node:child_process');
+const { createSarifReport } = require('../core/sarif_engine.js');
+
+/**
+ * Sanitiza o domínio Atlassian removendo protocolos, caminhos e barras residuais.
+ * @param {string} domainStr 
+ * @returns {string|null}
+ */
+function sanitizeDomain(domainStr) {
+  if (!domainStr || typeof domainStr !== 'string') return null;
+  const trimmed = domainStr.trim();
+  if (!trimmed) return null;
+
+  return trimmed
+    .replace(/^https?:\/\//i, '')
+    .split('/')[0]
+    .replace(/\/+$/, '')
+    .trim() || null;
+}
+
+/**
+ * Resolve as configurações locais de MCP em busca de credenciais Atlassian.
+ * @returns {object|null}
+ */
+function resolveMcpConfig() {
+  const homeDir = process.env.USERPROFILE || process.env.HOME || '';
+  const candidatePaths = [
+    path.join(homeDir, '.gemini', 'config', 'mcp_config.json'),
+    path.join(homeDir, '.antigravity', 'config', 'mcp_config.json'),
+    path.resolve(process.cwd(), '.mcp_config.json')
+  ];
+
+  for (const p of candidatePaths) {
+    if (fs.existsSync(p)) {
+      try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+      } catch (err) {
+        void err;
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Obtém credenciais Atlassian via variáveis de ambiente, arquivos .env ou mcp_config.json.
+ * @param {string} [targetDir=process.cwd()] 
+ * @returns {object}
+ */
+function getAtlassianCredentials(targetDir = process.cwd()) {
+  const safeTargetDir = (typeof targetDir === 'string' && targetDir.trim()) ? targetDir : process.cwd();
+
+  let token = process.env.ATLASSIAN_API_TOKEN || process.env.JIRA_API_TOKEN || process.env.CONFLUENCE_API_TOKEN || process.env.PAT;
+  let email = process.env.ATLASSIAN_EMAIL || process.env.JIRA_EMAIL || process.env.CONFLUENCE_EMAIL || process.env.CONFLUENCE_USERNAME;
+  let rawDomain = process.env.ATLASSIAN_DOMAIN || process.env.JIRA_DOMAIN || process.env.CONFLUENCE_DOMAIN || process.env.JIRA_BASE_URL || process.env.CONFLUENCE_BASE_URL;
+  let source = (token && email && rawDomain) ? 'environment_variables' : null;
+
+  if (!process.env.IGNORE_LOCAL_ENV && (!token || !email || !rawDomain)) {
+    const isLocalWorkspace = path.resolve(safeTargetDir) === path.resolve(process.cwd());
+    const candidateFiles = isLocalWorkspace
+      ? [
+          path.resolve(safeTargetDir, '.env'),
+          path.resolve(safeTargetDir, '..', '.env'),
+          path.resolve(process.cwd(), '.env'),
+          path.resolve(process.cwd(), '.env.local')
+        ]
+      : [
+          path.resolve(safeTargetDir, '.env'),
+          path.resolve(safeTargetDir, '.env.local')
+        ];
+
+    for (const envPath of candidateFiles) {
+      if (fs.existsSync(envPath)) {
+        try {
+          const raw = fs.readFileSync(envPath, 'utf8');
+          const dMatch = raw.match(/(?:ATLASSIAN_DOMAIN|JIRA_DOMAIN|CONFLUENCE_DOMAIN)=(.*)/);
+          const eMatch = raw.match(/(?:ATLASSIAN_EMAIL|JIRA_EMAIL|CONFLUENCE_EMAIL)=(.*)/);
+          const tMatch = raw.match(/(?:ATLASSIAN_API_TOKEN|JIRA_API_TOKEN|CONFLUENCE_API_TOKEN)=(.*)/);
+
+          if (dMatch && dMatch[1] && !rawDomain) rawDomain = dMatch[1].trim().replace(/^['"]|['"]$/g, '');
+          if (eMatch && eMatch[1] && !email) email = eMatch[1].trim().replace(/^['"]|['"]$/g, '');
+          if (tMatch && tMatch[1] && !token) token = tMatch[1].trim().replace(/^['"]|['"]$/g, '');
+
+          if (rawDomain && email && token) {
+            source = source || `local_file:${path.basename(envPath)}`;
+            break;
+          }
+        } catch (err) {
+          void err;
+        }
+      }
+    }
+  }
+
+  const isLocalTarget = path.resolve(safeTargetDir) === path.resolve(process.cwd());
+  if ((!token || !email || !rawDomain) && isLocalTarget) {
+    const mcp = resolveMcpConfig();
+    if (mcp && mcp.mcpServers) {
+      if (mcp.mcpServers.jira && mcp.mcpServers.jira.env) {
+        token = token || mcp.mcpServers.jira.env.JIRA_API_TOKEN;
+        email = email || mcp.mcpServers.jira.env.JIRA_EMAIL;
+        rawDomain = rawDomain || mcp.mcpServers.jira.env.JIRA_BASE_URL;
+        if (token && email && rawDomain) source = source || 'mcp_config:jira';
+      }
+      if (mcp.mcpServers.confluence && mcp.mcpServers.confluence.env) {
+        token = token || mcp.mcpServers.confluence.env.PAT;
+        if (token) source = source || 'mcp_config:confluence';
+      }
+    }
+  }
+
+  const cleanDomain = sanitizeDomain(rawDomain);
+  const isConfigured = Boolean(token && email && cleanDomain);
+  const auth = isConfigured ? Buffer.from(`${email}:${token}`).toString('base64') : null;
+
+  return Object.freeze({
+    domain: cleanDomain,
+    email: email || null,
+    token: token || null,
+    auth,
+    authBase64: auth,
+    isConfigured,
+    source
+  });
+}
+
+/**
+ * Verifica autenticação do GitHub via gh CLI ou variáveis de ambiente.
+ * @param {object} [options={}] 
+ * @returns {object}
+ */
+function checkGithubAuth(options = {}) {
+  const { globalStateCache } = require('../core/hot_state_cache.js');
+  const cacheKey = `gh_auth_${process.env.GITHUB_TOKEN || ''}_${process.env.GH_TOKEN || ''}`;
+  if (options && options.forceFresh) {
+    globalStateCache.invalidate(cacheKey);
+  }
+
+  return globalStateCache.wrap(cacheKey, () => {
+    let token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    let isAuthenticated = false;
+    let user = null;
+    let details = '';
+    let installed = true;
+
+    try {
+      const stdout = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+      isAuthenticated = true;
+      details = stdout.trim();
+      const userMatch = stdout.match(/Logged in to [^\s]+ account ([^\s\(\)]+)/i) || stdout.match(/account ([^\s\(\)]+)/i);
+      if (userMatch) user = userMatch[1];
+    } catch (err) {
+      if (err && err.code === 'ENOENT') {
+        installed = false;
+      }
+      const output = (err.stdout || '') + (err.stderr || '');
+      if (/Logged in to/i.test(output)) {
+        isAuthenticated = true;
+        details = output.trim();
+        const userMatch = output.match(/account ([^\s\(\)]+)/i);
+        if (userMatch) user = userMatch[1];
+      } else if (token) {
+        isAuthenticated = true;
+        user = 'token-authenticated';
+        details = 'Autenticado via GITHUB_TOKEN.';
+      } else {
+        isAuthenticated = false;
+        details = output.trim() || (installed ? 'Usuário não autenticado no GitHub CLI.' : 'GitHub CLI (gh) não está instalado no PATH.');
+      }
+    }
+
+    return Object.freeze({
+      installed,
+      authenticated: isAuthenticated,
+      isAuthenticated,
+      token: token || null,
+      user,
+      details
+    });
+  }, 10000); // 10s TTL
+}
+
+/**
+ * Recupera a URL canônica do repositório Git.
+ * @returns {string}
+ */
+function getGitRepositoryUrl() {
+  if (process.env.GITHUB_REPOSITORY) {
+    return `https://github.com/${process.env.GITHUB_REPOSITORY}`;
+  }
+
+  try {
+    const rawRemote = execFileSync('git', ['config', '--get', 'remote.origin.url'], { encoding: 'utf8' }).trim();
+    if (rawRemote.startsWith('git@github.com:')) {
+      return `https://github.com/${rawRemote.replace('git@github.com:', '').replace(/\.git$/, '')}`;
+    } else if (rawRemote.startsWith('https://github.com/')) {
+      return rawRemote.replace(/\.git$/, '');
+    }
+  } catch (err) {
+    void err;
+  }
+
+  return 'https://github.com/ContalApps/agent-master-devsecops';
+}
+
+/**
+ * Coleta metadados essenciais do repositório Git local (branch, SHA, commit, autor).
+ * @param {object} [options={}] 
+ * @returns {object}
+ */
+function getGitMetadata(options = {}) {
+  const { globalStateCache } = require('../core/hot_state_cache.js');
+  if (options && options.forceFresh) {
+    globalStateCache.invalidate('git_metadata');
+  }
+
+  return globalStateCache.wrap('git_metadata', () => {
+    let sha = '';
+    let branch = '';
+    let message = '';
+    let authorName = '';
+
+    try {
+      sha = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+      branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { encoding: 'utf8' }).trim();
+      message = execFileSync('git', ['log', '-1', '--format=%s', sha], { encoding: 'utf8' }).trim();
+      authorName = execFileSync('git', ['log', '-1', '--format=%an', sha], { encoding: 'utf8' }).trim();
+    } catch (err) {
+      void err;
+    }
+
+    return Object.freeze({
+      sha,
+      shortSha: sha ? sha.slice(0, 7) : 'unknown',
+      branch,
+      message,
+      commitMessage: message,
+      authorName: authorName || process.env.GIT_AUTHOR || 'DevSecOps Bot',
+      repoUrl: getGitRepositoryUrl()
+    });
+  }, 5000); // 5s TTL
+}
+
+/**
+ * Executa requisições HTTPS para a API REST da Atlassian de forma segura e resiliente.
+ * @param {object} credentials 
+ * @param {string} [method='GET'] 
+ * @param {string} [endpointPath='/'] 
+ * @param {any} [bodyData=null] 
+ * @param {object} [options={}] 
+ * @returns {Promise<{ status: number, body: any }>}
+ */
+async function requestAtlassian(credentials, method = 'GET', endpointPath = '/', bodyData = null, options = {}) {
+  return new Promise((resolve, reject) => {
+    if (!credentials || typeof credentials !== 'object') {
+      return reject(new Error('AtlassianClient: credentials object is required'));
+    }
+
+    const domain = sanitizeDomain(credentials.domain);
+    if (!domain) {
+      return reject(new Error('AtlassianClient: valid domain is required'));
+    }
+
+    const safeOptions = (options && typeof options === 'object') ? options : {};
+    const timeout = Number.isInteger(safeOptions.timeout) && safeOptions.timeout > 0
+      ? safeOptions.timeout
+      : 30000;
+
+    const postData = (bodyData !== null && bodyData !== undefined)
+      ? (typeof bodyData === 'string' ? bodyData : JSON.stringify(bodyData))
+      : null;
+
+    let authHeader = '';
+    if (credentials.auth || credentials.authBase64) {
+      authHeader = `Basic ${credentials.auth || credentials.authBase64}`;
+    } else if (credentials.token) {
+      if (credentials.email) {
+        authHeader = `Basic ${Buffer.from(`${credentials.email}:${credentials.token}`).toString('base64')}`;
+      } else {
+        authHeader = `Bearer ${credentials.token}`;
+      }
+    }
+
+    const headers = {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'User-Agent': safeOptions.userAgent || 'agent-master-devsecops/5.1',
+      ...(authHeader ? { 'Authorization': authHeader } : {}),
+      ...(postData ? { 'Content-Length': Buffer.byteLength(postData) } : {}),
+      ...(safeOptions.headers || {})
+    };
+
+    const req = https.request({
+      hostname: domain,
+      path: endpointPath,
+      method: (method || 'GET').toUpperCase(),
+      headers
+    }, res => {
+      let data = '';
+      res.on('data', chunk => { data += chunk; });
+      res.on('end', () => {
+        try {
+          resolve({ status: res.statusCode, body: data ? JSON.parse(data) : {} });
+        } catch (err) {
+          // Fallback quando resposta não for JSON
+          resolve({ status: res.statusCode, body: data });
+        }
+      });
+    });
+
+    req.setTimeout(timeout, () => {
+      req.destroy(new Error(`AtlassianClient: Request timed out after ${timeout}ms for ${domain}${endpointPath}`));
+    });
+
+    req.on('error', reject);
+
+    if (postData) {
+      req.write(postData);
+    }
+    req.end();
+  });
+}
+
+/**
+ * Formata um relatório executivo em Markdown sobre a saúde das integrações da Tríade.
+ * @param {string} [targetDir=process.cwd()] 
+ * @returns {string}
+ */
+function formatReport(targetDir = process.cwd()) {
+  const atlassian = getAtlassianCredentials(targetDir);
+  const github = checkGithubAuth();
+  const git = getGitMetadata();
+
+  let md = '# 🔗 Atlassian & Git Client Integration Status Report\n\n';
+
+  const isAllReady = atlassian.isConfigured && github.isAuthenticated && Boolean(git.sha);
+  md += `**Status da Tríade:** \`${isAllReady ? 'HOMOLOGADA' : 'PARCIAL / PENDENTE'}\`\n\n`;
+
+  md += '### 1. Integração Atlassian (Jira & Confluence)\n';
+  md += `- **Configurado:** \`${atlassian.isConfigured ? 'SIM' : 'NÃO'}\`\n`;
+  md += `- **Domínio:** \`${atlassian.domain || 'N/A'}\`\n`;
+  md += `- **E-mail:** \`${atlassian.email || 'N/A'}\`\n`;
+  md += `- **API Token:** \`${atlassian.token ? '***CONFIGURADO***' : 'AUSENTE'}\`\n`;
+  md += `- **Origem:** \`${atlassian.source || 'NÃO ENCONTRADO'}\`\n\n`;
+
+  md += '### 2. Autenticação GitHub\n';
+  md += `- **Autenticado:** \`${github.isAuthenticated ? 'SIM' : 'NÃO'}\`\n`;
+  md += `- **Usuário:** \`${github.user || 'N/A'}\`\n`;
+  md += `- **Detalhes:** ${github.details || 'N/A'}\n\n`;
+
+  md += '### 3. Repositório Git Local\n';
+  md += `- **Repositório:** \`${git.repoUrl || 'N/A'}\`\n`;
+  md += `- **Branch Ativa:** \`${git.branch || 'N/A'}\`\n`;
+  md += `- **Último Commit:** \`${git.shortSha || 'N/A'}\` — ${git.message || 'Sem mensagem'}\n`;
+  md += `- **Autor:** \`${git.authorName || 'N/A'}\`\n`;
+
+  return md;
+}
+
+/**
+ * Audita a integridade e prontidão da Tríade emitindo relatório OASIS SARIF v2.1.0.
+ * @param {string} [targetDir=process.cwd()] 
+ * @returns {object} SARIF v2.1.0 JSON object
+ */
+function auditToSarif(targetDir = process.cwd()) {
+  const atlassian = getAtlassianCredentials(targetDir);
+  const github = checkGithubAuth();
+  const git = getGitMetadata();
+
+  const rules = [
+    {
+      id: 'RULE-ATL-001',
+      name: 'AtlassianCredentialsMissing',
+      severity: 'WARNING',
+      message: 'Credenciais Atlassian não configuradas para Jira/Confluence.',
+      remediation: 'Configurar variáveis ATLASSIAN_DOMAIN, ATLASSIAN_EMAIL e ATLASSIAN_API_TOKEN ou executar agent_configure_credentials.',
+      cwe: 'CWE-200'
+    },
+    {
+      id: 'RULE-GH-001',
+      name: 'GitHubAuthMissing',
+      severity: 'NOTE',
+      message: 'GitHub CLI ou GITHUB_TOKEN não autenticado.',
+      remediation: 'Executar gh auth login ou exportar GITHUB_TOKEN.',
+      cwe: 'CWE-287'
+    },
+    {
+      id: 'RULE-GIT-001',
+      name: 'GitRepoUninitialized',
+      severity: 'WARNING',
+      message: 'Diretório não possui repositório Git ou commits válidos.',
+      remediation: 'Inicializar repositório Git com git init e criar o commit canônico.',
+      cwe: 'CWE-1059'
+    }
+  ];
+
+  const findings = [];
+
+  if (!atlassian.isConfigured) {
+    findings.push({
+      ruleId: 'RULE-ATL-001',
+      severity: 'WARNING',
+      message: `Credenciais Atlassian incompletas (domínio: ${atlassian.domain ? 'ok' : 'falta'}, email: ${atlassian.email ? 'ok' : 'falta'}, token: ${atlassian.token ? 'ok' : 'falta'}). Operando em resiliência local.`,
+      filename: '.env',
+      line: 1,
+      column: 1
+    });
+  }
+
+  if (!github.isAuthenticated) {
+    findings.push({
+      ruleId: 'RULE-GH-001',
+      severity: 'NOTE',
+      message: `GitHub não autenticado (${github.details}).`,
+      filename: '.env',
+      line: 1,
+      column: 1
+    });
+  }
+
+  if (!git.sha || !git.branch) {
+    findings.push({
+      ruleId: 'RULE-GIT-001',
+      severity: 'WARNING',
+      message: 'Metadados Git ausentes ou incompletos.',
+      filename: '.git',
+      line: 1,
+      column: 1
+    });
+  }
+
+  return createSarifReport({
+    toolName: 'agent-master-atlassian-client',
+    toolVersion: '5.1.0',
+    rules,
+    findings,
+    properties: {
+      category: 'Governance & Credentials Healthcheck',
+      atlassianConfigured: atlassian.isConfigured,
+      githubAuthenticated: github.isAuthenticated,
+      gitSha: git.sha || 'unknown'
+    }
+  });
+}
+
+/**
+ * Classe Canônica AtlassianClient.
+ * Fornece interface orientada a objetos para requisições Atlassian REST,
+ * inspeção de Git/GitHub e auditorias em SARIF v2.1.0.
+ */
+class AtlassianClient {
+  constructor(credentialsOrTargetDir = {}, options = {}) {
+    let credentials = null;
+    let targetDir = process.cwd();
+    let safeOptions = {};
+
+    if (typeof credentialsOrTargetDir === 'string') {
+      targetDir = credentialsOrTargetDir;
+      safeOptions = (options && typeof options === 'object') ? options : {};
+      credentials = getAtlassianCredentials(targetDir);
+    } else if (credentialsOrTargetDir && typeof credentialsOrTargetDir === 'object') {
+      if (credentialsOrTargetDir.isConfigured !== undefined || credentialsOrTargetDir.domain || credentialsOrTargetDir.token) {
+        credentials = credentialsOrTargetDir;
+        safeOptions = (options && typeof options === 'object') ? options : {};
+      } else {
+        safeOptions = credentialsOrTargetDir;
+        targetDir = safeOptions.targetDir || process.cwd();
+        credentials = getAtlassianCredentials(targetDir);
+      }
+    } else {
+      credentials = getAtlassianCredentials(targetDir);
+      safeOptions = (options && typeof options === 'object') ? options : {};
+    }
+
+    this.credentials = credentials;
+    this.targetDir = targetDir;
+    this.options = Object.freeze({
+      timeout: safeOptions.timeout || 30000,
+      userAgent: safeOptions.userAgent || 'agent-master-devsecops/5.1',
+      ...safeOptions
+    });
+  }
+
+  isConfigured() {
+    return Boolean(this.credentials && this.credentials.isConfigured);
+  }
+
+  getCredentials() {
+    return this.credentials;
+  }
+
+  async request(method, endpointPath, bodyData = null, requestOptions = {}) {
+    return requestAtlassian(this.credentials, method, endpointPath, bodyData, {
+      ...this.options,
+      ...requestOptions
+    });
+  }
+
+  async get(endpointPath, requestOptions = {}) {
+    return this.request('GET', endpointPath, null, requestOptions);
+  }
+
+  async post(endpointPath, bodyData, requestOptions = {}) {
+    return this.request('POST', endpointPath, bodyData, requestOptions);
+  }
+
+  async put(endpointPath, bodyData, requestOptions = {}) {
+    return this.request('PUT', endpointPath, bodyData, requestOptions);
+  }
+
+  async delete(endpointPath, requestOptions = {}) {
+    return this.request('DELETE', endpointPath, null, requestOptions);
+  }
+
+  checkGithub(options = {}) {
+    return checkGithubAuth(options);
+  }
+
+  getGitMetadata(options = {}) {
+    return getGitMetadata(options);
+  }
+
+  getGitRepositoryUrl() {
+    return getGitRepositoryUrl();
+  }
+
+  formatReport() {
+    return formatReport(this.targetDir);
+  }
+
+  auditToSarif() {
+    return auditToSarif(this.targetDir);
+  }
+
+  // Métodos Estáticos Canônicos
+  static sanitizeDomain(domainStr) {
+    return sanitizeDomain(domainStr);
+  }
+
+  static resolveMcpConfig() {
+    return resolveMcpConfig();
+  }
+
+  static getCredentials(targetDir) {
+    return getAtlassianCredentials(targetDir);
+  }
+
+  static checkGithubAuth(options) {
+    return checkGithubAuth(options);
+  }
+
+  static getGitRepositoryUrl() {
+    return getGitRepositoryUrl();
+  }
+
+  static getGitMetadata(options) {
+    return getGitMetadata(options);
+  }
+
+  static async request(credentials, method, endpointPath, bodyData, options) {
+    return requestAtlassian(credentials, method, endpointPath, bodyData, options);
+  }
+
+  static formatReport(targetDir) {
+    return formatReport(targetDir);
+  }
+
+  static auditToSarif(targetDir) {
+    return auditToSarif(targetDir);
+  }
+}
+
+module.exports = {
+  AtlassianClient,
+  sanitizeDomain,
+  getAtlassianCredentials,
+  checkGithubAuth,
+  getGitRepositoryUrl,
+  getGitMetadata,
+  requestAtlassian,
+  formatReport,
+  auditToSarif
+};
+