aura-security 0.4.0

package/dist/output/index.js

@@ -0,0 +1,399 @@
+// Output Format Generators
+// Supports: SARIF 2.1.0, JUnit XML, JSON Summary, GitLab Security Report
+// Severity to SARIF level mapping
+function severityToLevel(severity) {
+    switch (severity.toLowerCase()) {
+        case 'critical':
+        case 'high':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+            return 'note';
+        default:
+            return 'none';
+    }
+}
+// Severity to security-severity score (for GitHub)
+function severityToScore(severity) {
+    switch (severity.toLowerCase()) {
+        case 'critical': return '9.0';
+        case 'high': return '7.0';
+        case 'medium': return '5.0';
+        case 'low': return '3.0';
+        default: return '1.0';
+    }
+}
+// Generate SARIF report from scan results
+export function toSARIF(result, targetPath) {
+    const rules = [];
+    const results = [];
+    const ruleIds = new Set();
+    // Helper to add rule if not exists
+    const addRule = (id, name, description, severity, tags) => {
+        if (!ruleIds.has(id)) {
+            ruleIds.add(id);
+            rules.push({
+                id,
+                name,
+                shortDescription: { text: description },
+                defaultConfiguration: { level: severityToLevel(severity) },
+                properties: {
+                    tags,
+                    'security-severity': severityToScore(severity)
+                }
+            });
+        }
+    };
+    // Process secrets
+    for (const secret of result.secrets) {
+        const ruleId = `secret/${secret.type.toLowerCase().replace(/\s+/g, '-')}`;
+        addRule(ruleId, `Secret: ${secret.type}`, `Potential secret or credential found: ${secret.type}`, secret.severity, ['security', 'secret-detection']);
+        results.push({
+            ruleId,
+            level: severityToLevel(secret.severity),
+            message: { text: `Found ${secret.type} in source code` },
+            locations: [{
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: secret.file.replace(targetPath ? targetPath + '/' : '', ''),
+                            uriBaseId: '%SRCROOT%'
+                        },
+                        region: {
+                            startLine: secret.line
+                        }
+                    }
+                }]
+        });
+    }
+    // Process package vulnerabilities
+    for (const pkg of result.packages) {
+        const ruleId = pkg.vulnId ? `vuln/${pkg.vulnId}` : `vuln/${pkg.name}`;
+        addRule(ruleId, pkg.vulnId || `Vulnerability in ${pkg.name}`, pkg.title || `Security vulnerability in ${pkg.name}@${pkg.version}`, pkg.severity, ['security', 'dependency', 'vulnerability']);
+        results.push({
+            ruleId,
+            level: severityToLevel(pkg.severity),
+            message: {
+                text: `${pkg.name}@${pkg.version}: ${pkg.title || pkg.vulnId || 'vulnerability found'}${pkg.fixedVersion ? ` (fix: ${pkg.fixedVersion})` : ''}`
+            },
+            fixes: pkg.fixedVersion ? [{
+                    description: { text: `Upgrade to version ${pkg.fixedVersion}` }
+                }] : undefined
+        });
+    }
+    // Process SAST findings
+    for (const sast of result.sastFindings) {
+        const ruleId = `sast/${sast.rule.replace(/[^a-zA-Z0-9-]/g, '-')}`;
+        addRule(ruleId, sast.rule, sast.message, sast.severity, ['security', 'sast']);
+        results.push({
+            ruleId,
+            level: severityToLevel(sast.severity),
+            message: { text: sast.message },
+            locations: [{
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: sast.file.replace(targetPath ? targetPath + '/' : '', ''),
+                            uriBaseId: '%SRCROOT%'
+                        },
+                        region: {
+                            startLine: sast.line
+                        }
+                    }
+                }]
+        });
+    }
+    // Process IaC findings
+    for (const iac of result.iacFindings) {
+        const ruleId = `iac/${iac.checkId}`;
+        addRule(ruleId, iac.checkId, iac.title, iac.severity, ['security', 'iac', iac.checkType]);
+        results.push({
+            ruleId,
+            level: severityToLevel(iac.severity),
+            message: { text: `${iac.title} - Resource: ${iac.resource}` },
+            locations: [{
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: iac.file.replace(targetPath ? targetPath + '/' : '', ''),
+                            uriBaseId: '%SRCROOT%'
+                        }
+                    }
+                }],
+            fixes: iac.guideline ? [{
+                    description: { text: iac.guideline }
+                }] : undefined
+        });
+    }
+    // Process Dockerfile findings
+    for (const docker of result.dockerfileFindings) {
+        const ruleId = `dockerfile/${docker.code}`;
+        addRule(ruleId, docker.code, docker.message, docker.severity, ['security', 'dockerfile', 'container']);
+        results.push({
+            ruleId,
+            level: severityToLevel(docker.severity),
+            message: { text: docker.message },
+            locations: [{
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: docker.file.replace(targetPath ? targetPath + '/' : '', ''),
+                            uriBaseId: '%SRCROOT%'
+                        },
+                        region: {
+                            startLine: docker.line
+                        }
+                    }
+                }]
+        });
+    }
+    return {
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+        version: '2.1.0',
+        runs: [{
+                tool: {
+                    driver: {
+                        name: 'AuraSecurity',
+                        informationUri: 'https://github.com/aurasecurity/aura-security',
+                        version: '0.2.0',
+                        rules
+                    }
+                },
+                results,
+                invocations: [{
+                        executionSuccessful: true,
+                        endTimeUtc: new Date().toISOString()
+                    }]
+            }]
+    };
+}
+// ============ JUnit XML Format ============
+export function toJUnit(result) {
+    const totalTests = result.secrets.length + result.packages.length +
+        result.sastFindings.length + result.iacFindings.length +
+        result.dockerfileFindings.length;
+    const failures = result.secrets.filter(s => s.severity === 'critical' || s.severity === 'high').length +
+        result.packages.filter(p => p.severity === 'critical' || p.severity === 'high').length +
+        result.iacFindings.filter(i => i.severity === 'critical' || i.severity === 'high').length +
+        result.dockerfileFindings.filter(d => d.severity === 'critical' || d.severity === 'high').length;
+    let xml = `<?xml version="1.0" encoding="UTF-8"?>
+<testsuites name="AuraSecurity Security Scan" tests="${totalTests}" failures="${failures}" time="0">
+  <testsuite name="Secrets" tests="${result.secrets.length}" failures="${result.secrets.filter(s => s.severity === 'critical' || s.severity === 'high').length}">
+`;
+    for (const secret of result.secrets) {
+        const isFailure = secret.severity === 'critical' || secret.severity === 'high';
+        xml += `    <testcase name="${escapeXml(secret.type)}" classname="${escapeXml(secret.file)}">\n`;
+        if (isFailure) {
+            xml += `      <failure message="${escapeXml(secret.type)} found at line ${secret.line}" type="${secret.severity}">${escapeXml(secret.snippet)}</failure>\n`;
+        }
+        xml += `    </testcase>\n`;
+    }
+    xml += `  </testsuite>
+  <testsuite name="Vulnerabilities" tests="${result.packages.length}" failures="${result.packages.filter(p => p.severity === 'critical' || p.severity === 'high').length}">
+`;
+    for (const pkg of result.packages) {
+        const isFailure = pkg.severity === 'critical' || pkg.severity === 'high';
+        xml += `    <testcase name="${escapeXml(pkg.name)}@${escapeXml(pkg.version)}" classname="dependencies">\n`;
+        if (isFailure) {
+            xml += `      <failure message="${escapeXml(pkg.vulnId || 'vulnerability')}" type="${pkg.severity}">${escapeXml(pkg.title || '')}</failure>\n`;
+        }
+        xml += `    </testcase>\n`;
+    }
+    xml += `  </testsuite>
+  <testsuite name="IaC" tests="${result.iacFindings.length}" failures="${result.iacFindings.filter(i => i.severity === 'critical' || i.severity === 'high').length}">
+`;
+    for (const iac of result.iacFindings) {
+        const isFailure = iac.severity === 'critical' || iac.severity === 'high';
+        xml += `    <testcase name="${escapeXml(iac.checkId)}" classname="${escapeXml(iac.file)}">\n`;
+        if (isFailure) {
+            xml += `      <failure message="${escapeXml(iac.title)}" type="${iac.severity}">${escapeXml(iac.guideline || '')}</failure>\n`;
+        }
+        xml += `    </testcase>\n`;
+    }
+    xml += `  </testsuite>
+</testsuites>`;
+    return xml;
+}
+function escapeXml(str) {
+    return str
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+function toGitLabSeverity(severity) {
+    switch (severity.toLowerCase()) {
+        case 'critical': return 'Critical';
+        case 'high': return 'High';
+        case 'medium': return 'Medium';
+        case 'low': return 'Low';
+        default: return 'Unknown';
+    }
+}
+export function toGitLabReport(result, reportType) {
+    const vulnerabilities = [];
+    const startTime = new Date().toISOString();
+    if (reportType === 'secret_detection') {
+        for (const secret of result.secrets) {
+            vulnerabilities.push({
+                id: `secret-${Buffer.from(secret.file + secret.line).toString('base64').substring(0, 16)}`,
+                category: 'secret_detection',
+                name: secret.type,
+                message: `${secret.type} detected`,
+                description: `Potential secret found in ${secret.file}`,
+                severity: toGitLabSeverity(secret.severity),
+                confidence: 'High',
+                scanner: {
+                    id: 'aura-security-secrets',
+                    name: 'AuraSecurity Secret Detection'
+                },
+                location: {
+                    file: secret.file,
+                    start_line: secret.line,
+                    end_line: secret.line
+                },
+                identifiers: [{
+                        type: 'aura_security_secret',
+                        name: secret.type,
+                        value: secret.type
+                    }]
+            });
+        }
+    }
+    if (reportType === 'dependency_scanning') {
+        for (const pkg of result.packages) {
+            vulnerabilities.push({
+                id: pkg.vulnId || `dep-${Buffer.from(pkg.name + pkg.version).toString('base64').substring(0, 16)}`,
+                category: 'dependency_scanning',
+                name: pkg.vulnId || `Vulnerability in ${pkg.name}`,
+                message: pkg.title || `Security vulnerability in ${pkg.name}`,
+                description: `${pkg.name}@${pkg.version} has a known vulnerability`,
+                severity: toGitLabSeverity(pkg.severity),
+                scanner: {
+                    id: 'aura-security-deps',
+                    name: 'AuraSecurity Dependency Scanning'
+                },
+                location: {
+                    dependency: {
+                        package: { name: pkg.name },
+                        version: pkg.version
+                    }
+                },
+                identifiers: pkg.vulnId ? [{
+                        type: pkg.vulnId.startsWith('CVE') ? 'cve' : 'ghsa',
+                        name: pkg.vulnId,
+                        value: pkg.vulnId,
+                        url: pkg.vulnId.startsWith('CVE')
+                            ? `https://nvd.nist.gov/vuln/detail/${pkg.vulnId}`
+                            : `https://github.com/advisories/${pkg.vulnId}`
+                    }] : [],
+                solution: pkg.fixedVersion ? `Upgrade to version ${pkg.fixedVersion}` : undefined
+            });
+        }
+    }
+    if (reportType === 'sast') {
+        for (const sast of result.sastFindings) {
+            vulnerabilities.push({
+                id: `sast-${Buffer.from(sast.file + sast.line + sast.rule).toString('base64').substring(0, 16)}`,
+                category: 'sast',
+                name: sast.rule,
+                message: sast.message,
+                description: sast.message,
+                severity: toGitLabSeverity(sast.severity),
+                scanner: {
+                    id: 'aura-security-sast',
+                    name: 'AuraSecurity SAST'
+                },
+                location: {
+                    file: sast.file,
+                    start_line: sast.line
+                },
+                identifiers: [{
+                        type: 'semgrep_rule',
+                        name: sast.rule,
+                        value: sast.rule
+                    }]
+            });
+        }
+        // Include IaC in SAST report
+        for (const iac of result.iacFindings) {
+            vulnerabilities.push({
+                id: `iac-${Buffer.from(iac.file + iac.checkId).toString('base64').substring(0, 16)}`,
+                category: 'sast',
+                name: iac.checkId,
+                message: iac.title,
+                description: iac.guideline || iac.title,
+                severity: toGitLabSeverity(iac.severity),
+                scanner: {
+                    id: 'aura-security-iac',
+                    name: 'AuraSecurity IaC'
+                },
+                location: {
+                    file: iac.file
+                },
+                identifiers: [{
+                        type: 'checkov_check',
+                        name: iac.checkId,
+                        value: iac.checkId
+                    }],
+                solution: iac.guideline
+            });
+        }
+    }
+    return {
+        version: '15.0.0',
+        vulnerabilities,
+        scan: {
+            analyzer: {
+                id: 'aura-security',
+                name: 'AuraSecurity',
+                version: '0.2.0',
+                vendor: { name: 'AuraSecurity' }
+            },
+            scanner: {
+                id: 'aura-security',
+                name: 'AuraSecurity',
+                version: '0.2.0',
+                vendor: { name: 'AuraSecurity' }
+            },
+            type: reportType,
+            start_time: startTime,
+            end_time: new Date().toISOString(),
+            status: 'success'
+        }
+    };
+}
+export function toJSONSummary(result) {
+    const critical = result.secrets.filter(s => s.severity === 'critical').length +
+        result.packages.filter(p => p.severity === 'critical').length +
+        result.iacFindings.filter(i => i.severity === 'critical').length +
+        result.dockerfileFindings.filter(d => d.severity === 'critical').length;
+    const high = result.secrets.filter(s => s.severity === 'high').length +
+        result.packages.filter(p => p.severity === 'high').length +
+        result.iacFindings.filter(i => i.severity === 'high').length +
+        result.dockerfileFindings.filter(d => d.severity === 'high').length;
+    const medium = result.secrets.filter(s => s.severity === 'medium').length +
+        result.packages.filter(p => p.severity === 'medium').length +
+        result.iacFindings.filter(i => i.severity === 'medium').length +
+        result.dockerfileFindings.filter(d => d.severity === 'medium').length;
+    const low = result.secrets.filter(s => s.severity === 'low').length +
+        result.packages.filter(p => p.severity === 'low').length +
+        result.iacFindings.filter(i => i.severity === 'low').length +
+        result.dockerfileFindings.filter(d => d.severity === 'low').length;
+    const total = critical + high + medium + low;
+    return {
+        scan: {
+            path: result.path,
+            timestamp: result.timestamp,
+            tools: result.toolsUsed,
+            languages: result.languagesDetected
+        },
+        summary: { total, critical, high, medium, low },
+        findings: {
+            secrets: result.secrets.length,
+            vulnerabilities: result.packages.length,
+            sast: result.sastFindings.length,
+            iac: result.iacFindings.length,
+            dockerfile: result.dockerfileFindings.length
+        },
+        exitCode: critical > 0 ? 2 : high > 0 ? 1 : 0
+    };
+}

package/dist/pipeline/index.d.ts

@@ -0,0 +1,72 @@
+import type { AuditorInput, AuditEvent, Severity, AssuranceBreak, EvidenceType } from '../types/events.js';
+export interface PipelineContext {
+    input: AuditorInput;
+    events: AuditEvent[];
+    assumptions: string[];
+    uncertainties: string[];
+    metadata: Map<string, unknown>;
+}
+export interface AnalysisStage {
+    name: string;
+    description: string;
+    analyze(ctx: PipelineContext): Promise<void> | void;
+}
+export interface RuleDefinition {
+    id: string;
+    name: string;
+    description: string;
+    severity: Severity;
+    category: 'secrets' | 'vulnerabilities' | 'compliance' | 'infrastructure' | 'access_control';
+    check: (input: AuditorInput) => RuleResult | null;
+}
+export interface RuleResult {
+    severity: Severity;
+    claim: string;
+    attackPath: string[];
+    affectedAssets: string[];
+    evidenceRefs: Array<{
+        type: EvidenceType;
+        pointer: string;
+    }>;
+    assuranceBreak: AssuranceBreak[];
+    confidence: number;
+}
+export declare class SecretsDetectionStage implements AnalysisStage {
+    name: string;
+    description: string;
+    private patterns;
+    analyze(ctx: PipelineContext): void;
+    private createEvent;
+}
+export declare class VulnerabilityScanStage implements AnalysisStage {
+    name: string;
+    description: string;
+    analyze(ctx: PipelineContext): void;
+    private parseVulnScan;
+}
+export declare class CriticalAssetStage implements AnalysisStage {
+    name: string;
+    description: string;
+    analyze(ctx: PipelineContext): void;
+    private adjustSeverity;
+}
+export declare class InfrastructureChangeStage implements AnalysisStage {
+    name: string;
+    description: string;
+    private iacPatterns;
+    analyze(ctx: PipelineContext): void;
+}
+export declare class ProductionDeployStage implements AnalysisStage {
+    name: string;
+    description: string;
+    analyze(ctx: PipelineContext): void;
+}
+export declare class SecurityPipeline {
+    private stages;
+    constructor();
+    addStage(stage: AnalysisStage): void;
+    removeStage(name: string): void;
+    getStages(): AnalysisStage[];
+    execute(input: AuditorInput): Promise<PipelineContext>;
+}
+export { PipelineContext as Context, AnalysisStage as Stage, RuleDefinition as Rule };