bandit-cli 1.0.0

package/README.md

@@ -0,0 +1 @@
+Bandit - a cli tool which can audit your backend project for the important and best practices of creating an industry grade backend by checking for require package files and dependencies , whether your env variables are ignored in .gitignore or not , what type of framework is being used , does it contain src/ file structure and many more comprehensive checks which i am constantly adding to make the developers aware of their backend system

package/dist/cli/api.js

@@ -0,0 +1,374 @@
+import fs from "node:fs";
+import path from "node:path";
+import fg from "fast-glob";
+import * as clack from "@clack/prompts";
+import chalk from "chalk";
+// Scans files for common route definitions
+async function scanForRoutes(projectPath) {
+    const routes = [];
+    const files = await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
+        cwd: projectPath,
+        absolute: true,
+        ignore: ["**/node_modules/**", "**/dist/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"],
+    });
+    // Regex patterns
+    // 1. Express/Fastify/Hono: router.get('/path', ...) or app.post('/path', ...)
+    const expressPattern = /\b(app|router|route|fastify|hono|api)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
+    // 2. NestJS decorators: @Get('/path') or @Post('/path')
+    const nestPattern = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
+    // 3. NestJS controllers to prefix: @Controller('/prefix')
+    const controllerPattern = /@Controller\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const relativePath = path.relative(projectPath, file);
+            // Check NestJS Controller prefix if any
+            let controllerPrefix = "";
+            const cMatch = [...content.matchAll(controllerPattern)];
+            if (cMatch.length > 0) {
+                controllerPrefix = cMatch[0][1];
+                if (controllerPrefix === "/")
+                    controllerPrefix = "";
+            }
+            // 1. Check Express-style matches
+            let match;
+            expressPattern.lastIndex = 0;
+            while ((match = expressPattern.exec(content)) !== null) {
+                const method = match[2].toUpperCase();
+                let rPath = match[3];
+                // Sanitize path variable names if necessary
+                routes.push({
+                    method,
+                    routePath: rPath,
+                    sourceFile: relativePath,
+                });
+            }
+            // 2. Check NestJS matches
+            nestPattern.lastIndex = 0;
+            while ((match = nestPattern.exec(content)) !== null) {
+                const method = match[1].toUpperCase();
+                let subPath = match[2];
+                if (subPath === "/")
+                    subPath = "";
+                const fullPath = `${controllerPrefix.replace(/\/$/, "")}/${subPath.replace(/^\//, "")}`;
+                const sanitizedFullPath = fullPath.startsWith("/") ? fullPath : `/${fullPath}`;
+                routes.push({
+                    method: method === "DELETE" ? "DELETE" : method,
+                    routePath: sanitizedFullPath,
+                    sourceFile: relativePath,
+                });
+            }
+        }
+        catch (err) {
+            // Ignore reading errors
+        }
+    }
+    // Deduplicate routes by method + routePath
+    const seen = new Set();
+    const uniqueRoutes = [];
+    for (const r of routes) {
+        const key = `${r.method}-${r.routePath}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            uniqueRoutes.push(r);
+        }
+    }
+    return uniqueRoutes.sort((a, b) => a.routePath.localeCompare(b.routePath));
+}
+// Detect potential local server port from project files
+function detectLocalPort(projectPath) {
+    try {
+        const envPath = path.join(projectPath, ".env");
+        if (fs.existsSync(envPath)) {
+            const content = fs.readFileSync(envPath, "utf-8");
+            const portMatch = content.match(/^PORT\s*=\s*(\d+)/m);
+            if (portMatch) {
+                return parseInt(portMatch[1], 10);
+            }
+        }
+    }
+    catch { }
+    return 3000;
+}
+export async function runApiCommand(projectPath = ".") {
+    clack.intro(chalk.bold.bgBlue.white(" Bandit Interactive API Client "));
+    const absoluteProjectPath = path.resolve(projectPath);
+    const s = clack.spinner();
+    s.start("Scanning codebase for API endpoints...");
+    const discoveredRoutes = await scanForRoutes(absoluteProjectPath);
+    s.stop(`Scan complete. Discovered ${chalk.bold.cyan(discoveredRoutes.length)} unique route(s).`);
+    const detectedPort = detectLocalPort(absoluteProjectPath);
+    const detectedUrl = `http://localhost:${detectedPort}`;
+    // Common ports to offer
+    const defaultPorts = [3000, 8080, 5000, 5500, 8000];
+    const urlOptions = [{ value: detectedUrl, label: `${detectedUrl} (Detected)` }];
+    for (const p of defaultPorts) {
+        const url = `http://localhost:${p}`;
+        if (p !== detectedPort) {
+            urlOptions.push({ value: url, label: url });
+        }
+    }
+    const serverUrlSelection = await clack.select({
+        message: "Select your server's base URL:",
+        options: [
+            ...urlOptions,
+            { value: "custom", label: "+ Enter a custom base URL manually" },
+        ],
+    });
+    if (clack.isCancel(serverUrlSelection)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    let baseUrl = "";
+    if (serverUrlSelection === "custom") {
+        const customUrlInput = await clack.text({
+            message: "Enter custom base URL:",
+            placeholder: "http://localhost:3000",
+            validate: (v) => {
+                if (!v || !v.trim())
+                    return "Base URL cannot be empty";
+                if (!v.startsWith("http://") && !v.startsWith("https://")) {
+                    return "URL must start with http:// or https://";
+                }
+                return undefined;
+            },
+        });
+        if (clack.isCancel(customUrlInput)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        baseUrl = customUrlInput.trim();
+    }
+    else {
+        baseUrl = serverUrlSelection;
+    }
+    baseUrl = baseUrl.replace(/\/$/, "");
+    // Compile options
+    const routeOptions = discoveredRoutes.map((r) => ({
+        value: r,
+        label: `[${chalk.bold.green(r.method)}] ${r.routePath} ${chalk.gray(`(${r.sourceFile})`)}`,
+    }));
+    const selectedRoute = (await clack.select({
+        message: "Choose an endpoint to request:",
+        options: [
+            ...routeOptions,
+            { value: "custom", label: chalk.yellow("+ Enter a custom route path manually") },
+        ],
+    }));
+    if (clack.isCancel(selectedRoute)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    let finalMethod = "GET";
+    let finalPath = "";
+    if (selectedRoute === "custom") {
+        const customMethod = (await clack.select({
+            message: "Select HTTP Method:",
+            options: [
+                { value: "GET", label: "GET" },
+                { value: "POST", label: "POST" },
+                { value: "PUT", label: "PUT" },
+                { value: "PATCH", label: "PATCH" },
+                { value: "DELETE", label: "DELETE" },
+            ],
+        }));
+        if (clack.isCancel(customMethod)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        finalMethod = customMethod;
+        const customPath = await clack.text({
+            message: "Enter route path:",
+            placeholder: "/api/v1/users",
+            validate: (v) => (!v || !v.startsWith("/") ? "Route path must start with a slash '/'" : undefined),
+        });
+        if (clack.isCancel(customPath)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        finalPath = customPath;
+    }
+    else {
+        finalMethod = selectedRoute.method;
+        finalPath = selectedRoute.routePath;
+    }
+    // 1. Process Path Parameters if any (e.g. /users/:id or /users/{id})
+    // We look for :name or {name}
+    const pathParamPattern = /:([a-zA-Z0-9_]+)|\{([a-zA-Z0-9_]+)\}/g;
+    let matches;
+    const pathParams = [];
+    while ((matches = pathParamPattern.exec(finalPath)) !== null) {
+        const paramName = matches[1] || matches[2];
+        if (paramName && !pathParams.includes(paramName)) {
+            pathParams.push(paramName);
+        }
+    }
+    let resolvedPath = finalPath;
+    for (const param of pathParams) {
+        const val = await clack.text({
+            message: `Enter value for path parameter [${chalk.bold.yellow(param)}]:`,
+            validate: (v) => (!v || !v.trim() ? "Parameter value cannot be empty" : undefined),
+        });
+        if (clack.isCancel(val)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        // Replace :param or {param}
+        resolvedPath = resolvedPath
+            .replace(`:${param}`, val)
+            .replace(`{${param}}`, val);
+    }
+    // 2. Process Query Params if needed
+    const addQueryParams = await clack.confirm({
+        message: "Do you want to add query parameters?",
+        initialValue: false,
+    });
+    if (clack.isCancel(addQueryParams)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    let queryStr = "";
+    if (addQueryParams) {
+        const qParams = await clack.text({
+            message: "Enter query string:",
+            placeholder: "limit=10&page=1",
+        });
+        if (clack.isCancel(qParams)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        const trimmed = qParams.trim();
+        if (trimmed) {
+            queryStr = trimmed.startsWith("?") ? trimmed : `?${trimmed}`;
+        }
+    }
+    // 3. Process Request Body if POST/PUT/PATCH
+    let requestBody;
+    if (["POST", "PUT", "PATCH"].includes(finalMethod)) {
+        const enterBody = await clack.confirm({
+            message: "Do you want to send a JSON request body?",
+            initialValue: true,
+        });
+        if (clack.isCancel(enterBody)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        if (enterBody) {
+            const bodyInput = await clack.text({
+                message: "Enter JSON payload:",
+                placeholder: '{"name": "Alice", "email": "alice@gmail.com"}',
+                validate: (v) => {
+                    if (!v || !v.trim())
+                        return undefined;
+                    try {
+                        JSON.parse(v);
+                        return undefined;
+                    }
+                    catch {
+                        return "Invalid JSON syntax. Please enter valid JSON.";
+                    }
+                },
+            });
+            if (clack.isCancel(bodyInput)) {
+                clack.outro("Execution stopped.");
+                return;
+            }
+            const val = bodyInput.trim();
+            if (val) {
+                requestBody = val;
+            }
+        }
+    }
+    // 4. Prompt for Authorization Header (Bearer token)
+    const addAuth = await clack.confirm({
+        message: "Do you want to add an Authorization Bearer token?",
+        initialValue: false,
+    });
+    if (clack.isCancel(addAuth)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    let bearerToken;
+    if (addAuth) {
+        const tokenInput = await clack.text({
+            message: "Enter Bearer Token:",
+            placeholder: "eyJhbGciOi...",
+            validate: (v) => (!v || !v.trim() ? "Token cannot be empty" : undefined),
+        });
+        if (clack.isCancel(tokenInput)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        bearerToken = tokenInput.trim();
+    }
+    // Confirm and Execute Request
+    const finalUrl = `${baseUrl}${resolvedPath}${queryStr}`;
+    clack.log.info(`Ready to request: ${chalk.bold.green(finalMethod)} ${chalk.cyan(finalUrl)}`);
+    if (bearerToken) {
+        const preview = bearerToken.length > 12 ? `${bearerToken.slice(0, 8)}...` : bearerToken;
+        clack.log.info(`Auth: Bearer ${preview} (masked)`);
+    }
+    if (requestBody) {
+        clack.log.info(`Body:\n${chalk.gray(JSON.stringify(JSON.parse(requestBody), null, 2))}`);
+    }
+    const proceed = await clack.confirm({
+        message: "Execute request?",
+        initialValue: true,
+    });
+    if (clack.isCancel(proceed) || !proceed) {
+        clack.outro("Aborted.");
+        return;
+    }
+    s.start(`Sending ${finalMethod} request to ${finalUrl}...`);
+    try {
+        const start = performance.now();
+        const headers = {
+            Accept: "application/json, text/plain, */*",
+            ...(requestBody ? { "Content-Type": "application/json" } : {}),
+        };
+        if (bearerToken) {
+            headers["Authorization"] = `Bearer ${bearerToken}`;
+        }
+        const fetchOptions = {
+            method: finalMethod,
+            headers,
+            ...(requestBody ? { body: requestBody } : {}),
+        };
+        const res = await fetch(finalUrl, fetchOptions);
+        const end = performance.now();
+        const duration = end - start;
+        s.stop(`Request completed in ${chalk.bold.yellow(duration.toFixed(1))}ms.`);
+        // Read response text or json
+        const contentType = res.headers.get("content-type") || "";
+        const resText = await res.text();
+        console.log("\n" + chalk.bold.cyan("📬 RESPONSE"));
+        console.log(chalk.gray("──────────────────────────────────────────────────"));
+        console.log(`Status:  ${res.status >= 200 && res.status < 300 ? chalk.bold.green(res.status) : chalk.bold.red(res.status)} ${res.statusText}`);
+        console.log(`Time:    ${duration.toFixed(1)} ms`);
+        console.log(chalk.gray("──────────────────────────────────────────────────"));
+        console.log(chalk.bold.cyan("Headers:"));
+        res.headers.forEach((val, key) => {
+            console.log(`  ${chalk.gray(key)}: ${val}`);
+        });
+        console.log(chalk.gray("──────────────────────────────────────────────────"));
+        console.log(chalk.bold.cyan("Body:"));
+        if (contentType.includes("application/json")) {
+            try {
+                const parsed = JSON.parse(resText);
+                console.log(chalk.green(JSON.stringify(parsed, null, 2)));
+            }
+            catch {
+                console.log(resText);
+            }
+        }
+        else {
+            console.log(resText || chalk.italic.gray("<empty body>"));
+        }
+        console.log(chalk.gray("──────────────────────────────────────────────────"));
+    }
+    catch (err) {
+        s.stop("Request failed.");
+        clack.log.error(`Fetch execution error: ${err.message}`);
+    }
+    clack.outro(chalk.bold.green("API Playfield session complete."));
+}

package/dist/cli/bench.js

@@ -0,0 +1,135 @@
+import { performance } from "node:perf_hooks";
+import * as clack from "@clack/prompts";
+import chalk from "chalk";
+export async function runBenchCommand(targetUrl, opts) {
+    clack.intro(chalk.bold.bgBlue.white(" Bandit Load Benchmarker "));
+    clack.log.info(`Target URL: ${chalk.bold.cyan(targetUrl)}`);
+    clack.log.info(`Config: ${chalk.bold(opts.requests)} requests total, ${chalk.bold(opts.connections)} concurrent connections`);
+    const s = clack.spinner();
+    s.start("Pre-flight ping to check endpoint availability...");
+    try {
+        const res = await fetch(targetUrl);
+        s.stop(`Ping successful (Status ${res.status}). Starting load test...`);
+    }
+    catch (err) {
+        s.stop("Pre-flight ping failed.");
+        clack.log.error(`Cannot contact target: ${err.message}`);
+        clack.outro(chalk.red("Benchmark aborted."));
+        return;
+    }
+    const latencies = [];
+    let successCount = 0;
+    let failCount = 0;
+    let completedCount = 0;
+    const requestTimes = [];
+    const startBenchmark = performance.now();
+    // Create a queue of requests
+    const runWorker = async () => {
+        while (completedCount < opts.requests) {
+            const currentReqIndex = completedCount++;
+            if (currentReqIndex >= opts.requests)
+                break;
+            const reqStart = performance.now();
+            try {
+                const res = await fetch(targetUrl);
+                const reqEnd = performance.now();
+                const duration = reqEnd - reqStart;
+                latencies.push(duration);
+                if (res.ok) {
+                    successCount++;
+                    requestTimes.push({ start: reqStart, end: reqEnd, success: true });
+                }
+                else {
+                    failCount++;
+                    requestTimes.push({ start: reqStart, end: reqEnd, success: false });
+                }
+            }
+            catch (err) {
+                const reqEnd = performance.now();
+                const duration = reqEnd - reqStart;
+                latencies.push(duration);
+                failCount++;
+                requestTimes.push({ start: reqStart, end: reqEnd, success: false });
+            }
+        }
+    };
+    // Run workers concurrently
+    const workers = [];
+    for (let i = 0; i < opts.connections; i++) {
+        workers.push(runWorker());
+    }
+    s.start(`Firing requests... (Completed: 0/${opts.requests})`);
+    // Periodically update progress
+    const progressInterval = setInterval(() => {
+        s.message(`Firing requests... (Completed: ${Math.min(completedCount, opts.requests)}/${opts.requests})`);
+    }, 100);
+    await Promise.all(workers);
+    clearInterval(progressInterval);
+    const endBenchmark = performance.now();
+    s.stop(`Load test completed!`);
+    const totalTimeSec = (endBenchmark - startBenchmark) / 1000;
+    const rps = opts.requests / totalTimeSec;
+    if (latencies.length === 0) {
+        clack.outro(chalk.red("No requests completed successfully."));
+        return;
+    }
+    // Calculate statistics
+    latencies.sort((a, b) => a - b);
+    const min = latencies[0];
+    const max = latencies[latencies.length - 1];
+    const sum = latencies.reduce((a, b) => a + b, 0);
+    const avg = sum / latencies.length;
+    const getPercentile = (p) => {
+        const idx = Math.floor((p / 100) * (latencies.length - 1));
+        return latencies[idx];
+    };
+    const p50 = getPercentile(50);
+    const p90 = getPercentile(90);
+    const p95 = getPercentile(95);
+    const p99 = getPercentile(99);
+    // Render Stats
+    console.log("");
+    console.log(chalk.bold.cyan("📊 BENCHMARK SUMMARY"));
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    console.log(`  Total Time Taken:  ${chalk.bold(totalTimeSec.toFixed(3))} seconds`);
+    console.log(`  Throughput:        ${chalk.bold.green(rps.toFixed(2))} req/sec`);
+    console.log(`  Successful Reqs:   ${chalk.green(successCount)}`);
+    console.log(`  Failed Reqs:       ${failCount > 0 ? chalk.red(failCount) : chalk.gray(failCount)}`);
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    console.log(chalk.bold.cyan("⏱  LATENCY STATS"));
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    console.log(`  Min Latency:       ${min.toFixed(2)} ms`);
+    console.log(`  Avg Latency:       ${avg.toFixed(2)} ms`);
+    console.log(`  Max Latency:       ${max.toFixed(2)} ms`);
+    console.log(`  p50 (Median):      ${chalk.yellow(p50.toFixed(2))} ms`);
+    console.log(`  p90:               ${p90.toFixed(2)} ms`);
+    console.log(`  p95:               ${p95.toFixed(2)} ms`);
+    console.log(`  p99 (Tail):        ${chalk.red(p99.toFixed(2))} ms`);
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    // Draw ASCII Latency Distribution Histogram
+    console.log(chalk.bold.cyan("📈 LATENCY DISTRIBUTION"));
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    const bucketCount = 8;
+    const bucketSize = (max - min) / bucketCount || 1;
+    const buckets = new Array(bucketCount).fill(0);
+    for (const lat of latencies) {
+        let bIdx = Math.floor((lat - min) / bucketSize);
+        if (bIdx >= bucketCount)
+            bIdx = bucketCount - 1;
+        buckets[bIdx]++;
+    }
+    const maxBucketVal = Math.max(...buckets) || 1;
+    const maxBarWidth = 35;
+    for (let i = 0; i < bucketCount; i++) {
+        const rangeStart = min + i * bucketSize;
+        const rangeEnd = rangeStart + bucketSize;
+        const count = buckets[i];
+        const percentage = (count / latencies.length) * 100;
+        const barWidth = Math.round((count / maxBucketVal) * maxBarWidth);
+        const bar = "█".repeat(barWidth) + "░".repeat(Math.max(0, maxBarWidth - barWidth));
+        const label = `${rangeStart.toFixed(1).padStart(6)}ms - ${rangeEnd.toFixed(1).padStart(6)}ms`;
+        console.log(`  ${chalk.gray(label)} : [${chalk.green(bar)}] ${count.toString().padStart(4)} (${percentage.toFixed(1)}%)`);
+    }
+    console.log(chalk.gray("──────────────────────────────────────────────────"));
+    clack.outro(chalk.bold.green("Benchmark complete!"));
+}