cokit-cli 1.0.9 → 1.2.2

package/skills/web-testing/references/security-checklists.md

@@ -0,0 +1,81 @@
+# Security Checklists
+
+## Authentication Security
+
+- [ ] Strong auth mechanism (OAuth 2.0, JWT, OIDC)
+- [ ] No basic auth or custom schemes
+- [ ] Password policy enforced (12+ chars, complexity)
+- [ ] MFA/2FA for sensitive operations
+- [ ] Account lockout after failed attempts (5-10)
+- [ ] Secure password reset (token expiration)
+- [ ] Default credentials removed/disabled
+- [ ] API keys not in code/version control
+- [ ] Session tokens cryptographically generated
+- [ ] Logout invalidates session/token
+
+## API Security
+
+- [ ] HTTPS/TLS enforced for all endpoints
+- [ ] API versioning strategy in place
+- [ ] Rate limiting implemented
+- [ ] Auth required (API key or OAuth token)
+- [ ] Input validation on all parameters
+- [ ] Output encoding/sanitization
+- [ ] CORS headers properly configured
+- [ ] Pagination limits prevent enumeration
+- [ ] Proper HTTP status codes (401 vs 403)
+- [ ] Error messages don't expose internals
+
+## Session Management
+
+- [ ] Session IDs cryptographically random
+- [ ] Cookies: HttpOnly, Secure, SameSite flags
+- [ ] Session timeout (idle + absolute)
+- [ ] Session invalidation on logout
+- [ ] Session fixation protection (regenerate on login)
+- [ ] CSRF tokens for state-changing ops
+- [ ] Session data server-side (not in cookies)
+
+## Input Validation
+
+- [ ] Whitelist validation (allow only expected)
+- [ ] Type validation (string, number, date)
+- [ ] Length validation (min/max)
+- [ ] Format validation (regex for email, URL)
+- [ ] SQL parameters use prepared statements
+- [ ] NoSQL queries use safe APIs
+- [ ] Command execution avoided/validated
+- [ ] XML external entities disabled (XXE)
+- [ ] JSON parsing safe (no eval)
+- [ ] ReDoS-safe regex patterns
+
+## Security Headers
+
+```
+Content-Security-Policy: default-src 'self'; script-src 'self'
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+X-XSS-Protection: 1; mode=block
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+- [ ] CSP configured (restrict resource loading)
+- [ ] X-Content-Type-Options: nosniff
+- [ ] X-Frame-Options (DENY or SAMEORIGIN)
+- [ ] HSTS enabled with appropriate max-age
+- [ ] Referrer-Policy configured
+- [ ] Permissions-Policy set
+- [ ] Server/X-Powered-By headers removed
+- [ ] CORS: No wildcard on credentialed endpoints
+
+## Verify Headers
+
+```bash
+# Check security headers
+curl -I https://example.com
+
+# Use securityheaders.com
+# Use observatory.mozilla.org
+```

package/skills/web-testing/references/security-testing-overview.md

@@ -0,0 +1,92 @@
+# Security Testing Overview
+
+## OWASP Top 10 (2024)
+
+| Rank | Vulnerability | Testing Method |
+|------|--------------|----------------|
+| A01 | Broken Access Control | Test unauthorized actions across roles |
+| A02 | Cryptographic Failures | Check HTTPS, encryption algorithms |
+| A03 | Injection (SQL/NoSQL/Cmd) | Test with payloads (see vulnerability-payloads.md) |
+| A04 | Insecure Design | Threat modeling, abuse case testing |
+| A05 | Security Misconfiguration | Default creds, open ports, headers |
+| A06 | Vulnerable Components | npm audit, Snyk scanning |
+| A07 | Auth Failures | Brute force, session hijacking |
+| A08 | Integrity Failures | Deserialization, CI/CD security |
+| A09 | Logging Failures | Verify security event logging |
+| A10 | SSRF | Test internal URL access |
+
+## Security Testing Types
+
+### SAST (Static Analysis)
+- **When**: Early development, pre-commit
+- **Tools**: SonarQube, CodeQL, Semgrep
+- **Focus**: Code flaws without execution
+- **Limitation**: High false positives
+
+### DAST (Dynamic Analysis)
+- **When**: QA/staging, running application
+- **Tools**: OWASP ZAP, Burp Suite, Nuclei
+- **Focus**: Runtime vulnerabilities
+- **Limitation**: Requires running app
+
+### SCA (Dependency Scanning)
+- **Tools**: npm audit, Snyk, Dependabot
+- **Focus**: Known CVEs in dependencies
+- **Automation**: CI/CD integration
+
+### Secret Detection
+- **Tools**: detect-secrets, GitGuardian
+- **Focus**: API keys, passwords in code
+- **Implementation**: Pre-commit hooks
+
+## Quick Security Scan
+
+```bash
+# Dependency vulnerabilities
+npm audit
+npx snyk test
+
+# OWASP ZAP baseline scan
+docker run -t ghcr.io/zaproxy/zaproxy:stable \
+  zap-baseline.py -t https://example.com
+
+# Nuclei template scan
+nuclei -u https://example.com -t cves/
+
+# Check security headers
+curl -I https://example.com | grep -i "security\|content-security\|x-"
+```
+
+## Penetration Testing Phases
+
+1. **Reconnaissance**: DNS, WHOIS, tech fingerprinting
+2. **Scanning**: Port scan, service enumeration
+3. **Vulnerability Assessment**: Automated + manual testing
+4. **Exploitation**: Verify findings, demonstrate impact
+5. **Reporting**: CVSS scores, remediation guidance
+
+## Tools Comparison
+
+| Tool | Type | Cost | Best For |
+|------|------|------|----------|
+| OWASP ZAP | DAST | Free | CI/CD, learning |
+| Burp Suite | DAST | Paid | Enterprise, detailed |
+| Nuclei | DAST | Free | Custom checks |
+| npm audit | SCA | Free | Node.js deps |
+| Snyk | SCA | Free/Paid | Multi-language |
+
+## CI/CD Integration
+
+```yaml
+# Security scanning in pipeline
+- name: Dependency Scan
+  run: npm audit --audit-level=high
+
+- name: SAST Scan
+  uses: github/codeql-action/analyze@v3
+
+- name: DAST Scan
+  run: |
+    docker run -v $(pwd):/zap/wrk:rw ghcr.io/zaproxy/zaproxy:stable \
+      zap-api-scan.py -t http://localhost:3000/openapi.json -f openapi
+```

package/skills/web-testing/references/shadow-dom-testing.md

@@ -0,0 +1,70 @@
+# Shadow DOM & Web Components Testing
+
+## Challenges
+
+- CSS encapsulation breaks selectors
+- Elements hidden from DOM queries
+- XPath doesn't penetrate shadow boundaries
+
+## Tool Support
+
+| Tool | Support | Method |
+|------|---------|--------|
+| Playwright | Native | `>>` piercing selector |
+| Cypress | Good | `.shadow()` command |
+| Selenium | Limited | JS execution |
+| Axe | v5.7+ | API support |
+
+## Playwright Shadow Piercing
+
+```javascript
+const input = page.locator('my-component >> .internal-input');
+const button = page.locator('comp-a >> comp-b >> button');
+const el = page.locator('custom-element >> button:has-text("Click me")');
+```
+
+## Cypress Shadow DOM
+
+```javascript
+cy.get('my-component').shadow().find('.internal-button').click();
+
+// Enable globally: { includeShadowDom: true }
+```
+
+## Selenium Workaround
+
+```javascript
+const shadowHost = driver.findElement(By.css('my-component'));
+const shadowRoot = driver.executeScript('return arguments[0].shadowRoot', shadowHost);
+const button = shadowRoot.findElement(By.css('button'));
+```
+
+## Page Object Pattern
+
+```typescript
+export class MyComponentPO {
+  constructor(private page: Page) {}
+
+  async fillEmail(email: string) {
+    await this.page.locator('my-form >> input[type="email"]').fill(email);
+  }
+
+  async submit() {
+    await this.page.locator('my-form >> button[type="submit"]').click();
+  }
+}
+```
+
+## Best Practices
+
+1. Request `open` shadow roots when possible
+2. Encapsulate shadow traversal in page objects
+3. Avoid deep nesting (increases complexity)
+
+## Debugging
+
+```javascript
+const contents = await page.evaluate(() => {
+  return document.querySelector('my-component').shadowRoot.innerHTML;
+});
+```

package/skills/web-testing/references/test-data-management.md

@@ -0,0 +1,131 @@
+# Test Data Management
+
+## Faker.js (Dynamic Data Generation)
+
+```typescript
+import { faker } from '@faker-js/faker';
+
+// Reproducible data (seeding)
+faker.seed(123);
+
+const user = {
+  id: faker.string.uuid(),
+  name: faker.person.fullName(),
+  email: faker.internet.email(),
+  avatar: faker.image.avatar(),
+  createdAt: faker.date.past(),
+};
+```
+
+## Factory Pattern (Fishery)
+
+```typescript
+import { Factory } from 'fishery';
+import { faker } from '@faker-js/faker';
+
+// Define factory
+const userFactory = Factory.define<User>(() => ({
+  id: faker.string.uuid(),
+  name: faker.person.fullName(),
+  email: faker.internet.email(),
+  role: 'user',
+}));
+
+// Usage
+const user = userFactory.build();
+const admin = userFactory.build({ role: 'admin' });
+const users = userFactory.buildList(5);
+```
+
+## Factory with Associations
+
+```typescript
+const postFactory = Factory.define<Post>(({ associations }) => ({
+  id: faker.string.uuid(),
+  title: faker.lorem.sentence(),
+  author: associations.author || userFactory.build(),
+}));
+
+const post = postFactory.build({
+  author: userFactory.build({ role: 'admin' }),
+});
+```
+
+## Fixtures (Static Baseline Data)
+
+```typescript
+// fixtures/users.ts
+export const testUsers = {
+  admin: {
+    id: 'admin-001',
+    email: 'admin@test.com',
+    role: 'admin',
+  },
+  member: {
+    id: 'member-001',
+    email: 'member@test.com',
+    role: 'member',
+  },
+};
+
+// In tests
+import { testUsers } from './fixtures/users';
+```
+
+## Combined Pattern (Fixtures + Factories)
+
+```typescript
+// Baseline fixtures for known states
+const baseUser = testUsers.admin;
+
+// Factory for dynamic variations
+const dynamicUser = userFactory.build({
+  ...baseUser,
+  email: faker.internet.email(), // Override specific fields
+});
+```
+
+## Database Seeding
+
+```typescript
+// seed.ts
+async function seedTestData(db: Database, workerIndex: number) {
+  // Worker-isolated data
+  const prefix = `w${workerIndex}`;
+
+  await db.users.insertMany([
+    { id: `${prefix}-user-1`, email: `user1-${prefix}@test.com` },
+    { id: `${prefix}-user-2`, email: `user2-${prefix}@test.com` },
+  ]);
+}
+
+async function clearTestData(db: Database, workerIndex: number) {
+  const prefix = `w${workerIndex}`;
+  await db.users.deleteMany({ id: { $regex: `^${prefix}` } });
+}
+```
+
+## Best Practices
+
+- **Reproducibility:** Seed Faker for consistent test data
+- **Isolation:** Prefix data with worker index for parallelism
+- **Cleanup:** Always clean up in afterEach/afterAll
+- **Minimal data:** Only create what's needed for test
+- **Type safety:** Type your factories
+
+## Anti-Patterns
+
+```typescript
+// BAD: Hardcoded values
+const user = { email: 'test@test.com' }; // Collisions!
+
+// GOOD: Dynamic generation
+const user = { email: faker.internet.email() };
+
+// BAD: Shared mutable state
+let globalUser;
+beforeAll(() => { globalUser = createUser(); });
+
+// GOOD: Fresh data per test
+beforeEach(() => { user = userFactory.build(); });
+```

package/skills/web-testing/references/test-flakiness-mitigation.md

@@ -0,0 +1,86 @@
+# Test Flakiness Mitigation
+
+## Root Causes
+
+- Timing mismatches (hard waits)
+- Non-isolated tests (shared state)
+- Network instability
+- Animation timing
+
+## Explicit Waits (Not Hard Waits)
+
+```javascript
+// BAD: Hard wait
+await new Promise(r => setTimeout(r, 500));
+
+// GOOD: Wait for condition
+await page.waitForSelector('.success', { timeout: 10000 });
+await expect(page.locator('.count')).toContainText('5');
+
+// BEST: Playwright auto-wait
+await page.getByRole('button', { name: /submit/i }).click();
+```
+
+## Wait Timeout Guidelines
+
+| Scenario | Timeout |
+|----------|---------|
+| Page load | 10-15s |
+| Element visibility | 5-10s |
+| API responses | 30-60s |
+
+## Retry Strategies
+
+```javascript
+// Playwright built-in
+test.describe.configure({ retries: 3 });
+
+// Per-test
+test('flaky test', async ({ page }) => { /* */ }, { retries: 3 });
+
+// Exponential backoff
+async function retryWithBackoff(fn, maxRetries = 3) {
+  for (let i = 0; i < maxRetries; i++) {
+    try { return await fn(); }
+    catch (e) {
+      if (i === maxRetries - 1) throw e;
+      await new Promise(r => setTimeout(r, Math.pow(2, i) * 1000));
+    }
+  }
+}
+```
+
+## Test Isolation
+
+```javascript
+// BAD: Dependent tests
+let userId;
+test('create', async () => { userId = await createUser(); });
+test('load', async () => { await loadUser(userId); }); // Depends on previous!
+
+// GOOD: Independent
+test('create and load', async ({ page }) => {
+  const userId = await createUser(page);
+  await loadUser(page, userId);
+});
+```
+
+## Disable Animations
+
+```css
+* { animation-duration: 0s !important; transition-duration: 0s !important; }
+```
+
+## Network Stability
+
+```javascript
+await page.route('**/external-api/**', route =>
+  route.fulfill({ status: 200, body: '{}' })
+);
+```
+
+## Flakiness Detection
+
+```bash
+npx playwright test --repeat-each=5
+```

package/skills/web-testing/references/testing-pyramid-strategy.md

@@ -0,0 +1,76 @@
+# Testing Strategy Models
+
+## Model Comparison
+
+| Model | Structure | Best For |
+|-------|-----------|----------|
+| Pyramid | Unit 70% > Integration 20% > E2E 10% | Monoliths, logic-heavy |
+| Trophy (Dodds) | Static > Integration (largest) > Unit > E2E | Modern SPAs |
+| Honeycomb (Spotify) | Contract-centric cells | Microservices |
+| Diamond | Balanced unit/integration | Domain services |
+
+## Testing Trophy (Recommended for SPAs)
+
+```
+         E2E (minimal)
+        /------------\
+       / Integration  \   <-- Largest portion
+      /----------------\
+     /   Unit Tests     \
+    /--------------------\
+   /   Static Analysis    \  <-- Foundation
+  /________________________\
+```
+
+**Philosophy:** "The more your tests resemble how software is used, the more confidence they give you." - Kent C. Dodds
+
+**Key Principles:**
+- Test behavior, not implementation
+- Minimize mocking
+- Prioritize integration tests
+- Use accessible queries (getByRole first)
+
+## Testing Honeycomb (Microservices)
+
+Contract testing at center, interconnected cells for:
+- Unit tests (implementation details)
+- Integration tests (service boundaries)
+- Contract tests (API agreements)
+- E2E tests (critical paths only)
+
+## Ratios by Context
+
+| Context | Unit | Integration | E2E |
+|---------|------|-------------|-----|
+| Classic Pyramid | 70% | 20% | 10% |
+| Testing Trophy | 30% | 50% | 10% |
+| API-heavy | 75% | 15% | 10% |
+| Microservices | 40% | 40% | 20% |
+
+## Priority Matrix
+
+| Priority | Category | Examples |
+|----------|----------|----------|
+| P0 | Core flows | Signup, login, checkout, payment |
+| P1 | Major features | Search, CRUD, navigation |
+| P2 | Secondary | Filters, sorting, pagination |
+| P3 | Edge cases | Empty states, max limits |
+
+## Coverage Targets
+
+| Area | Target |
+|------|--------|
+| Critical paths | 100% |
+| Core features | 80-90% |
+| Overall | 75-85% |
+
+**Note:** Coverage as diagnostic, not target. Focus on what's uncovered.
+
+## CI/CD Order
+
+```yaml
+- run: npm run lint          # Gate 0: Static analysis
+- run: npm run test:unit     # Gate 1: Fast fail
+- run: npm run test:integration # Gate 2
+- run: npm run test:e2e      # Gate 3: Pre-merge
+```

package/skills/web-testing/references/unit-integration-testing.md

@@ -0,0 +1,138 @@
+# Unit & Integration Testing
+
+## Framework Comparison
+
+| Framework | Speed | Best For |
+|-----------|-------|----------|
+| Vitest | Fastest | Modern projects, Vite |
+| Jest | Fast | React/CRA legacy |
+| Bun test | Ultra-fast | Bun projects |
+
+## Vitest Setup
+
+```typescript
+// vitest.config.ts
+export default defineConfig({
+  test: {
+    environment: 'jsdom', // or 'happy-dom'
+    globals: true,
+    coverage: { reporter: ['text', 'json', 'html'] },
+  },
+});
+```
+
+## Vitest Browser Mode (Real Browser)
+
+```typescript
+// vitest.config.ts - higher fidelity than jsdom
+export default defineConfig({
+  test: {
+    browser: {
+      enabled: true,
+      name: 'chromium',
+      provider: 'playwright',
+    },
+  },
+});
+```
+
+**When to use:** Complex DOM interactions, CSS testing, browser APIs
+
+## Test Structure (AAA)
+
+```typescript
+import { describe, it, expect, beforeEach } from 'vitest';
+
+describe('UserService', () => {
+  let service: UserService;
+
+  beforeEach(() => {
+    service = new UserService();
+  });
+
+  it('creates user with valid data', () => {
+    // Arrange
+    const userData = { email: 'test@example.com' };
+
+    // Act
+    const user = service.create(userData);
+
+    // Assert
+    expect(user.id).toBeDefined();
+    expect(user.email).toBe('test@example.com');
+  });
+
+  it('throws on invalid email', () => {
+    expect(() => service.create({ email: 'invalid' }))
+      .toThrow('Invalid email');
+  });
+});
+```
+
+## Integration Test
+
+```typescript
+describe('User API', () => {
+  let db: Database;
+
+  beforeAll(async () => {
+    db = new Database(':memory:');
+    await db.migrate();
+  });
+
+  afterEach(async () => {
+    await db.clearAllTables();
+  });
+
+  it('persists and retrieves user', async () => {
+    await db.users.insert({ email: 'test@example.com' });
+    const user = await db.users.findOne({ email: 'test@example.com' });
+    expect(user).toBeDefined();
+  });
+});
+```
+
+## Test Naming
+
+```typescript
+// Good - describes behavior
+it('should return 200 when valid token provided');
+it('should throw ValidationError when email invalid');
+
+// Bad - vague
+it('test1');
+it('works');
+```
+
+## Mocking
+
+```typescript
+import { vi } from 'vitest';
+
+// Mock module
+vi.mock('./api', () => ({
+  fetchUser: vi.fn().mockResolvedValue({ name: 'John' })
+}));
+
+// Spy
+const spy = vi.spyOn(console, 'log');
+expect(spy).toHaveBeenCalledWith('message');
+```
+
+## Coverage Targets
+
+| Area | Target |
+|------|--------|
+| Critical paths | 100% |
+| Core features | 80-90% |
+| Overall | 75-85% |
+
+## Commands
+
+```bash
+npx vitest run              # Run all
+npx vitest                  # Watch mode
+npx vitest run --coverage   # Coverage
+npx vitest run -u           # Update snapshots
+npx vitest --browser        # Browser mode
+```