coverme-security-scanner 3.0.0

package/src/types.ts

@@ -0,0 +1,204 @@
+/**
+ * CoverMe Scanner v3 - Type Definitions
+ * Clean, minimal types for security assessment reports
+ */
+
+// =============================================================================
+// CORE TYPES
+// =============================================================================
+
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type ThreatStatus = 'open' | 'partial' | 'mitigated' | 'accepted';
+export type FixOwner = 'developer' | 'devops' | 'architect';
+
+// =============================================================================
+// DREAD SCORING
+// =============================================================================
+
+export interface DreadScore {
+  damage: number;         // 1-10: How severe is the impact?
+  reproducibility: number; // 1-10: How easy to reproduce?
+  exploitability: number;  // 1-10: How easy to exploit?
+  affectedUsers: number;   // 1-10: How many users impacted?
+  discoverability: number; // 1-10: How easy to find?
+  total: number;          // Average of above
+}
+
+// =============================================================================
+// FINDINGS
+// =============================================================================
+
+export interface Finding {
+  id: string;              // e.g., "T-FE-1", "CR-03"
+  title: string;           // Specific, descriptive title
+  severity: Severity;
+  category: string;        // security, quality, performance
+
+  // Location
+  file: string;
+  line: number | string;   // Can be "51-91" for range
+  endLine?: number;
+  code?: string;           // The vulnerable code snippet
+
+  // Description (must include DREAD-D inline for HIGH/CRITICAL)
+  description: string;
+  recommendation: string;
+
+  // Metadata
+  cwe?: string;            // e.g., "CWE-89"
+  owasp?: string;          // e.g., "A03:2021"
+  dread?: DreadScore;
+  confidence?: number;     // 0-100
+  dpiPriority?: 'Today' | 'This Sprint' | 'Next Sprint' | 'Backlog';
+
+  // Cross-references
+  crossReferences?: string[];  // Related finding IDs
+  fixOwner?: FixOwner;
+}
+
+// =============================================================================
+// THREAT MODEL
+// =============================================================================
+
+export interface ThreatModelEntry {
+  id: string;
+  threat: string;
+  category: 'STRIDE' | 'LINDDUN';
+  strideType?: 'S' | 'T' | 'R' | 'I' | 'D' | 'E';  // Spoofing, Tampering, etc.
+  status: ThreatStatus;
+  relatedFindings: string[];
+  mitigation?: string;
+  dreadScore?: number;
+}
+
+// =============================================================================
+// QUALITY REVIEW
+// =============================================================================
+
+export interface QualityItem {
+  type: 'delete' | 'merge' | 'simplify';
+  file: string;
+  lines?: number;
+  title: string;
+  description: string;
+  reason: string;
+  roi: string;  // e.g., "~250 lines"
+}
+
+export interface QualityReview {
+  deleteItems: QualityItem[];
+  mergeItems: QualityItem[];
+  simplifyItems: QualityItem[];
+  totalLinesRemovable: number;
+  percentageOfCodebase: number;
+}
+
+// =============================================================================
+// EXECUTIVE SUMMARY
+// =============================================================================
+
+export interface ExecutiveSummary {
+  headline: string;        // e.g., "0 Critical + 7 High findings"
+  riskLevel: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+  overview: string;        // 2-3 sentences: architecture + posture
+  topRisks: string[];      // Specific risk descriptions
+  positives: string[];     // Specific strengths with evidence
+  recommendedActions?: RecommendedAction[];
+}
+
+export interface RecommendedAction {
+  priority: number;
+  action: string;
+  owner: FixOwner;
+  effort?: string;
+}
+
+// =============================================================================
+// ARCHITECTURE
+// =============================================================================
+
+export interface ArchitectureComponent {
+  name: string;
+  type: 'service' | 'database' | 'cache' | 'external' | 'frontend';
+  description: string;
+  trustLevel: 'untrusted' | 'semi-trusted' | 'trusted';
+}
+
+export interface TrustBoundary {
+  name: string;
+  from: string;
+  to: string;
+  protocol: string;
+}
+
+export interface ArchitectureOverview {
+  components: ArchitectureComponent[];
+  trustBoundaries: TrustBoundary[];
+  criticalAssets: { name: string; type: string; location: string; protection: string }[];
+  dataFlows: string[];
+}
+
+// =============================================================================
+// POSITIVE OBSERVATIONS
+// =============================================================================
+
+export interface PositiveObservation {
+  title: string;       // e.g., "Zero-Knowledge Architecture"
+  description: string; // Specific technical evidence
+}
+
+// =============================================================================
+// PREVIOUSLY RESOLVED
+// =============================================================================
+
+export interface ResolvedIssue {
+  id: string;
+  title: string;
+  originalSeverity: Severity;
+  resolution: string;
+  resolvedDate: string;
+}
+
+// =============================================================================
+// MAIN SCAN RESULT
+// =============================================================================
+
+export interface ScanResult {
+  // Project Info
+  projectName: string;
+  scanDate: string;
+  branch?: string;
+  commit?: string;
+  filesScanned: number;
+  linesOfCode: number;
+  projectTree?: string;
+
+  // Project Overview
+  projectOverview?: {
+    name: string;
+    type: string;
+    stack: string[];
+    purpose: string;
+    architecture: string;
+    keyComponents: string[];
+  };
+
+  // Main Content
+  executiveSummary?: ExecutiveSummary;
+  architectureOverview?: ArchitectureOverview;
+  findings: Finding[];
+  threatModel?: ThreatModelEntry[];
+  qualityReview?: QualityReview;
+  positiveObservations?: PositiveObservation[];
+  previouslyResolved?: ResolvedIssue[];
+
+  // Summary counts
+  summary: {
+    total: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+  };
+}

package/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}