easyvibegate 0.4.4 → 0.6.2

package/dist/orchestrator/flow.js

@@ -7,6 +7,90 @@ import { discoverFirebase, probeFirebase } from '../engine/checkers/backend/fire
 import { checkLiveSite } from '../engine/checkers/live/http-checks.js';
 import { probeEndpointsUnauth } from '../engine/checkers/live/endpoint-probe.js';
 import { idorDifferential } from '../engine/checkers/live/idor.js';
+/** Files that feed discovery, endpoint enumeration and the plan: ignorePaths applied. */
+export function visibleFiles(files, config) {
+    return files.filter((f) => !config.ignorePaths.some((sub) => f.rel.includes(sub)));
+}
+/** The identity a consent answer is bound to: kind + normalized target. */
+export function consentKey(kind, target) {
+    return `${kind} ${target}`;
+}
+/** Trailing slashes and host case must not make "the same" host look different. */
+function normalizeTarget(url) {
+    const trimmed = url.trim().replace(/\/+$/, '');
+    try {
+        return new URL(trimmed).toString().replace(/\/$/, '');
+    }
+    catch {
+        return trimmed;
+    }
+}
+const DETAIL = {
+    supabase: 'read tables, buckets and RPC using the public key (read-only)',
+    firebase: 'anonymous reads of RTDB, Firestore and Storage',
+    live: 'passive checks (headers, exposed files) + unauthenticated endpoint probe',
+    idor: 'replay object-scoped endpoints with two accounts (IDOR test)',
+};
+/**
+ * The live-site targets that follow from an app URL. Exported so the wizard,
+ * which learns the URL only after the backend questions, can extend the plan
+ * without a second discovery pass.
+ */
+export function liveTargets(appUrl, idorTokens, source = '--url') {
+    if (!appUrl)
+        return [];
+    const target = normalizeTarget(appUrl);
+    const out = [{ kind: 'live', target, explicit: true, source, appUrl: target }];
+    if (idorTokens)
+        out.push({ kind: 'idor', target, explicit: true, source: '--idor-tokens', appUrl: target, tokens: idorTokens });
+    return out;
+}
+/**
+ * Build the immutable target plan: ONE discovery pass over the files that
+ * survive `ignorePaths`, plus whatever the caller asked for explicitly. Both the
+ * consent prompt and the probes work from this same list.
+ */
+export function planTargets(files, config, opts = {}) {
+    const visible = visibleFiles(files, config);
+    const targets = [];
+    if (opts.supabaseUrl && opts.supabaseKey) {
+        const keyKind = classifyKey(opts.supabaseKey) === 'publishable' ? 'publishable' : 'jwt-anon';
+        const url = normalizeTarget(opts.supabaseUrl);
+        targets.push({ kind: 'supabase', target: url, explicit: true, source: '--supabase-url', creds: { url, anonKey: opts.supabaseKey, keyKind } });
+    }
+    else {
+        const sb = discoverSupabase(visible);
+        if (sb)
+            targets.push({ kind: 'supabase', target: sb.url, explicit: false, source: `discovered:${sb.source ?? 'code'}`, creds: sb });
+    }
+    const fb = discoverFirebase(visible);
+    if (fb)
+        targets.push({ kind: 'firebase', target: fb.projectId, explicit: false, source: 'discovered:code', creds: fb });
+    targets.push(...liveTargets(opts.appUrl, opts.idorTokens, opts.appUrlSource));
+    return { targets };
+}
+/** Which CheckRun ids a target produces when it runs — used to record the not-run case. */
+function runIdsFor(target) {
+    switch (target.kind) {
+        case 'supabase': return ['supabase-probe'];
+        case 'firebase': return ['firebase-probe'];
+        case 'live': return ['live-site', 'endpoint-probe'];
+        case 'idor': return ['idor'];
+    }
+}
+/**
+ * A target that was requested and did not run is missing coverage, never a
+ * clean result: `unsupported` makes the gate incomplete. A target that was only
+ * auto-discovered and declined is a voluntary skip — visible, gate unaffected.
+ */
+function notRun(target) {
+    const ownership = target.kind === 'live' || target.kind === 'idor';
+    const via = target.source === 'wizard' ? 'in the wizard' : `via ${target.source}`;
+    const note = target.explicit
+        ? `requested ${via} but ${ownership ? 'ownership was not confirmed' : 'consent was not given'}`
+        : 'declined by user';
+    return runIdsFor(target).map((id) => ({ id, level: 2, status: target.explicit ? 'unsupported' : 'skipped', note }));
+}
 /**
  * Tiered orchestrator shared by the CLI wizard and the skill. Every check that
  * runs records a status (completed/partial/failed/skipped/unsupported) so a
@@ -14,13 +98,15 @@ import { idorDifferential } from '../engine/checkers/live/idor.js';
  */
 export async function runFlow(opts) {
     const log = opts.log ?? (() => { });
-    const result = opts.precomputedStatic ?? (await scanStatic(opts.root, { configPath: opts.configPath }));
+    const result = opts.precomputedStatic ?? (await scanStatic(opts.root, { configPath: opts.configPath, excludeAbs: opts.excludeAbs }));
     const findings = [...result.findings];
     const runs = [...result.runs];
-    // Files used for backend discovery / endpoint enumeration honor ignorePaths,
-    // so an ignored path (e.g. tests/, fixtures/) does not feed the live probes.
+    // Files used for endpoint enumeration (and, without a caller-supplied plan,
+    // backend discovery) honor ignorePaths, so an ignored path (e.g. tests/,
+    // fixtures/) does not feed the live probes.
     const config = loadConfig(opts.root, opts.configPath);
-    const visible = result.files.filter((f) => !config.ignorePaths.some((sub) => f.rel.includes(sub)));
+    const visible = visibleFiles(result.files, config);
+    const plan = opts.plan ?? planTargets(result.files, config, opts);
     // Level 1 — dependency audit.
     if (opts.runDeps) {
         log('Level 1: dependency audit…');
@@ -28,86 +114,55 @@ export async function runFlow(opts) {
         findings.push(...deps.findings);
         runs.push(deps.run);
     }
-    // Level 2 — Supabase active probe (read-only).
-    const sbCreds = opts.supabaseUrl && opts.supabaseKey
-        ? { url: opts.supabaseUrl, anonKey: opts.supabaseKey, keyKind: classifyKey(opts.supabaseKey) === 'publishable' ? 'publishable' : 'jwt-anon' }
-        : discoverSupabase(visible);
-    if (sbCreds) {
-        const ok = await opts.consent({
-            kind: 'supabase',
-            target: sbCreds.url,
-            detail: 'read tables, buckets and RPC using the public key (read-only)',
-        });
-        if (ok === true) {
-            log(`Level 2: probing Supabase ${sbCreds.url}…`);
-            const r = await probeSupabase({ creds: sbCreds, log });
-            findings.push(...r.findings);
-            runs.push(r.run);
-        }
-        else {
-            runs.push({ id: 'supabase-probe', level: 2, status: 'skipped', note: 'declined' });
-        }
-    }
-    // Level 2 — Firebase active probe.
-    const fbCreds = discoverFirebase(visible);
-    if (fbCreds) {
-        const ok = await opts.consent({
-            kind: 'firebase',
-            target: fbCreds.projectId,
-            detail: 'anonymous reads of RTDB, Firestore and Storage',
-        });
-        if (ok === true) {
-            log(`Level 2: probing Firebase ${fbCreds.projectId}…`);
-            const r = await probeFirebase({ creds: fbCreds, log });
-            findings.push(...r.findings);
-            runs.push(r.run);
+    // Level 2 — execute exactly the plan, one consent per concrete target.
+    // IDOR depends on the live-site consent: without ownership of the host, the
+    // two-account replay must not run either.
+    let liveApproved = false;
+    let endpoints;
+    for (const target of plan.targets) {
+        const req = { kind: target.kind, target: target.target, detail: DETAIL[target.kind], explicit: target.explicit };
+        const approved = target.kind === 'idor' ? liveApproved && (await opts.consent(req)) === true : (await opts.consent(req)) === true;
+        if (!approved) {
+            runs.push(...notRun(target));
+            continue;
         }
-        else {
-            runs.push({ id: 'firebase-probe', level: 2, status: 'skipped', note: 'declined' });
-        }
-    }
-    // Level 2 — live site + endpoint probe + IDOR.
-    if (opts.appUrl) {
-        const ok = await opts.consent({
-            kind: 'live',
-            target: opts.appUrl,
-            detail: 'passive checks (headers, exposed files) + unauthenticated endpoint probe',
-        });
-        if (ok === true) {
-            log(`Level 2: live checks on ${opts.appUrl}…`);
-            const site = await checkLiveSite(opts.appUrl);
-            findings.push(...site.findings);
-            runs.push(site.run);
-            const endpoints = collectEndpoints(visible);
-            const ep = await probeEndpointsUnauth(opts.appUrl, endpoints);
-            findings.push(...ep.findings);
-            runs.push(ep.run);
-            if (opts.idorTokens) {
-                const idorOk = await opts.consent({
-                    kind: 'idor',
-                    target: opts.appUrl,
-                    detail: 'replay object-scoped endpoints with two accounts (IDOR test)',
-                });
-                if (idorOk === true) {
-                    const r = await idorDifferential(opts.appUrl, endpoints, opts.idorTokens[0], opts.idorTokens[1]);
-                    findings.push(...r.findings);
-                    runs.push(r.run);
-                }
-                else {
-                    runs.push({ id: 'idor', level: 2, status: 'skipped', note: 'declined' });
-                }
+        switch (target.kind) {
+            case 'supabase': {
+                log(`Level 2: probing Supabase ${target.target}…`);
+                const r = await probeSupabase({ creds: target.creds, log });
+                findings.push(...r.findings);
+                runs.push(r.run);
+                break;
+            }
+            case 'firebase': {
+                log(`Level 2: probing Firebase ${target.target}…`);
+                const r = await probeFirebase({ creds: target.creds, log });
+                findings.push(...r.findings);
+                runs.push(r.run);
+                break;
+            }
+            case 'live': {
+                liveApproved = true;
+                log(`Level 2: live checks on ${target.appUrl}…`);
+                const site = await checkLiveSite(target.appUrl);
+                findings.push(...site.findings);
+                runs.push(site.run);
+                endpoints ??= collectEndpoints(visible);
+                const ep = await probeEndpointsUnauth(target.appUrl, endpoints);
+                findings.push(...ep.findings);
+                runs.push(ep.run);
+                break;
+            }
+            case 'idor': {
+                endpoints ??= collectEndpoints(visible);
+                const r = await idorDifferential(target.appUrl, endpoints, target.tokens[0], target.tokens[1]);
+                findings.push(...r.findings);
+                // Tokens are always an explicit request. If the check could not run
+                // (identical tokens, no id-scoped endpoints…) that is a request not
+                // honoured — `unsupported`, so it cannot hide inside a clean PASS.
+                runs.push(r.run.status === 'skipped' ? { ...r.run, status: 'unsupported' } : r.run);
+                break;
             }
-        }
-        else {
-            // A URL only reaches here because the caller explicitly asked for it, so
-            // this is a check that was REQUESTED and did not run. That is missing
-            // coverage, not a clean result: `unsupported` makes the gate incomplete,
-            // where `skipped` would have let a never-run live check exit 0 as PASS.
-            const note = 'requested but not authorized — ownership was not confirmed';
-            runs.push({ id: 'live-site', level: 2, status: 'unsupported', note });
-            runs.push({ id: 'endpoint-probe', level: 2, status: 'unsupported', note });
-            if (opts.idorTokens)
-                runs.push({ id: 'idor', level: 2, status: 'unsupported', note });
         }
     }
     // Apply config-based suppressions to the full finding set (Level 1/2 too).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easyvibegate",
-  "version": "0.4.4",
+  "version": "0.6.2",
   "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
   "type": "module",
   "bin": {