fini-proof 0.3.0

package/src/engines/vendor/entrypoint-guard-core.mjs

@@ -0,0 +1,43 @@
+// PROVENANCE — ported, not rewritten.
+//   source : finipe/scripts/ci/check-entrypoint-guard.mjs (ESM entrypoint fail-open detector)
+//   commit : finipe 4ac53b367b348d23d000629cb14e19633beb9613 (file last changed in 04152854b)
+//   kept   : rawGuards() and its helper constants verbatim (lines 60-103 of the source, minus the Finipe
+//            CANONICAL_BLOCK text, which is replaced by an empty sentinel: a customer repo has no canonical
+//            block, so every argv[1]-vs-own-path compare that is not realpath'd on both sides is reported).
+//   changed: the Finipe-only "must carry the byte-identical canonical block" rule and the symlink probe of every
+//            guarded file are not ported (running a customer's scripts is out of scope for a static v0.1 check);
+//            the symlink repro survives as this engine's behavioural negative control.
+const CANONICAL_BLOCK = '\u0000fini-proof-no-canonical-block\u0000'
+// Built by concatenation so that no source line of THIS file is a raw guard.
+const ARGV1 = 'process.argv' + '[1]'
+const SELF_REFS = ['import.meta.url', '__filename', 'fileURLToPath', 'pathToFileURL']
+const isComment = (t) => t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')
+
+/** Raw guard findings in one source text (canonical blocks blanked first, line numbers kept). Pure. */
+export function rawGuards(src) {
+  const blank = '\n'.repeat(CANONICAL_BLOCK.split('\n').length - 1)
+  const lines = src.split(CANONICAL_BLOCK).join(blank).split('\n')
+  const out = []
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim()
+    if (!t.includes(ARGV1) || isComment(t)) continue
+    const win = lines.slice(Math.max(0, i - 2), i + 3).filter((l) => !isComment(l.trim())).join('\n')
+    if (win.includes('===') && SELF_REFS.some((r) => win.includes(r))) out.push({ line: i + 1, text: t.slice(0, 140) })
+  }
+  // Indirection: `const entry = process.argv[1]` … `path.resolve(entry) === fileURLToPath(import.meta.url)`
+  // any number of lines later (scripts/codemods/aggressive-token-enforcement.mjs had exactly this).
+  const aliases = new Set()
+  for (const l of lines) {
+    const m = !isComment(l.trim()) && l.includes(ARGV1) && /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/.exec(l)
+    if (m) aliases.add(m[1])
+  }
+  for (const a of aliases) {
+    const re = new RegExp(`\\b${a.replace(/\$/g, '\\$')}\\b`)
+    lines.forEach((l, i) => {
+      const t = l.trim()
+      if (isComment(t) || t.includes(ARGV1) || !re.test(t)) return
+      if (t.includes('===') && SELF_REFS.some((r) => t.includes(r)) && !out.some((o) => o.line === i + 1)) out.push({ line: i + 1, text: t.slice(0, 140) })
+    })
+  }
+  return out
+}

package/src/engines/vendor/migration-invariants-core.mjs

@@ -0,0 +1,127 @@
+// PORTED from finipe scripts/ci/lib/migration-invariants.cjs (blob 6440772a, last changed 18ce3086b 2026-09-26,
+// read at finipe commit 4ac53b367b348d23d000629cb14e19633beb9613).
+// Lines 33–135 (LIT, ROUTE, balanced, literalArray, constArray, constString, classesOf, expandStatic) are VERBATIM,
+// converted from CommonJS to ESM exports. expandStatic() expands the statically-resolvable loops of a migration
+// (`for (const t of ['a','b']) { … ${t} … }`) so table-level rules see every table; what stays interpolated is
+// reported as `unresolved` — never read as clean.
+// downReversal() is ADAPTED from evaluateMigration() lines 213–230 (down() must drop what up() created, in
+// reverse order): the Finipe RLS / GRANT / tenant_id-TEXT / finipe_system rules are Finipe-schema-specific and
+// were NOT ported; the problem strings are returned as { rule, table(s) } objects instead of text.
+const LIT = /^\s*(['"`])([A-Za-z0-9_.]+)\1\s*$/;
+
+/** The DB-backed tier gate that measures each property class; null = none does. */
+const ROUTE = {
+  'force-rls': 'lint:force-rls-coverage',
+  grants: 'lint:grants-coverage',
+  'policy-shape': 'lint:finipe-system-policy-shape',
+  'down-drop': null, // migration:test:roundtrip is continue-on-error in the tier — not a gate
+  'create-table': null, // tenant_id shape has no DB gate
+};
+
+function balanced(text, openIdx, open, close) {
+  let depth = 0;
+  for (let j = openIdx; j < text.length; j += 1) {
+    if (text[j] === open) depth += 1;
+    else if (text[j] === close) {
+      depth -= 1;
+      if (depth === 0) return j;
+    }
+  }
+  return -1;
+}
+
+/** `[ 'a', "b", `c`, ] as const` -> ['a','b','c'], or null if any element is not a plain literal. */
+function literalArray(inner) {
+  const parts = inner.split(',').map((p) => p.trim()).filter((p) => p.length);
+  if (!parts.length) return null;
+  const out = [];
+  for (const p of parts) {
+    const m = LIT.exec(p);
+    if (!m) return null;
+    out.push(m[2]);
+  }
+  return out;
+}
+
+function constArray(src, name) {
+  const re = new RegExp(`\\bconst\\s+${name}\\s*(?::[^=]+)?=\\s*\\[`, 'g');
+  const m = re.exec(src);
+  if (!m) return null;
+  const open = m.index + m[0].length - 1;
+  const close = balanced(src, open, '[', ']');
+  return close < 0 ? null : literalArray(src.slice(open + 1, close));
+}
+
+function constString(src, name) {
+  const m = new RegExp(`\\bconst\\s+${name}\\s*(?::\\s*string\\s*)?=\\s*(['"\`])([A-Za-z0-9_.]+)\\1\\s*;`).exec(src);
+  return m ? m[2] : null;
+}
+
+function classesOf(sqlTemplate) {
+  const c = [];
+  if (/ROW\s+LEVEL\s+SECURITY/i.test(sqlTemplate)) c.push('force-rls');
+  if (/\bGRANT\b/i.test(sqlTemplate)) c.push('grants');
+  if (/CREATE\s+POLICY/i.test(sqlTemplate)) c.push('policy-shape');
+  if (/DROP\s+TABLE/i.test(sqlTemplate)) c.push('down-drop');
+  if (/CREATE\s+TABLE/i.test(sqlTemplate)) c.push('create-table');
+  return c;
+}
+
+function expandStatic(execText) {
+  let text = execText;
+  // Loops, LAST first: an inner loop starts after its outer one, so it is expanded before it.
+  const heads = [...text.matchAll(/\bfor\s*\(\s*const\s+([A-Za-z_$][\w$]*)\s+of\s+/g)].reverse();
+  for (const h of heads) {
+    const v = h[1];
+    let i = h.index + h[0].length;
+    let items = null;
+    let afterIter;
+    if (text[i] === '[') {
+      const close = balanced(text, i, '[', ']');
+      if (close < 0) continue;
+      items = literalArray(text.slice(i + 1, close));
+      afterIter = close + 1;
+    } else {
+      const id = /^([A-Za-z_$][\w$]*)/.exec(text.slice(i));
+      if (!id) continue;
+      items = constArray(execText, id[1]);
+      afterIter = i + id[1].length;
+    }
+    const paren = /^\s*(?:as\s+const\s*)?\)\s*\{/.exec(text.slice(afterIter));
+    if (!paren) continue;
+    const bodyOpen = afterIter + paren[0].length - 1;
+    const bodyClose = balanced(text, bodyOpen, '{', '}');
+    if (bodyClose < 0 || !items) continue; // left in place; the unresolved scan below names it
+    const body = text.slice(bodyOpen + 1, bodyClose);
+    const iv = new RegExp(`\\$\\{\\s*${v.replace(/\$/g, '\\$')}\\s*\\}`, 'g');
+    const expanded = items.map((it) => body.replace(iv, it)).join('\n');
+    text = text.slice(0, h.index) + expanded + text.slice(bodyClose + 1);
+  }
+  // Same-file string constants.
+  text = text.replace(/\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g, (all, name) => constString(execText, name) ?? all);
+  // Whatever is still interpolated inside an RLS-relevant SQL template.
+  const unresolved = [];
+  for (const m of text.matchAll(/\$\{([^}]*)\}/g)) {
+    const start = text.lastIndexOf('`', m.index);
+    const end = text.indexOf('`', m.index);
+    const tpl = text.slice(start < 0 ? 0 : start, end < 0 ? text.length : end);
+    const classes = classesOf(tpl);
+    if (classes.length) unresolved.push({ expr: m[1].trim(), classes });
+  }
+  return { text, unresolved };
+}
+
+/** Adapted from evaluateMigration(): creates = tables up() creates, drops = tables down() drops (in order). */
+function downReversal(creates, drops, sharedTableCounts = {}) {
+  const problems = []
+  const owned = creates.filter((t) => (sharedTableCounts[t] || 1) <= 1)
+  if (owned.length && !drops.length) { problems.push({ rule: 'DOWN_INCOMPLETE', tables: owned }); return problems }
+  const missing = owned.filter((t) => !drops.includes(t))
+  if (missing.length) problems.push({ rule: 'DOWN_INCOMPLETE', tables: missing })
+  const expected = [...owned].reverse().filter((t) => drops.includes(t))
+  const actual = drops.filter((t) => owned.includes(t))
+  if (expected.length > 1 && expected.join(',') !== actual.join(',')) problems.push({ rule: 'DOWN_ORDER', expected, actual })
+  return problems
+}
+
+export { LIT, ROUTE, balanced, literalArray, constArray, constString, classesOf, expandStatic, downReversal }

package/src/engines/vendor/secrets-core.mjs

@@ -0,0 +1,123 @@
+// PROVENANCE — ported, not rewritten.
+//   source : finipe/scripts/ci/check-secrets-and-log-redaction.mjs, part (a) "no secret material in the tree"
+//   commit : finipe 4ac53b367b348d23d000629cb14e19633beb9613 (file last changed in ae240e49e)
+//   kept   : lines 62-129 and 157-200 verbatim (patterns, .env credential-key segmentation, placeholder rules,
+//            binary-extension list, scanContentForSecrets, lineOf).
+//   changed: Finipe path allowlist + git/fs walker removed (runner owns file listing; allowlisting is the
+//            customer's .fini-proof.json `ignore`), and the pure scanner is exported. Part (b), log redaction,
+//            is NestJS-specific (backend/src logger helpers) and is NOT ported in v0.1.
+
+// ── (a) secret-material patterns ────────────────────────────────────────
+
+const AWS_ACCESS_KEY_RE = /\bAKIA[0-9A-Z]{16}\b/g
+const PRIVATE_KEY_BLOCK_RE = /-----BEGIN (?:RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----/g
+const JWT_ASSIGNED_RE = /([A-Za-z_$][\w$]*)\s*[:=]\s*['"`](eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})['"`]/g
+const SLACK_TOKEN_RE = /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g
+const STRIPE_KEY_RE = /\b(?:sk|rk)_live_[0-9A-Za-z]{10,}\b/g
+const SENDGRID_KEY_RE = /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g
+// Any KEY=VALUE line in an .env* file — filtered below to those whose key
+// has PASSWORD/SECRET/TOKEN as a whole UNDERSCORE-DELIMITED SEGMENT (never
+// a plain substring: `_` is a \w character, so a regex `\bPASSWORD\b` does
+// NOT see a boundary between `DB_` and `PASSWORD` and would silently match
+// nothing — segment-splitting is used instead of `\b` for exactly this
+// reason). `TOKENS` (plural) is therefore excluded automatically: it is
+// never its own segment. A second pass drops keys that are self-evidently a
+// numeric limit/toggle (`_CAP`, `_LIMIT`, `_MAX`, `_ENABLED`, …) despite
+// containing one of those words as a segment, e.g.
+// `COPILOT_MONTHLY_TOKEN_CAP_PER_TENANT`.
+// NOTE: the whitespace around `=` is deliberately `[ \t]*`, never `\s*` —
+// `\s` matches `\n`, and a greedy `\s*` immediately before a `(.*)` capture
+// will happily cross the newline and swallow the ENTIRE NEXT LINE as this
+// line's "value" on backtracking (caught by this gate's own self-test: an
+// empty `KEY=` line was mis-captured as holding the next line's full text).
+const ENV_ASSIGNMENT_RE = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=(.*)$/gim
+const ENV_CREDENTIAL_SEGMENTS = new Set(['PASSWORD', 'SECRET', 'TOKEN'])
+const ENV_NON_CREDENTIAL_SEGMENTS = new Set(['CAP', 'LIMIT', 'MAX', 'COUNT', 'SIZE', 'TTL', 'EXPIRY', 'EXPIRES', 'DURATION', 'ENABLED', 'DISABLED'])
+
+function envKeyLooksLikeCredential(key) {
+  const segments = key.toUpperCase().split('_')
+  if (!segments.some(s => ENV_CREDENTIAL_SEGMENTS.has(s))) return false
+  if (segments.some(s => ENV_NON_CREDENTIAL_SEGMENTS.has(s))) return false
+  return true
+}
+
+// Substrings that are self-evidently placeholder, not real secret material —
+// deliberately broad, as a substring test anywhere in the value. A security
+// gate's false positives get reviewed and allowlisted or fixed here; its
+// false NEGATIVES ship a real secret, which is the worse failure direction.
+const PLACEHOLDER_SUBSTRINGS = [
+  'change-me', 'changeme', 'change_me', 'replace', 'your-', 'your_',
+  'todo', 'placeholder', 'example', 'sample', 'dummy', 'fake', 'stub',
+  'not-set', 'not_set', '<', '>', '...',
+]
+const PLACEHOLDER_EXACT_RE = /^["']?(?:|none|null|undefined|true|false|dev|development|staging|local|test)["']?$/i
+// Inline env-file comment (`KEY=   # explanatory text`, or `KEY=# text` once
+// the assignment regex has already eaten the leading whitespace) is not a
+// value.
+const ENV_INLINE_COMMENT_RE = /(?:^|\s)#.*$/
+// A value that is one character repeated (`0000…0`, `xxxxxxxx`) end to end.
+const REPEATED_CHAR_VALUE_RE = /^(.)\1{5,}$/
+// Universally-known, publicly-documented default credentials for local
+// dev-only services — not secrets by any definition (anyone can look them
+// up in the tool's own docs); flagging them is pure noise.
+const KNOWN_DEV_DEFAULT_VALUES = new Set(['minioadmin', 'postgres', 'guest'])
+
+function isPlaceholderEnvValue(rawValue) {
+  const v = rawValue.replace(ENV_INLINE_COMMENT_RE, '').trim()
+  if (!v) return true
+  const unquoted = v.replace(/^["']|["']$/g, '')
+  if (PLACEHOLDER_EXACT_RE.test(v)) return true
+  if (KNOWN_DEV_DEFAULT_VALUES.has(unquoted.toLowerCase())) return true
+  if (REPEATED_CHAR_VALUE_RE.test(unquoted)) return true
+  const lower = v.toLowerCase()
+  return PLACEHOLDER_SUBSTRINGS.some(s => lower.includes(s))
+}
+
+// Allowlisted EXACTLY by path — fixtures/test vectors that legitimately embed
+// fake-shaped secret material to exercise the code that handles real ones.
+const BINARY_EXT_RE = /\.(png|jpg|jpeg|gif|webp|ico|pdf|woff2?|ttf|eot|zip|gz|tgz|jar|class|so|dylib|dll|exe|bin|wasm|mp4|mov|mp3|db|sqlite)$/i
+
+/**
+ * Scan one file's CONTENT (already read) for secret material. Pure function —
+ * no fs/git access — so the self-test below can drive it directly on fixture
+ * strings without needing the fixture to be `git`-tracked.
+ */
+function scanContentForSecrets(relPath, content) {
+  const findings = []
+  const isEnvFile = /(^|\/)\.env(\..+)?$/.test(relPath)
+
+  for (const re of [AWS_ACCESS_KEY_RE, PRIVATE_KEY_BLOCK_RE, SLACK_TOKEN_RE, STRIPE_KEY_RE, SENDGRID_KEY_RE]) {
+    re.lastIndex = 0
+    let m
+    while ((m = re.exec(content)) !== null) {
+      findings.push({ kind: re === AWS_ACCESS_KEY_RE ? 'aws-access-key' : re === PRIVATE_KEY_BLOCK_RE ? 'private-key-block' : re === SLACK_TOKEN_RE ? 'slack-token' : re === STRIPE_KEY_RE ? 'stripe-live-key' : 'sendgrid-key', line: lineOf(content, m.index), match: m[0].slice(0, 24) + (m[0].length > 24 ? '…' : '') })
+    }
+  }
+
+  {
+    JWT_ASSIGNED_RE.lastIndex = 0
+    let m
+    while ((m = JWT_ASSIGNED_RE.exec(content)) !== null) {
+      findings.push({ kind: 'jwt-assigned-to-config', line: lineOf(content, m.index), match: `${m[1]} = ${m[2].slice(0, 20)}…` })
+    }
+  }
+
+  if (isEnvFile) {
+    ENV_ASSIGNMENT_RE.lastIndex = 0
+    let m
+    while ((m = ENV_ASSIGNMENT_RE.exec(content)) !== null) {
+      const key = m[1]
+      if (!envKeyLooksLikeCredential(key)) continue
+      if (isPlaceholderEnvValue(m[2])) continue
+      findings.push({ kind: 'env-secret-assignment', line: lineOf(content, m.index), match: `${key}=<redacted-for-report>` })
+    }
+  }
+
+  return findings
+}
+
+function lineOf(src, idx) {
+  return src.slice(0, idx).split('\n').length
+}
+
+export { scanContentForSecrets, BINARY_EXT_RE, lineOf }