flecto 1.0.2 → 2.1.0

package/src/packs/node-runtime.json

@@ -0,0 +1,44 @@
+{
+  "id": "node-runtime",
+  "rules": [
+    {
+      "id": "node-runtime-engine-removed",
+      "severity": "warn",
+      "when": ["removed"],
+      "match": {
+        "pathEquals": "engines.node"
+      },
+      "message": "Node.js engine requirement was removed. Keep a supported runtime floor to avoid accidental runtime downgrades."
+    },
+    {
+      "id": "node-runtime-tls-verification-disabled",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_TLS_REJECT_UNAUTHORIZED$"
+      },
+      "afterIn": [0, "0"],
+      "message": "NODE_TLS_REJECT_UNAUTHORIZED disables TLS certificate verification. Remove it and fix the certificate chain."
+    },
+    {
+      "id": "node-runtime-debug-enabled",
+      "severity": "warn",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_DEBUG$"
+      },
+      "afterMatches": ".+",
+      "message": "NODE_DEBUG is enabled. Confirm verbose runtime debugging is appropriate for this environment."
+    },
+    {
+      "id": "node-runtime-inspector-enabled",
+      "severity": "warn",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_OPTIONS$"
+      },
+      "afterMatches": "(^|\\s)--inspect(?:-brk)?(?:=|\\s|$)",
+      "message": "Node.js inspector is enabled through NODE_OPTIONS. Avoid exposing debug ports outside trusted development environments."
+    }
+  ]
+}

package/src/packs/strict-prod.json

@@ -0,0 +1,37 @@
+{
+  "id": "strict-prod",
+  "rules": [
+    {
+      "id": "secret-key-changed",
+      "severity": "error",
+      "when": ["added", "changed", "removed"],
+      "match": {
+        "path": "(secret|token|password|api[_-]?key|private[_-]?key|credential)",
+        "pathFlags": "i"
+      },
+      "message": "Sensitive-looking key changed in production profile. Confirm rotation and access controls."
+    },
+    {
+      "id": "dangerous-toggle-enabled",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(debug|allow_insecure|disable_tls|skip_tls_verify|permit_all)",
+        "pathFlags": "i"
+      },
+      "afterTruthy": true,
+      "message": "Dangerous toggle enabled in production profile."
+    },
+    {
+      "id": "pool-size-jump",
+      "severity": "error",
+      "when": ["changed"],
+      "match": {
+        "path": "pool_size$",
+        "pathFlags": "i"
+      },
+      "numericJump": { "minMultiple": 2 },
+      "messageTemplate": "Pool size increased from {before} to {after} (>=2x) in production."
+    }
+  ]
+}

package/src/parser.js

@@ -1,10 +1,72 @@
 import { readFileSync } from 'fs';
-import { extname } from 'path';
+import { basename, extname } from 'path';
 import yaml from 'js-yaml';
 import TOML from '@iarna/toml';
 import dotenv from 'dotenv';
 
-const SUPPORTED = ['.json', '.yaml', '.yml', '.toml', '.env'];
+const SUPPORTED_EXT = ['.json', '.yaml', '.yml', '.toml', '.env', '.ini'];
+
+/**
+ * True for dotenv-like names: `.env`, `.env.*`, `*.env`
+ * @param {string} filepath
+ */
+export function isEnvFilename(filepath) {
+  const base = basename(filepath);
+  return base === '.env' || base.startsWith('.env.') || base.endsWith('.env');
+}
+
+/**
+ * True for INI files.
+ * @param {string} filepath
+ */
+export function isIniFilename(filepath) {
+  return extname(filepath).toLowerCase() === '.ini';
+}
+
+/**
+ * Minimal INI parser: [section] + key=value.
+ * Root keys are top-level; sectioned keys nest under the section name.
+ * @param {string} raw
+ * @returns {Record<string, unknown>}
+ */
+export function parseIni(raw) {
+  /** @type {Record<string, unknown>} */
+  const out = {};
+  let section = null;
+
+  for (const line of String(raw).split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith(';') || trimmed.startsWith('#')) continue;
+    const sectionMatch = trimmed.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      section = sectionMatch[1].trim();
+      if (!isPlainObject(out[section])) out[section] = {};
+      continue;
+    }
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (section == null) {
+      out[key] = value;
+    } else {
+      /** @type {Record<string, string>} */
+      const bucket = /** @type {any} */ (out[section]);
+      bucket[key] = value;
+    }
+  }
+  return out;
+}
+
+function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
 
 /**
  * Auto-detect the format of a file and parse it into a plain JS object.
@@ -15,35 +77,38 @@ const SUPPORTED = ['.json', '.yaml', '.yml', '.toml', '.env'];
  */
 export function parseContent(filepath, raw) {
   const ext = extname(filepath).toLowerCase();
+  const envLike = isEnvFilename(filepath);
+  const iniLike = isIniFilename(filepath);
 
-  if (!SUPPORTED.includes(ext)) {
-    const supported = SUPPORTED.join(', ');
+  if (!envLike && !iniLike && !SUPPORTED_EXT.includes(ext)) {
+    const supported = [...SUPPORTED_EXT, '.env.*', '*.env'].join(', ');
     throw new Error(
-      `Unsupported file format "${ext}" for "${filepath}".\n` +
+      `Unsupported file format "${ext || '(none)'}" for "${filepath}".\n` +
       `Supported extensions: ${supported}`
     );
   }
   try {
+    if (envLike || ext === '.env') {
+      return dotenv.parse(raw);
+    }
+
+    if (iniLike) {
+      return parseIni(raw);
+    }
+
     if (ext === '.json') {
       return JSON.parse(raw);
     }
 
     if (ext === '.yaml' || ext === '.yml') {
       const result = yaml.load(raw);
-      // yaml.load can return null for empty files
       return result == null ? {} : result;
     }
 
     if (ext === '.toml') {
       return TOML.parse(raw);
     }
-
-    if (ext === '.env') {
-      const parsed = dotenv.parse(raw);
-      return parsed;
-    }
   } catch (err) {
-    // Try to extract line info from error messages
     const lineMatch = err.message?.match(/line (\d+)/i);
     const lineInfo = lineMatch ? ` (line ${lineMatch[1]})` : '';
     throw new Error(
@@ -68,10 +133,11 @@ export function parseFile(filepath) {
 }
 
 /**
- * Returns true if the file extension is supported.
+ * Returns true if the file format is supported.
  * @param {string} filepath
  * @returns {boolean}
  */
 export function isSupported(filepath) {
-  return SUPPORTED.includes(extname(filepath).toLowerCase());
+  if (isEnvFilename(filepath) || isIniFilename(filepath)) return true;
+  return SUPPORTED_EXT.includes(extname(filepath).toLowerCase());
 }

package/src/policy-test.js

@@ -0,0 +1,124 @@
+import { existsSync, readFileSync } from 'fs';
+import { join, resolve } from 'path';
+
+import { diffTrees } from './differ.js';
+import { parseFile } from './parser.js';
+import { evaluatePolicies } from './policy.js';
+
+const DEFAULT_CONFIG_NAME = 'flecto-policy-test.json';
+
+function readJson(path, label) {
+  if (!existsSync(path)) {
+    throw new Error(`Policy fixture ${label} not found: ${path}`);
+  }
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch (err) {
+    throw new Error(`Policy fixture ${label} is not valid JSON: ${path}: ${err.message}`);
+  }
+}
+
+function validateExpectedFinding(finding, index) {
+  if (!finding || typeof finding !== 'object') {
+    throw new Error(`Policy fixture expected[${index}] must be an object`);
+  }
+  for (const field of ['id', 'severity', 'path']) {
+    if (typeof finding[field] !== 'string' || !finding[field]) {
+      throw new Error(`Policy fixture expected[${index}].${field} must be a non-empty string`);
+    }
+  }
+}
+
+function findingKey(finding) {
+  return `${finding.id}\u0000${finding.severity}\u0000${finding.path}`;
+}
+
+function displayFinding(finding) {
+  return `${finding.severity} ${finding.id} at ${finding.path}`;
+}
+
+/**
+ * Compare findings by id, severity, and path, ignoring messages and pack labels.
+ * @param {import('./policy.js').PolicyFinding[]} actual
+ * @param {Array<{id: string, severity: string, path: string}>} expected
+ */
+export function assertExpectedFindings(actual, expected) {
+  const expectedByKey = new Map();
+  const actualByKey = new Map();
+  for (const finding of expected) {
+    const key = findingKey(finding);
+    expectedByKey.set(key, (expectedByKey.get(key) ?? 0) + 1);
+  }
+  for (const finding of actual) {
+    const key = findingKey(finding);
+    actualByKey.set(key, (actualByKey.get(key) ?? 0) + 1);
+  }
+
+  const missing = [];
+  const unexpected = [];
+  for (const finding of expected) {
+    const key = findingKey(finding);
+    if ((actualByKey.get(key) ?? 0) > 0) {
+      actualByKey.set(key, actualByKey.get(key) - 1);
+    } else {
+      missing.push(finding);
+    }
+  }
+  for (const finding of actual) {
+    const key = findingKey(finding);
+    if ((expectedByKey.get(key) ?? 0) > 0) {
+      expectedByKey.set(key, expectedByKey.get(key) - 1);
+    } else {
+      unexpected.push(finding);
+    }
+  }
+
+  if (missing.length === 0 && unexpected.length === 0) return;
+
+  const lines = ['Policy fixture findings did not match.'];
+  if (missing.length > 0) {
+    lines.push('Missing findings:');
+    lines.push(...missing.map((finding) => `  - ${displayFinding(finding)}`));
+  }
+  if (unexpected.length > 0) {
+    lines.push('Unexpected findings:');
+    lines.push(...unexpected.map((finding) => `  - ${displayFinding(finding)}`));
+  }
+  throw new Error(lines.join('\n'));
+}
+
+/**
+ * Run a policy fixture stored in a directory.
+ * @param {string} fixtureDir
+ * @param {{ configName?: string }} [options]
+ */
+export async function testPolicyFixture(fixtureDir, options = {}) {
+  const dir = resolve(fixtureDir);
+  const configName = options.configName ?? DEFAULT_CONFIG_NAME;
+  const configPath = join(dir, configName);
+  const config = readJson(configPath, 'config');
+  if (!Array.isArray(config.expected)) {
+    throw new Error(`Policy fixture config must contain an expected array: ${configPath}`);
+  }
+  config.expected.forEach(validateExpectedFinding);
+
+  const baselinePath = resolve(dir, config.baseline ?? 'baseline.json');
+  const currentPath = resolve(dir, config.current ?? 'current.json');
+  const baseline = readJson(baselinePath, 'baseline');
+  if (!existsSync(currentPath)) {
+    throw new Error(`Policy fixture current file not found: ${currentPath}`);
+  }
+
+  const changes = diffTrees(baseline.state ?? baseline, parseFile(currentPath));
+  const findings = await evaluatePolicies(changes, {
+    cwd: dir,
+    file: currentPath,
+    profile: config.profile ?? null,
+    source: config.source ?? 'ci',
+    policies: config.policies,
+    plugins: config.plugins,
+  });
+  assertExpectedFindings(findings, config.expected);
+
+  return { fixtureDir: dir, changes, findings };
+}