iamsecure 0.0.0-stage → 0.1.2

package/src/ui/server.js

@@ -0,0 +1,97 @@
+import http from 'node:http';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const PAGE = fileURLToPath(new URL('./index.html', import.meta.url));
+
+function openBrowser(url) {
+  const [cmd, args] =
+    process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] : ['xdg-open', [url]];
+  try {
+    spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+  } catch {}
+}
+
+function listen(server, port, attempts = 20) {
+  return new Promise((resolve, reject) => {
+    const tryPort = (p, left) => {
+      server.once('error', (err) => {
+        if (err.code === 'EADDRINUSE' && left > 0) tryPort(p + 1, left - 1);
+        else reject(err);
+      });
+      server.listen(p, '127.0.0.1', () => resolve(p));
+    };
+    tryPort(port, attempts);
+  });
+}
+
+/**
+ * Serve the dashboard for a report. Bound to 127.0.0.1 only; every API call needs the session
+ * token and a localhost Host header so other sites can't read the report (DNS rebinding / CSRF).
+ * @param {any} initialReport
+ * @param {{port?: number, open?: boolean, rescan?: () => Promise<any>, analyze?: (findingId: string) => Promise<any>, aiProvider?: string|null}} opts
+ */
+export async function serveDashboard(initialReport, { port = 4477, open = true, rescan, analyze, aiProvider = null } = {}) {
+  let report = initialReport;
+  const token = crypto.randomBytes(16).toString('hex');
+  let busy = false;
+
+  const server = http.createServer(async (req, res) => {
+    const host = (req.headers.host ?? '').split(':')[0];
+    if (!['127.0.0.1', 'localhost'].includes(host)) {
+      res.writeHead(403).end('Forbidden');
+      return;
+    }
+    const send = (status, body, type = 'application/json') => {
+      res.writeHead(status, {
+        'content-type': type,
+        'cache-control': 'no-store',
+        'x-content-type-options': 'nosniff',
+        'content-security-policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; img-src data:",
+      });
+      res.end(type === 'application/json' ? JSON.stringify(body) : body);
+    };
+    const url = new URL(req.url, 'http://localhost');
+
+    if (req.method === 'GET' && url.pathname === '/') {
+      const html = fs
+        .readFileSync(PAGE, 'utf8')
+        .replace('__IAMSECURE_TOKEN__', token)
+        .replace('__IAMSECURE_AI__', JSON.stringify(aiProvider));
+      return send(200, html, 'text/html; charset=utf-8');
+    }
+    if (!url.pathname.startsWith('/api/')) return send(404, { error: 'not found' });
+    if (req.headers['x-iamsecure-token'] !== token) return send(401, { error: 'bad token' });
+
+    try {
+      if (req.method === 'GET' && url.pathname === '/api/report') return send(200, report);
+      if (req.method === 'POST' && url.pathname === '/api/rescan' && rescan) {
+        if (busy) return send(409, { error: 'A scan is already running' });
+        busy = true;
+        try {
+          report = await rescan();
+        } finally {
+          busy = false;
+        }
+        return send(200, report);
+      }
+      if (req.method === 'POST' && url.pathname === '/api/analyze' && analyze) {
+        const id = url.searchParams.get('id');
+        const finding = report.findings.find((f) => f.id === id);
+        if (!finding) return send(404, { error: 'unknown finding' });
+        const ai = await analyze(finding, report);
+        return send(200, finding.ai ? finding : { ...finding, ai });
+      }
+      send(404, { error: 'not found' });
+    } catch (err) {
+      send(500, { error: err.message });
+    }
+  });
+
+  const actual = await listen(server, port);
+  const url = `http://localhost:${actual}/`;
+  if (open) openBrowser(url);
+  return { url, server };
+}

package/src/util/cache.js

@@ -0,0 +1,35 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+const baseDir =
+  process.env.IAMSECURE_CACHE_DIR ||
+  path.join(process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache'), 'iamsecure');
+
+const fileFor = (ns, key) =>
+  path.join(baseDir, ns, crypto.createHash('sha256').update(key).digest('hex').slice(0, 40) + '.json');
+
+/** Returns undefined on miss, expiry or any read error. */
+export function cacheGet(ns, key, maxAgeMs) {
+  if (process.env.IAMSECURE_NO_CACHE) return undefined;
+  const file = fileFor(ns, key);
+  try {
+    if (maxAgeMs && Date.now() - fs.statSync(file).mtimeMs > maxAgeMs) return undefined;
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return undefined;
+  }
+}
+
+export function cacheSet(ns, key, value) {
+  const file = fileFor(ns, key);
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(value));
+  } catch {
+    // A cache that can't be written is just a slower scan.
+  }
+}
+
+export const cacheDir = baseDir;

package/src/util/http.js

@@ -0,0 +1,43 @@
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * fetch() + JSON with timeout and retry on 429/5xx/network errors.
+ * @param {string} url
+ * @param {{method?: string, body?: any, headers?: Record<string,string>, timeout?: number, retries?: number}} [opts]
+ */
+export async function fetchJson(url, { method = 'GET', body, headers = {}, timeout = 30000, retries = 2 } = {}) {
+  for (let attempt = 0; ; attempt++) {
+    let retryable = true;
+    try {
+      const res = await fetch(url, {
+        method,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        headers: { 'content-type': 'application/json', 'user-agent': 'iamsecure', ...headers },
+        signal: AbortSignal.timeout(timeout),
+      });
+      if (!res.ok) {
+        retryable = res.status === 429 || res.status >= 500;
+        const text = await res.text().catch(() => '');
+        throw new Error(`${method} ${url} → HTTP ${res.status} ${text.slice(0, 300)}`);
+      }
+      return await res.json();
+    } catch (err) {
+      if (!retryable || attempt >= retries) throw err;
+      await sleep(600 * 2 ** attempt);
+    }
+  }
+}
+
+/** Run fn over items with at most `limit` in flight. Results keep input order. */
+export async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i], i);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return out;
+}

package/src/util/semver.js

@@ -0,0 +1,23 @@
+// Loose version comparison that works well enough for npm, Packagist and PyPI versions.
+
+function parse(v) {
+  const s = String(v).trim().replace(/^v/i, '').split('+')[0];
+  const m = s.match(/^(\d+(?:\.\d+)*)(.*)$/);
+  if (!m) return { nums: [], pre: s };
+  return { nums: m[1].split('.').map(Number), pre: m[2].replace(/^[-.]/, '') };
+}
+
+/** @returns {-1|0|1} */
+export function compareVersions(a, b) {
+  const pa = parse(a);
+  const pb = parse(b);
+  const len = Math.max(pa.nums.length, pb.nums.length);
+  for (let i = 0; i < len; i++) {
+    const d = (pa.nums[i] ?? 0) - (pb.nums[i] ?? 0);
+    if (d) return d > 0 ? 1 : -1;
+  }
+  if (pa.pre === pb.pre) return 0;
+  if (!pa.pre) return 1;
+  if (!pb.pre) return -1;
+  return pa.pre < pb.pre ? -1 : 1;
+}

package/src/util/toml.js

@@ -0,0 +1,129 @@
+// Minimal TOML subset parser for lockfiles and pyproject.toml: [tables], [[array tables]],
+// dotted keys, strings, numbers, booleans, (multi-line) arrays and inline tables.
+
+function parseValue(src, i) {
+  const skipWs = () => {
+    while (i < src.length) {
+      if (/\s/.test(src[i])) i++;
+      else if (src[i] === '#') while (i < src.length && src[i] !== '\n') i++;
+      else break;
+    }
+  };
+  skipWs();
+  const ch = src[i];
+  if (src.startsWith('"""', i) || src.startsWith("'''", i)) {
+    const q = src.slice(i, i + 3);
+    const end = src.indexOf(q, i + 3);
+    return [src.slice(i + 3, end).replace(/^\n/, ''), end + 3];
+  }
+  if (ch === '"') {
+    let j = i + 1;
+    let out = '';
+    while (j < src.length && src[j] !== '"') {
+      if (src[j] === '\\') {
+        const n = src[j + 1];
+        out += { n: '\n', t: '\t', '"': '"', '\\': '\\' }[n] ?? n;
+        j += 2;
+      } else out += src[j++];
+    }
+    return [out, j + 1];
+  }
+  if (ch === "'") {
+    const end = src.indexOf("'", i + 1);
+    return [src.slice(i + 1, end), end + 1];
+  }
+  if (ch === '[') {
+    const arr = [];
+    i++;
+    for (;;) {
+      skipWs();
+      if (src[i] === ']') return [arr, i + 1];
+      const [v, next] = parseValue(src, i);
+      arr.push(v);
+      i = next;
+      skipWs();
+      if (src[i] === ',') i++;
+    }
+  }
+  if (ch === '{') {
+    const obj = {};
+    i++;
+    for (;;) {
+      skipWs();
+      if (src[i] === '}') return [obj, i + 1];
+      const m = /^\s*("[^"]*"|'[^']*'|[\w.-]+)\s*=/.exec(src.slice(i, i + 200));
+      if (!m) return [obj, src.indexOf('}', i) + 1];
+      i += m[0].length;
+      const [v, next] = parseValue(src, i);
+      setPath(obj, splitKey(m[1]), v);
+      i = next;
+      skipWs();
+      if (src[i] === ',') i++;
+    }
+  }
+  const m = /^[^,\]}\n#]+/.exec(src.slice(i));
+  const raw = (m?.[0] ?? '').trim();
+  const v = raw === 'true' ? true : raw === 'false' ? false : /^-?\d+(\.\d+)?$/.test(raw) ? Number(raw) : raw;
+  return [v, i + (m?.[0].length ?? 0)];
+}
+
+function splitKey(k) {
+  const parts = [];
+  for (const m of k.matchAll(/"([^"]*)"|'([^']*)'|([^.\s]+)/g)) parts.push(m[1] ?? m[2] ?? m[3]);
+  return parts;
+}
+
+function setPath(obj, keys, value) {
+  let o = obj;
+  for (const k of keys.slice(0, -1)) {
+    if (Array.isArray(o[k])) o = o[k].at(-1);
+    else o = o[k] ??= {};
+  }
+  o[keys.at(-1)] = value;
+}
+
+export function parseToml(src) {
+  const root = {};
+  let current = root;
+  let i = 0;
+  while (i < src.length) {
+    const rest = src.slice(i);
+    const ws = /^\s+/.exec(rest);
+    if (ws) {
+      i += ws[0].length;
+      continue;
+    }
+    if (rest[0] === '#') {
+      i = src.indexOf('\n', i) === -1 ? src.length : src.indexOf('\n', i);
+      continue;
+    }
+    const arrTable = /^\[\[\s*([^\]]+?)\s*\]\]/.exec(rest);
+    if (arrTable) {
+      const keys = splitKey(arrTable[1]);
+      let o = root;
+      for (const k of keys.slice(0, -1)) o = Array.isArray(o[k]) ? o[k].at(-1) : (o[k] ??= {});
+      const last = keys.at(-1);
+      if (!Array.isArray(o[last])) o[last] = [];
+      current = {};
+      o[last].push(current);
+      i += arrTable[0].length;
+      continue;
+    }
+    const table = /^\[\s*([^\]]+?)\s*\]/.exec(rest);
+    if (table) {
+      current = root;
+      for (const k of splitKey(table[1])) current = Array.isArray(current[k]) ? current[k].at(-1) : (current[k] ??= {});
+      i += table[0].length;
+      continue;
+    }
+    const kv = /^("[^"]*"|'[^']*'|[\w.-]+)\s*=\s*/.exec(rest);
+    if (!kv) {
+      i = src.indexOf('\n', i) === -1 ? src.length : src.indexOf('\n', i) + 1;
+      continue;
+    }
+    const [value, next] = parseValue(src, i + kv[0].length);
+    setPath(current, splitKey(kv[1]), value);
+    i = next;
+  }
+  return root;
+}

package/src/util/yaml.js

@@ -0,0 +1,85 @@
+// Minimal YAML subset parser — enough for pnpm-lock.yaml and yarn berry lockfiles:
+// block mappings, block sequences of scalars, quoted/plain scalars. Flow collections
+// ({...} / [...]) are kept as raw strings since lockfile parsing never needs them.
+
+function unquote(s) {
+  s = s.trim();
+  if (s.length >= 2 && s[0] === '"' && s.at(-1) === '"') {
+    try {
+      return JSON.parse(s);
+    } catch {
+      return s.slice(1, -1);
+    }
+  }
+  if (s.length >= 2 && s[0] === "'" && s.at(-1) === "'") return s.slice(1, -1).replace(/''/g, "'");
+  return s;
+}
+
+/** Split "key: value" honoring a quoted key. Returns null when the line isn't a mapping entry. */
+function splitKey(line) {
+  if (line[0] === '"' || line[0] === "'") {
+    const q = line[0];
+    let i = 1;
+    while (i < line.length) {
+      if (line[i] === '\\' && q === '"') i += 2;
+      else if (line[i] === q && q === "'" && line[i + 1] === q) i += 2;
+      else if (line[i] === q) break;
+      else i++;
+    }
+    const rest = line.slice(i + 1);
+    if (!rest.startsWith(':')) return null;
+    return [unquote(line.slice(0, i + 1)), rest.slice(1).trim()];
+  }
+  const m = line.match(/^(.*?):(?:\s+(.*))?$/);
+  if (!m) return null;
+  return [m[1].trim(), (m[2] ?? '').trim()];
+}
+
+function stripComment(v) {
+  if (!v || v[0] === '"' || v[0] === "'") return v;
+  const i = v.indexOf(' #');
+  return i === -1 ? v : v.slice(0, i).trim();
+}
+
+export function parseYaml(text) {
+  const root = {};
+  // Each frame: indent of the line that opened it, the container, and where it lives.
+  const stack = [{ indent: -1, obj: root, owner: null, key: null }];
+
+  for (const raw of text.split(/\r?\n/)) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith('#') || trimmed === '---') continue;
+    const indent = raw.length - raw.trimStart().length;
+    const isItem = trimmed === '-' || trimmed.startsWith('- ');
+
+    // A sequence may sit at the same indent as its key ("key:\n- a").
+    const top = stack.at(-1);
+    const sameIndentList = isItem && top.indent === indent && top.owner && isEmptyContainer(top.obj);
+    if (!sameIndentList) while (stack.length > 1 && indent <= stack.at(-1).indent) stack.pop();
+
+    const frame = stack.at(-1);
+    if (isItem) {
+      if (!Array.isArray(frame.obj)) {
+        if (!frame.owner || !isEmptyContainer(frame.obj)) continue;
+        frame.obj = frame.owner[frame.key] = [];
+      }
+      frame.obj.push(unquote(stripComment(trimmed.slice(1).trim())));
+      continue;
+    }
+
+    const kv = splitKey(trimmed);
+    if (!kv || Array.isArray(frame.obj)) continue;
+    const [key, value] = kv;
+    if (value === '') {
+      frame.obj[key] = {};
+      stack.push({ indent, obj: frame.obj[key], owner: frame.obj, key });
+    } else {
+      frame.obj[key] = unquote(stripComment(value));
+    }
+  }
+  return root;
+}
+
+function isEmptyContainer(o) {
+  return (Array.isArray(o) && o.length === 0) || (o && typeof o === 'object' && Object.keys(o).length === 0);
+}