ira-review 2.0.1 → 2.0.2

package/README.md

@@ -15,55 +15,19 @@ No install required. Drop `--dry-run` to post comments directly on the PR. For B
 ## What You Get
 
 ```
-🔍 IRA — Scanning PR before your reviewers do
-
-  ✓ Config loaded — AI-only mode, openai, PR #42
-  ✓ Diff loaded — 4 files changed
-  ✓ Review complete — 3 issues found
-
-────────────────────────────────────────────────────────────
-📄 src/routes/auth.ts:31
-   Rule:     IRA/security (CRITICAL)
-   Message:  User input passed directly to SQL query
-   Explain:  The username parameter is concatenated into a SQL string,
-             creating a SQL injection vector.
-   Impact:   Attacker could execute arbitrary SQL and gain database control.
-   Fix:      BEFORE: `db.query(`SELECT * FROM users WHERE name = ${username}`)`
-             → AFTER: `db.query('SELECT * FROM users WHERE name = $1', [username])`
-
-────────────────────────────────────────────────────────────
-📄 src/middleware/cors.ts:8
-   Rule:     IRA/error-handling (MAJOR)
-   Message:  Empty catch block swallows CORS validation errors
-   Explain:  fetch() failure in CORS preflight is caught and ignored,
-             leaving the request in an undefined state.
-   Impact:   Silent CORS failures in production with no logging.
-   Fix:      BEFORE: `} catch {}`
-             → AFTER: `} catch (err) { logger.error('CORS preflight failed', err); throw err; }`
-
-# 🔍 IRA Review Summary
-
-## 🟡 Risk: MEDIUM (38/100)
-
-| Metric        | Value    |
-|---------------|----------|
-| Review mode   | AI-only  |
-| Total issues  | 3        |
-| Reviewed (AI) | 3        |
-| Framework     | react    |
-
-## ✅ Requirements: AUTH-234 — 83% Complete (5/6)
-
-  ✅ OAuth2 login flow implemented with Google provider
-  ✅ JWT tokens generated on successful authentication
-  ✅ Refresh token rotation with 7-day expiry
-  ❌ Input validation on login endpoint — no email format check
-  ✅ Logout endpoint clears session and revokes token
-  ✅ Rate limiting on login attempts
-
-  ⚠️ Edge Cases Not Covered
-  - What happens when Google OAuth is unreachable?
-  - Token refresh during concurrent requests?
+IRA: Found 3 issues (Risk: MEDIUM - 47/100)
+
+src/routes/todos.ts
+  [BLOCKER] SQL injection risk - user input passed directly to query
+  [MAJOR]   Missing database index on frequently queried column
+
+src/middleware/auth.ts
+  [CRITICAL] JWT secret hardcoded - move to environment variable
+
+JIRA AC Validation (PROJ-1234):
+  AC 1: User can create a todo item        COVERED
+  AC 2: Input is validated before save      NOT COVERED
+  AC 3: Error returns 422 with details      COVERED
 ```
 
 Each issue is posted as an inline comment on the exact PR line with explanation, impact, and a minimal BEFORE → AFTER fix.

package/README.npm.md

@@ -15,55 +15,19 @@ No install required. Drop `--dry-run` to post comments directly on the PR. For B
 ## What You Get
 
 ```
-🔍 IRA — Scanning PR before your reviewers do
-
-  ✓ Config loaded — AI-only mode, openai, PR #42
-  ✓ Diff loaded — 4 files changed
-  ✓ Review complete — 3 issues found
-
-────────────────────────────────────────────────────────────
-📄 src/routes/auth.ts:31
-   Rule:     IRA/security (CRITICAL)
-   Message:  User input passed directly to SQL query
-   Explain:  The username parameter is concatenated into a SQL string,
-             creating a SQL injection vector.
-   Impact:   Attacker could execute arbitrary SQL and gain database control.
-   Fix:      BEFORE: `db.query(`SELECT * FROM users WHERE name = ${username}`)`
-             → AFTER: `db.query('SELECT * FROM users WHERE name = $1', [username])`
-
-────────────────────────────────────────────────────────────
-📄 src/middleware/cors.ts:8
-   Rule:     IRA/error-handling (MAJOR)
-   Message:  Empty catch block swallows CORS validation errors
-   Explain:  fetch() failure in CORS preflight is caught and ignored,
-             leaving the request in an undefined state.
-   Impact:   Silent CORS failures in production with no logging.
-   Fix:      BEFORE: `} catch {}`
-             → AFTER: `} catch (err) { logger.error('CORS preflight failed', err); throw err; }`
-
-# 🔍 IRA Review Summary
-
-## 🟡 Risk: MEDIUM (38/100)
-
-| Metric        | Value    |
-|---------------|----------|
-| Review mode   | AI-only  |
-| Total issues  | 3        |
-| Reviewed (AI) | 3        |
-| Framework     | react    |
-
-## ✅ Requirements: AUTH-234 — 83% Complete (5/6)
-
-  ✅ OAuth2 login flow implemented with Google provider
-  ✅ JWT tokens generated on successful authentication
-  ✅ Refresh token rotation with 7-day expiry
-  ❌ Input validation on login endpoint — no email format check
-  ✅ Logout endpoint clears session and revokes token
-  ✅ Rate limiting on login attempts
-
-  ⚠️ Edge Cases Not Covered
-  - What happens when Google OAuth is unreachable?
-  - Token refresh during concurrent requests?
+IRA: Found 3 issues (Risk: MEDIUM - 47/100)
+
+src/routes/todos.ts
+  [BLOCKER] SQL injection risk - user input passed directly to query
+  [MAJOR]   Missing database index on frequently queried column
+
+src/middleware/auth.ts
+  [CRITICAL] JWT secret hardcoded - move to environment variable
+
+JIRA AC Validation (PROJ-1234):
+  AC 1: User can create a todo item        COVERED
+  AC 2: Input is validated before save      NOT COVERED
+  AC 3: Error returns 422 with details      COVERED
 ```
 
 Each issue is posted as an inline comment on the exact PR line with explanation, impact, and a minimal BEFORE → AFTER fix.

package/dist/{bitbucket-TQU3E6SG.js → bitbucket-CSZZGWYR.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   BitbucketClient
-} from "./chunk-XOR6EFZE.js";
-import "./chunk-AHCFDKK4.js";
+} from "./chunk-RAJNISC2.js";
+import "./chunk-AFLVYFZ2.js";
 export {
   BitbucketClient
 };

package/dist/{chunk-NIAFIXU4.js → chunk-4XYBVOZW.js}

@@ -2,8 +2,9 @@
 import {
   RetryableError,
   fetchWithTimeout,
+  parseApiError,
   withRetry
-} from "./chunk-AHCFDKK4.js";
+} from "./chunk-AFLVYFZ2.js";
 
 // src/scm/github.ts
 var GitHubClient = class {
@@ -48,7 +49,7 @@ var GitHubClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -81,7 +82,7 @@ var GitHubClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -97,7 +98,7 @@ var GitHubClient = class {
         const response = await fetchWithTimeout(url, { headers: this.headers });
         if (!response.ok) {
           const text = await response.text();
-          throw new RetryableError(`GitHub API error (${response.status}): ${text}`, response.status);
+          throw new RetryableError(parseApiError(response.status, text, "GitHub"), response.status);
         }
         return response.json();
       });
@@ -125,7 +126,7 @@ ${file.patch}`;
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -154,7 +155,7 @@ ${file.patch}`;
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -171,7 +172,7 @@ ${file.patch}`;
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -188,7 +189,7 @@ ${file.patch}`;
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }
@@ -221,7 +222,7 @@ ${file.patch}`;
         if (!response.ok && response.status !== 422) {
           const text = await response.text();
           throw new RetryableError(
-            `GitHub API error (${response.status}): ${text}`,
+            parseApiError(response.status, text, "GitHub"),
             response.status
           );
         }
@@ -258,7 +259,7 @@ ${file.patch}`;
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `GitHub API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "GitHub"),
           response.status
         );
       }

package/dist/{chunk-AHCFDKK4.js → chunk-AFLVYFZ2.js}

@@ -88,6 +88,41 @@ async function fetchWithTimeout(url, init = {}, timeoutMs = 3e4) {
     clearTimeout(timer);
   }
 }
+function parseApiError(status, body, provider) {
+  const statusMessages = {
+    400: "Bad request",
+    401: "Authentication failed \u2014 check your token or credentials",
+    403: "Access denied \u2014 you may not have permission for this resource",
+    404: "Not found \u2014 check the URL, project key, or PR number",
+    408: "Request timed out \u2014 try again in a moment",
+    409: "Conflict \u2014 the resource may have been modified",
+    422: "Invalid request \u2014 the server couldn't process it",
+    429: "Rate limited \u2014 too many requests, try again shortly",
+    500: "Server error \u2014 the service is having issues",
+    502: "Bad gateway \u2014 the service is temporarily unavailable",
+    503: "Service unavailable \u2014 try again in a moment",
+    504: "Gateway timeout \u2014 the service took too long to respond"
+  };
+  const friendlyStatus = statusMessages[status] ?? `HTTP ${status}`;
+  const trimmed = body.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      const json = JSON.parse(trimmed);
+      const msg = json.message ?? json.error?.message ?? json.error ?? json.errors?.[0]?.message ?? json.detail;
+      if (typeof msg === "string" && msg.length > 0 && msg.length < 200) {
+        return `${provider} (${status}): ${msg}`;
+      }
+    } catch {
+    }
+  }
+  if (trimmed.startsWith("<!") || trimmed.startsWith("<html") || trimmed.includes("<body")) {
+    return `${provider} (${status}): ${friendlyStatus}`;
+  }
+  if (trimmed.length > 0 && trimmed.length < 150) {
+    return `${provider} (${status}): ${trimmed}`;
+  }
+  return `${provider} (${status}): ${friendlyStatus}`;
+}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -95,5 +130,6 @@ function sleep(ms) {
 export {
   RetryableError,
   withRetry,
-  fetchWithTimeout
+  fetchWithTimeout,
+  parseApiError
 };

package/dist/{chunk-XOR6EFZE.js → chunk-RAJNISC2.js}

@@ -2,8 +2,9 @@
 import {
   RetryableError,
   fetchWithTimeout,
+  parseApiError,
   withRetry
-} from "./chunk-AHCFDKK4.js";
+} from "./chunk-AFLVYFZ2.js";
 
 // src/scm/bitbucket.ts
 var BitbucketClient = class {
@@ -55,14 +56,14 @@ var BitbucketClient = class {
           if (!retryResponse.ok) {
             const retryText = await retryResponse.text();
             throw new RetryableError(
-              `Bitbucket API error (${retryResponse.status}): ${retryText}`,
+              parseApiError(retryResponse.status, retryText, "Bitbucket"),
               retryResponse.status
             );
           }
           return;
         }
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }
@@ -82,7 +83,7 @@ var BitbucketClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }
@@ -99,7 +100,7 @@ var BitbucketClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }
@@ -131,7 +132,7 @@ var BitbucketClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }
@@ -147,7 +148,7 @@ var BitbucketClient = class {
         const response = await fetchWithTimeout(nextUrl, { headers: this.headers });
         if (!response.ok) {
           const text = await response.text();
-          throw new RetryableError(`Bitbucket API error (${response.status}): ${text}`, response.status);
+          throw new RetryableError(parseApiError(response.status, text, "Bitbucket"), response.status);
         }
         return response.json();
       });
@@ -166,7 +167,7 @@ var BitbucketClient = class {
           const response = await fetchWithTimeout(url, { headers: this.headers }, 15e3);
           if (!response.ok) {
             const text = await response.text();
-            throw new RetryableError(`Bitbucket API error (${response.status}): ${text}`, response.status);
+            throw new RetryableError(parseApiError(response.status, text, "Bitbucket"), response.status);
           }
           return response.text();
         });
@@ -189,7 +190,7 @@ var BitbucketClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }
@@ -218,7 +219,7 @@ var BitbucketClient = class {
       if (!response.ok) {
         const text = await response.text();
         throw new RetryableError(
-          `Bitbucket API error (${response.status}): ${text}`,
+          parseApiError(response.status, text, "Bitbucket"),
           response.status
         );
       }