launchprep 0.0.1 → 0.1.0

package/src/checks-batch3.mjs

@@ -0,0 +1,327 @@
+// Remaining tier-1 checks: data, deployment, framework config, real-user readiness.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
+const isProdSettings = (p) =>
+  /settings/i.test(p) && !/local|dev|development|test|example|template/i.test(p);
+
+export const BATCH3_CHECKS = [
+
+// ---- data & scale --------------------------------------------------------
+{ id: 'DATA-001', run(repo, profile) {
+    if (profile.stack?.database === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path)) continue;
+      if (!/\/(api|routes?|server|actions?)\//.test(f.path)) continue;
+      // match the call site, then read a window - a whole-call regex cannot
+      // survive nested objects like { where: { active: true } }
+      const re = /\.findMany\s*\(|\.select\s*\(\s*['"`]\*/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(m.index, m.index + 320) +
+                       f.text.slice(Math.max(0, m.index - 200), m.index);
+        if (/take\s*:|limit\s*:|\.limit\s*\(|\.range\s*\(|paginat/i.test(around)) continue;
+        if (/count|aggregate|findFirst|\.single\(/.test(around)) continue;
+        out.push(finding('DATA-001', 'List query with no limit', 'high',
+          f.path, lineOf(f.text, m.index),
+          'This returns every matching row. Fine with fifty records, a timeout with fifty thousand — and the failure only appears once you have real users.',
+          'Add a limit and a cursor, and cap whatever the caller can ask for.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DATA-004', run(repo, profile) {
+    const SERVERLESS = ['vercel', 'netlify', 'cloudflare'];
+    if (!SERVERLESS.includes(profile.stack?.host)) return [];
+    if (!['postgres', 'mysql', 'planetscale'].includes(profile.stack?.database)) return [];
+    const pooled = repo.grep(/pgbouncer|pooler\.|connection_limit|:6543|@neondatabase|planetscale|prisma-accelerate|\bpool\b/i,
+                             /\.(ts|js|mjs|env|prisma|ya?ml|json)$/).length;
+    if (pooled) return [];
+    const f = repo.files.find(x => x.text && /(schema\.prisma|db\.(ts|js)|database\.(ts|js)|drizzle\.config)/.test(x.path));
+    if (!f) return [];
+    return [finding('DATA-004', 'No connection pooling on a serverless host', 'high',
+      f.path, 1,
+      `Every ${profile.stack.host} invocation opens its own database connection. Under ordinary traffic you exhaust the connection limit and the database starts refusing everyone, including you.`,
+      'Route through a pooler — PgBouncer, Supabase\'s pooler on 6543, Neon, or Prisma Accelerate.')];
+  }},
+
+{ id: 'DATA-005', run(repo, profile) {
+    if (profile.stack?.database === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs|py|rb)$/.test(f.path)) continue;
+      const re = /SELECT\s+\*\s+FROM\s+(\w+)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (/count\(|exists|information_schema|pg_/i.test(f.text.slice(m.index, m.index + 160))) continue;
+        out.push(finding('DATA-005', `SELECT * on ${m[1]}`, 'medium',
+          f.path, lineOf(f.text, m.index),
+          'Every column travels over the wire, including ones you never read and any you add later — password hashes and internal flags among them.',
+          'Name the columns you actually use.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- deployment ----------------------------------------------------------
+{ id: 'DEP-005', run(repo, profile) {
+    if (!profile.has_migrations || profile.stage !== 'production') return [];
+    const out = [];
+    const dirs = repo.find(/migrations?\//);
+    const hasDown = dirs.some(f => /down|rollback|revert/i.test(f.path)) ||
+                    repo.grep(/def downgrade|\.down\s*=|DROP.*-- rollback|def self\.down/i, /\.(py|rb|ts|js|sql)$/).length;
+    if (hasDown || !dirs.length) return [];
+    return [finding('DEP-005', 'Migrations have no rollback path', 'medium',
+      dirs[0].path, 1,
+      'A migration that fails halfway through production leaves the schema in a state nothing knows how to undo — under pressure, at the worst possible moment.',
+      'Write a down step for each migration, or use a tool that generates one.')];
+  }},
+
+{ id: 'DEP-014', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/(next\.config|vite\.config|webpack\.config|nuxt\.config)/.test(f.path)) continue;
+      const re = /(productionBrowserSourceMaps\s*:\s*true|sourcemap\s*:\s*true|devtool\s*:\s*['"]source-map)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('DEP-014', 'Source maps published in production', 'medium',
+          f.path, lineOf(f.text, m.index),
+          'Source maps let anyone reconstruct your original source from the deployed bundle — comments, variable names, internal logic and all.',
+          'Generate them for your error reporter but do not serve them publicly.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DEP-009', run(repo, profile) {
+    if (profile.stage !== 'production' || !profile.has_background_jobs) return [];
+    if (repo.grep(/SIGTERM|SIGINT|gracefulShutdown|on\(['"]exit/).length) return [];
+    const f = repo.files.find(x => x.text && /(server|index|main|worker|app)\.(ts|js|mjs|py|rb)$/.test(x.path));
+    if (!f) return [];
+    return [finding('DEP-009', 'No graceful shutdown', 'medium',
+      f.path, 1,
+      'On every deploy the process is killed mid-flight. Jobs that were running are lost, and half-finished work stays half-finished.',
+      'Handle SIGTERM: stop accepting new work, let in-flight work finish, then exit.')];
+  }},
+
+// ---- django config -------------------------------------------------------
+{ id: 'DJ-007', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    if (profile.stage !== 'production' || !profile.is_public) return [];
+    const settings = repo.files.filter(f => f.text && /\.py$/.test(f.path) && isProdSettings(f.path));
+    if (!settings.length) return [];
+    const all = settings.map(f => f.text).join('\n');
+    if (/SECURE_SSL_REDIRECT\s*=\s*True/.test(all)) return [];
+    return [finding('DJ-007', 'SECURE_SSL_REDIRECT is not enabled', 'high',
+      settings[0].path, 1,
+      'Django will serve over plain HTTP if asked. The first request of a session carries the session cookie in clear text.',
+      'SECURE_SSL_REDIRECT = True, and set SECURE_PROXY_SSL_HEADER if you sit behind a proxy.')];
+  }},
+
+{ id: 'DJ-009', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    if (profile.stage !== 'production' || !profile.is_public) return [];
+    const settings = repo.files.filter(f => f.text && /\.py$/.test(f.path) && isProdSettings(f.path));
+    if (!settings.length) return [];
+    const all = settings.map(f => f.text).join('\n');
+    const m = /SECURE_HSTS_SECONDS\s*=\s*(\d+)/.exec(all);
+    if (m && Number(m[1]) > 0) return [];
+    return [finding('DJ-009', 'HSTS not configured', 'medium',
+      settings[0].path, 1,
+      'Without HSTS a browser will try plain HTTP first every time, which is the window an attacker on the same network needs.',
+      'SECURE_HSTS_SECONDS = 31536000, plus SECURE_HSTS_INCLUDE_SUBDOMAINS.')];
+  }},
+
+{ id: 'DJ-013', run(repo, profile) {
+    if (profile.stack?.framework !== 'django' || !profile.is_public) return [];
+    const settings = repo.files.filter(f => f.text && /\.py$/.test(f.path) &&
+      isProdSettings(f.path) && /MIDDLEWARE\s*=/.test(f.text));
+    if (!settings.length) return [];
+    const bad = settings.find(f => !/XFrameOptionsMiddleware/.test(f.text) ||
+                                    /X_FRAME_OPTIONS\s*=\s*['"]ALLOWALL/.test(f.text));
+    if (!bad) return [];
+    return [finding('DJ-013', 'Clickjacking protection disabled', 'medium',
+      bad.path, 1,
+      'Django enables this by default, so its absence was deliberate. Without it your pages can be framed invisibly over a lookalike site and clicks stolen.',
+      'Keep django.middleware.clickjacking.XFrameOptionsMiddleware in MIDDLEWARE.')];
+  }},
+
+{ id: 'DJ-012', run(repo, profile) {
+    if (profile.stack?.framework !== 'django' || !profile.has_accounts) return [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path) || !isProdSettings(f.path)) continue;
+      const m = /AUTH_PASSWORD_VALIDATORS\s*=\s*\[\s*\]/.exec(f.text);
+      if (!m) continue;
+      return [finding('DJ-012', 'Password validators removed', 'medium',
+        f.path, lineOf(f.text, m.index),
+        'Django ships four validators — length, common passwords, all-numeric, similarity to the username. An empty list accepts "1234".',
+        'Restore the default validator list.')];
+    }
+    return [];
+  }},
+
+// ---- next.js -------------------------------------------------------------
+{ id: 'NEXT-009', run(repo, profile) {
+    if (profile.stack?.framework !== 'next') return [];
+    for (const f of repo.files) {
+      if (!f.text || !/next\.config/.test(f.path)) continue;
+      const m = /hostname\s*:\s*['"]\*\*?['"]|domains\s*:\s*\[\s*['"]\*/.exec(f.text);
+      if (!m) continue;
+      return [finding('NEXT-009', 'Image optimizer accepts any remote host', 'medium',
+        f.path, lineOf(f.text, m.index),
+        'Anyone can point your optimizer at any URL and make your server fetch and resize it — bandwidth and compute on your bill, from their request.',
+        'List the hostnames you actually load images from.')];
+    }
+    return [];
+  }},
+
+{ id: 'NEXT-011', run(repo, profile) {
+    if (profile.stack?.framework !== 'next') return [];
+    if (repo.has(/app\/.*error\.(tsx|jsx|js)$|global-error\.(tsx|jsx|js)$/)) return [];
+    if (!repo.has(/app\/(layout|page)\.(tsx|jsx|js)$/)) return [];
+    return [finding('NEXT-011', 'No error boundary', 'medium',
+      'app/error.tsx', 1,
+      'When a component throws, the user gets Next.js\'s default screen instead of anything you wrote. In production that is a blank page and a lost customer.',
+      'Add app/error.tsx and app/global-error.tsx with something recoverable.')];
+  }},
+
+// ---- rails ---------------------------------------------------------------
+{ id: 'RB-014', run(repo, profile) {
+    if (profile.stack?.auth !== 'devise' || !profile.is_public) return [];
+    const models = repo.grep(/devise\s+:/, /\.rb$/);
+    if (!models.length) return [];
+    if (models.some(f => /:lockable/.test(f.text))) return [];
+    const f = models[0];
+    return [finding('RB-014', 'Devise configured without :lockable', 'medium',
+      f.path, lineOf(f.text, f.text.search(/devise\s+:/)),
+      'Devise ships no brute-force lockout enabled. Nothing stops unlimited password guesses against every account you have.',
+      'Add :lockable to the devise line and configure maximum_attempts.')];
+  }},
+
+// ---- real users ----------------------------------------------------------
+{ id: 'RU-004', run(repo, profile) {
+    if (profile.handles_payments === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(sql|prisma|ts)$/.test(f.path)) continue;
+      if (!/CREATE TABLE|pgTable\s*\(|^model\s+\w+/mi.test(f.text)) continue;
+      const re = /(?:^|[(,\s])["`]?(\w*(?:amount|price|total|subtotal)\w*)["`]?\s*[:\s]/gim;
+      let m, flagged = false;
+      while ((m = re.exec(f.text)) && !flagged) {
+        const block = f.text.slice(Math.max(0, m.index - 700), m.index + 700);
+        if (/currency|iso_?4217|\bccy\b/i.test(block)) continue;
+        flagged = true;
+        out.push(finding('RU-004', `Money column "${m[1]}" with no currency alongside it`, 'high',
+          f.path, lineOf(f.text, m.index),
+          'A number without a currency is not an amount. The day you take a second currency, every historical row becomes ambiguous and there is no way to reconstruct which was which.',
+          'Store a currency code next to every monetary column.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RU-019', run(repo, profile) {
+    if (!profile.has_accounts || profile.stack?.auth !== 'custom') return [];
+    const sessions = repo.grep(/session|jwt\.sign|createToken/i, /\.(ts|js|mjs)$/);
+    if (!sessions.length) return [];
+    if (repo.grep(/expiresIn|maxAge|expires_at|exp\s*:|ttl/i, /\.(ts|js|mjs)$/).length) return [];
+    return [finding('RU-019', 'Sessions never expire', 'medium',
+      sessions[0].path, 1,
+      'A token with no expiry is valid until someone revokes it — which nothing here does. A session stolen today still works next year.',
+      'Set an expiry, and refresh it while the user is active.')];
+  }},
+
+{ id: 'RU-010', run(repo, profile) {
+    if (!profile.is_public || profile.stage !== 'production') return [];
+    if (profile.surface === 'library') return [];
+    const has = repo.grep(/mailto:|support@|help@|contact@|\/contact\b/i,
+                          /\.(tsx|jsx|html|erb|vue|svelte|md|py|rb)$/).length;
+    if (has) return [];
+    return [finding('RU-010', 'No way for a customer to reach you', 'medium',
+      'contact details', 1,
+      'A user with a billing problem and no contact address disputes the charge instead. That costs you the sale, a fee, and a mark against your dispute rate.',
+      'Put a monitored email address in the footer and on the receipt.')];
+  }},
+
+// ---- uploads -------------------------------------------------------------
+{ id: 'UP-007', run(repo, profile) {
+    if (!profile.has_file_uploads) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      const re = /(?:createSignedUrl|getSignedUrl|generate_presigned_url|expiresIn|ExpiresIn|expires_in)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        // the lifetime is somewhere in the call, not necessarily adjacent
+        const win = f.text.slice(m.index, m.index + 160);
+        const num = win.match(/\b(\d{5,})\b/);
+        if (!num) continue;
+        const secs = Number(num[1]);
+        if (secs <= 86400) continue;                 // a day is defensible
+        const days = Math.round(secs / 86400);
+        out.push(finding('UP-007', `Signed URL valid for about ${days} days`, 'medium',
+          f.path, lineOf(f.text, m.index),
+          'A signed URL is a bearer token in a link. Anything that long survives being pasted into a chat, forwarded, or logged by a proxy.',
+          'Minutes, not days. Re-sign on demand instead.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- ai ------------------------------------------------------------------
+{ id: 'AIOP-002', run(repo, profile) {
+    if (!profile.calls_llm || profile.stage !== 'production') return [];
+    const out = [];
+    const ALIASES = /['"]((?:claude|gpt|gemini)[a-z0-9.-]*(?:latest|preview))['"]/gi;
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      let m; ALIASES.lastIndex = 0;
+      while ((m = ALIASES.exec(f.text))) {
+        out.push(finding('AIOP-002', `Model pinned to a moving alias: ${m[1]}`, 'medium',
+          f.path, lineOf(f.text, m.index),
+          'An alias points at whatever is current. Behaviour, output shape and price can all change under you with no deploy and no warning.',
+          'Pin an explicit model version and upgrade deliberately.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'AI-011', run(repo, profile) {
+    if (!profile.calls_llm || profile.stage !== 'production') return [];
+    if (repo.grep(/maxRetries|max_retries|retry|backoff|p-retry|tenacity/i).length) return [];
+    const site = repo.grep(/\.messages\.create|\.chat\.completions\.create/)[0];
+    if (!site) return [];
+    return [finding('AI-011', 'No retry on rate-limit responses', 'medium',
+      site.path, 1,
+      'Providers return 429 under load. With no backoff, a brief rate limit surfaces to your user as a broken feature.',
+      'Retry with exponential backoff — the SDKs take maxRetries directly.')];
+  }},
+
+// ---- observability & discoverability -------------------------------------
+{ id: 'UX-005', run(repo, profile) {
+    if (!profile.is_public || !['web-app', 'web-site'].includes(profile.surface)) return [];
+    const has = repo.grep(/og:image|twitter:image|openGraph/i,
+                          /\.(tsx|jsx|html|erb|vue|svelte|ts|js)$/).length;
+    if (has) return [];
+    const f = repo.files.find(x => x.text && /(layout|index|_app|_document)\.(tsx|jsx|html|js)$/.test(x.path));
+    if (!f) return [];
+    return [finding('UX-005', 'No social preview image', 'low',
+      f.path, 1,
+      'Shared anywhere — Slack, X, iMessage — your link renders as a bare grey box. It is the cheapest credibility you will ever buy.',
+      'Add og:image and twitter:image tags with a 1200x630 image.')];
+  }},
+
+{ id: 'INC-004', run(repo, profile) {
+    if (!profile.is_public || profile.stage !== 'production') return [];
+    if (repo.has(/security\.txt$|SECURITY\.md$/i)) return [];
+    if (repo.grep(/security@/i).length) return [];
+    return [finding('INC-004', 'No security contact', 'medium',
+      'SECURITY.md', 1,
+      'A researcher who finds a flaw in your app has no way to tell you. What they do instead is post it publicly, or sell it.',
+      'Add a SECURITY.md and a /.well-known/security.txt with an address you read.')];
+  }},
+];