openpitstop 1.0.0

package/demo-repo/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "pitstop-demo-api",
+  "version": "0.0.0",
+  "private": true,
+  "description": "OpenPitStop's intentionally-broken demo API",
+  "scripts": {
+    "start": "node src/server.js",
+    "test": "jest"
+  },
+  "dependencies": {
+    "express": "^4.18.2",
+    "lodash": "4.17.15"
+  },
+  "devDependencies": {
+    "jest": "^29.7.0"
+  }
+}

package/demo-repo/src/config.js

@@ -0,0 +1,5 @@
+// Hardcoded credentials — gitleaks flags this for real when installed.
+const API_KEY = "AKIA1234567890ABCDEFGH"; // fake AWS access key id
+const DB_PASSWORD = "supersecretpassword123";
+
+module.exports = { API_KEY, DB_PASSWORD };

package/demo-repo/src/db.js

@@ -0,0 +1,31 @@
+// Fake in-memory data layer. In a real app this would open a DB connection.
+const users = [
+  { id: 1, name: "alice", email: "alice@example.com", score: 70 },
+  { id: 2, name: "bob", email: "bob@example.com", score: 30 },
+  { id: 3, name: "carol", email: "carol@example.com", score: 10 },
+];
+
+const posts = [
+  { id: 101, userId: 1, title: "Hello" },
+  { id: 102, userId: 1, title: "World" },
+  { id: 103, userId: 2, title: "Hi" },
+];
+
+function query(sql, params) {
+  // Pretend this hits the database.
+  return [];
+}
+
+function getUsers() {
+  return users;
+}
+
+function getPostsByUser(userId) {
+  return posts.filter((p) => p.userId === userId);
+}
+
+function getConnection() {
+  return { query };
+}
+
+module.exports = { query, getUsers, getPostsByUser, getConnection };

package/demo-repo/src/server.js

@@ -0,0 +1,13 @@
+const express = require("express");
+const userController = require("./userController");
+
+const app = express();
+
+app.get("/users", userController.list);
+
+if (require.main === module) {
+  const port = process.env.PORT || 3000;
+  app.listen(port, () => console.log(`pitstop-demo-api listening on ${port}`));
+}
+
+module.exports = app;

package/demo-repo/src/userController.js

@@ -0,0 +1,22 @@
+const service = require("./userService");
+const db = require("./db");
+
+function list(req, res) {
+  const users = service.listUsersWithPosts();
+  res.json(users);
+}
+
+function render(users) {
+  // --- DUPLICATED BLOCK (start) ---
+  return users.map((u) => {
+    const name = (u.name || "").toUpperCase();
+    const email = (u.email || "").toLowerCase();
+    const score = (u.score || 0) + 10;
+    const tier = score > 50 ? "gold" : score > 20 ? "silver" : "bronze";
+    const summary = `${name} <${email}> [${tier}]`;
+    return { id: u.id, summary, score };
+  });
+  // --- DUPLICATED BLOCK (end) ---
+}
+
+module.exports = { list, render };

package/demo-repo/src/userRepo.js

@@ -0,0 +1,18 @@
+const db = require("./db");
+// Intentional layering violation: the repository reaches back up to the service.
+const userService = require("./userService");
+
+function getUsers() {
+  return db.getUsers();
+}
+
+function getPostsByUser(userId) {
+  return db.getPostsByUser(userId);
+}
+
+function getUserSummary(id) {
+  const u = db.getUsers().find((x) => x.id === id);
+  return userService.formatUser(u);
+}
+
+module.exports = { getUsers, getPostsByUser, getUserSummary };

package/demo-repo/src/userService.js

@@ -0,0 +1,59 @@
+const _ = require("lodash");
+const repo = require("./userRepo");
+// Intentional circular dependency: the service reaches into the controller.
+const controller = require("./userController");
+const config = require("./config");
+
+// BUG: tier calculation is missing the "silver" band.
+function calculateTier(score) {
+  if (score > 100) return "gold";
+  return "bronze";
+}
+
+// BUG: should uppercase the name but does nothing.
+function normalizeName(name) {
+  return name;
+}
+
+function formatUser(u) {
+  return { id: u.id, name: u.name, email: u.email };
+}
+
+// N+1 query pattern: fetch all users, then one query per user for their posts.
+// Spans userController -> userService -> userRepo (3 files).
+function listUsersWithPosts() {
+  const users = repo.getUsers();
+  for (const u of users) {
+    u.posts = repo.getPostsByUser(u.id);
+  }
+  return users;
+}
+
+function summarize(users) {
+  // --- DUPLICATED BLOCK (start) ---
+  return users.map((u) => {
+    const name = (u.name || "").toUpperCase();
+    const email = (u.email || "").toLowerCase();
+    const score = (u.score || 0) + 10;
+    const tier = score > 50 ? "gold" : score > 20 ? "silver" : "bronze";
+    const summary = `${name} <${email}> [${tier}]`;
+    return { id: u.id, summary, score };
+  });
+  // --- DUPLICATED BLOCK (end) ---
+}
+
+function renderList() {
+  const users = listUsersWithPosts();
+  // The API key is "used" here only to make the config import reachable.
+  void config.API_KEY;
+  return controller.render(users);
+}
+
+module.exports = {
+  calculateTier,
+  normalizeName,
+  formatUser,
+  listUsersWithPosts,
+  summarize,
+  renderList,
+};

package/demo-repo/test/user.test.js

@@ -0,0 +1,12 @@
+const service = require("../src/userService");
+
+describe("pitstop-demo-api", () => {
+  it("assigns the correct tier for a mid score", () => {
+    // score 30 -> +10 = 40 -> should be "silver"
+    expect(service.calculateTier(30)).toBe("silver");
+  });
+
+  it("uppercases the name", () => {
+    expect(service.normalizeName("bob")).toBe("BOB");
+  });
+});

package/demo-repo-fintech/README.md

@@ -0,0 +1,27 @@
+# pitstop-demo-fintech
+
+> **This is OpenPitStop's intentionally-broken *fintech* demo repository.** It is the
+> companion fixture for `pitstop scan --ledger`, whose job is to prove a **real
+> double-charge** exists (not a simulated one).
+
+## What's broken (on purpose)
+
+- `POST /api/orders/:id/charge` — takes `amount`/`currency` and an optional
+  `Idempotency-Key` header, forwards a real charge to the (mocked) `razorpay`
+  gateway… but **never dedupes on the idempotency key**. Fire the same key twice
+  and the gateway is charged twice.
+- `POST /api/webhooks/razorpay` — on every `payment.captured` event it captures
+  the payment through the gateway with **no dedup**. Replay the same webhook and
+  the gateway is captured twice.
+
+## Safety
+
+`pitstop scan --ledger` runs this app under a `nock` sandbox that intercepts
+*every* outbound HTTP request before it leaves the process. The `razorpay`
+requests land on a local mock and **never** reach a real payment gateway.
+
+Run it (from the repo root):
+
+```
+node dist/cli.js scan demo-repo-fintech --ledger
+```