pumuki 6.3.276 → 6.3.278

package/core/facts/detectors/typescript/index.test.ts

@@ -3,12 +3,17 @@ import test from 'node:test';
 import {
   findEmptyCatchClauseLines,
   findConcreteDependencyInstantiationMatch,
+  findDtoPropertyWithoutValidationMatch,
+  findDtoNestedPropertyWithoutNestedValidationMatch,
+  findBackendControllerRouteWithoutGuardLines,
   findFrameworkDependencyImportMatch,
   findMixedCommandQueryClassMatch,
   findMixedCommandQueryInterfaceMatch,
   findOverrideMethodThrowingNotImplementedMatch,
   findTypeDiscriminatorSwitchMatch,
   findNetworkCallWithoutErrorHandlingLines,
+  findNestJsConstructorDependencyWithoutDecoratorMatch,
+  findPersistenceMutationWithoutAuditEventMatch,
   findRecordStringUnknownTypeLines,
   findUndefinedInBaseTypeUnionLines,
   findUnknownWithoutGuardLines,
@@ -21,6 +26,9 @@ import {
   hasDeleteOperator,
   hasDefaultExportedApiRouteHandler,
   hasDirectNetworkCall,
+  hasDtoPropertyWithoutValidation,
+  hasDtoNestedPropertyWithoutNestedValidation,
+  hasBackendControllerRouteWithoutGuard,
   hasEmptyCatchClause,
   hasEvalCall,
   hasExplicitAnyType,
@@ -29,8 +37,16 @@ import {
   hasInterpolatedUnsafeSqlCall,
   hasNestedCallbackUsage,
   hasNestedIfElseStatement,
+  hasNestJsConstructorDependencyWithoutDecorator,
+  hasBackendMagicNumberLiteral,
+  hasBackendGenericErrorThrow,
+  hasBackendProductionMockOrSpy,
+  hasBackendErrorStackInHttpResponse,
+  hasBackendAnemicDomainModel,
   hasNonSemanticClickableJsx,
+  hasSensitiveDataLoggingCall,
   hasSensitiveTokenInUrl,
+  hasPersistenceMutationWithoutAuditEvent,
   hasWeakBcryptSaltRounds,
   hasNetworkCallWithoutErrorHandling,
   hasMixedCommandQueryClass,
@@ -151,6 +167,229 @@ test('hasConsoleErrorCall detecta console.error y descarta metodos distintos', (
   assert.equal(hasConsoleErrorCall(warnAst), false);
 });
 
+test('hasSensitiveDataLoggingCall detecta datos sensibles en sinks de logging', () => {
+  const sensitiveConsoleAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'console' },
+      property: { type: 'Identifier', name: 'log' },
+    },
+    arguments: [{ type: 'Identifier', name: 'accessToken' }],
+  };
+  const sensitiveLoggerAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'logger' },
+      property: { type: 'Identifier', name: 'error' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'password' },
+            value: { type: 'Identifier', name: 'password' },
+          },
+        ],
+      },
+    ],
+  };
+  const safeLoggerAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'logger' },
+      property: { type: 'Identifier', name: 'info' },
+    },
+    arguments: [{ type: 'Identifier', name: 'orderId' }],
+  };
+
+  assert.equal(hasSensitiveDataLoggingCall(sensitiveConsoleAst), true);
+  assert.equal(hasSensitiveDataLoggingCall(sensitiveLoggerAst), true);
+  assert.equal(hasSensitiveDataLoggingCall(safeLoggerAst), false);
+});
+
+test('hasBackendMagicNumberLiteral detecta numeros inline y permite constantes nombradas', () => {
+  const inlineMagicNumberAst = {
+    type: 'ReturnStatement',
+    argument: { type: 'NumericLiteral', value: 42 },
+  };
+  const namedConstantAst = {
+    type: 'VariableDeclaration',
+    kind: 'const',
+    declarations: [
+      {
+        type: 'VariableDeclarator',
+        id: { type: 'Identifier', name: 'MAX_RETRY_ATTEMPTS' },
+        init: { type: 'NumericLiteral', value: 3 },
+      },
+    ],
+  };
+  const trivialCounterAst = {
+    type: 'BinaryExpression',
+    operator: '+',
+    left: { type: 'Identifier', name: 'count' },
+    right: { type: 'NumericLiteral', value: 1 },
+  };
+
+  assert.equal(hasBackendMagicNumberLiteral(inlineMagicNumberAst), true);
+  assert.equal(hasBackendMagicNumberLiteral(namedConstantAst), false);
+  assert.equal(hasBackendMagicNumberLiteral(trivialCounterAst), false);
+});
+
+test('hasBackendGenericErrorThrow detecta throw new Error y permite excepciones especificas', () => {
+  const genericErrorAst = {
+    type: 'ThrowStatement',
+    argument: {
+      type: 'NewExpression',
+      callee: { type: 'Identifier', name: 'Error' },
+      arguments: [{ type: 'StringLiteral', value: 'invalid order' }],
+    },
+  };
+  const specificErrorAst = {
+    type: 'ThrowStatement',
+    argument: {
+      type: 'NewExpression',
+      callee: { type: 'Identifier', name: 'ValidationException' },
+      arguments: [{ type: 'StringLiteral', value: 'invalid order' }],
+    },
+  };
+
+  assert.equal(hasBackendGenericErrorThrow(genericErrorAst), true);
+  assert.equal(hasBackendGenericErrorThrow(specificErrorAst), false);
+});
+
+test('hasBackendProductionMockOrSpy detecta mocks y spies de test en codigo production', () => {
+  const jestMockAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'jest' },
+      property: { type: 'Identifier', name: 'fn' },
+    },
+    arguments: [],
+  };
+  const chainedMockAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'CallExpression', callee: { type: 'Identifier', name: 'loadUser' } },
+      property: { type: 'Identifier', name: 'mockResolvedValue' },
+    },
+    arguments: [],
+  };
+  const realFactoryAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'createUserRepository' },
+    arguments: [],
+  };
+
+  assert.equal(hasBackendProductionMockOrSpy(jestMockAst), true);
+  assert.equal(hasBackendProductionMockOrSpy(chainedMockAst), true);
+  assert.equal(hasBackendProductionMockOrSpy(realFactoryAst), false);
+});
+
+test('hasBackendErrorStackInHttpResponse detecta stack trace expuesto en respuesta HTTP', () => {
+  const exposedStackAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'res' },
+      property: { type: 'Identifier', name: 'json' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'stack' },
+            value: {
+              type: 'MemberExpression',
+              object: { type: 'Identifier', name: 'error' },
+              property: { type: 'Identifier', name: 'stack' },
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const internalLoggingAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'logger' },
+      property: { type: 'Identifier', name: 'error' },
+    },
+    arguments: [
+      {
+        type: 'MemberExpression',
+        object: { type: 'Identifier', name: 'error' },
+        property: { type: 'Identifier', name: 'stack' },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendErrorStackInHttpResponse(exposedStackAst), true);
+  assert.equal(hasBackendErrorStackInHttpResponse(internalLoggingAst), false);
+});
+
+test('hasBackendAnemicDomainModel detecta entidades de dominio anemicas', () => {
+  const anemicEntityAst = {
+    type: 'ClassDeclaration',
+    id: { type: 'Identifier', name: 'OrderEntity' },
+    body: {
+      type: 'ClassBody',
+      body: [
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'getStatus' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'setStatus' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+      ],
+    },
+  };
+  const richEntityAst = {
+    type: 'ClassDeclaration',
+    id: { type: 'Identifier', name: 'OrderEntity' },
+    body: {
+      type: 'ClassBody',
+      body: [
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'id' } },
+        { type: 'ClassProperty', key: { type: 'Identifier', name: 'status' } },
+        {
+          type: 'ClassMethod',
+          kind: 'method',
+          key: { type: 'Identifier', name: 'markAsPaid' },
+          body: { type: 'BlockStatement', body: [] },
+        },
+      ],
+    },
+  };
+
+  assert.equal(hasBackendAnemicDomainModel(anemicEntityAst), true);
+  assert.equal(hasBackendAnemicDomainModel(richEntityAst), false);
+});
+
 test('hasEvalCall detecta eval directo y descarta member eval', () => {
   const directEvalAst = {
     type: 'CallExpression',
@@ -1653,3 +1892,384 @@ test('findNetworkCallWithoutErrorHandlingLines devuelve lineas de llamadas sin m
 
   assert.deepEqual(findNetworkCallWithoutErrorHandlingLines(ast), [12]);
 });
+
+test('hasNestJsConstructorDependencyWithoutDecorator detecta dependencias constructor sin decorador NestJS', () => {
+  const undecoratedProviderAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrdersService' },
+        loc: { start: { line: 7 }, end: { line: 15 } },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              kind: 'constructor',
+              key: { type: 'Identifier', name: 'constructor' },
+              params: [
+                {
+                  type: 'Identifier',
+                  name: 'repository',
+                  typeAnnotation: {
+                    type: 'TSTypeAnnotation',
+                    typeAnnotation: {
+                      type: 'TSTypeReference',
+                      typeName: { type: 'Identifier', name: 'OrdersRepository' },
+                    },
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const decoratedProviderAst = {
+    ...undecoratedProviderAst,
+    body: [
+      {
+        ...(undecoratedProviderAst.body[0] as object),
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'Injectable' },
+              arguments: [],
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const primitiveConstructorAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'PrimitiveConfig' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              kind: 'constructor',
+              key: { type: 'Identifier', name: 'constructor' },
+              params: [
+                {
+                  type: 'Identifier',
+                  name: 'name',
+                  typeAnnotation: {
+                    type: 'TSTypeAnnotation',
+                    typeAnnotation: { type: 'TSStringKeyword' },
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasNestJsConstructorDependencyWithoutDecorator(undecoratedProviderAst), true);
+  assert.equal(hasNestJsConstructorDependencyWithoutDecorator(decoratedProviderAst), false);
+  assert.equal(hasNestJsConstructorDependencyWithoutDecorator(primitiveConstructorAst), false);
+
+  const match = findNestJsConstructorDependencyWithoutDecoratorMatch(undecoratedProviderAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [7]);
+  assert.equal(match.primary_node, 'OrdersService');
+});
+
+test('hasPersistenceMutationWithoutAuditEvent detecta mutaciones persistentes sin evento ni auditoria', () => {
+  const missingAuditAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'FunctionDeclaration',
+        id: { type: 'Identifier', name: 'completeOrder' },
+        loc: { start: { line: 21 }, end: { line: 25 } },
+        body: {
+          type: 'BlockStatement',
+          body: [
+            {
+              type: 'ExpressionStatement',
+              expression: {
+                type: 'CallExpression',
+                callee: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'ordersRepository' },
+                  property: { type: 'Identifier', name: 'save' },
+                },
+                arguments: [],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const auditedMutationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'FunctionDeclaration',
+        id: { type: 'Identifier', name: 'completeOrder' },
+        body: {
+          type: 'BlockStatement',
+          body: [
+            {
+              type: 'ExpressionStatement',
+              expression: {
+                type: 'CallExpression',
+                callee: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'ordersRepository' },
+                  property: { type: 'Identifier', name: 'save' },
+                },
+                arguments: [],
+              },
+            },
+            {
+              type: 'ExpressionStatement',
+              expression: {
+                type: 'CallExpression',
+                callee: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'eventBus' },
+                  property: { type: 'Identifier', name: 'emit' },
+                },
+                arguments: [],
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasPersistenceMutationWithoutAuditEvent(missingAuditAst), true);
+  assert.equal(hasPersistenceMutationWithoutAuditEvent(auditedMutationAst), false);
+
+  const match = findPersistenceMutationWithoutAuditEventMatch(missingAuditAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [21]);
+  assert.equal(match.primary_node, 'completeOrder');
+});
+
+test('hasDtoPropertyWithoutValidation detecta DTOs sin validacion class-validator', () => {
+  const missingValidationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'email' },
+              loc: { start: { line: 4 }, end: { line: 4 } },
+              typeAnnotation: { type: 'TSTypeAnnotation' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const validatedDtoAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'email' },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'IsEmail' },
+                    arguments: [],
+                  },
+                },
+              ],
+              typeAnnotation: { type: 'TSTypeAnnotation' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasDtoPropertyWithoutValidation(missingValidationAst), true);
+  assert.equal(hasDtoPropertyWithoutValidation(validatedDtoAst), false);
+
+  const match = findDtoPropertyWithoutValidationMatch(missingValidationAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [4]);
+  assert.equal(match.primary_node, 'CreateOrderDto');
+  assert.deepEqual(match.related_nodes, ['email']);
+});
+
+test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin ValidateNested y Type', () => {
+  const missingNestedValidationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'address' },
+              loc: { start: { line: 9 }, end: { line: 9 } },
+              typeAnnotation: {
+                type: 'TSTypeAnnotation',
+                typeAnnotation: {
+                  type: 'TSTypeReference',
+                  typeName: { type: 'Identifier', name: 'AddressDto' },
+                },
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const validNestedDtoAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'address' },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'ValidateNested' },
+                    arguments: [],
+                  },
+                },
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Type' },
+                    arguments: [],
+                  },
+                },
+              ],
+              typeAnnotation: {
+                type: 'TSTypeAnnotation',
+                typeAnnotation: {
+                  type: 'TSTypeReference',
+                  typeName: { type: 'Identifier', name: 'AddressDto' },
+                },
+              },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasDtoNestedPropertyWithoutNestedValidation(missingNestedValidationAst), true);
+  assert.equal(hasDtoNestedPropertyWithoutNestedValidation(validNestedDtoAst), false);
+
+  const match = findDtoNestedPropertyWithoutNestedValidationMatch(missingNestedValidationAst);
+  assert.ok(match);
+  assert.deepEqual(match.lines, [9]);
+  assert.equal(match.primary_node, 'CreateOrderDto');
+  assert.deepEqual(match.related_nodes, ['address']);
+});
+
+test('hasBackendControllerRouteWithoutGuard detecta rutas NestJS sin UseGuards', () => {
+  const unguardedRouteAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'listOrders' },
+              loc: { start: { line: 12 }, end: { line: 14 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Get' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const classGuardedRouteAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'UseGuards' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'listOrders' },
+              loc: { start: { line: 22 }, end: { line: 24 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Get' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendControllerRouteWithoutGuard(unguardedRouteAst), true);
+  assert.equal(hasBackendControllerRouteWithoutGuard(classGuardedRouteAst), false);
+  assert.deepEqual(findBackendControllerRouteWithoutGuardLines(unguardedRouteAst), [12]);
+});