pumuki 6.3.285 → 6.3.286

package/core/facts/detectors/typescript/index.test.ts

@@ -6,6 +6,14 @@ import {
   findDtoPropertyWithoutValidationMatch,
   findDtoNestedPropertyWithoutNestedValidationMatch,
   findBackendControllerRouteWithoutGuardLines,
+  findBackendPermissiveCorsConfigurationLines,
+  findBackendStringLiteralUnionEnumCandidateLines,
+  findBackendHardDeleteWithoutSoftDeleteLines,
+  findBackendLogWithoutContextLines,
+  findBackendInconsistentErrorResponseLines,
+  findBackendErrorPayloadWithSuccessStatusLines,
+  findBackendControllerEntityResponseLines,
+  findBackendRawThrowExpressionLines,
   findFrameworkDependencyImportMatch,
   findMixedCommandQueryClassMatch,
   findMixedCommandQueryInterfaceMatch,
@@ -29,6 +37,13 @@ import {
   hasDtoPropertyWithoutValidation,
   hasDtoNestedPropertyWithoutNestedValidation,
   hasBackendControllerRouteWithoutGuard,
+  hasBackendPermissiveCorsConfiguration,
+  hasBackendStringLiteralUnionEnumCandidate,
+  hasBackendHardDeleteWithoutSoftDelete,
+  hasBackendInconsistentErrorResponse,
+  hasBackendErrorPayloadWithSuccessStatus,
+  hasBackendControllerEntityResponse,
+  hasBackendRawThrowExpression,
   hasEmptyCatchClause,
   hasEvalCall,
   hasExplicitAnyType,
@@ -38,6 +53,7 @@ import {
   hasNestedCallbackUsage,
   hasNestedIfElseStatement,
   hasNestJsConstructorDependencyWithoutDecorator,
+  hasBackendLogWithoutContext,
   hasBackendMagicNumberLiteral,
   hasBackendGenericErrorThrow,
   hasBackendProductionMockOrSpy,
@@ -215,6 +231,82 @@ test('hasSensitiveDataLoggingCall detecta datos sensibles en sinks de logging',
   assert.equal(hasSensitiveDataLoggingCall(safeLoggerAst), false);
 });
 
+test('hasBackendLogWithoutContext detecta logs backend sin request user o trace context', () => {
+  const errorWithoutContextAst = {
+    type: 'File',
+    program: {
+      type: 'Program',
+      body: [
+        {
+          type: 'ExpressionStatement',
+          loc: { start: { line: 8 } },
+          expression: {
+            type: 'CallExpression',
+            loc: { start: { line: 8 } },
+            callee: {
+              type: 'MemberExpression',
+              computed: false,
+              object: { type: 'Identifier', name: 'logger' },
+              property: { type: 'Identifier', name: 'error' },
+            },
+            arguments: [{ type: 'Identifier', name: 'error' }],
+          },
+        },
+        {
+          type: 'ExpressionStatement',
+          loc: { start: { line: 12 } },
+          expression: {
+            type: 'CallExpression',
+            loc: { start: { line: 12 } },
+            callee: {
+              type: 'MemberExpression',
+              computed: false,
+              object: { type: 'Identifier', name: 'logger' },
+              property: { type: 'Identifier', name: 'error' },
+            },
+            arguments: [
+              {
+                type: 'ObjectExpression',
+                properties: [
+                  {
+                    type: 'ObjectProperty',
+                    key: { type: 'Identifier', name: 'message' },
+                    value: { type: 'MemberExpression', property: { type: 'Identifier', name: 'message' } },
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      ],
+    },
+  };
+  const contextualLoggerAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'logger' },
+      property: { type: 'Identifier', name: 'error' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'message' }, value: { type: 'Identifier', name: 'message' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'requestId' }, value: { type: 'Identifier', name: 'requestId' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'traceId' }, value: { type: 'Identifier', name: 'traceId' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'userId' }, value: { type: 'Identifier', name: 'userId' } },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendLogWithoutContext(errorWithoutContextAst), true);
+  assert.deepEqual(findBackendLogWithoutContextLines(errorWithoutContextAst), [8, 12]);
+  assert.equal(hasBackendLogWithoutContext(contextualLoggerAst), false);
+});
+
 test('hasBackendMagicNumberLiteral detecta numeros inline y permite constantes nombradas', () => {
   const inlineMagicNumberAst = {
     type: 'ReturnStatement',
@@ -265,6 +357,41 @@ test('hasBackendGenericErrorThrow detecta throw new Error y permite excepciones
   assert.equal(hasBackendGenericErrorThrow(specificErrorAst), false);
 });
 
+test('hasBackendRawThrowExpression detecta throw de valores crudos y permite excepciones tipadas', () => {
+  const rawThrowAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ThrowStatement',
+        loc: { start: { line: 6 }, end: { line: 6 } },
+        argument: { type: 'StringLiteral', value: 'invalid order' },
+      },
+      {
+        type: 'ThrowStatement',
+        loc: { start: { line: 9 }, end: { line: 9 } },
+        argument: { type: 'Identifier', name: 'error' },
+      },
+    ],
+  };
+  const typedThrowAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ThrowStatement',
+        argument: {
+          type: 'NewExpression',
+          callee: { type: 'Identifier', name: 'ValidationException' },
+          arguments: [{ type: 'StringLiteral', value: 'invalid order' }],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendRawThrowExpression(rawThrowAst), true);
+  assert.deepEqual(findBackendRawThrowExpressionLines(rawThrowAst), [6, 9]);
+  assert.equal(hasBackendRawThrowExpression(typedThrowAst), false);
+});
+
 test('hasBackendProductionMockOrSpy detecta mocks y spies de test en codigo production', () => {
   const jestMockAst = {
     type: 'CallExpression',
@@ -344,6 +471,250 @@ test('hasBackendErrorStackInHttpResponse detecta stack trace expuesto en respues
   assert.equal(hasBackendErrorStackInHttpResponse(internalLoggingAst), false);
 });
 
+test('hasBackendInconsistentErrorResponse detecta respuestas de error sin contrato completo', () => {
+  const inconsistentErrorResponseAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'TryStatement',
+        block: { type: 'BlockStatement', body: [] },
+        handler: {
+          type: 'CatchClause',
+          body: {
+            type: 'BlockStatement',
+            body: [
+              {
+                type: 'ExpressionStatement',
+                expression: {
+                  type: 'CallExpression',
+                  loc: { start: { line: 12 }, end: { line: 12 } },
+                  callee: {
+                    type: 'MemberExpression',
+                    computed: false,
+                    object: { type: 'Identifier', name: 'res' },
+                    property: { type: 'Identifier', name: 'json' },
+                  },
+                  arguments: [
+                    {
+                      type: 'ObjectExpression',
+                      properties: [
+                        {
+                          type: 'ObjectProperty',
+                          key: { type: 'Identifier', name: 'message' },
+                          value: { type: 'StringLiteral', value: 'failed' },
+                        },
+                      ],
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 20 }, end: { line: 20 } },
+          callee: {
+            type: 'MemberExpression',
+            computed: false,
+            object: {
+              type: 'CallExpression',
+              callee: {
+                type: 'MemberExpression',
+                computed: false,
+                object: { type: 'Identifier', name: 'res' },
+                property: { type: 'Identifier', name: 'status' },
+              },
+              arguments: [{ type: 'NumericLiteral', value: 404 }],
+            },
+            property: { type: 'Identifier', name: 'json' },
+          },
+          arguments: [
+            {
+              type: 'ObjectExpression',
+              properties: [
+                {
+                  type: 'ObjectProperty',
+                  key: { type: 'Identifier', name: 'error' },
+                  value: { type: 'StringLiteral', value: 'not found' },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const consistentErrorResponseAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'CallExpression',
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'res' },
+          property: { type: 'Identifier', name: 'status' },
+        },
+        arguments: [{ type: 'NumericLiteral', value: 400 }],
+      },
+      property: { type: 'Identifier', name: 'json' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'statusCode' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'message' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'timestamp' } },
+          { type: 'ObjectProperty', key: { type: 'Identifier', name: 'path' } },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendInconsistentErrorResponse(inconsistentErrorResponseAst), true);
+  assert.deepEqual(findBackendInconsistentErrorResponseLines(inconsistentErrorResponseAst), [
+    12,
+    20,
+  ]);
+  assert.equal(hasBackendInconsistentErrorResponse(consistentErrorResponseAst), false);
+});
+
+test('hasBackendErrorPayloadWithSuccessStatus detecta payload de error con status 2xx o 3xx', () => {
+  const wrongStatusAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 9 }, end: { line: 9 } },
+          callee: {
+            type: 'MemberExpression',
+            computed: false,
+            object: {
+              type: 'CallExpression',
+              callee: {
+                type: 'MemberExpression',
+                computed: false,
+                object: { type: 'Identifier', name: 'res' },
+                property: { type: 'Identifier', name: 'status' },
+              },
+              arguments: [{ type: 'NumericLiteral', value: 200 }],
+            },
+            property: { type: 'Identifier', name: 'json' },
+          },
+          arguments: [
+            {
+              type: 'ObjectExpression',
+              properties: [
+                {
+                  type: 'ObjectProperty',
+                  key: { type: 'Identifier', name: 'error' },
+                  value: { type: 'StringLiteral', value: 'invalid order' },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const correctStatusAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: {
+        type: 'CallExpression',
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'res' },
+          property: { type: 'Identifier', name: 'status' },
+        },
+        arguments: [{ type: 'NumericLiteral', value: 400 }],
+      },
+      property: { type: 'Identifier', name: 'json' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'error' },
+            value: { type: 'StringLiteral', value: 'invalid order' },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendErrorPayloadWithSuccessStatus(wrongStatusAst), true);
+  assert.deepEqual(findBackendErrorPayloadWithSuccessStatusLines(wrongStatusAst), [9]);
+  assert.equal(hasBackendErrorPayloadWithSuccessStatus(correctStatusAst), false);
+});
+
+test('hasBackendControllerEntityResponse detecta entidades expuestas por controllers', () => {
+  const entityReturnTypeAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassMethod',
+        loc: { start: { line: 7 }, end: { line: 10 } },
+        key: { type: 'Identifier', name: 'getOrder' },
+        returnType: {
+          type: 'TSTypeAnnotation',
+          typeAnnotation: {
+            type: 'TSTypeReference',
+            typeName: { type: 'Identifier', name: 'Promise' },
+            typeParameters: {
+              type: 'TSTypeParameterInstantiation',
+              params: [
+                {
+                  type: 'TSTypeReference',
+                  typeName: { type: 'Identifier', name: 'OrderEntity' },
+                },
+              ],
+            },
+          },
+        },
+      },
+      {
+        type: 'ReturnStatement',
+        loc: { start: { line: 14 }, end: { line: 14 } },
+        argument: {
+          type: 'NewExpression',
+          callee: { type: 'Identifier', name: 'UserEntity' },
+          arguments: [],
+        },
+      },
+    ],
+  };
+  const dtoReturnTypeAst = {
+    type: 'ClassMethod',
+    key: { type: 'Identifier', name: 'getOrder' },
+    returnType: {
+      type: 'TSTypeAnnotation',
+      typeAnnotation: {
+        type: 'TSTypeReference',
+        typeName: { type: 'Identifier', name: 'OrderResponseDto' },
+      },
+    },
+  };
+
+  assert.equal(hasBackendControllerEntityResponse(entityReturnTypeAst), true);
+  assert.deepEqual(findBackendControllerEntityResponseLines(entityReturnTypeAst), [7, 14]);
+  assert.equal(hasBackendControllerEntityResponse(dtoReturnTypeAst), false);
+});
+
 test('hasBackendAnemicDomainModel detecta entidades de dominio anemicas', () => {
   const anemicEntityAst = {
     type: 'ClassDeclaration',
@@ -390,6 +761,190 @@ test('hasBackendAnemicDomainModel detecta entidades de dominio anemicas', () =>
   assert.equal(hasBackendAnemicDomainModel(richEntityAst), false);
 });
 
+test('hasBackendPermissiveCorsConfiguration detecta CORS permisivo y permite origenes acotados', () => {
+  const permissiveAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 3 }, end: { line: 3 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'app' },
+          property: { type: 'Identifier', name: 'enableCors' },
+        },
+        arguments: [],
+      },
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 7 }, end: { line: 7 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'NestFactory' },
+          property: { type: 'Identifier', name: 'create' },
+        },
+        arguments: [
+          { type: 'Identifier', name: 'AppModule' },
+          {
+            type: 'ObjectExpression',
+            properties: [
+              {
+                type: 'ObjectProperty',
+                key: { type: 'Identifier', name: 'cors' },
+                value: { type: 'BooleanLiteral', value: true },
+              },
+            ],
+          },
+        ],
+      },
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 11 }, end: { line: 11 } },
+        callee: { type: 'Identifier', name: 'cors' },
+        arguments: [
+          {
+            type: 'ObjectExpression',
+            properties: [
+              {
+                type: 'ObjectProperty',
+                key: { type: 'Identifier', name: 'origin' },
+                value: { type: 'StringLiteral', value: '*' },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+  const safeAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'CallExpression',
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'app' },
+          property: { type: 'Identifier', name: 'enableCors' },
+        },
+        arguments: [
+          {
+            type: 'ObjectExpression',
+            properties: [
+              {
+                type: 'ObjectProperty',
+                key: { type: 'Identifier', name: 'origin' },
+                value: { type: 'Identifier', name: 'allowedOrigins' },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendPermissiveCorsConfiguration(permissiveAst), true);
+  assert.deepEqual(findBackendPermissiveCorsConfigurationLines(permissiveAst), [
+    3,
+    7,
+    11,
+  ]);
+  assert.equal(hasBackendPermissiveCorsConfiguration(safeAst), false);
+});
+
+test('hasBackendStringLiteralUnionEnumCandidate detecta uniones de literales string para enum', () => {
+  const enumCandidateAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'TSTypeAliasDeclaration',
+        id: { type: 'Identifier', name: 'OrderStatus' },
+        typeAnnotation: {
+          type: 'TSUnionType',
+          loc: { start: { line: 4 }, end: { line: 4 } },
+          types: [
+            { type: 'TSLiteralType', literal: { type: 'StringLiteral', value: 'pending' } },
+            { type: 'TSLiteralType', literal: { type: 'StringLiteral', value: 'paid' } },
+            { type: 'TSLiteralType', literal: { type: 'StringLiteral', value: 'cancelled' } },
+          ],
+        },
+      },
+    ],
+  };
+  const openUnionAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'TSUnionType',
+        types: [
+          { type: 'TSLiteralType', literal: { type: 'StringLiteral', value: 'pending' } },
+          { type: 'TSStringKeyword' },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendStringLiteralUnionEnumCandidate(enumCandidateAst), true);
+  assert.deepEqual(findBackendStringLiteralUnionEnumCandidateLines(enumCandidateAst), [4]);
+  assert.equal(hasBackendStringLiteralUnionEnumCandidate(openUnionAst), false);
+});
+
+test('hasBackendHardDeleteWithoutSoftDelete detecta borrados fisicos en persistencia backend', () => {
+  const hardDeleteAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 8 }, end: { line: 8 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'ordersRepository' },
+          property: { type: 'Identifier', name: 'delete' },
+        },
+        arguments: [{ type: 'Identifier', name: 'orderId' }],
+      },
+      {
+        type: 'CallExpression',
+        loc: { start: { line: 12 }, end: { line: 12 } },
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: {
+            type: 'MemberExpression',
+            computed: false,
+            object: { type: 'Identifier', name: 'prisma' },
+            property: { type: 'Identifier', name: 'order' },
+          },
+          property: { type: 'Identifier', name: 'deleteMany' },
+        },
+        arguments: [],
+      },
+    ],
+  };
+  const softDeleteAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'CallExpression',
+        callee: {
+          type: 'MemberExpression',
+          computed: false,
+          object: { type: 'Identifier', name: 'ordersRepository' },
+          property: { type: 'Identifier', name: 'softDelete' },
+        },
+        arguments: [{ type: 'Identifier', name: 'orderId' }],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendHardDeleteWithoutSoftDelete(hardDeleteAst), true);
+  assert.deepEqual(findBackendHardDeleteWithoutSoftDeleteLines(hardDeleteAst), [8, 12]);
+  assert.equal(hasBackendHardDeleteWithoutSoftDelete(softDeleteAst), false);
+});
+
 test('hasEvalCall detecta eval directo y descarta member eval', () => {
   const directEvalAst = {
     type: 'CallExpression',