pumuki 6.3.294 → 6.3.295

package/core/facts/detectors/typescript/index.test.ts

@@ -7,10 +7,17 @@ import {
   findDtoNestedPropertyWithoutNestedValidationMatch,
   findBackendControllerRouteWithoutGuardLines,
   findBackendControllerRouteWithoutRolesLines,
+  findBackendEventHandlerWithoutOnEventLines,
+  findBackendAuthRouteWithoutThrottleLines,
   findBackendPermissiveCorsConfigurationLines,
   findBackendStringLiteralUnionEnumCandidateLines,
+  findBackendSensitiveCacheWriteLines,
   findBackendHardDeleteWithoutSoftDeleteLines,
   findBackendLogWithoutContextLines,
+  findBackendAuthResponseWithoutRefreshTokenLines,
+  findBackendProcessEnvDefaultFallbackLines,
+  findBackendDirectProcessEnvReadLines,
+  findBackendConfigModuleWithoutValidationLines,
   findBackendInconsistentErrorResponseLines,
   findBackendErrorPayloadWithSuccessStatusLines,
   findBackendControllerEntityResponseLines,
@@ -19,6 +26,7 @@ import {
   findBackendRawThrowExpressionLines,
   findBackendMissingGlobalValidationPipeLines,
   findBackendMissingHelmetSecurityHeadersLines,
+  findBackendMissingCompressionMiddlewareLines,
   findFrameworkDependencyImportMatch,
   findMixedCommandQueryClassMatch,
   findMixedCommandQueryInterfaceMatch,
@@ -27,6 +35,7 @@ import {
   findNetworkCallWithoutErrorHandlingLines,
   findNestJsConstructorDependencyWithoutDecoratorMatch,
   findPersistenceMutationWithoutAuditEventMatch,
+  findDtoPropertyWithoutApiPropertyLines,
   findRecordStringUnknownTypeLines,
   findUndefinedInBaseTypeUnionLines,
   findUnknownWithoutGuardLines,
@@ -40,11 +49,15 @@ import {
   hasDefaultExportedApiRouteHandler,
   hasDirectNetworkCall,
   hasDtoPropertyWithoutValidation,
+  hasDtoPropertyWithoutApiProperty,
   hasDtoNestedPropertyWithoutNestedValidation,
   hasBackendControllerRouteWithoutGuard,
   hasBackendControllerRouteWithoutRoles,
+  hasBackendEventHandlerWithoutOnEvent,
+  hasBackendAuthRouteWithoutThrottle,
   hasBackendPermissiveCorsConfiguration,
   hasBackendStringLiteralUnionEnumCandidate,
+  hasBackendSensitiveCacheWrite,
   hasBackendHardDeleteWithoutSoftDelete,
   hasBackendInconsistentErrorResponse,
   hasBackendErrorPayloadWithSuccessStatus,
@@ -54,6 +67,7 @@ import {
   hasBackendRawThrowExpression,
   hasBackendMissingGlobalValidationPipe,
   hasBackendMissingHelmetSecurityHeaders,
+  hasBackendMissingCompressionMiddleware,
   hasEmptyCatchClause,
   hasEvalCall,
   hasExplicitAnyType,
@@ -64,6 +78,10 @@ import {
   hasNestedIfElseStatement,
   hasNestJsConstructorDependencyWithoutDecorator,
   hasBackendLogWithoutContext,
+  hasBackendAuthResponseWithoutRefreshToken,
+  hasBackendProcessEnvDefaultFallback,
+  hasBackendDirectProcessEnvRead,
+  hasBackendConfigModuleWithoutValidation,
   hasBackendMagicNumberLiteral,
   hasBackendGenericErrorThrow,
   hasBackendProductionMockOrSpy,
@@ -317,6 +335,237 @@ test('hasBackendLogWithoutContext detecta logs backend sin request user o trace
   assert.equal(hasBackendLogWithoutContext(contextualLoggerAst), false);
 });
 
+test('hasBackendAuthResponseWithoutRefreshToken detecta respuestas auth solo con access token', () => {
+  const accessOnlyResponseAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ReturnStatement',
+        argument: {
+          type: 'ObjectExpression',
+          loc: { start: { line: 16 }, end: { line: 19 } },
+          properties: [
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'accessToken' },
+              value: { type: 'Identifier', name: 'accessToken' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const refreshTokenResponseAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ReturnStatement',
+        argument: {
+          type: 'ObjectExpression',
+          loc: { start: { line: 27 }, end: { line: 31 } },
+          properties: [
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'accessToken' },
+              value: { type: 'Identifier', name: 'accessToken' },
+            },
+            {
+              type: 'ObjectProperty',
+              key: { type: 'Identifier', name: 'refreshToken' },
+              value: { type: 'Identifier', name: 'refreshToken' },
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendAuthResponseWithoutRefreshToken(accessOnlyResponseAst), true);
+  assert.deepEqual(findBackendAuthResponseWithoutRefreshTokenLines(accessOnlyResponseAst), [16]);
+  assert.equal(hasBackendAuthResponseWithoutRefreshToken(refreshTokenResponseAst), false);
+});
+
+test('hasBackendProcessEnvDefaultFallback detecta defaults literales en process.env', () => {
+  const envFallbackAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'jwtSecret' },
+            init: {
+              type: 'LogicalExpression',
+              operator: '||',
+              loc: { start: { line: 6 }, end: { line: 6 } },
+              left: {
+                type: 'MemberExpression',
+                object: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'process' },
+                  property: { type: 'Identifier', name: 'env' },
+                },
+                property: { type: 'Identifier', name: 'JWT_SECRET' },
+              },
+              right: { type: 'StringLiteral', value: 'dev-secret' },
+            },
+          },
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'port' },
+            init: {
+              type: 'LogicalExpression',
+              operator: '??',
+              loc: { start: { line: 9 }, end: { line: 9 } },
+              left: {
+                type: 'MemberExpression',
+                object: {
+                  type: 'MemberExpression',
+                  object: { type: 'Identifier', name: 'process' },
+                  property: { type: 'Identifier', name: 'env' },
+                },
+                property: { type: 'Identifier', name: 'PORT' },
+              },
+              right: { type: 'NumericLiteral', value: 3000 },
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const strictEnvAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'jwtSecret' },
+            init: {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'requiredEnv' },
+              arguments: [
+                {
+                  type: 'MemberExpression',
+                  object: {
+                    type: 'MemberExpression',
+                    object: { type: 'Identifier', name: 'process' },
+                    property: { type: 'Identifier', name: 'env' },
+                  },
+                  property: { type: 'Identifier', name: 'JWT_SECRET' },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendProcessEnvDefaultFallback(envFallbackAst), true);
+  assert.deepEqual(findBackendProcessEnvDefaultFallbackLines(envFallbackAst), [6, 9]);
+  assert.equal(hasBackendProcessEnvDefaultFallback(strictEnvAst), false);
+});
+
+test('hasBackendDirectProcessEnvRead detecta lecturas directas de process.env', () => {
+  const directEnvAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            id: { type: 'Identifier', name: 'databaseUrl' },
+            init: {
+              type: 'MemberExpression',
+              loc: { start: { line: 6 }, end: { line: 6 } },
+              object: {
+                type: 'MemberExpression',
+                object: { type: 'Identifier', name: 'process' },
+                property: { type: 'Identifier', name: 'env' },
+              },
+              property: { type: 'Identifier', name: 'DATABASE_URL' },
+            },
+          },
+        ],
+      },
+    ],
+  };
+  const configServiceAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      object: { type: 'Identifier', name: 'configService' },
+      property: { type: 'Identifier', name: 'getOrThrow' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'DATABASE_URL' }],
+  };
+
+  assert.equal(hasBackendDirectProcessEnvRead(directEnvAst), true);
+  assert.deepEqual(findBackendDirectProcessEnvReadLines(directEnvAst), [6]);
+  assert.equal(hasBackendDirectProcessEnvRead(configServiceAst), false);
+});
+
+test('hasBackendConfigModuleWithoutValidation detecta ConfigModule sin validacion de env', () => {
+  const missingValidationAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 8 }, end: { line: 11 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'ConfigModule' },
+            property: { type: 'Identifier', name: 'forRoot' },
+          },
+          arguments: [
+            {
+              type: 'ObjectExpression',
+              properties: [
+                {
+                  type: 'ObjectProperty',
+                  key: { type: 'Identifier', name: 'isGlobal' },
+                  value: { type: 'BooleanLiteral', value: true },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const validatedAst = {
+    type: 'CallExpression',
+    loc: { start: { line: 18 }, end: { line: 21 } },
+    callee: {
+      type: 'MemberExpression',
+      object: { type: 'Identifier', name: 'ConfigModule' },
+      property: { type: 'Identifier', name: 'forRoot' },
+    },
+    arguments: [
+      {
+        type: 'ObjectExpression',
+        properties: [
+          {
+            type: 'ObjectProperty',
+            key: { type: 'Identifier', name: 'validationSchema' },
+            value: { type: 'Identifier', name: 'envSchema' },
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(hasBackendConfigModuleWithoutValidation(missingValidationAst), true);
+  assert.deepEqual(findBackendConfigModuleWithoutValidationLines(missingValidationAst), [8]);
+  assert.equal(hasBackendConfigModuleWithoutValidation(validatedAst), false);
+});
+
 test('hasBackendMagicNumberLiteral detecta numeros inline y permite constantes nombradas', () => {
   const inlineMagicNumberAst = {
     type: 'ReturnStatement',
@@ -1094,6 +1343,55 @@ test('hasBackendStringLiteralUnionEnumCandidate detecta uniones de literales str
   assert.equal(hasBackendStringLiteralUnionEnumCandidate(openUnionAst), false);
 });
 
+test('hasBackendSensitiveCacheWrite detecta datos sensibles escritos en cache', () => {
+  const sensitiveCacheAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 18 }, end: { line: 18 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'cacheManager' },
+            property: { type: 'Identifier', name: 'set' },
+          },
+          arguments: [
+            { type: 'StringLiteral', value: 'session:token' },
+            { type: 'Identifier', name: 'accessToken' },
+          ],
+        },
+      },
+    ],
+  };
+  const safeCacheAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 27 }, end: { line: 27 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'cacheManager' },
+            property: { type: 'Identifier', name: 'set' },
+          },
+          arguments: [
+            { type: 'StringLiteral', value: 'products:list' },
+            { type: 'Identifier', name: 'products' },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendSensitiveCacheWrite(sensitiveCacheAst), true);
+  assert.deepEqual(findBackendSensitiveCacheWriteLines(sensitiveCacheAst), [18]);
+  assert.equal(hasBackendSensitiveCacheWrite(safeCacheAst), false);
+});
+
 test('hasBackendHardDeleteWithoutSoftDelete detecta borrados fisicos en persistencia backend', () => {
   const hardDeleteAst = {
     type: 'Program',
@@ -2880,6 +3178,71 @@ test('hasDtoPropertyWithoutValidation detecta DTOs sin validacion class-validato
   assert.deepEqual(match.related_nodes, ['email']);
 });
 
+test('hasDtoPropertyWithoutApiProperty detecta DTOs sin decoradores Swagger', () => {
+  const missingSwaggerAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'email' },
+              loc: { start: { line: 7 }, end: { line: 7 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'IsEmail' },
+                    arguments: [],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const swaggerDtoAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'CreateOrderDto' },
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassProperty',
+              key: { type: 'Identifier', name: 'email' },
+              loc: { start: { line: 14 }, end: { line: 14 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'ApiProperty' },
+                    arguments: [],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasDtoPropertyWithoutApiProperty(missingSwaggerAst), true);
+  assert.deepEqual(findDtoPropertyWithoutApiPropertyLines(missingSwaggerAst), [7]);
+  assert.equal(hasDtoPropertyWithoutApiProperty(swaggerDtoAst), false);
+});
+
 test('hasDtoNestedPropertyWithoutNestedValidation detecta DTOs anidados sin ValidateNested y Type', () => {
   const missingNestedValidationAst = {
     type: 'Program',
@@ -3119,6 +3482,67 @@ test('hasBackendMissingHelmetSecurityHeaders detecta bootstrap NestJS sin Helmet
   assert.equal(hasBackendMissingHelmetSecurityHeaders(helmetAst), false);
 });
 
+test('hasBackendMissingCompressionMiddleware detecta bootstrap NestJS sin compression', () => {
+  const missingCompressionAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 9 }, end: { line: 9 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+    ],
+  };
+  const compressionAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          loc: { start: { line: 7 }, end: { line: 7 } },
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'NestFactory' },
+            property: { type: 'Identifier', name: 'create' },
+          },
+          arguments: [],
+        },
+      },
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'MemberExpression',
+            object: { type: 'Identifier', name: 'app' },
+            property: { type: 'Identifier', name: 'use' },
+          },
+          arguments: [
+            {
+              type: 'CallExpression',
+              callee: { type: 'Identifier', name: 'compression' },
+              arguments: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendMissingCompressionMiddleware(missingCompressionAst), true);
+  assert.deepEqual(findBackendMissingCompressionMiddlewareLines(missingCompressionAst), [9]);
+  assert.equal(hasBackendMissingCompressionMiddleware(compressionAst), false);
+});
+
 test('hasBackendControllerRouteWithoutGuard detecta rutas NestJS sin UseGuards', () => {
   const unguardedRouteAst = {
     type: 'Program',
@@ -3190,6 +3614,85 @@ test('hasBackendControllerRouteWithoutGuard detecta rutas NestJS sin UseGuards',
   assert.deepEqual(findBackendControllerRouteWithoutGuardLines(unguardedRouteAst), [12]);
 });
 
+test('hasBackendAuthRouteWithoutThrottle detecta endpoints auth sin rate limiting', () => {
+  const loginWithoutThrottleAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'login' },
+              loc: { start: { line: 21 }, end: { line: 24 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [{ type: 'StringLiteral', value: 'login' }],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const classThrottledLoginAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Controller' }, arguments: [] },
+          },
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Throttle' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'login' },
+              loc: { start: { line: 34 }, end: { line: 37 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: {
+                    type: 'CallExpression',
+                    callee: { type: 'Identifier', name: 'Post' },
+                    arguments: [{ type: 'StringLiteral', value: 'login' }],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendAuthRouteWithoutThrottle(loginWithoutThrottleAst), true);
+  assert.deepEqual(findBackendAuthRouteWithoutThrottleLines(loginWithoutThrottleAst), [21]);
+  assert.equal(hasBackendAuthRouteWithoutThrottle(classThrottledLoginAst), false);
+});
+
 test('hasBackendControllerRouteWithoutRoles detecta rutas NestJS protegidas sin RBAC explicito', () => {
   const guardedWithoutRolesAst = {
     type: 'Program',
@@ -3280,3 +3783,69 @@ test('hasBackendControllerRouteWithoutRoles detecta rutas NestJS protegidas sin
   assert.equal(hasBackendControllerRouteWithoutRoles(methodRolesAst), false);
   assert.equal(hasBackendControllerRouteWithoutRoles(unguardedRouteAst), false);
 });
+
+test('hasBackendEventHandlerWithoutOnEvent detecta handlers backend sin decorador OnEvent', () => {
+  const missingOnEventAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrderCreatedEventHandler' },
+        loc: { start: { line: 9 }, end: { line: 20 } },
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Injectable' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'handleOrderCreatedEvent' },
+              loc: { start: { line: 14 }, end: { line: 18 } },
+              decorators: [],
+            },
+          ],
+        },
+      },
+    ],
+  };
+  const decoratedMethodAst = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ClassDeclaration',
+        id: { type: 'Identifier', name: 'OrderCreatedEventHandler' },
+        loc: { start: { line: 29 }, end: { line: 40 } },
+        decorators: [
+          {
+            type: 'Decorator',
+            expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'Injectable' }, arguments: [] },
+          },
+        ],
+        body: {
+          type: 'ClassBody',
+          body: [
+            {
+              type: 'ClassMethod',
+              key: { type: 'Identifier', name: 'handleOrderCreatedEvent' },
+              loc: { start: { line: 34 }, end: { line: 38 } },
+              decorators: [
+                {
+                  type: 'Decorator',
+                  expression: { type: 'CallExpression', callee: { type: 'Identifier', name: 'OnEvent' }, arguments: [] },
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasBackendEventHandlerWithoutOnEvent(missingOnEventAst), true);
+  assert.deepEqual(findBackendEventHandlerWithoutOnEventLines(missingOnEventAst), [9, 14]);
+  assert.equal(hasBackendEventHandlerWithoutOnEvent(decoratedMethodAst), false);
+});