qa360 2.1.2 → 2.1.4

package/scripts/validation/simple-pack-check.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# QA360 Simple Pack Validation - Phase 7-Final Certification
+# Validation basique YAML sans dépendances complexes
+
+set -e
+
+PACK_FILE="$1"
+
+if [ -z "$PACK_FILE" ]; then
+  echo "Usage: $0 <pack.yml>"
+  exit 1
+fi
+
+if [ ! -f "$PACK_FILE" ]; then
+  echo "❌ Pack file not found: $PACK_FILE"
+  exit 1
+fi
+
+echo "🔍 Validating pack: $PACK_FILE"
+
+# Check required fields
+if ! grep -q "^name:" "$PACK_FILE"; then
+  echo "❌ Missing required field: name"
+  exit 1
+fi
+
+if ! grep -q "^version:" "$PACK_FILE"; then
+  echo "❌ Missing required field: version"
+  exit 1
+fi
+
+if ! grep -q "^gates:" "$PACK_FILE"; then
+  echo "❌ Missing required field: gates"
+  exit 1
+fi
+
+# Extract values
+NAME=$(grep "^name:" "$PACK_FILE" | head -1 | sed 's/name: *//' | tr -d '"')
+VERSION=$(grep "^version:" "$PACK_FILE" | head -1 | sed 's/version: *//' | tr -d '"')
+DESCRIPTION=$(grep "^description:" "$PACK_FILE" | head -1 | sed 's/description: *//' | tr -d '"')
+
+# Count enabled gates
+GATES_ENABLED=$(grep -A1 "^  [a-z]*:" "$PACK_FILE" | grep "enabled: true" | wc -l | tr -d ' ')
+
+echo "✅ Pack schema: VALID"
+echo "   Name: $NAME"
+echo "   Version: $VERSION"
+echo "   Description: $DESCRIPTION"
+echo "   Gates enabled: $GATES_ENABLED"
+
+exit 0

package/scripts/validation/validate-universal-pack.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * QA360 Universal Pack Validation Script
+ * Validation directe sans dépendance CLI pour certification Phase 7-Final
+ */
+
+import { readFileSync } from 'fs';
+import { parse } from '../../node_modules/js-yaml/dist/js-yaml.mjs';
+import Ajv from '../../node_modules/ajv/dist/ajv.js';
+import addFormats from '../../node_modules/ajv-formats/dist/index.js';
+
+const ajv = new Ajv({ allErrors: true, strict: false });
+addFormats(ajv);
+
+// Schéma Pack v1 simplifié pour validation
+const packSchema = {
+  type: 'object',
+  required: ['name', 'version', 'gates'],
+  properties: {
+    name: { type: 'string', pattern: '^[a-z0-9-]+$' },
+    version: { type: 'string', pattern: '^\\d+\\.\\d+\\.\\d+$' },
+    description: { type: 'string' },
+    gates: {
+      type: 'object',
+      properties: {
+        api: { type: 'object' },
+        ui: { type: 'object' },
+        perf: { type: 'object' },
+        a11y: { type: 'object' },
+        sast: { type: 'object' },
+        deps: { type: 'object' },
+        secrets: { type: 'object' },
+        dast: { type: 'object' }
+      }
+    },
+    metadata: { type: 'object' }
+  }
+};
+
+const validate = ajv.compile(packSchema);
+
+async function validatePack(packPath) {
+  console.log(`\n🔍 Validating pack: ${packPath}`);
+  
+  try {
+    const content = readFileSync(packPath, 'utf8');
+    const pack = parse(content);
+    
+    const valid = validate(pack);
+    
+    if (valid) {
+      console.log('✅ Pack schema: VALID');
+      console.log(`   Name: ${pack.name}`);
+      console.log(`   Version: ${pack.version}`);
+      console.log(`   Gates enabled: ${Object.keys(pack.gates).filter(g => pack.gates[g]?.enabled).join(', ')}`);
+      return { valid: true, pack };
+    } else {
+      console.log('❌ Pack schema: INVALID');
+      console.log('   Errors:', validate.errors);
+      return { valid: false, errors: validate.errors };
+    }
+  } catch (error) {
+    console.log('❌ Pack parsing: FAILED');
+    console.log('   Error:', error.message);
+    return { valid: false, error: error.message };
+  }
+}
+
+// Main
+const packPath = process.argv[2];
+if (!packPath) {
+  console.error('Usage: node validate-universal-pack.js <pack.yml>');
+  process.exit(1);
+}
+
+const result = await validatePack(packPath);
+process.exit(result.valid ? 0 : 1);

package/scripts/verify-persistence.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// scripts/verify-persistence.js - Script d'audit persistance après redeploy
+
+const BASE_URL = process.env.BASE_URL || 'https://qa360-cloud-preview.vercel.app';
+
+async function verifyPersistence() {
+  console.log('🔍 AUDIT PERSISTANCE QA360 CLOUD');
+  console.log(`Base URL: ${BASE_URL}`);
+  console.log('');
+
+  try {
+    // 1. POST /api/runpack → récupère runId
+    console.log('1️⃣ Exécution d\'un pack pour générer un runId...');
+    const runResponse = await fetch(`${BASE_URL}/api/runpack`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Origin': BASE_URL
+      },
+      body: JSON.stringify({ pack: 'httpbin' })
+    });
+
+    if (!runResponse.ok) {
+      throw new Error(`POST /api/runpack failed: ${runResponse.status}`);
+    }
+
+    const runData = await runResponse.json();
+    const { pack, runId } = runData;
+    console.log(`✅ Run créé: pack=${pack}, runId=${runId}`);
+    console.log(`📋 Summary: ${runData.summary.tests.passed} passed, ${runData.summary.tests.failed} failed`);
+    console.log('');
+
+    // 2. Vérifier que le run est accessible immédiatement
+    console.log('2️⃣ Vérification accès immédiat au rapport...');
+    const reportResponse = await fetch(`${BASE_URL}/api/report/gherkin?pack=${pack}&runId=${runId}`);
+    
+    if (!reportResponse.ok) {
+      throw new Error(`GET /api/report/gherkin failed: ${reportResponse.status}`);
+    }
+
+    const reportData = await reportResponse.json();
+    console.log(`✅ Rapport accessible: ${reportData.routes.length} routes, ${reportData.gherkin.scenarios.length} scenarios`);
+    console.log('');
+
+    // 3. Vérifier deep-link
+    console.log('3️⃣ Vérification deep-link...');
+    const deepLinkResponse = await fetch(`${BASE_URL}/r/${pack}/${runId}`);
+    
+    if (!deepLinkResponse.ok) {
+      throw new Error(`GET /r/${pack}/${runId} failed: ${deepLinkResponse.status}`);
+    }
+
+    console.log(`✅ Deep-link accessible: ${BASE_URL}/r/${pack}/${runId}`);
+    console.log('');
+
+    // 4. Simuler un redeploy (attendre 30s)
+    console.log('4️⃣ Simulation redeploy (attente 30s pour cold start)...');
+    await new Promise(resolve => setTimeout(resolve, 30000));
+    console.log('');
+
+    // 5. Vérifier persistance après "redeploy"
+    console.log('5️⃣ Vérification persistance après redeploy...');
+    const persistentReportResponse = await fetch(`${BASE_URL}/api/report/gherkin?pack=${pack}&runId=${runId}`);
+    
+    if (!persistentReportResponse.ok) {
+      console.log(`❌ ÉCHEC PERSISTANCE: GET /api/report/gherkin failed: ${persistentReportResponse.status}`);
+      console.log('⚠️  Le store persistant (Vercel KV/Redis) n\'est pas branché correctement');
+      console.log('💡 Action requise: Configurer KV_REST_API_URL et KV_REST_API_TOKEN');
+      return false;
+    }
+
+    const persistentReportData = await persistentReportResponse.json();
+    console.log(`✅ PERSISTANCE OK: Rapport toujours accessible après redeploy`);
+    console.log(`📋 Données: ${persistentReportData.routes.length} routes, ${persistentReportData.gherkin.scenarios.length} scenarios`);
+    console.log('');
+
+    // 6. Vérifier deep-link persistant
+    console.log('6️⃣ Vérification deep-link persistant...');
+    const persistentDeepLinkResponse = await fetch(`${BASE_URL}/r/${pack}/${runId}`);
+    
+    if (!persistentDeepLinkResponse.ok) {
+      console.log(`❌ Deep-link non persistant: ${persistentDeepLinkResponse.status}`);
+      return false;
+    }
+
+    console.log(`✅ Deep-link persistant: ${BASE_URL}/r/${pack}/${runId}`);
+    console.log('');
+
+    // 7. Vérifier KPI
+    console.log('7️⃣ Vérification KPI...');
+    const kpiResponse = await fetch(`${BASE_URL}/api/kpi`);
+    
+    if (!kpiResponse.ok) {
+      console.log(`⚠️  KPI endpoint failed: ${kpiResponse.status}`);
+    } else {
+      const kpiData = await kpiResponse.json();
+      console.log(`✅ KPI accessible: ${Object.keys(kpiData.kpis || {}).length} packs avec KPI`);
+    }
+
+    console.log('');
+    console.log('🎉 AUDIT PERSISTANCE RÉUSSI');
+    console.log('✅ Store persistant opérationnel');
+    console.log('✅ Deep-links durables après redeploy');
+    console.log('✅ KPI accessibles');
+    
+    return true;
+
+  } catch (error) {
+    console.error('❌ AUDIT PERSISTANCE ÉCHOUÉ:', error.message);
+    console.log('');
+    console.log('🔧 Actions correctives:');
+    console.log('1. Vérifier variables d\'environnement KV_REST_API_URL et KV_REST_API_TOKEN');
+    console.log('2. Configurer Vercel KV ou Upstash Redis');
+    console.log('3. Tester le fallback memory en développement');
+    
+    return false;
+  }
+}
+
+// Exécuter si appelé directement
+if (require.main === module) {
+  verifyPersistence().then(success => {
+    process.exit(success ? 0 : 1);
+  });
+}
+
+module.exports = { verifyPersistence };

package/test-pack.yaml

@@ -0,0 +1,43 @@
+# QA360 Test Pack - Validation du Phase3Runner
+# Cible : httpbin.org (API de test publique)
+
+version: 1
+name: "qa360-validation-test"
+description: "Test de validation du Phase3Runner avec httpbin.org"
+
+gates:
+  - api_smoke
+  - ui
+
+targets:
+  api:
+    baseUrl: "https://httpbin.org"
+    smoke:
+      - "GET /get -> 200"
+      - "GET /ip -> 200"
+      - "GET /headers -> 200"
+      - "POST /post -> 200"
+  
+  web:
+    baseUrl: "https://example.com"
+    pages:
+      - "https://example.com"
+
+budgets:
+  perf_p95_ms: 5000
+  a11y_min: 70
+
+security:
+  sast:
+    max_critical: 0
+    max_high: 5
+    max_medium: 20
+
+execution:
+  timeout: 30000
+  max_retries: 1
+  on_failure: continue
+
+observability:
+  metrics: true
+  trace: basic

package/test-results/.last-run.json

@@ -0,0 +1,4 @@
+{
+  "status": "passed",
+  "failedTests": []
+}

package/test-runner.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * QA360 Phase3Runner Validation Test
+ * Execute: node test-runner.mjs
+ */
+
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import { load } from 'js-yaml';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+async function main() {
+  console.log('🧪 QA360 Phase3Runner Validation Test\n');
+  console.log('='.repeat(50));
+  
+  try {
+    // 1. Load the pack configuration
+    console.log('\n📦 Step 1: Loading pack configuration...');
+    const packPath = join(__dirname, 'test-pack.yaml');
+    const packContent = readFileSync(packPath, 'utf-8');
+    const pack = load(packContent);
+    console.log(`   ✅ Pack loaded: ${pack.name}`);
+    console.log(`   Gates: ${pack.gates.join(', ')}`);
+    
+    // 2. Import Phase3Runner dynamically
+    console.log('\n🔧 Step 2: Importing Phase3Runner...');
+    const { Phase3Runner } = await import('./core/dist/runner/phase3-runner.js');
+    console.log('   ✅ Phase3Runner imported');
+    
+    // 3. Create runner instance
+    console.log('\n🏃 Step 3: Creating runner instance...');
+    const runner = new Phase3Runner({
+      workingDir: __dirname,
+      pack: pack,
+      outputDir: join(__dirname, '.qa360', 'test-runs')
+    });
+    console.log('   ✅ Runner created');
+    
+    // 4. Execute the run
+    console.log('\n🚀 Step 4: Executing Phase3Runner...');
+    console.log('='.repeat(50));
+    
+    const result = await runner.run();
+    
+    // 5. Display results
+    console.log('\n' + '='.repeat(50));
+    console.log('📊 RESULTS SUMMARY');
+    console.log('='.repeat(50));
+    
+    console.log(`\n   Success: ${result.success ? '✅ YES' : '❌ NO'}`);
+    console.log(`   Duration: ${result.duration}ms`);
+    console.log(`   Trust Score: ${result.summary.trustScore}%`);
+    console.log(`   Gates: ${result.summary.passed}/${result.summary.total} passed`);
+    
+    if (result.proofPath) {
+      console.log(`   Proof: ${result.proofPath}`);
+    }
+    
+    console.log('\n📋 Gate Details:');
+    for (const gate of result.gates) {
+      const icon = gate.success ? '✅' : '❌';
+      console.log(`   ${icon} ${gate.gate} (${gate.adapter}) - ${gate.duration}ms`);
+      if (gate.error) {
+        console.log(`      Error: ${gate.error}`);
+      }
+    }
+    
+    if (result.error) {
+      console.log(`\n❌ Error: ${result.error}`);
+    }
+    
+    console.log('\n' + '='.repeat(50));
+    console.log('🏁 Test completed!');
+    console.log('='.repeat(50));
+    
+    process.exit(result.success ? 0 : 1);
+    
+  } catch (error) {
+    console.error('\n💥 Fatal error:', error.message);
+    console.error(error.stack);
+    process.exit(2);
+  }
+}
+
+main();

package/tests/artifacts.spec.js

@@ -0,0 +1,147 @@
+// tests/artifacts.spec.js - Tests E2E pour endpoints artifacts et PDF
+const { test, expect } = require('@playwright/test');
+
+const BASE_URL = process.env.BASE_URL || 'https://qa360-cloud-preview.vercel.app';
+
+test.describe('Artifacts Endpoints', () => {
+  let pack, runId;
+
+  test.beforeAll(async () => {
+    // Exécuter un pack pour obtenir un runId valide
+    const response = await fetch(`${BASE_URL}/api/runpack`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Origin': BASE_URL
+      },
+      body: JSON.stringify({ pack: 'httpbin' })
+    });
+
+    expect(response.ok).toBe(true);
+    const data = await response.json();
+    pack = data.pack;
+    runId = data.runId;
+    
+    console.log(`Test setup: pack=${pack}, runId=${runId}`);
+  });
+
+  test('Logs endpoint should return 200 with text/plain', async () => {
+    const response = await fetch(`${BASE_URL}/api/artifacts/logs?pack=${pack}&runId=${runId}`);
+    
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/plain');
+    
+    const logsContent = await response.text();
+    expect(logsContent).toContain('QA360 Test Execution');
+    expect(logsContent).toContain(pack);
+    expect(logsContent).toContain(runId);
+  });
+
+  test('Screenshot endpoint should return 200 with image/png', async () => {
+    const response = await fetch(`${BASE_URL}/api/artifacts/screenshot?pack=${pack}&runId=${runId}&route=0`);
+    
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toBe('image/png');
+    
+    const buffer = await response.arrayBuffer();
+    expect(buffer.byteLength).toBeGreaterThan(0);
+    
+    // Vérifier que c'est un PNG valide (commence par PNG signature)
+    const uint8Array = new Uint8Array(buffer);
+    expect(uint8Array[0]).toBe(0x89); // PNG signature
+    expect(uint8Array[1]).toBe(0x50); // P
+    expect(uint8Array[2]).toBe(0x4E); // N
+    expect(uint8Array[3]).toBe(0x47); // G
+  });
+
+  test('Video endpoint should return 200/302 with video/mp4', async () => {
+    const response = await fetch(`${BASE_URL}/api/artifacts/video?pack=${pack}&runId=${runId}`, {
+      redirect: 'manual' // Ne pas suivre les redirections automatiquement
+    });
+    
+    // Accepter 200 (vidéo directe) ou 302 (redirection)
+    expect([200, 302]).toContain(response.status);
+    
+    if (response.status === 200) {
+      expect(response.headers.get('content-type')).toBe('video/mp4');
+      const buffer = await response.arrayBuffer();
+      expect(buffer.byteLength).toBeGreaterThan(0);
+    } else if (response.status === 302) {
+      const location = response.headers.get('location');
+      expect(location).toBeTruthy();
+      expect(location).toContain('.mp4');
+    }
+  });
+
+  test('PDF endpoint should return 200 with application/pdf or text/html', async () => {
+    const response = await fetch(`${BASE_URL}/api/report/pdf?pack=${pack}&runId=${runId}`);
+    
+    expect(response.status).toBe(200);
+    
+    const contentType = response.headers.get('content-type');
+    const contentDisposition = response.headers.get('content-disposition');
+    
+    // Accepter PDF ou HTML fallback
+    expect(['application/pdf', 'text/html']).toContain(contentType.split(';')[0]);
+    expect(contentDisposition).toContain('inline');
+    expect(contentDisposition).toContain(`${pack}-${runId}`);
+    
+    const content = await response.arrayBuffer();
+    expect(content.byteLength).toBeGreaterThan(0);
+  });
+
+  test('All artifacts should have proper cache headers', async () => {
+    const endpoints = [
+      `/api/artifacts/logs?pack=${pack}&runId=${runId}`,
+      `/api/artifacts/screenshot?pack=${pack}&runId=${runId}&route=0`,
+      `/api/artifacts/video?pack=${pack}&runId=${runId}`,
+      `/api/report/pdf?pack=${pack}&runId=${runId}`
+    ];
+
+    for (const endpoint of endpoints) {
+      const response = await fetch(`${BASE_URL}${endpoint}`, { method: 'HEAD' });
+      
+      expect(response.status).toBe(200);
+      
+      const cacheControl = response.headers.get('cache-control');
+      expect(cacheControl).toBeTruthy();
+      expect(cacheControl).toContain('public');
+    }
+  });
+
+  test('Missing parameters should return 400', async () => {
+    const endpoints = [
+      '/api/artifacts/logs',
+      '/api/artifacts/screenshot',
+      '/api/artifacts/video',
+      '/api/report/pdf'
+    ];
+
+    for (const endpoint of endpoints) {
+      const response = await fetch(`${BASE_URL}${endpoint}`);
+      expect(response.status).toBe(400);
+      
+      const error = await response.json();
+      expect(error.error).toBe('missing_params');
+    }
+  });
+
+  test('Non-existent run should still return 200 with fallback content', async () => {
+    const fakeRunId = '00000000-0000-0000-0000-000000000000';
+    
+    // Logs avec run inexistant
+    const logsResponse = await fetch(`${BASE_URL}/api/artifacts/logs?pack=httpbin&runId=${fakeRunId}`);
+    expect(logsResponse.status).toBe(200);
+    expect(logsResponse.headers.get('content-type')).toContain('text/plain');
+    
+    // Screenshot avec run inexistant
+    const screenshotResponse = await fetch(`${BASE_URL}/api/artifacts/screenshot?pack=httpbin&runId=${fakeRunId}`);
+    expect(screenshotResponse.status).toBe(200);
+    expect(screenshotResponse.headers.get('content-type')).toBe('image/png');
+    
+    // PDF avec run inexistant
+    const pdfResponse = await fetch(`${BASE_URL}/api/report/pdf?pack=httpbin&runId=${fakeRunId}`);
+    expect(pdfResponse.status).toBe(200);
+    // Peut être PDF ou HTML selon disponibilité Puppeteer
+  });
+});