qa360 2.1.7 → 2.2.0

package/dist/core/adapters/gitleaks-secrets.d.ts

@@ -1,114 +0,0 @@
-/**
- * QA360 Gitleaks Secrets Adapter (Sécurité Réelle)
- * Scan for hardcoded secrets in source code
- */
-import { PackSecurity } from '../types/pack-v1.js';
-export interface GitleaksConfig {
-    workingDir: string;
-    security?: PackSecurity;
-    timeout?: number;
-    excludePaths?: string[];
-    configFile?: string;
-    verbose?: boolean;
-}
-export interface GitleaksFinding {
-    Description: string;
-    StartLine: number;
-    EndLine: number;
-    StartColumn: number;
-    EndColumn: number;
-    Match: string;
-    Secret: string;
-    File: string;
-    SymlinkFile: string;
-    Commit: string;
-    Entropy: number;
-    Author: string;
-    Email: string;
-    Date: string;
-    Message: string;
-    Tags: string[];
-    RuleID: string;
-    Fingerprint: string;
-}
-export interface GitleaksScanResult {
-    success: boolean;
-    findings: GitleaksFinding[];
-    summary: {
-        total: number;
-        by_rule: Record<string, number>;
-        by_file: Record<string, number>;
-        high_entropy: number;
-    };
-    budgetCheck: {
-        findings_passed: boolean;
-    };
-    scannedPath: string;
-    error?: string;
-    rawOutput?: string;
-    junit?: string;
-    errorCode?: string;
-}
-export declare class GitleaksSecretsAdapter {
-    private redactor;
-    private workingDir;
-    constructor(workingDir?: string);
-    /**
-     * Execute Gitleaks secrets scan
-     */
-    runSecretsScan(config: GitleaksConfig): Promise<GitleaksScanResult>;
-    /**
-     * Prepare gitleaks configuration
-     */
-    private prepareConfig;
-    /**
-     * Generate TOML config from object
-     */
-    private generateTomlConfig;
-    /**
-     * Execute gitleaks scanner
-     */
-    private executeGitleaks;
-    /**
-     * Parse gitleaks results
-     */
-    private parseGitleaksResults;
-    /**
-     * Fallback mock scan when gitleaks not available
-     */
-    private fallbackMockScan;
-    /**
-     * Calculate findings summary
-     */
-    private calculateSummary;
-    /**
-     * Generate budget check based on security config
-     */
-    private generateBudgetCheck;
-    /**
-     * Get empty summary structure
-     */
-    private getEmptySummary;
-    /**
-     * Get default budget check structure
-     */
-    private getDefaultBudgetCheck;
-    /**
-     * Generate JUnit XML report
-     */
-    private generateJUnit;
-    /**
-     * Validate gitleaks scan configuration
-     */
-    static validateConfig(config: GitleaksConfig): {
-        valid: boolean;
-        errors: string[];
-    };
-    /**
-     * Check if Gitleaks is available
-     */
-    static isAvailable(): Promise<{
-        available: boolean;
-        error?: string;
-    }>;
-}

package/dist/core/adapters/gitleaks-secrets.js

@@ -1,410 +0,0 @@
-/**
- * QA360 Gitleaks Secrets Adapter (Sécurité Réelle)
- * Scan for hardcoded secrets in source code
- */
-import { spawn } from 'child_process';
-import { existsSync, writeFileSync, unlinkSync } from 'fs';
-import { join } from 'path';
-import { SecurityRedactor } from '../security/redactor.js';
-export class GitleaksSecretsAdapter {
-    redactor;
-    workingDir;
-    constructor(workingDir = process.cwd()) {
-        this.redactor = SecurityRedactor.forLogs();
-        this.workingDir = workingDir;
-    }
-    /**
-     * Execute Gitleaks secrets scan
-     */
-    async runSecretsScan(config) {
-        try {
-            console.log('🔍 Running Gitleaks secrets scan');
-            // Generate gitleaks config if needed
-            const configPath = await this.prepareConfig(config);
-            // Execute gitleaks
-            const result = await this.executeGitleaks(configPath, config);
-            // Cleanup temp config
-            if (configPath && configPath.includes('gitleaks-temp')) {
-                try {
-                    unlinkSync(configPath);
-                }
-                catch {
-                    // Ignore cleanup errors
-                }
-            }
-            return result;
-        }
-        catch (error) {
-            return {
-                success: false,
-                findings: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                scannedPath: config.workingDir,
-                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error'),
-                errorCode: 'GL099'
-            };
-        }
-    }
-    /**
-     * Prepare gitleaks configuration
-     */
-    async prepareConfig(config) {
-        if (config.configFile && existsSync(config.configFile)) {
-            return config.configFile;
-        }
-        // Generate default config with QA360 exclusions
-        const gitleaksConfig = {
-            title: 'QA360 Gitleaks Config',
-            extend: {
-                useDefault: true
-            },
-            allowlist: {
-                description: 'QA360 allowlist',
-                paths: [
-                    '.qa360/**',
-                    'node_modules/**',
-                    'dist/**',
-                    'build/**',
-                    'coverage/**',
-                    '**/*.min.js',
-                    '**/*.map',
-                    ...(config.excludePaths || [])
-                ],
-                regexes: [
-                    'example',
-                    'test.*key',
-                    'dummy.*secret',
-                    'placeholder',
-                    'YOUR_.*_HERE'
-                ]
-            },
-            rules: [
-                {
-                    id: 'generic-api-key',
-                    description: 'Generic API Key',
-                    regex: '(?i)\\b[a-z0-9]{32,}\\b',
-                    entropy: 3.5,
-                    keywords: ['api', 'key', 'token']
-                },
-                {
-                    id: 'jwt-token',
-                    description: 'JWT Token',
-                    regex: 'eyJ[A-Za-z0-9_/+-]*\\.eyJ[A-Za-z0-9_/+-]*\\.[A-Za-z0-9_/+-]*',
-                    keywords: ['jwt', 'token']
-                },
-                {
-                    id: 'private-key',
-                    description: 'Private Key',
-                    regex: '-----BEGIN [A-Z]+ PRIVATE KEY-----',
-                    keywords: ['private', 'key']
-                }
-            ]
-        };
-        const configPath = join(config.workingDir, 'gitleaks-temp.toml');
-        // Convert to TOML format (simplified)
-        const tomlConfig = this.generateTomlConfig(gitleaksConfig);
-        writeFileSync(configPath, tomlConfig);
-        return configPath;
-    }
-    /**
-     * Generate TOML config from object
-     */
-    generateTomlConfig(config) {
-        let toml = `title = "${config.title}"\n\n`;
-        if (config.extend?.useDefault) {
-            toml += '[extend]\nuseDefault = true\n\n';
-        }
-        if (config.allowlist) {
-            toml += '[allowlist]\n';
-            toml += `description = "${config.allowlist.description}"\n`;
-            if (config.allowlist.paths) {
-                toml += 'paths = [\n';
-                for (const path of config.allowlist.paths) {
-                    toml += `  "${path}",\n`;
-                }
-                toml += ']\n';
-            }
-            if (config.allowlist.regexes) {
-                toml += 'regexes = [\n';
-                for (const regex of config.allowlist.regexes) {
-                    toml += `  "${regex}",\n`;
-                }
-                toml += ']\n\n';
-            }
-        }
-        if (config.rules) {
-            for (const rule of config.rules) {
-                toml += `[[rules]]\n`;
-                toml += `id = "${rule.id}"\n`;
-                toml += `description = "${rule.description}"\n`;
-                toml += `regex = '''${rule.regex}'''\n`;
-                if (rule.entropy) {
-                    toml += `entropy = ${rule.entropy}\n`;
-                }
-                if (rule.keywords) {
-                    toml += 'keywords = [\n';
-                    for (const keyword of rule.keywords) {
-                        toml += `  "${keyword}",\n`;
-                    }
-                    toml += ']\n';
-                }
-                toml += '\n';
-            }
-        }
-        return toml;
-    }
-    /**
-     * Execute gitleaks scanner
-     */
-    async executeGitleaks(configPath, config) {
-        return new Promise((resolve) => {
-            let output = '';
-            let error = '';
-            const args = [
-                'detect',
-                '--source', config.workingDir,
-                '--report-format', 'json',
-                '--no-git'
-            ];
-            if (configPath) {
-                args.push('--config', configPath);
-            }
-            if (config.verbose) {
-                args.push('--verbose');
-            }
-            const child = spawn('gitleaks', args, {
-                cwd: config.workingDir,
-                stdio: ['ignore', 'pipe', 'pipe']
-            });
-            const timeout = setTimeout(() => {
-                child.kill('SIGKILL');
-                resolve({
-                    success: false,
-                    findings: [],
-                    summary: this.getEmptySummary(),
-                    budgetCheck: this.getDefaultBudgetCheck(),
-                    scannedPath: config.workingDir,
-                    error: `Gitleaks scan timed out after ${config.timeout || 120000}ms`,
-                    errorCode: 'GL001'
-                });
-            }, config.timeout || 120000);
-            if (child.stdout) {
-                child.stdout.on('data', (data) => {
-                    output += data.toString();
-                });
-            }
-            if (child.stderr) {
-                child.stderr.on('data', (data) => {
-                    error += data.toString();
-                });
-            }
-            child.on('close', (code) => {
-                clearTimeout(timeout);
-                if (code === 0 || code === 1) { // 0 = no secrets, 1 = secrets found
-                    const result = this.parseGitleaksResults(output, config);
-                    resolve(result);
-                }
-                else {
-                    resolve({
-                        success: false,
-                        findings: [],
-                        summary: this.getEmptySummary(),
-                        budgetCheck: this.getDefaultBudgetCheck(),
-                        scannedPath: config.workingDir,
-                        error: this.redactor.redact(error || `Gitleaks exited with code ${code}`),
-                        rawOutput: this.redactor.redact(output),
-                        errorCode: 'GL002'
-                    });
-                }
-            });
-            child.on('error', (err) => {
-                clearTimeout(timeout);
-                // Fallback to mock scan
-                resolve(this.fallbackMockScan(config));
-            });
-        });
-    }
-    /**
-     * Parse gitleaks results
-     */
-    parseGitleaksResults(output, config) {
-        try {
-            let findings = [];
-            if (output.trim()) {
-                const data = JSON.parse(output);
-                findings = Array.isArray(data) ? data : [data];
-            }
-            // Redact sensitive information from findings
-            const redactedFindings = findings.map(finding => ({
-                ...finding,
-                Secret: this.redactor.redact(finding.Secret || ''),
-                Match: this.redactor.redact(finding.Match || ''),
-                Email: this.redactor.redact(finding.Email || ''),
-                Author: this.redactor.redact(finding.Author || '')
-            }));
-            const summary = this.calculateSummary(redactedFindings);
-            const budgetCheck = this.generateBudgetCheck(summary, config);
-            const success = budgetCheck.findings_passed;
-            const junit = this.generateJUnit(summary, success, config);
-            return {
-                success,
-                findings: redactedFindings,
-                summary,
-                budgetCheck,
-                scannedPath: config.workingDir,
-                rawOutput: this.redactor.redact(output),
-                junit
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                findings: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                scannedPath: config.workingDir,
-                error: `Failed to parse Gitleaks results: ${error}`,
-                rawOutput: this.redactor.redact(output),
-                errorCode: 'GL003'
-            };
-        }
-    }
-    /**
-     * Fallback mock scan when gitleaks not available
-     */
-    fallbackMockScan(config) {
-        console.log('⚠️  Gitleaks not found, using mock scan (install gitleaks for real scanning)');
-        return {
-            success: true,
-            findings: [],
-            summary: this.getEmptySummary(),
-            budgetCheck: this.getDefaultBudgetCheck(),
-            scannedPath: config.workingDir,
-            error: 'Gitleaks not available - install from https://github.com/gitleaks/gitleaks',
-            junit: this.generateJUnit(this.getEmptySummary(), true, config),
-            errorCode: 'GL004'
-        };
-    }
-    /**
-     * Calculate findings summary
-     */
-    calculateSummary(findings) {
-        const summary = {
-            total: findings.length,
-            by_rule: {},
-            by_file: {},
-            high_entropy: 0
-        };
-        for (const finding of findings) {
-            // Count by rule
-            const ruleId = finding.RuleID || 'unknown';
-            summary.by_rule[ruleId] = (summary.by_rule[ruleId] || 0) + 1;
-            // Count by file
-            const file = finding.File || 'unknown';
-            summary.by_file[file] = (summary.by_file[file] || 0) + 1;
-            // Count high entropy findings
-            if (finding.Entropy && finding.Entropy > 4.0) {
-                summary.high_entropy++;
-            }
-        }
-        return summary;
-    }
-    /**
-     * Generate budget check based on security config
-     */
-    generateBudgetCheck(summary, config) {
-        const secrets = config.security?.secrets;
-        return {
-            findings_passed: !secrets?.max_findings || summary.total <= secrets.max_findings
-        };
-    }
-    /**
-     * Get empty summary structure
-     */
-    getEmptySummary() {
-        return {
-            total: 0,
-            by_rule: {},
-            by_file: {},
-            high_entropy: 0
-        };
-    }
-    /**
-     * Get default budget check structure
-     */
-    getDefaultBudgetCheck() {
-        return {
-            findings_passed: true
-        };
-    }
-    /**
-     * Generate JUnit XML report
-     */
-    generateJUnit(summary, success, config) {
-        const timestamp = new Date().toISOString();
-        const duration = '0.1';
-        let junit = `<?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="Gitleaks Secrets Scan" tests="1" failures="${success ? 0 : 1}" time="${duration}" timestamp="${timestamp}">
-  <testcase name="Secret Detection: ${config.workingDir}" time="${duration}">
-`;
-        if (!success) {
-            junit += `    <failure message="Secrets found in source code">
-Total findings: ${summary.total}
-High entropy: ${summary.high_entropy}
-Files affected: ${Object.keys(summary.by_file).length}
-Rules triggered: ${Object.keys(summary.by_rule).length}
-    </failure>
-`;
-        }
-        junit += `  </testcase>
-</testsuite>`;
-        return junit;
-    }
-    /**
-     * Validate gitleaks scan configuration
-     */
-    static validateConfig(config) {
-        const errors = [];
-        if (!config.workingDir) {
-            errors.push('Working directory is required');
-        }
-        if (!existsSync(config.workingDir)) {
-            errors.push(`Working directory does not exist: ${config.workingDir}`);
-        }
-        if (config.configFile && !existsSync(config.configFile)) {
-            errors.push(`Config file does not exist: ${config.configFile}`);
-        }
-        return {
-            valid: errors.length === 0,
-            errors
-        };
-    }
-    /**
-     * Check if Gitleaks is available
-     */
-    static async isAvailable() {
-        return new Promise((resolve) => {
-            const child = spawn('gitleaks', ['version'], { stdio: 'pipe' });
-            child.on('close', (code) => {
-                resolve({
-                    available: code === 0,
-                    error: code !== 0 ? 'gitleaks not found. Install from https://github.com/gitleaks/gitleaks' : undefined
-                });
-            });
-            child.on('error', () => {
-                resolve({
-                    available: false,
-                    error: 'gitleaks not found. Install from https://github.com/gitleaks/gitleaks'
-                });
-            });
-            setTimeout(() => {
-                child.kill();
-                resolve({
-                    available: false,
-                    error: 'gitleaks check timed out'
-                });
-            }, 5000);
-        });
-    }
-}

package/dist/core/adapters/k6-perf.d.ts

@@ -1,85 +0,0 @@
-/**
- * QA360 k6 Performance Adapter (Socle OOTB)
- * Short performance tests with P95 calculation
- */
-import { PackBudgets } from '../types/pack-v1.js';
-export interface K6TestConfig {
-    baseUrl: string;
-    budgets?: PackBudgets;
-    duration?: string;
-    vus?: number;
-    timeout?: number;
-    scenarios?: Record<string, any>;
-}
-export interface K6TestResult {
-    success: boolean;
-    metrics: {
-        http_req_duration_p95: number;
-        http_req_duration_avg: number;
-        http_req_failed_rate: number;
-        http_reqs_total: number;
-        vus_max: number;
-        iterations: number;
-    };
-    thresholds: {
-        [key: string]: {
-            passed: boolean;
-            value: number;
-            threshold: string;
-        };
-    };
-    error?: string;
-    rawOutput?: string;
-    junit?: string;
-}
-export declare class K6PerfAdapter {
-    private redactor;
-    private workingDir;
-    constructor(workingDir?: string);
-    /**
-     * Execute k6 performance test
-     */
-    runPerfTest(config: K6TestConfig): Promise<K6TestResult>;
-    /**
-     * Generate k6 test script
-     */
-    private generateK6Script;
-    /**
-     * Execute k6 command
-     */
-    private executeK6;
-    /**
-     * Parse k6 results from output
-     */
-    private parseK6Results;
-    /**
-     * Parse metrics from text output
-     */
-    private parseTextMetrics;
-    /**
-     * Parse thresholds from text output
-     */
-    private parseTextThresholds;
-    /**
-     * Generate JUnit XML
-     */
-    private generateJUnit;
-    /**
-     * Get default metrics structure
-     */
-    private getDefaultMetrics;
-    /**
-     * Check if k6 is available
-     */
-    static isAvailable(): Promise<{
-        available: boolean;
-        error?: string;
-    }>;
-    /**
-     * Validate performance test configuration
-     */
-    static validateConfig(config: K6TestConfig): {
-        valid: boolean;
-        errors: string[];
-    };
-}