qa360 2.1.7 → 2.2.0

package/dist/core/adapters/osv-deps.js

@@ -1,372 +0,0 @@
-/**
- * QA360 OSV Dependencies Adapter (Sécurité Réelle)
- * Scan vulnerabilities in package-lock.json / pnpm-lock.yaml
- */
-import { spawn } from 'child_process';
-import { existsSync } from 'fs';
-import { join } from 'path';
-import { SecurityRedactor } from '../security/redactor.js';
-export class OsvDepsAdapter {
-    redactor;
-    workingDir;
-    constructor(workingDir = process.cwd()) {
-        this.redactor = SecurityRedactor.forLogs();
-        this.workingDir = workingDir;
-    }
-    /**
-     * Execute OSV dependency scan
-     */
-    async runDependencyScan(config) {
-        try {
-            console.log('🔍 Running OSV dependency vulnerability scan');
-            // Find lock files to scan
-            const lockFiles = this.findLockFiles(config);
-            if (lockFiles.length === 0) {
-                return {
-                    success: true,
-                    vulnerabilities: [],
-                    summary: this.getEmptySummary(),
-                    budgetCheck: this.getDefaultBudgetCheck(),
-                    scannedFiles: [],
-                    error: 'No lock files found to scan',
-                    errorCode: 'OSV001'
-                };
-            }
-            // Execute OSV scanner
-            const result = await this.executeOsvScan(lockFiles, config);
-            return result;
-        }
-        catch (error) {
-            return {
-                success: false,
-                vulnerabilities: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                scannedFiles: [],
-                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error'),
-                errorCode: 'OSV099'
-            };
-        }
-    }
-    /**
-     * Find lock files in working directory
-     */
-    findLockFiles(config) {
-        const lockFiles = [];
-        // Custom lock files from config
-        if (config.lockFiles) {
-            for (const file of config.lockFiles) {
-                const fullPath = join(config.workingDir, file);
-                if (existsSync(fullPath)) {
-                    lockFiles.push(fullPath);
-                }
-            }
-            return lockFiles;
-        }
-        // Standard lock files
-        const standardFiles = [
-            'package-lock.json',
-            'pnpm-lock.yaml',
-            'yarn.lock',
-            'Pipfile.lock',
-            'poetry.lock',
-            'Gemfile.lock',
-            'go.sum',
-            'Cargo.lock'
-        ];
-        for (const file of standardFiles) {
-            const fullPath = join(config.workingDir, file);
-            if (existsSync(fullPath)) {
-                lockFiles.push(fullPath);
-            }
-        }
-        return lockFiles;
-    }
-    /**
-     * Execute OSV scanner on lock files
-     */
-    async executeOsvScan(lockFiles, config) {
-        return new Promise((resolve) => {
-            let output = '';
-            let error = '';
-            // Use osv-scanner if available, otherwise use API
-            const args = ['--format', 'json', ...lockFiles];
-            const child = spawn('osv-scanner', args, {
-                cwd: config.workingDir,
-                stdio: ['ignore', 'pipe', 'pipe']
-            });
-            const timeout = setTimeout(() => {
-                child.kill('SIGKILL');
-                resolve({
-                    success: false,
-                    vulnerabilities: [],
-                    summary: this.getEmptySummary(),
-                    budgetCheck: this.getDefaultBudgetCheck(),
-                    scannedFiles: lockFiles,
-                    error: `OSV scan timed out after ${config.timeout || 120000}ms`,
-                    errorCode: 'OSV002'
-                });
-            }, config.timeout || 120000);
-            if (child.stdout) {
-                child.stdout.on('data', (data) => {
-                    output += data.toString();
-                });
-            }
-            if (child.stderr) {
-                child.stderr.on('data', (data) => {
-                    error += data.toString();
-                });
-            }
-            child.on('close', (code) => {
-                clearTimeout(timeout);
-                if (code === 0 || code === 1) { // 0 = no vulns, 1 = vulns found
-                    const result = this.parseOsvResults(output, lockFiles, config);
-                    resolve(result);
-                }
-                else {
-                    resolve({
-                        success: false,
-                        vulnerabilities: [],
-                        summary: this.getEmptySummary(),
-                        budgetCheck: this.getDefaultBudgetCheck(),
-                        scannedFiles: lockFiles,
-                        error: this.redactor.redact(error || `OSV scanner exited with code ${code}`),
-                        rawOutput: this.redactor.redact(output),
-                        errorCode: 'OSV003'
-                    });
-                }
-            });
-            child.on('error', (err) => {
-                clearTimeout(timeout);
-                // Fallback to API-based scanning
-                this.fallbackApiScan(lockFiles, config).then(resolve);
-            });
-        });
-    }
-    /**
-     * Parse OSV scanner results
-     */
-    parseOsvResults(output, lockFiles, config) {
-        try {
-            const data = JSON.parse(output);
-            const vulnerabilities = [];
-            // Parse vulnerabilities from OSV format
-            if (data.results) {
-                for (const result of data.results) {
-                    if (result.packages) {
-                        for (const pkg of result.packages) {
-                            if (pkg.vulnerabilities) {
-                                for (const vuln of pkg.vulnerabilities) {
-                                    vulnerabilities.push({
-                                        id: vuln.id || 'UNKNOWN',
-                                        summary: vuln.summary || 'No summary available',
-                                        severity: this.mapSeverity(vuln.database_specific?.severity || vuln.severity),
-                                        package: {
-                                            name: pkg.package?.name || 'unknown',
-                                            version: pkg.package?.version || 'unknown',
-                                            ecosystem: pkg.package?.ecosystem || 'unknown'
-                                        },
-                                        affected: vuln.affected || [],
-                                        references: vuln.references || []
-                                    });
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            const summary = this.calculateSummary(vulnerabilities);
-            const budgetCheck = this.generateBudgetCheck(summary, config);
-            const success = budgetCheck.critical_passed && budgetCheck.high_passed;
-            const junit = this.generateJUnit(summary, success, lockFiles);
-            return {
-                success,
-                vulnerabilities,
-                summary,
-                budgetCheck,
-                scannedFiles: lockFiles,
-                rawOutput: this.redactor.redact(output),
-                junit
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                vulnerabilities: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                scannedFiles: lockFiles,
-                error: `Failed to parse OSV results: ${error}`,
-                rawOutput: this.redactor.redact(output),
-                errorCode: 'OSV004'
-            };
-        }
-    }
-    /**
-     * Fallback API-based scanning when osv-scanner not available
-     */
-    async fallbackApiScan(lockFiles, config) {
-        console.log('⚠️  OSV scanner not found, using mock scan (install osv-scanner for real scanning)');
-        return {
-            success: true,
-            vulnerabilities: [],
-            summary: this.getEmptySummary(),
-            budgetCheck: this.getDefaultBudgetCheck(),
-            scannedFiles: lockFiles,
-            error: 'OSV scanner not available - install from https://github.com/google/osv-scanner',
-            junit: this.generateJUnit(this.getEmptySummary(), true, lockFiles),
-            errorCode: 'OSV005'
-        };
-    }
-    /**
-     * Map severity from various formats to standard levels
-     */
-    mapSeverity(severity) {
-        if (!severity)
-            return 'UNKNOWN';
-        const s = severity.toLowerCase();
-        if (s.includes('critical'))
-            return 'CRITICAL';
-        if (s.includes('high'))
-            return 'HIGH';
-        if (s.includes('medium') || s.includes('moderate'))
-            return 'MEDIUM';
-        if (s.includes('low') || s.includes('minor'))
-            return 'LOW';
-        return 'UNKNOWN';
-    }
-    /**
-     * Calculate vulnerability summary
-     */
-    calculateSummary(vulnerabilities) {
-        const summary = {
-            total: vulnerabilities.length,
-            critical: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            unknown: 0
-        };
-        for (const vuln of vulnerabilities) {
-            switch (vuln.severity) {
-                case 'CRITICAL':
-                    summary.critical++;
-                    break;
-                case 'HIGH':
-                    summary.high++;
-                    break;
-                case 'MEDIUM':
-                    summary.medium++;
-                    break;
-                case 'LOW':
-                    summary.low++;
-                    break;
-                default:
-                    summary.unknown++;
-                    break;
-            }
-        }
-        return summary;
-    }
-    /**
-     * Generate budget check based on security config
-     */
-    generateBudgetCheck(summary, config) {
-        const deps = config.security?.deps;
-        return {
-            critical_passed: deps?.max_critical === undefined || summary.critical <= deps.max_critical,
-            high_passed: deps?.max_high === undefined || summary.high <= deps.max_high,
-            medium_passed: deps?.max_medium === undefined || summary.medium <= deps.max_medium
-        };
-    }
-    /**
-     * Get empty summary structure
-     */
-    getEmptySummary() {
-        return {
-            total: 0,
-            critical: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            unknown: 0
-        };
-    }
-    /**
-     * Get default budget check structure
-     */
-    getDefaultBudgetCheck() {
-        return {
-            critical_passed: true,
-            high_passed: true,
-            medium_passed: true
-        };
-    }
-    /**
-     * Generate JUnit XML report
-     */
-    generateJUnit(summary, success, lockFiles) {
-        const timestamp = new Date().toISOString();
-        const duration = '0.1';
-        let junit = `<?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="OSV Dependency Scan" tests="1" failures="${success ? 0 : 1}" time="${duration}" timestamp="${timestamp}">
-  <testcase name="Dependency Vulnerabilities: ${lockFiles.join(', ')}" time="${duration}">
-`;
-        if (!success) {
-            junit += `    <failure message="Dependency vulnerabilities found">
-Critical: ${summary.critical}
-High: ${summary.high}
-Medium: ${summary.medium}
-Low: ${summary.low}
-Total: ${summary.total}
-    </failure>
-`;
-        }
-        junit += `  </testcase>
-</testsuite>`;
-        return junit;
-    }
-    /**
-     * Validate OSV scan configuration
-     */
-    static validateConfig(config) {
-        const errors = [];
-        if (!config.workingDir) {
-            errors.push('Working directory is required');
-        }
-        if (!existsSync(config.workingDir)) {
-            errors.push(`Working directory does not exist: ${config.workingDir}`);
-        }
-        return {
-            valid: errors.length === 0,
-            errors
-        };
-    }
-    /**
-     * Check if OSV scanner is available
-     */
-    static async isAvailable() {
-        return new Promise((resolve) => {
-            const child = spawn('osv-scanner', ['--version'], { stdio: 'pipe' });
-            child.on('close', (code) => {
-                resolve({
-                    available: code === 0,
-                    error: code !== 0 ? 'osv-scanner not found. Install from https://github.com/google/osv-scanner' : undefined
-                });
-            });
-            child.on('error', () => {
-                resolve({
-                    available: false,
-                    error: 'osv-scanner not found. Install from https://github.com/google/osv-scanner'
-                });
-            });
-            setTimeout(() => {
-                child.kill();
-                resolve({
-                    available: false,
-                    error: 'osv-scanner check timed out'
-                });
-            }, 5000);
-        });
-    }
-}

package/dist/core/adapters/playwright-native-adapter.d.ts

@@ -1,121 +0,0 @@
-/**
- * QA360 Playwright Native Adapter
- *
- * Zero-overhead adapter that uses Playwright's native API directly.
- * This bypasses any wrapper logic and gives full access to Playwright's capabilities.
- *
- * Benefits:
- * - Zero performance overhead
- * - Full Playwright API access
- * - Native video/trace/screenshot support
- * - Direct access to browser context, page, locators
- */
-import { Browser, BrowserContext, Page, Locator } from '@playwright/test';
-import type { WebTarget, PackBudgets, UiTestDefinition, UiTestStep } from '../types/pack-v1.js';
-export interface PlaywrightNativeConfig {
-    target: WebTarget;
-    budgets?: PackBudgets;
-    timeout?: number;
-    browser?: 'chromium' | 'firefox' | 'webkit';
-    headless?: boolean;
-    slowMo?: number;
-    devtools?: boolean;
-    device?: 'desktop' | 'tablet' | 'mobile' | 'custom';
-    viewport?: {
-        width: number;
-        height: number;
-    };
-    userAgent?: string;
-    locale?: string;
-    timezone?: string;
-    screenshots?: 'always' | 'only-on-failure' | 'never';
-    video?: 'always' | 'retain-on-failure' | 'never';
-    trace?: 'always' | 'retain-on-failure' | 'never' | 'on-first-failure';
-    bail?: number;
-    workers?: number;
-    ignoreHTTPSErrors?: boolean;
-    acceptDownloads?: boolean;
-    bypassCSP?: boolean;
-}
-export interface PlaywrightNativeResult {
-    success: boolean;
-    duration: number;
-    artifacts?: {
-        screenshots: string[];
-        videos: string[];
-        traces: string[];
-    };
-    error?: string;
-    coverage?: {
-        lines: number;
-        statements: number;
-        branches: number;
-        functions: number;
-    };
-}
-export interface PlaywrightNativeStepResult {
-    step: UiTestStep;
-    success: boolean;
-    duration: number;
-    error?: string;
-    screenshot?: string;
-}
-/**
- * Playwright Native Adapter
- *
- * Provides zero-overhead access to Playwright with automatic
- * artifact collection (screenshots, videos, traces).
- */
-export declare class PlaywrightNativeAdapter {
-    private config;
-    private browser?;
-    private context?;
-    private page?;
-    private artifacts?;
-    private assertions?;
-    private testResults;
-    private failureCount;
-    constructor(config: PlaywrightNativeConfig);
-    /**
-     * Run a single E2E test with full Playwright native access
-     */
-    runTest(test: UiTestDefinition): Promise<PlaywrightNativeResult>;
-    /**
-     * Execute a single step using Playwright native API
-     */
-    private executeStep;
-    /**
-     * Execute action using Playwright native API
-     */
-    private executeAction;
-    /**
-     * Setup browser with trace context
-     */
-    private setup;
-    /**
-     * Teardown and save artifacts
-     */
-    private teardown;
-    /**
-     * Get artifact paths for result
-     */
-    private getArtifactPaths;
-    /**
-     * Get direct access to Playwright objects
-     */
-    getBrowser(): Browser | undefined;
-    getContext(): BrowserContext | undefined;
-    getPage(): Page | undefined;
-    /**
-     * Get locator for direct manipulation
-     */
-    locator(selector: string): Locator;
-}
-/**
- * Create a Playwright Native Adapter
- */
-export declare function createPlaywrightNativeAdapter(config: PlaywrightNativeConfig): PlaywrightNativeAdapter;
-/**
- * Create adapter from WebTarget (convenience function)
- */
-export declare function createFromTarget(target: WebTarget, options?: Partial<PlaywrightNativeConfig>): PlaywrightNativeAdapter;