qa360 2.1.7 → 2.2.1

package/core/src/schemas/gherkin-report.json

@@ -0,0 +1,122 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "QA360 Gherkin Report Schema",
+  "type": "object",
+  "required": ["pack", "runId", "timestamp", "summary", "routes"],
+  "properties": {
+    "pack": {
+      "type": "string",
+      "description": "Pack name (e.g., httpbin, petstore)"
+    },
+    "runId": {
+      "type": "string",
+      "format": "uuid",
+      "description": "Unique run identifier"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 timestamp of test execution"
+    },
+    "summary": {
+      "type": "object",
+      "required": ["totalRoutes", "totalScenarios", "totalSteps", "passed", "failed", "durationMs"],
+      "properties": {
+        "totalRoutes": {"type": "integer", "minimum": 0},
+        "totalScenarios": {"type": "integer", "minimum": 0},
+        "totalSteps": {"type": "integer", "minimum": 0},
+        "passed": {"type": "integer", "minimum": 0},
+        "failed": {"type": "integer", "minimum": 0},
+        "durationMs": {"type": "integer", "minimum": 0}
+      }
+    },
+    "routes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["method", "path", "scenarios"],
+        "properties": {
+          "method": {
+            "type": "string",
+            "enum": ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]
+          },
+          "path": {
+            "type": "string",
+            "description": "API endpoint path"
+          },
+          "scenarios": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["feature", "scenario", "steps", "status", "durationMs"],
+              "properties": {
+                "feature": {
+                  "type": "string",
+                  "description": "Gherkin Feature name"
+                },
+                "scenario": {
+                  "type": "string", 
+                  "description": "Gherkin Scenario name"
+                },
+                "steps": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "required": ["type", "text", "status", "durationMs"],
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": ["Given", "When", "Then", "And", "But"]
+                      },
+                      "text": {
+                        "type": "string",
+                        "description": "Step description in natural language"
+                      },
+                      "status": {
+                        "type": "string",
+                        "enum": ["passed", "failed", "skipped", "pending"]
+                      },
+                      "durationMs": {
+                        "type": "integer",
+                        "minimum": 0
+                      },
+                      "error": {
+                        "type": "string",
+                        "description": "Error message if step failed"
+                      }
+                    }
+                  }
+                },
+                "status": {
+                  "type": "string",
+                  "enum": ["passed", "failed", "skipped", "pending"]
+                },
+                "durationMs": {
+                  "type": "integer",
+                  "minimum": 0
+                },
+                "error": {
+                  "type": "string",
+                  "description": "Error message if scenario failed"
+                },
+                "sourceSpec": {
+                  "type": "string",
+                  "description": "Path to source test file with line numbers"
+                },
+                "artifacts": {
+                  "type": "object",
+                  "properties": {
+                    "videoUrl": {"type": ["string", "null"]},
+                    "traceUrl": {"type": ["string", "null"]},
+                    "screenshotUrl": {"type": ["string", "null"]},
+                    "stdout": {"type": ["string", "null"]}
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/core/src/secrets/__tests__/crypto.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Secrets Crypto Tests
+ * Target: 60%+ coverage on crypto.ts
+ */
+
+import { SecretsCrypto } from '../crypto.js';
+
+describe('Secrets Crypto', () => {
+  const testPassword = 'test-password-strong-123!';
+  const testSecrets = {
+    'api_key': {
+      name: 'api_key',
+      value: 'sk_live_test1234567890',
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString()
+    }
+  };
+
+  describe('Basic Encryption/Decryption', () => {
+    it('should encrypt secrets successfully', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+
+      expect(encrypted).toBeDefined();
+      expect(encrypted.version).toBe('1.0.0');
+      expect(encrypted.encrypted.algorithm).toBe('aes-256-gcm');
+      expect(encrypted.encrypted.data).toBeDefined();
+      expect(encrypted.encrypted.iv).toBeDefined();
+      expect(encrypted.encrypted.salt).toBeDefined();
+      expect(encrypted.encrypted.tag).toBeDefined();
+      expect(encrypted.checksum).toBeDefined();
+    });
+
+    it('should decrypt secrets successfully', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(testSecrets);
+    });
+
+    it('should perform round-trip encryption/decryption', () => {
+      const original = {
+        'db_password': {
+          name: 'db_password',
+          value: 'super-secret-db-pass-123',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        }
+      };
+
+      const encrypted = SecretsCrypto.encrypt(original, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(original);
+      expect(decrypted.db_password.value).toBe(original.db_password.value);
+    });
+
+    it('should handle multiple secrets', () => {
+      const multipleSecrets = {
+        'api_key': {
+          name: 'api_key',
+          value: 'sk_live_abc123',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        },
+        'db_password': {
+          name: 'db_password',
+          value: 'db_pass_xyz789',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        },
+        'jwt_secret': {
+          name: 'jwt_secret',
+          value: 'jwt_token_secret_key',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        }
+      };
+
+      const encrypted = SecretsCrypto.encrypt(multipleSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(multipleSecrets);
+      expect(Object.keys(decrypted)).toHaveLength(3);
+    });
+  });
+
+  describe('Error Handling', () => {
+    it('should fail with wrong password', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      const wrongPassword = 'wrong-password-456';
+
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, wrongPassword);
+      }).toThrow();
+    });
+
+    it('should fail with corrupted ciphertext', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      encrypted.encrypted.data = 'corrupted-invalid-hex-data';
+
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, testPassword);
+      }).toThrow();
+    });
+
+    it('should fail with corrupted tag', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      encrypted.encrypted.tag = '0'.repeat(32); // Invalid tag
+
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, testPassword);
+      }).toThrow();
+    });
+  });
+
+  describe('Edge Cases', () => {
+    it('should handle empty secrets object', () => {
+      const emptySecrets = {};
+
+      const encrypted = SecretsCrypto.encrypt(emptySecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(emptySecrets);
+    });
+
+    it('should handle special characters in secrets', () => {
+      const specialSecrets = {
+        'special': {
+          name: 'special',
+          value: 'p@ssw0rd!#$%^&*(){}[]|\\:;"<>?/~`',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        }
+      };
+
+      const encrypted = SecretsCrypto.encrypt(specialSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(specialSecrets);
+      expect(decrypted.special.value).toBe(specialSecrets.special.value);
+    });
+
+    it('should handle large secrets', () => {
+      const largeValue = 'x'.repeat(10000); // 10KB secret
+      const largeSecrets = {
+        'large': {
+          name: 'large',
+          value: largeValue,
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString()
+        }
+      };
+
+      const encrypted = SecretsCrypto.encrypt(largeSecrets, testPassword);
+      const decrypted = SecretsCrypto.decrypt(encrypted, testPassword);
+
+      expect(decrypted).toEqual(largeSecrets);
+      expect(decrypted.large.value.length).toBe(10000);
+    });
+  });
+
+  describe('Checksum Validation', () => {
+    it('should validate checksum on decryption', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      
+      // Checksum should be present
+      expect(encrypted.checksum).toBeDefined();
+      expect(encrypted.checksum.length).toBeGreaterThan(0);
+    });
+
+    it('should fail with invalid checksum', () => {
+      const encrypted = SecretsCrypto.encrypt(testSecrets, testPassword);
+      encrypted.checksum = 'invalid-checksum-xyz';
+
+      expect(() => {
+        SecretsCrypto.decrypt(encrypted, testPassword);
+      }).toThrow();
+    });
+  });
+});

package/core/src/secrets/crypto.ts

@@ -0,0 +1,289 @@
+/**
+ * QA360 Secrets Cryptography
+ * AES-256-GCM encryption with PBKDF2 key derivation
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from 'crypto';
+import { execSync } from 'child_process';
+import os from 'os';
+
+export interface EncryptedData {
+  data: string;
+  iv: string;
+  salt: string;
+  tag: string;
+  algorithm: 'aes-256-gcm';
+  iterations: number;
+}
+
+export interface SecretEntry {
+  name: string;
+  value: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface SecretsStore {
+  version: string;
+  encrypted: EncryptedData;
+  checksum: string;
+}
+
+export class SecretsCrypto {
+  private static readonly ALGORITHM = 'aes-256-gcm';
+  private static readonly KEY_LENGTH = 32; // 256 bits
+  private static readonly IV_LENGTH = 16;  // 128 bits
+  private static readonly SALT_LENGTH = 32; // 256 bits
+  private static readonly TAG_LENGTH = 16; // 128 bits
+  private static readonly ITERATIONS = 100000; // PBKDF2 iterations
+
+  /**
+   * Encrypt secrets with password-derived key
+   */
+  static encrypt(secrets: Record<string, SecretEntry>, password: string): SecretsStore {
+    try {
+      // Generate random salt and IV
+      const salt = randomBytes(this.SALT_LENGTH);
+      const iv = randomBytes(this.IV_LENGTH);
+      
+      // Derive key from password using PBKDF2
+      const key = pbkdf2Sync(password, salt, this.ITERATIONS, this.KEY_LENGTH, 'sha256');
+      
+      // Serialize secrets
+      const plaintext = JSON.stringify(secrets);
+      
+      // Encrypt using AES-256-GCM
+      const cipher = createCipheriv(this.ALGORITHM, key, iv);
+      cipher.setAAD(Buffer.from('qa360-secrets-v1'));
+      
+      let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+      encrypted += cipher.final('hex');
+      
+      const tag = cipher.getAuthTag();
+      
+      // Create encrypted data structure
+      const encryptedData: EncryptedData = {
+        data: encrypted,
+        iv: iv.toString('hex'),
+        salt: salt.toString('hex'),
+        tag: tag.toString('hex'),
+        algorithm: this.ALGORITHM,
+        iterations: this.ITERATIONS
+      };
+      
+      // Calculate checksum for integrity
+      const checksum = this.calculateChecksum(encryptedData);
+      
+      return {
+        version: '1.0.0',
+        encrypted: encryptedData,
+        checksum
+      };
+      
+    } catch (error) {
+      throw new Error(`Encryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+  }
+
+  /**
+   * Decrypt secrets with password
+   */
+  static decrypt(store: SecretsStore, password: string): Record<string, SecretEntry> {
+    try {
+      // Verify checksum
+      const expectedChecksum = this.calculateChecksum(store.encrypted);
+      if (store.checksum !== expectedChecksum) {
+        throw new Error('Secrets store integrity check failed');
+      }
+      
+      const { data, iv, salt, tag, algorithm, iterations } = store.encrypted;
+      
+      // Verify algorithm
+      if (algorithm !== this.ALGORITHM) {
+        throw new Error(`Unsupported encryption algorithm: ${algorithm}`);
+      }
+      
+      // Derive key from password
+      const key = pbkdf2Sync(password, Buffer.from(salt, 'hex'), iterations, this.KEY_LENGTH, 'sha256');
+      
+      // Decrypt using AES-256-GCM
+      const decipher = createDecipheriv(algorithm, key, Buffer.from(iv, 'hex'));
+      decipher.setAAD(Buffer.from('qa360-secrets-v1'));
+      decipher.setAuthTag(Buffer.from(tag, 'hex'));
+      
+      let decrypted = decipher.update(data, 'hex', 'utf8');
+      decrypted += decipher.final('utf8');
+      
+      // Parse secrets
+      return JSON.parse(decrypted);
+      
+    } catch (error) {
+      if (error instanceof Error && /unsupported state|authenticity|bad decrypt|unable to decrypt/i.test(error.message)) {
+        throw new Error('Invalid password or corrupted secrets store');
+      }
+      throw new Error(`Decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+  }
+
+  /**
+   * Generate a secure random password
+   */
+  static generatePassword(length: number = 32): string {
+    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*';
+    let password = '';
+    
+    for (let i = 0; i < length; i++) {
+      const randomIndex = Math.floor(Math.random() * charset.length);
+      password += charset[randomIndex];
+    }
+    
+    return password;
+  }
+
+  /**
+   * Derive password from system keychain or environment
+   */
+  static async deriveSystemPassword(): Promise<string> {
+    // Try to get from environment first (for CI/CD)
+    const envPassword = process.env.QA360_SECRETS_PASSWORD;
+    if (envPassword) {
+      return envPassword;
+    }
+
+    // Try to get from system keychain (macOS/Linux)
+    try {
+      if (process.platform === 'darwin') {
+        return await this.getMacOSKeychainPassword();
+      } else if (process.platform === 'linux') {
+        return await this.getLinuxKeychainPassword();
+      } else if (process.platform === 'win32') {
+        return await this.getWindowsCredentialPassword();
+      }
+    } catch (error) {
+      // Fallback to machine-specific derived password
+      console.warn('System keychain unavailable, using machine-derived password');
+    }
+
+    // Generate machine-specific password as fallback
+    return this.generateMachinePassword();
+  }
+
+  /**
+   * Get password from macOS Keychain
+   */
+  private static async getMacOSKeychainPassword(): Promise<string> {
+    try {
+      // Try to get existing password
+      const result = execSync(
+        'security find-generic-password -a qa360 -s "QA360 Secrets" -w',
+        { encoding: 'utf8', stdio: 'pipe' }
+      );
+      return result.trim();
+    } catch (error) {
+      // Create new password if not found
+      const password = this.generatePassword();
+      execSync(
+        `security add-generic-password -a qa360 -s "QA360 Secrets" -w "${password}"`,
+        { stdio: 'pipe' }
+      );
+      return password;
+    }
+  }
+
+  /**
+   * Get password from Linux keyring (using secret-tool)
+   */
+  private static async getLinuxKeychainPassword(): Promise<string> {
+    try {
+      // Try to get existing password
+      const result = execSync(
+        'secret-tool lookup application qa360 service secrets',
+        { encoding: 'utf8', stdio: 'pipe' }
+      );
+      return result.trim();
+    } catch (error) {
+      // Create new password if not found
+      const password = this.generatePassword();
+      execSync(
+        `echo "${password}" | secret-tool store --label="QA360 Secrets" application qa360 service secrets`,
+        { stdio: 'pipe' }
+      );
+      return password;
+    }
+  }
+
+  /**
+   * Get password from Windows Credential Manager
+   */
+  private static async getWindowsCredentialPassword(): Promise<string> {
+    try {
+      // Try to get existing password
+      const result = execSync(
+        'powershell -Command "Get-StoredCredential -Target QA360-Secrets | Select-Object -ExpandProperty Password"',
+        { encoding: 'utf8', stdio: 'pipe' }
+      );
+      return result.trim();
+    } catch (error) {
+      // Create new password if not found
+      const password = this.generatePassword();
+      execSync(
+        `powershell -Command "New-StoredCredential -Target QA360-Secrets -UserName qa360 -Password '${password}'"`,
+        { stdio: 'pipe' }
+      );
+      return password;
+    }
+  }
+
+  /**
+   * Generate machine-specific password as fallback
+   */
+  private static generateMachinePassword(): string {
+    // Collect machine-specific data
+    const machineData = [
+      os.hostname(),
+      os.platform(),
+      os.arch(),
+      os.userInfo().username,
+      process.env.HOME || process.env.USERPROFILE || '',
+    ].join('|');
+    
+    // Hash machine data to create consistent password
+    const hash = createHash('sha256').update(machineData + 'qa360-secrets-salt').digest('hex');
+    
+    // Convert to password format
+    return hash.substring(0, 32);
+  }
+
+  /**
+   * Calculate checksum for integrity verification
+   */
+  private static calculateChecksum(data: EncryptedData): string {
+    const content = `${data.data}${data.iv}${data.salt}${data.tag}${data.algorithm}${data.iterations}`;
+    return createHash('sha256').update(content).digest('hex');
+  }
+
+  /**
+   * Redact secret value for logging
+   */
+  static redactSecret(value: string): string {
+    const n = value.length;
+    if (n <= 4) return '***';
+    if (n <= 8) return value.slice(0, 2) + '***' + value.slice(-2);
+    return value.slice(0, 3) + '***' + value.slice(-3);
+  }
+
+  /**
+   * Check if a string looks like a secret
+   */
+  static looksLikeSecret(value: string): boolean {
+    if (value.length < 8) return false;
+    
+    const RX_BASE64 = /^(?:[A-Za-z0-9+/]{16,}={0,2})$/;
+    const RX_OPENAI = /^sk-[A-Za-z0-9]{20,}$/;
+    const RX_GH = /^ghp_[A-Za-z0-9]{36,}$/;
+    const RX_SLACK = /^xox[baprs]-\d{10,}-\d{10,}-[A-Za-z0-9]{10,}$/;
+    const RX_HEX = /^(?:[A-Fa-f0-9]{32,})$/;
+    
+    return RX_OPENAI.test(value) || RX_GH.test(value) || RX_SLACK.test(value) || RX_BASE64.test(value) || RX_HEX.test(value);
+  }
+}