qa360 2.2.1 → 2.2.7

package/cli/dist/core/schemas/pack.schema.json

@@ -0,0 +1,236 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://qa360.dev/schemas/pack.v1.json",
+  "title": "QA360 Pack Configuration v1",
+  "description": "Schema for QA360 test pack configuration files",
+  "type": "object",
+  "required": ["version", "name", "gates"],
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1,
+      "description": "Pack schema version"
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-zA-Z0-9_-]+$",
+      "description": "Pack name (alphanumeric, underscore, hyphen only)"
+    },
+    "description": {
+      "type": "string",
+      "maxLength": 500,
+      "description": "Human-readable pack description"
+    },
+    "gates": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["api_smoke", "ui", "perf", "sast", "dast", "a11y"]
+      },
+      "description": "Quality gates to execute"
+    },
+    "targets": {
+      "type": "object",
+      "properties": {
+        "api": {
+          "type": "object",
+          "properties": {
+            "baseUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL for API testing"
+            },
+            "smoke": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^(GET|POST|PUT|DELETE|PATCH) .+ -> \\d{3}$",
+                "description": "Smoke test definition: METHOD path -> expectedStatus"
+              }
+            }
+          },
+          "required": ["baseUrl"]
+        },
+        "web": {
+          "type": "object",
+          "properties": {
+            "baseUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL for web testing"
+            },
+            "pages": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "description": "Page paths to test"
+              }
+            }
+          },
+          "required": ["baseUrl"]
+        }
+      },
+      "description": "Test targets configuration"
+    },
+    "budgets": {
+      "type": "object",
+      "properties": {
+        "perf_p95_ms": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 30000,
+          "description": "Performance budget: 95th percentile response time in ms"
+        },
+        "a11y_min": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100,
+          "description": "Accessibility minimum score (0-100)"
+        }
+      },
+      "description": "Performance and quality budgets"
+    },
+    "security": {
+      "type": "object",
+      "properties": {
+        "sast_max_high": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Maximum allowed high-severity SAST findings"
+        },
+        "secrets_leak": {
+          "type": "integer",
+          "const": 0,
+          "description": "Secrets leak tolerance (must be 0)"
+        }
+      },
+      "description": "Security constraints"
+    },
+    "data": {
+      "type": "object",
+      "properties": {
+        "profile": {
+          "type": "string",
+          "enum": ["demo", "staging", "production"],
+          "description": "Data profile to use"
+        },
+        "seed": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Random seed for reproducible data generation"
+        }
+      },
+      "description": "Test data configuration"
+    },
+    "hooks": {
+      "type": "object",
+      "properties": {
+        "beforeAll": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "run": {
+                "type": "string",
+                "description": "Command to execute"
+              },
+              "timeout": {
+                "type": "integer",
+                "minimum": 1000,
+                "default": 30000,
+                "description": "Timeout in milliseconds"
+              }
+            },
+            "required": ["run"]
+          },
+          "description": "Commands to run before all tests"
+        },
+        "afterAll": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "run": {
+                "type": "string",
+                "description": "Command to execute"
+              },
+              "timeout": {
+                "type": "integer",
+                "minimum": 1000,
+                "default": 30000,
+                "description": "Timeout in milliseconds"
+              }
+            },
+            "required": ["run"]
+          },
+          "description": "Commands to run after all tests"
+        }
+      },
+      "description": "Lifecycle hooks"
+    },
+    "execution": {
+      "type": "object",
+      "properties": {
+        "retry_on": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["ECONNRESET", "ETIMEDOUT", "502", "503", "504", "element-detached", "navigation-timeout"]
+          },
+          "description": "Error patterns that trigger retries"
+        },
+        "max_retries": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 5,
+          "default": 1,
+          "description": "Maximum number of retries per test"
+        },
+        "fail_on_readiness": {
+          "type": "boolean",
+          "default": true,
+          "description": "Fail if readiness checks fail"
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1000,
+          "default": 30000,
+          "description": "Global timeout per test in milliseconds"
+        }
+      },
+      "description": "Execution configuration"
+    },
+    "observability": {
+      "type": "object",
+      "properties": {
+        "metrics": {
+          "type": "boolean",
+          "default": true,
+          "description": "Enable metrics collection"
+        },
+        "trace": {
+          "type": "string",
+          "enum": ["none", "basic", "detailed"],
+          "default": "basic",
+          "description": "Tracing level"
+        }
+      },
+      "description": "Observability settings"
+    },
+    "environment": {
+      "type": "object",
+      "patternProperties": {
+        "^[A-Z_][A-Z0-9_]*$": {
+          "type": "string",
+          "description": "Environment variable value or secret reference"
+        }
+      },
+      "description": "Environment variables and secrets"
+    }
+  },
+  "additionalProperties": false
+}

package/cli/dist/core/secrets/crypto.d.ts

@@ -0,0 +1,75 @@
+/**
+ * QA360 Secrets Cryptography
+ * AES-256-GCM encryption with PBKDF2 key derivation
+ */
+export interface EncryptedData {
+    data: string;
+    iv: string;
+    salt: string;
+    tag: string;
+    algorithm: 'aes-256-gcm';
+    iterations: number;
+}
+export interface SecretEntry {
+    name: string;
+    value: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecretsStore {
+    version: string;
+    encrypted: EncryptedData;
+    checksum: string;
+}
+export declare class SecretsCrypto {
+    private static readonly ALGORITHM;
+    private static readonly KEY_LENGTH;
+    private static readonly IV_LENGTH;
+    private static readonly SALT_LENGTH;
+    private static readonly TAG_LENGTH;
+    private static readonly ITERATIONS;
+    /**
+     * Encrypt secrets with password-derived key
+     */
+    static encrypt(secrets: Record<string, SecretEntry>, password: string): SecretsStore;
+    /**
+     * Decrypt secrets with password
+     */
+    static decrypt(store: SecretsStore, password: string): Record<string, SecretEntry>;
+    /**
+     * Generate a secure random password
+     */
+    static generatePassword(length?: number): string;
+    /**
+     * Derive password from system keychain or environment
+     */
+    static deriveSystemPassword(): Promise<string>;
+    /**
+     * Get password from macOS Keychain
+     */
+    private static getMacOSKeychainPassword;
+    /**
+     * Get password from Linux keyring (using secret-tool)
+     */
+    private static getLinuxKeychainPassword;
+    /**
+     * Get password from Windows Credential Manager
+     */
+    private static getWindowsCredentialPassword;
+    /**
+     * Generate machine-specific password as fallback
+     */
+    private static generateMachinePassword;
+    /**
+     * Calculate checksum for integrity verification
+     */
+    private static calculateChecksum;
+    /**
+     * Redact secret value for logging
+     */
+    static redactSecret(value: string): string;
+    /**
+     * Check if a string looks like a secret
+     */
+    static looksLikeSecret(value: string): boolean;
+}

package/cli/dist/core/secrets/crypto.js

@@ -0,0 +1,223 @@
+/**
+ * QA360 Secrets Cryptography
+ * AES-256-GCM encryption with PBKDF2 key derivation
+ */
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from 'crypto';
+import { execSync } from 'child_process';
+import os from 'os';
+export class SecretsCrypto {
+    static ALGORITHM = 'aes-256-gcm';
+    static KEY_LENGTH = 32; // 256 bits
+    static IV_LENGTH = 16; // 128 bits
+    static SALT_LENGTH = 32; // 256 bits
+    static TAG_LENGTH = 16; // 128 bits
+    static ITERATIONS = 100000; // PBKDF2 iterations
+    /**
+     * Encrypt secrets with password-derived key
+     */
+    static encrypt(secrets, password) {
+        try {
+            // Generate random salt and IV
+            const salt = randomBytes(this.SALT_LENGTH);
+            const iv = randomBytes(this.IV_LENGTH);
+            // Derive key from password using PBKDF2
+            const key = pbkdf2Sync(password, salt, this.ITERATIONS, this.KEY_LENGTH, 'sha256');
+            // Serialize secrets
+            const plaintext = JSON.stringify(secrets);
+            // Encrypt using AES-256-GCM
+            const cipher = createCipheriv(this.ALGORITHM, key, iv);
+            cipher.setAAD(Buffer.from('qa360-secrets-v1'));
+            let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+            const tag = cipher.getAuthTag();
+            // Create encrypted data structure
+            const encryptedData = {
+                data: encrypted,
+                iv: iv.toString('hex'),
+                salt: salt.toString('hex'),
+                tag: tag.toString('hex'),
+                algorithm: this.ALGORITHM,
+                iterations: this.ITERATIONS
+            };
+            // Calculate checksum for integrity
+            const checksum = this.calculateChecksum(encryptedData);
+            return {
+                version: '1.0.0',
+                encrypted: encryptedData,
+                checksum
+            };
+        }
+        catch (error) {
+            throw new Error(`Encryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    /**
+     * Decrypt secrets with password
+     */
+    static decrypt(store, password) {
+        try {
+            // Verify checksum
+            const expectedChecksum = this.calculateChecksum(store.encrypted);
+            if (store.checksum !== expectedChecksum) {
+                throw new Error('Secrets store integrity check failed');
+            }
+            const { data, iv, salt, tag, algorithm, iterations } = store.encrypted;
+            // Verify algorithm
+            if (algorithm !== this.ALGORITHM) {
+                throw new Error(`Unsupported encryption algorithm: ${algorithm}`);
+            }
+            // Derive key from password
+            const key = pbkdf2Sync(password, Buffer.from(salt, 'hex'), iterations, this.KEY_LENGTH, 'sha256');
+            // Decrypt using AES-256-GCM
+            const decipher = createDecipheriv(algorithm, key, Buffer.from(iv, 'hex'));
+            decipher.setAAD(Buffer.from('qa360-secrets-v1'));
+            decipher.setAuthTag(Buffer.from(tag, 'hex'));
+            let decrypted = decipher.update(data, 'hex', 'utf8');
+            decrypted += decipher.final('utf8');
+            // Parse secrets
+            return JSON.parse(decrypted);
+        }
+        catch (error) {
+            if (error instanceof Error && /unsupported state|authenticity|bad decrypt|unable to decrypt/i.test(error.message)) {
+                throw new Error('Invalid password or corrupted secrets store');
+            }
+            throw new Error(`Decryption failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    /**
+     * Generate a secure random password
+     */
+    static generatePassword(length = 32) {
+        const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*';
+        let password = '';
+        for (let i = 0; i < length; i++) {
+            const randomIndex = Math.floor(Math.random() * charset.length);
+            password += charset[randomIndex];
+        }
+        return password;
+    }
+    /**
+     * Derive password from system keychain or environment
+     */
+    static async deriveSystemPassword() {
+        // Try to get from environment first (for CI/CD)
+        const envPassword = process.env.QA360_SECRETS_PASSWORD;
+        if (envPassword) {
+            return envPassword;
+        }
+        // Try to get from system keychain (macOS/Linux)
+        try {
+            if (process.platform === 'darwin') {
+                return await this.getMacOSKeychainPassword();
+            }
+            else if (process.platform === 'linux') {
+                return await this.getLinuxKeychainPassword();
+            }
+            else if (process.platform === 'win32') {
+                return await this.getWindowsCredentialPassword();
+            }
+        }
+        catch (error) {
+            // Fallback to machine-specific derived password
+            console.warn('System keychain unavailable, using machine-derived password');
+        }
+        // Generate machine-specific password as fallback
+        return this.generateMachinePassword();
+    }
+    /**
+     * Get password from macOS Keychain
+     */
+    static async getMacOSKeychainPassword() {
+        try {
+            // Try to get existing password
+            const result = execSync('security find-generic-password -a qa360 -s "QA360 Secrets" -w', { encoding: 'utf8', stdio: 'pipe' });
+            return result.trim();
+        }
+        catch (error) {
+            // Create new password if not found
+            const password = this.generatePassword();
+            execSync(`security add-generic-password -a qa360 -s "QA360 Secrets" -w "${password}"`, { stdio: 'pipe' });
+            return password;
+        }
+    }
+    /**
+     * Get password from Linux keyring (using secret-tool)
+     */
+    static async getLinuxKeychainPassword() {
+        try {
+            // Try to get existing password
+            const result = execSync('secret-tool lookup application qa360 service secrets', { encoding: 'utf8', stdio: 'pipe' });
+            return result.trim();
+        }
+        catch (error) {
+            // Create new password if not found
+            const password = this.generatePassword();
+            execSync(`echo "${password}" | secret-tool store --label="QA360 Secrets" application qa360 service secrets`, { stdio: 'pipe' });
+            return password;
+        }
+    }
+    /**
+     * Get password from Windows Credential Manager
+     */
+    static async getWindowsCredentialPassword() {
+        try {
+            // Try to get existing password
+            const result = execSync('powershell -Command "Get-StoredCredential -Target QA360-Secrets | Select-Object -ExpandProperty Password"', { encoding: 'utf8', stdio: 'pipe' });
+            return result.trim();
+        }
+        catch (error) {
+            // Create new password if not found
+            const password = this.generatePassword();
+            execSync(`powershell -Command "New-StoredCredential -Target QA360-Secrets -UserName qa360 -Password '${password}'"`, { stdio: 'pipe' });
+            return password;
+        }
+    }
+    /**
+     * Generate machine-specific password as fallback
+     */
+    static generateMachinePassword() {
+        // Collect machine-specific data
+        const machineData = [
+            os.hostname(),
+            os.platform(),
+            os.arch(),
+            os.userInfo().username,
+            process.env.HOME || process.env.USERPROFILE || '',
+        ].join('|');
+        // Hash machine data to create consistent password
+        const hash = createHash('sha256').update(machineData + 'qa360-secrets-salt').digest('hex');
+        // Convert to password format
+        return hash.substring(0, 32);
+    }
+    /**
+     * Calculate checksum for integrity verification
+     */
+    static calculateChecksum(data) {
+        const content = `${data.data}${data.iv}${data.salt}${data.tag}${data.algorithm}${data.iterations}`;
+        return createHash('sha256').update(content).digest('hex');
+    }
+    /**
+     * Redact secret value for logging
+     */
+    static redactSecret(value) {
+        const n = value.length;
+        if (n <= 4)
+            return '***';
+        if (n <= 8)
+            return value.slice(0, 2) + '***' + value.slice(-2);
+        return value.slice(0, 3) + '***' + value.slice(-3);
+    }
+    /**
+     * Check if a string looks like a secret
+     */
+    static looksLikeSecret(value) {
+        if (value.length < 8)
+            return false;
+        const RX_BASE64 = /^(?:[A-Za-z0-9+/]{16,}={0,2})$/;
+        const RX_OPENAI = /^sk-[A-Za-z0-9]{20,}$/;
+        const RX_GH = /^ghp_[A-Za-z0-9]{36,}$/;
+        const RX_SLACK = /^xox[baprs]-\d{10,}-\d{10,}-[A-Za-z0-9]{10,}$/;
+        const RX_HEX = /^(?:[A-Fa-f0-9]{32,})$/;
+        return RX_OPENAI.test(value) || RX_GH.test(value) || RX_SLACK.test(value) || RX_BASE64.test(value) || RX_HEX.test(value);
+    }
+}

package/cli/dist/core/secrets/manager.d.ts

@@ -0,0 +1,76 @@
+/**
+ * QA360 Secrets Manager
+ * Manages encrypted secrets storage and retrieval
+ */
+export interface SecretsManagerOptions {
+    qa360Dir?: string;
+    password?: string;
+}
+export declare class SecretsManager {
+    private qa360Dir;
+    private secretsPath;
+    private password;
+    private cache;
+    constructor(options?: SecretsManagerOptions);
+    /**
+     * Initialize secrets manager with password
+     */
+    initialize(password?: string): Promise<void>;
+    /**
+     * Add or update a secret
+     */
+    addSecret(name: string, value: string): Promise<void>;
+    /**
+     * Get a secret value
+     */
+    getSecret(name: string): Promise<string | null>;
+    /**
+     * List all secret names (without values)
+     */
+    listSecrets(): Promise<Array<{
+        name: string;
+        createdAt: string;
+        updatedAt: string;
+    }>>;
+    /**
+     * Remove a secret
+     */
+    removeSecret(name: string): Promise<boolean>;
+    /**
+     * Check if secrets store exists and is accessible
+     */
+    doctor(): Promise<{
+        exists: boolean;
+        accessible: boolean;
+        count: number;
+        errors: string[];
+    }>;
+    /**
+     * Export secrets in redacted format for debugging
+     */
+    exportRedacted(): Promise<Record<string, string>>;
+    /**
+     * Interpolate secrets in a string
+     */
+    interpolateSecrets(text: string): Promise<string>;
+    /**
+     * Find secret references in text
+     */
+    findSecretReferences(text: string): string[];
+    /**
+     * Validate that all referenced secrets exist
+     */
+    validateSecretReferences(text: string): Promise<string[]>;
+    /**
+     * Load secrets from encrypted store
+     */
+    private loadSecrets;
+    /**
+     * Save secrets to encrypted store
+     */
+    private saveSecrets;
+    /**
+     * Ensure manager is initialized
+     */
+    private ensureInitialized;
+}