qaify-playwright-reporter 0.8.0 → 0.9.0

package/dist/audit-api.js

@@ -0,0 +1,628 @@
+// Pemeriksaan API tanpa AI untuk audit-static: menguji BE yang sudah berjalan lewat HTTP, dan mencocokkan
+// pemanggilan API di kode FE dengan route BE. Semua deterministik; tidak ada yang menebak aturan bisnis.
+//   smokeApi:           login dengan akun dari catatan aplikasi, panggil route GET (termasuk yang terlindungi dan
+//                       ber-{param}, diisi ID dari route index-nya) → respons ≥500.
+//   checkValidation:    POST/PUT/PATCH dengan body kosong dan nilai yang melanggar aturan validasi → 500 / diterima.
+//   checkAuthorization: route API pengubah data tanpa auth, data yang terbaca tanpa login, akses antar-role.
+//   checkContract:      axios/fetch di src/ FE → route BE (path tidak ada / method beda).
+import { readFile, readdir } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { controllerLocation, lineAt, listSources, parseJsonLoose, tail } from './audit-static.js';
+const MAX_API_ROUTES = 80;
+const MAX_WRITE_ROUTES = 40;
+const MAX_ROLE_ROUTES = 20;
+const MAX_ACCOUNTS = 4;
+/** Temuan per jenis pemeriksaan, agar satu jenis tidak memenuhi laporan. */
+const MAX_PER_CHECK = 10;
+const WRITE_METHODS = ['POST', 'PUT', 'PATCH'];
+const IGNORED = /^\/?(_|telescope|horizon|pulse|livewire|storage)/;
+/** Route alur autentikasi: tidak diuji validasi, tidak dianggap bocor bila publik. */
+const AUTH_FLOW = /(^|\/)(login|logout|signin|sign-in|signup|sign-up|register|refresh|token|forgot-password|reset-password|password|email\/verify|verify-email|two-factor|csrf-cookie)(\/|$)/i;
+const LOGIN_URI = /(^|\/)(login|signin|sign-in|token)$/i;
+// ---------------------------------------------------------------- route & akun
+/** `route:list --json` → route; HEAD dibuang dari method. */
+export function parseRoutes(output) {
+    const routes = parseJsonLoose(output);
+    if (!Array.isArray(routes))
+        return [];
+    return routes
+        .filter((r) => typeof r?.uri === 'string')
+        .map((r) => ({
+        methods: String(r.method ?? '').split('|').filter((m) => m && m !== 'HEAD'),
+        uri: String(r.uri).replace(/^\/+/, ''),
+        action: typeof r.action === 'string' && r.action !== 'Closure' ? r.action : null,
+        middleware: Array.isArray(r.middleware) ? r.middleware.map(String) : [],
+    }));
+}
+const middlewareName = (m) => m.split('\\').pop() ?? m;
+export const isProtected = (route) => route.middleware.some((m) => /^(auth|verified|signed|password\.confirm)(:|$)/.test(middlewareName(m)) || /Authenticate/.test(m));
+/** Role yang boleh mengakses route dari middleware role:admin|manager, CheckRole:admin, isAdmin; null = tanpa batas role. */
+export function allowedRoles(route) {
+    for (const m of route.middleware.map(middlewareName)) {
+        const param = /^(?:role|roles|hasrole|checkrole|check[._]role|role_or_permission)[:]([\w|,.-]+)$/i.exec(m);
+        if (param)
+            return param[1].split(/[|,]/).map((r) => r.toLowerCase()).filter(Boolean);
+        if (/^(is_?admin|admin(_?only)?)$/i.test(m))
+            return ['admin'];
+    }
+    return null;
+}
+/** Akun dari catatan aplikasi, mis. "admin: admin@pos.test / rahasia; kasir: kasir@pos.test / kasir123". */
+export function parseLogins(instructions) {
+    const accounts = [];
+    for (const m of instructions.matchAll(/(?:([A-Za-z][\w-]*)\s*[:=]\s*)?([\w.+-]+@[\w-]+(?:\.[\w-]+)+)\s*\/\s*(\S+)/g)) {
+        const label = m[1] && !/^(login|akun|user|email|username|pengguna|kredensial)$/i.test(m[1]) ? m[1].toLowerCase() : null;
+        accounts.push({ label, email: m[2], password: m[3].replace(/[;,]$/, '') });
+    }
+    return accounts;
+}
+// ---------------------------------------------------------------- HTTP
+async function send(probe, method, uri, session, body) {
+    const headers = { Accept: 'application/json', ...session?.headers };
+    if (session?.cookies.size) {
+        headers.Cookie = [...session.cookies].map(([k, v]) => `${k}=${v}`).join('; ');
+        const xsrf = session.cookies.get('XSRF-TOKEN');
+        if (xsrf)
+            headers['X-XSRF-TOKEN'] = decodeURIComponent(xsrf);
+    }
+    if (body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    const res = await probe
+        .fetch(`${probe.base}/${uri.replace(/^\/+/, '')}`, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        redirect: 'manual',
+        signal: AbortSignal.timeout(10_000),
+    })
+        .catch(() => null);
+    if (!res)
+        return null;
+    if (session) {
+        for (const cookie of res.headers?.getSetCookie?.() ?? []) {
+            const [pair] = cookie.split(';');
+            const at = pair.indexOf('=');
+            if (at > 0)
+                session.cookies.set(pair.slice(0, at).trim(), pair.slice(at + 1).trim());
+        }
+    }
+    const text = await res.text().catch(() => '');
+    let json = null;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        // bukan JSON
+    }
+    return { status: res.status, text, json };
+}
+/** Token API di respons login (Sanctum / Passport / JWT), di kedalaman mana pun. */
+export function findToken(json, depth = 0) {
+    if (!json || typeof json !== 'object' || depth > 4)
+        return null;
+    const obj = json;
+    for (const key of ['token', 'access_token', 'accessToken', 'plainTextToken']) {
+        if (typeof obj[key] === 'string' && obj[key].length >= 10)
+            return obj[key];
+    }
+    for (const value of Object.values(obj)) {
+        const token = findToken(value, depth + 1);
+        if (token)
+            return token;
+    }
+    return null;
+}
+/** Login API: token Bearer dari respons, atau sesi cookie Sanctum SPA (csrf-cookie + X-XSRF-TOKEN). */
+export async function apiLogin(probe, account) {
+    const candidates = probe.routes
+        .filter((r) => r.methods.includes('POST') && LOGIN_URI.test(r.uri))
+        .sort((a, b) => Number(b.uri.startsWith('api/')) - Number(a.uri.startsWith('api/')));
+    const spa = probe.routes.some((r) => r.uri === 'sanctum/csrf-cookie');
+    const body = { email: account.email, password: account.password, device_name: 'qaify' };
+    for (const route of candidates.slice(0, 3)) {
+        const res = await send(probe, 'POST', route.uri, null, body);
+        const token = res && res.status < 300 ? findToken(res.json) : null;
+        if (token)
+            return { label: account.label, headers: { Authorization: `Bearer ${token}` }, cookies: new Map() };
+        if (!spa && res?.status !== 419)
+            continue;
+        // Origin = BE: 127.0.0.1:8000 termasuk domain stateful bawaan Sanctum
+        const session = { label: account.label, headers: { Origin: probe.base, Referer: `${probe.base}/` }, cookies: new Map() };
+        await send(probe, 'GET', 'sanctum/csrf-cookie', session);
+        const cookie = await send(probe, 'POST', route.uri, session, body);
+        if (cookie && cookie.status < 300 && session.cookies.size)
+            return session;
+    }
+    return null;
+}
+/** Login semua akun; akun pertama yang berhasil jadi sesi utama. */
+export async function openApi(routes, accounts, opts) {
+    const probe = { ...opts, routes, session: null, sessions: [], ids: new Map() };
+    if (!accounts.length)
+        return { probe, notes: ['Akun login tidak ada di catatan aplikasi: API hanya diuji tanpa login.'] };
+    const failed = [];
+    for (const account of accounts.slice(0, MAX_ACCOUNTS)) {
+        const session = await apiLogin(probe, account);
+        if (session)
+            probe.sessions.push(session);
+        else
+            failed.push(account.label ?? account.email);
+    }
+    probe.session = probe.sessions[0] ?? null;
+    const notes = probe.session
+        ? [`Login API berhasil (${probe.sessions.length} akun)${failed.length ? `, gagal: ${failed.join(', ')}` : ''}.`]
+        : ['Login API gagal (route login tidak ditemukan atau akun ditolak): API hanya diuji tanpa login.'];
+    return { probe, notes };
+}
+/** ID pertama dari respons index: array, data[], data.data[], items[], results[]. */
+export function firstId(json) {
+    const obj = json;
+    const lists = [obj, obj?.data, obj?.data?.data, obj?.items, obj?.results];
+    for (const list of lists) {
+        if (!Array.isArray(list) || !list.length)
+            continue;
+        const id = list[0]?.id ?? list[0]?.uuid ?? list[0]?.slug;
+        if (typeof id === 'string' || typeof id === 'number')
+            return id;
+    }
+    return null;
+}
+/**
+ * URI route → path yang bisa dipanggil: {param?} dibuang; satu {param} diisi ID pertama dari route index se-prefix
+ * (api/produk/{id}/stok → GET api/produk). null = tidak bisa diisi (tidak ada index / data kosong / >1 param).
+ */
+async function fillParams(probe, uri, session) {
+    const path = uri.replace(/\/?\{[\w:]+\?\}/g, '');
+    const required = path.match(/\{[\w:]+\}/g) ?? [];
+    if (!required.length)
+        return path;
+    if (required.length > 1)
+        return null;
+    const index = path.slice(0, path.indexOf('{')).replace(/\/$/, '');
+    if (!probe.routes.some((r) => r.uri === index && r.methods.includes('GET')))
+        return null;
+    const key = `${session?.label ?? '-'} ${index}`;
+    if (!probe.ids.has(key))
+        probe.ids.set(key, firstId((await send(probe, 'GET', index, session))?.json));
+    const id = probe.ids.get(key);
+    return id === null || id === undefined ? null : path.replace(/\{[\w:]+\}/, encodeURIComponent(String(id)));
+}
+// ---------------------------------------------------------------- smoke API
+/** Route GET (publik, atau semua bila sudah login) → temuan untuk respons ≥500. */
+export async function smokeApi(probe) {
+    const targets = probe.routes
+        .filter((r) => r.methods.includes('GET') && !IGNORED.test(r.uri) && !/(^|\/)logout$/.test(r.uri))
+        .filter((r) => probe.session || !isProtected(r))
+        .slice(0, MAX_API_ROUTES);
+    const findings = [];
+    const failed = [];
+    let called = 0;
+    let skipped = 0;
+    for (const route of targets) {
+        const path = await fillParams(probe, route.uri, probe.session);
+        if (path === null) {
+            skipped++;
+            continue;
+        }
+        called++;
+        const res = await send(probe, 'GET', path, probe.session);
+        if (!res || res.status < 500 || findings.length >= MAX_PER_CHECK)
+            continue;
+        const finding = {
+            repo: 'be',
+            area: 'error_handling',
+            severity: 'high',
+            title: `GET /${path} membalas ${res.status}`,
+            description: `Route GET /${route.uri}${route.action ? ` (${route.action})` : ''} membalas ${res.status} pada database hasil seed${probe.session && isProtected(route) ? ' (dengan login)' : ''}.`,
+            ...(await locate(probe, route)),
+            evidence: { request: `GET ${probe.base}/${path}`, response: tail(res.text, 2000) },
+            suggestion: 'Cek laravel.log untuk exception di route ini dan tangani kasus data kosong / parameter yang hilang.',
+        };
+        findings.push(finding);
+        failed.push({ finding, uri: path });
+    }
+    const notes = [
+        `Smoke API: ${called} route GET dipanggil${probe.session ? ' dengan login' : ' tanpa login'}${skipped ? `, ${skipped} route berparameter dilewati (tidak ada data untuk ID-nya)` : ''}.`,
+    ];
+    return { findings, notes, failed };
+}
+const locate = async (probe, route) => (route.action ? await controllerLocation(probe.root, route.action).catch(() => null) : null) ?? {};
+// ---------------------------------------------------------------- validasi
+/** Aturan validasi dari isi rules() / $request->validate([...]): field → token aturan. Field bersarang dilewati. */
+export function parseRules(source) {
+    const rules = new Map();
+    for (const m of source.matchAll(/(['"])([\w.*]+)\1\s*=>\s*(\[[^\]]*\]|(['"])[^'"]*\4)/g)) {
+        const field = m[2];
+        if (/[.*]/.test(field))
+            continue;
+        const value = m[3];
+        const tokens = value.startsWith('[') ? [...value.matchAll(/(['"])([^'"]*)\1/g)].map((t) => t[2]) : [value.slice(1, -1)];
+        rules.set(field, tokens.flatMap((t) => t.split('|')).map((t) => t.trim()).filter(Boolean));
+    }
+    return rules;
+}
+/** Satu nilai yang melanggar aturan per field; field tanpa aturan yang bisa dilanggar tidak diisi. */
+export function invalidPayload(rules) {
+    const out = {};
+    for (const [field, list] of rules) {
+        const has = (rule) => list.some((r) => r === rule || r.startsWith(`${rule}:`));
+        const param = (rule) => Number(list.find((r) => r.startsWith(`${rule}:`))?.split(':')[1]);
+        if (has('integer') || has('numeric') || has('decimal'))
+            out[field] = Number.isFinite(param('min')) ? param('min') - 1 : 'abc';
+        else if (has('email'))
+            out[field] = 'bukan-email';
+        else if (has('boolean'))
+            out[field] = 'bukan-boolean';
+        else if (has('date'))
+            out[field] = 'bukan-tanggal';
+        else if (has('array'))
+            out[field] = 'bukan-array';
+        else if (has('in'))
+            out[field] = '__qaify_tidak_valid__';
+        else if (has('max') && param('max') <= 5000)
+            out[field] = 'x'.repeat(param('max') + 1);
+        else if (has('exists'))
+            out[field] = 999999999;
+    }
+    return out;
+}
+/**
+ * Hasil satu request uji validasi:
+ * - server_error: ≥500 untuk input yang salah;
+ * - accepted: 2xx untuk nilai yang melanggar aturan, atau body kosong padahal ada field required;
+ * - unvalidated: 2xx untuk body kosong di action yang membaca input tanpa aturan validasi sama sekali.
+ */
+export function classifyValidation(status, kind, info) {
+    if (status >= 500)
+        return 'server_error';
+    if (status < 200 || status >= 300)
+        return null;
+    if (kind === 'invalid' || info.hasRequired)
+        return 'accepted';
+    return !info.hasRules && info.readsInput ? 'unvalidated' : null;
+}
+/** Aturan validasi action: FormRequest di parameter method, atau validate() / Validator::make di badan method. */
+export async function actionRules(root, action) {
+    const controller = await controllerLocation(root, action).catch(() => null);
+    const none = { rules: new Map(), readsInput: false, location: controller, controller };
+    if (!controller)
+        return none;
+    const source = await readFile(join(root, controller.file), 'utf8').catch(() => '');
+    const method = action.split('@')[1] ?? '__invoke';
+    const start = source.search(new RegExp(`function\\s+${method.replace(/\W/g, '')}\\s*\\(`));
+    if (start < 0)
+        return none;
+    const next = source.slice(start + 8).search(/\bfunction\s+\w+\s*\(/);
+    const body = source.slice(start, next < 0 ? undefined : start + 8 + next);
+    const signature = body.slice(0, body.indexOf(')') + 1);
+    const readsInput = /\$request->(input|all|only|get|post|json|validated|safe|except|string|integer|boolean|date)\s*\(|\$request->\w+\b(?!\s*\()|\brequest\(\s*['"]/.test(body);
+    const formRequest = /([\\\w]*?(\w+Request))\s+\$\w+/.exec(signature);
+    if (formRequest && formRequest[2] !== 'Request' && formRequest[2] !== 'FormRequest') {
+        const file = await formRequestFile(root, source, formRequest[1], formRequest[2]);
+        const request = file ? await readFile(join(root, file), 'utf8').catch(() => '') : '';
+        const at = request.search(/function\s+rules\s*\(/);
+        if (at >= 0) {
+            const end = request.slice(at + 8).search(/\bfunction\s+\w+\s*\(/);
+            return { rules: parseRules(request.slice(at, end < 0 ? undefined : at + 8 + end)), readsInput: true, location: { file: file, line: lineAt(request, at) }, controller };
+        }
+    }
+    if (/->validate\s*\(|Validator::make\s*\(/.test(body))
+        return { rules: parseRules(body), readsInput, location: controller, controller };
+    return { ...none, readsInput };
+}
+/** Kelas FormRequest → berkas: nama penuh, `use` di controller, atau cari <Nama>.php di app/Http/Requests. */
+async function formRequestFile(root, controllerSource, written, short) {
+    const used = new RegExp(`^use\\s+(App\\\\[\\w\\\\]*\\\\${short})\\s*;`, 'm').exec(controllerSource)?.[1];
+    const full = written.replace(/^\\/, '').startsWith('App\\') ? written.replace(/^\\/, '') : used;
+    if (full)
+        return `app/${full.slice(4).replace(/\\/g, '/')}.php`;
+    return findFile(join(root, 'app', 'Http', 'Requests'), `${short}.php`, 4).then((f) => (f ? relative(root, f).replace(/\\/g, '/') : null));
+}
+async function findFile(dir, name, depth) {
+    if (depth < 0)
+        return null;
+    for (const entry of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+        const full = join(dir, entry.name);
+        if (entry.isFile() && entry.name === name)
+            return full;
+        if (entry.isDirectory()) {
+            const found = await findFile(full, name, depth - 1);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+/** POST/PUT/PATCH: body kosong dan body yang melanggar aturan; satu temuan per route (yang terparah). */
+export async function checkValidation(probe) {
+    const targets = probe.routes
+        .filter((r) => r.action && r.methods.some((m) => WRITE_METHODS.includes(m)) && !IGNORED.test(r.uri) && !AUTH_FLOW.test(r.uri))
+        .filter((r) => probe.session || !isProtected(r))
+        .slice(0, MAX_WRITE_ROUTES);
+    const findings = [];
+    let tested = 0;
+    for (const route of targets) {
+        if (findings.length >= MAX_PER_CHECK)
+            break;
+        const method = WRITE_METHODS.find((m) => route.methods.includes(m));
+        const path = await fillParams(probe, route.uri, probe.session);
+        if (path === null)
+            continue;
+        const info = await actionRules(probe.root, route.action);
+        const flags = {
+            hasRules: info.rules.size > 0,
+            hasRequired: [...info.rules.values()].some((list) => list.includes('required')),
+            readsInput: info.readsInput,
+        };
+        const invalid = invalidPayload(info.rules);
+        const cases = [['empty', {}]];
+        if (Object.keys(invalid).length)
+            cases.push(['invalid', invalid]);
+        tested++;
+        let worst = null;
+        for (const [kind, body] of cases) {
+            const res = await send(probe, method, path, probe.session, body);
+            const verdict = res ? classifyValidation(res.status, kind, flags) : null;
+            if (verdict && (!worst || verdict === 'server_error'))
+                worst = { verdict, status: res.status, body, text: res.text };
+            if (worst?.verdict === 'server_error')
+                break;
+        }
+        if (!worst)
+            continue;
+        const request = `${method} ${probe.base}/${path}\n${JSON.stringify(worst.body)}`;
+        const location = info.location ?? {};
+        const related = info.controller && info.location?.file !== info.controller.file ? [{ repo: 'be', ...info.controller, role: 'controller' }] : [];
+        const common = {
+            repo: 'be',
+            ...location,
+            ...(related.length ? { related_files: related } : {}),
+            evidence: { request, response: tail(worst.text, 2000) },
+        };
+        findings.push(worst.verdict === 'server_error'
+            ? {
+                ...common,
+                area: 'error_handling',
+                severity: 'high',
+                title: `${method} /${route.uri}: input tidak valid membuat server error (${worst.status})`,
+                description: `${method} /${route.uri}${route.action ? ` (${route.action})` : ''} membalas ${worst.status} untuk ${Object.keys(worst.body).length ? 'nilai yang melanggar aturan validasi' : 'body kosong'}; seharusnya 422 dengan pesan validasi.`,
+                suggestion: 'Lengkapi aturan validasi (FormRequest / $request->validate) untuk semua field yang dipakai sebelum menyentuh database.',
+            }
+            : {
+                ...common,
+                area: 'validation',
+                severity: 'medium',
+                title: worst.verdict === 'unvalidated'
+                    ? `${method} /${route.uri}: data kosong diterima tanpa validasi`
+                    : `${method} /${route.uri}: input yang melanggar aturan validasi diterima`,
+                description: worst.verdict === 'unvalidated'
+                    ? `${method} /${route.uri} membaca input request tetapi tidak punya aturan validasi; body kosong diterima (${worst.status}).`
+                    : `${method} /${route.uri} membalas ${worst.status} untuk body ${JSON.stringify(worst.body).slice(0, 300)}; aturan validasinya tidak dijalankan.`,
+                suggestion: worst.verdict === 'unvalidated'
+                    ? 'Tambahkan FormRequest atau $request->validate() untuk field yang dibaca action ini.'
+                    : 'Pastikan FormRequest dipakai di parameter method (bukan Request biasa) atau validate() dipanggil sebelum data disimpan.',
+            });
+    }
+    return { findings, notes: [`Uji validasi: ${tested} route POST/PUT/PATCH.`] };
+}
+// ---------------------------------------------------------------- otorisasi
+const resource = (uri) => uri.split('/').filter((s) => !s.startsWith('{')).slice(0, 2).join('/');
+const hasData = (json) => {
+    const obj = json;
+    return [obj, obj?.data, obj?.data?.data].some((v) => Array.isArray(v) && v.length > 0) || (!!obj?.data && typeof obj.data === 'object' && !Array.isArray(obj.data));
+};
+/**
+ * - Route API POST/PUT/PATCH/DELETE tanpa middleware auth (statis dari route list).
+ * - Route GET publik di resource yang route lainnya terlindungi, dan mengembalikan data tanpa login.
+ * - Route ber-middleware role dipanggil dengan akun berlabel role lain: harus 401/403.
+ */
+export async function checkAuthorization(probe, beRoot) {
+    const findings = [];
+    const routesFile = await readFile(join(beRoot, 'routes', 'api.php'), 'utf8').then(() => 'routes/api.php', () => undefined);
+    const openWrites = probe.routes.filter((r) => r.uri.startsWith('api/') && r.methods.some((m) => [...WRITE_METHODS, 'DELETE'].includes(m)) && !isProtected(r) && !AUTH_FLOW.test(r.uri));
+    if (openWrites.length) {
+        const list = openWrites.slice(0, 15).map((r) => `- ${r.methods.join('|')} /${r.uri}${r.action ? ` (${r.action})` : ''}`);
+        const related = [];
+        for (const r of openWrites) {
+            const location = r.action ? await controllerLocation(beRoot, r.action).catch(() => null) : null;
+            if (location && !related.some((f) => f.file === location.file) && related.length < 5)
+                related.push({ repo: 'be', ...location, role: 'controller' });
+        }
+        findings.push({
+            repo: 'be',
+            area: 'security',
+            severity: 'high',
+            title: `${openWrites.length} route API pengubah data tanpa autentikasi`,
+            description: `Route berikut bisa mengubah data tanpa login (tidak ada middleware auth):\n${list.join('\n')}${openWrites.length > 15 ? `\n- … ${openWrites.length - 15} lainnya` : ''}`,
+            file: routesFile,
+            ...(related.length ? { related_files: related } : {}),
+            suggestion: "Pindahkan route ini ke grup Route::middleware('auth:sanctum'), kecuali memang sengaja publik.",
+        });
+    }
+    const guarded = new Set(probe.routes.filter(isProtected).map((r) => resource(r.uri)));
+    const leaks = [];
+    for (const route of probe.routes.filter((r) => r.uri.startsWith('api/') && r.methods.includes('GET') && !r.uri.includes('{') && !isProtected(r))) {
+        if (!guarded.has(resource(route.uri)) || AUTH_FLOW.test(route.uri))
+            continue;
+        const res = await send(probe, 'GET', route.uri, null);
+        if (res && res.status >= 200 && res.status < 300 && hasData(res.json))
+            leaks.push(`- GET /${route.uri}${route.action ? ` (${route.action})` : ''}`);
+    }
+    if (leaks.length) {
+        findings.push({
+            repo: 'be',
+            area: 'security',
+            severity: 'medium',
+            title: `${leaks.length} route API mengembalikan data tanpa login`,
+            description: `Route lain di resource yang sama memakai auth, tetapi route berikut membalas data tanpa login:\n${leaks.slice(0, 15).join('\n')}`,
+            file: routesFile,
+            suggestion: 'Periksa apakah data ini memang publik; bila tidak, tambahkan middleware auth.',
+        });
+    }
+    let roleTests = 0;
+    const labelled = probe.sessions.filter((s) => s.label);
+    if (labelled.length) {
+        const roleRoutes = probe.routes.filter((r) => r.methods.includes('GET') && allowedRoles(r)).slice(0, MAX_ROLE_ROUTES);
+        for (const route of roleRoutes) {
+            if (findings.length >= MAX_PER_CHECK)
+                break;
+            const allowed = allowedRoles(route);
+            const owner = labelled.find((s) => allowed.includes(s.label)) ?? probe.session;
+            const path = await fillParams(probe, route.uri, owner);
+            if (path === null)
+                continue;
+            for (const session of labelled.filter((s) => !allowed.includes(s.label))) {
+                roleTests++;
+                const res = await send(probe, 'GET', path, session);
+                if (!res || res.status < 200 || res.status >= 300)
+                    continue;
+                findings.push({
+                    repo: 'be',
+                    area: 'security',
+                    severity: 'high',
+                    title: `Akun ${session.label} bisa membuka GET /${route.uri} (khusus ${allowed.join(', ')})`,
+                    description: `Route GET /${route.uri} ber-middleware role ${allowed.join(', ')}, tetapi akun berlabel "${session.label}" mendapat ${res.status}.`,
+                    ...(await locate(probe, route)),
+                    evidence: { request: `GET ${probe.base}/${path} (akun ${session.label})`, response: tail(res.text, 2000) },
+                    suggestion: 'Periksa middleware role dan role akun seed; pastikan pengecekan role tidak selalu lolos.',
+                });
+                break;
+            }
+        }
+    }
+    return {
+        findings: findings.slice(0, MAX_PER_CHECK),
+        notes: [
+            `Uji otorisasi: ${openWrites.length} route pengubah data tanpa auth, ${leaks.length} route membalas data tanpa login${roleTests ? `, ${roleTests} uji antar-role` : labelled.length ? '' : ' (uji antar-role butuh akun berlabel, mis. "admin: a@x / pw")'}.`,
+        ],
+    };
+}
+/**
+ * URL pemanggilan di kode FE → path: base di depan (`${API_URL}/produk`) dibuang, `/${id}` → `/__p__`, query dibuang.
+ * null = URL absolut ke host lain, berkas statis, atau bukan path.
+ */
+export function normalizeCallPath(raw) {
+    let s = raw.trim().replace(/^\$\{[^}]*\}/, '');
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s) || s.startsWith('//'))
+        return null;
+    s = s.split(/[?#]/)[0];
+    s = s.replace(/\/\$\{[^}]*\}/g, '/__p__').replace(/\$\{[^}]*\}/g, '');
+    if (!s.startsWith('/')) {
+        if (!/^[\w-]+\//.test(s))
+            return null;
+        s = `/${s}`;
+    }
+    if (/\.[a-z0-9]{2,5}$/i.test(s))
+        return null;
+    s = s.replace(/\/+$/, '');
+    return s && /^[\w/.~:-]+$/.test(s) ? s : null;
+}
+/** axios-like `.get('/x')` / `.post(\`/x/${id}\`)` dan fetch('/x', { method }) di satu berkas sumber. */
+export function extractApiCalls(source, file) {
+    const calls = [];
+    const push = (method, raw, index, end) => {
+        const path = normalizeCallPath(raw);
+        if (!path)
+            return;
+        // _method di baris yang sama atau FormData.append('_method', …) di ±200 karakter sebelumnya
+        const from = source.lastIndexOf('\n', Math.max(0, index - 200)) + 1;
+        const to = source.indexOf('\n', end);
+        const spoofed = method.toUpperCase() === 'POST' && /_method/.test(source.slice(from, to < 0 ? undefined : to));
+        calls.push({ method: method.toUpperCase(), path, file, line: lineAt(source, index), spoofed });
+    };
+    for (const m of source.matchAll(/\.(get|post|put|patch|delete)\s*(?:<[^<>()]*>)?\s*\(\s*(['"`])((?:\\.|(?!\2)[^\\\n])*?)\2/g)) {
+        push(m[1], m[3], m.index, m.index + m[0].length);
+    }
+    for (const m of source.matchAll(/(?<![\w.])\$?fetch\s*\(\s*(['"`])((?:\\.|(?!\1)[^\\\n])*?)\1\s*(?:,\s*\{([^}]*)\})?/g)) {
+        const method = /method\s*:\s*['"`](\w+)['"`]/i.exec(m[3] ?? '')?.[1] ?? 'GET';
+        push(method, m[2], m.index, m.index + m[0].length);
+    }
+    return calls;
+}
+/** Path FE cocok dengan URI route: {param} BE cocok segmen apa pun, __p__ FE cocok segmen apa pun. */
+export function routeMatches(uri, path) {
+    const a = uri.replace(/\/?\{[\w:]+\?\}/g, '').split('/').filter(Boolean);
+    const b = path.split('/').filter(Boolean);
+    return a.length === b.length && a.every((seg, i) => seg.startsWith('{') || b[i] === '__p__' || seg === b[i]);
+}
+/** Path dasar API dari .env.example FE (VITE_*=http…/api) dan axios.create({ baseURL: '/api' }). */
+export function basePaths(envExample, sources) {
+    const bases = new Set(['']);
+    for (const m of envExample.matchAll(/^VITE_[A-Z0-9_]+=["']?(https?:\/\/[^"'\s]*)["']?\s*$/gm)) {
+        bases.add(new URL(m[1]).pathname.replace(/\/$/, ''));
+    }
+    for (const source of sources) {
+        for (const m of source.matchAll(/baseURL\s*:\s*(['"`])([^'"`$]+)\1/g)) {
+            const value = m[2];
+            const path = /^https?:\/\//.test(value) ? new URL(value).pathname : value;
+            if (path.startsWith('/'))
+                bases.add(path.replace(/\/$/, ''));
+        }
+    }
+    return [...bases];
+}
+/** Pemanggilan API di src/ FE yang path-nya tidak ada di BE, atau method-nya tidak diterima route BE. */
+export async function checkContract(feRoot, beRoot, routes) {
+    if (!routes.length)
+        return { findings: [], notes: [] };
+    const files = (await listSources(join(feRoot, 'src'), 6)).filter((f) => !/\.(spec|test)\.[jt]sx?$/.test(f) && !/[\\/](__tests__|__mocks__|mocks?|msw)[\\/]/.test(f));
+    const sources = await Promise.all(files.map(async (f) => ({ file: relative(feRoot, f).replace(/\\/g, '/'), source: await readFile(f, 'utf8').catch(() => '') })));
+    const env = (await readFile(join(feRoot, '.env.example'), 'utf8').catch(() => '')) || (await readFile(join(feRoot, '.env'), 'utf8').catch(() => ''));
+    const bases = basePaths(env, sources.map((s) => s.source));
+    const firstSegments = new Set(routes.map((r) => r.uri.split('/')[0]));
+    const problems = new Map();
+    let checked = 0;
+    for (const { file, source } of sources) {
+        for (const call of extractApiCalls(source, file)) {
+            checked++;
+            const candidates = bases.map((base) => `${base}${call.path}`);
+            const byPath = candidates.map((p) => ({ p, hits: routes.filter((r) => routeMatches(r.uri, p)) })).find((c) => c.hits.length);
+            if (byPath) {
+                if (call.spoofed || byPath.hits.some((r) => r.methods.includes(call.method)))
+                    continue;
+                const key = `method ${call.method} ${byPath.p}`;
+                const entry = problems.get(key) ?? { kind: 'method', method: call.method, path: byPath.p, calls: [], others: byPath.hits };
+                entry.calls.push(call);
+                problems.set(key, entry);
+                continue;
+            }
+            // hanya path yang jelas mengarah ke BE ini (segmen pertama sama dengan route BE)
+            const target = candidates.find((p) => firstSegments.has(p.split('/').filter(Boolean)[0]));
+            if (!target)
+                continue;
+            const key = `missing ${call.method} ${target}`;
+            const entry = problems.get(key) ?? { kind: 'missing', method: call.method, path: target, calls: [], others: [] };
+            entry.calls.push(call);
+            problems.set(key, entry);
+        }
+    }
+    const findings = [];
+    for (const problem of [...problems.values()].sort((a, b) => Number(a.kind === 'missing') - Number(b.kind === 'missing')).slice(0, MAX_PER_CHECK)) {
+        const first = problem.calls[0];
+        const shown = problem.path.replace(/__p__/g, '{…}');
+        const where = problem.calls.slice(0, 5).map((c) => `- ${c.file}:${c.line}`).join('\n');
+        const related = [];
+        for (const r of problem.others) {
+            const location = r.action ? await controllerLocation(beRoot, r.action).catch(() => null) : null;
+            if (location && !related.some((f) => f.file === location.file))
+                related.push({ repo: 'be', ...location, role: 'controller' });
+        }
+        const accepted = [...new Set(problem.others.flatMap((r) => r.methods))].join(', ');
+        findings.push({
+            repo: 'fe',
+            area: 'api_contract',
+            severity: problem.kind === 'method' ? 'high' : 'medium',
+            title: problem.kind === 'method'
+                ? `FE memanggil ${problem.method} ${shown}, BE hanya menerima ${accepted}`
+                : `FE memanggil ${problem.method} ${shown} yang tidak ada di route BE`,
+            description: `${problem.kind === 'method' ? `Route BE /${problem.others[0].uri} ada, tetapi tidak menerima ${problem.method}.` : 'Tidak ada route BE (php artisan route:list) yang cocok dengan path ini.'}\nDipanggil di:\n${where}`,
+            file: first.file,
+            line: first.line,
+            ...(related.length ? { related_files: related.slice(0, 5) } : {}),
+            suggestion: problem.kind === 'method'
+                ? 'Samakan method HTTP di pemanggil FE dengan route BE (atau tambahkan route BE untuk method ini).'
+                : 'Perbaiki path di FE, atau tambahkan route yang hilang di BE.',
+        });
+    }
+    return { findings, notes: [`Cek kontrak FE↔BE: ${checked} pemanggilan API di kode FE dicocokkan dengan ${routes.length} route BE.`] };
+}