server-action-audit 0.1.0 → 0.2.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { resolve as resolve2 } from "path";
+import { isAbsolute, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
 
 // src/format.ts
 var useColor = process.env.FORCE_COLOR ? true : !process.env.NO_COLOR && !!process.stdout.isTTY;
@@ -107,6 +107,51 @@ function formatGithub(report) {
   lines.push(`server-action-audit: ${summary.actions} Server Actions, ${summary.unprotected} unprotected, ${summary.protected} protected, ${summary.public} public, ${summary.unvalidated} with unvalidated input.`);
   return lines.join("\n");
 }
+function formatMarkdown(report, options = {}) {
+  const { summary } = report;
+  const fileCount = report.files.length;
+  const total = `${summary.actions} Server Action${summary.actions === 1 ? "" : "s"} in ${fileCount} file${fileCount === 1 ? "" : "s"}`;
+  const lines = ["### server-action-audit", ""];
+  const found = report.files.flatMap(
+    ({ file, actions }) => actions.filter((action) => action.status === "unprotected" || action.validated === false).map((action) => ({ file, action }))
+  );
+  if (!summary.actions) lines.push("No Server Actions found.");
+  else if (!found.length) lines.push(`\u2705 ${total}, no problems found.`);
+  else {
+    lines.push(
+      [
+        summary.unprotected ? `**\u274C ${summary.unprotected} unprotected**` : "0 unprotected",
+        `${summary.protected} protected`,
+        `${summary.public} public`,
+        summary.unvalidated ? `**\u26A0\uFE0F ${summary.unvalidated} with unvalidated input**` : "0 with unvalidated input"
+      ].join(" \xB7 ") + ` (${total})`,
+      "",
+      "| | Action | Where | Problem |",
+      "| --- | --- | --- | --- |"
+    );
+    const cell = (text) => text.replace(/\|/g, "\\|");
+    const segment = (part) => encodeURIComponent(part).replace(/[()!'*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+    const limit = options.limit ?? 50;
+    for (const { file, action } of found.slice(0, limit)) {
+      const where = `${file}:${action.line}`;
+      const link = options.sourceUrl ? `[${cell(where)}](${options.sourceUrl}${file.split("/").map(segment).join("/")}#L${action.line})` : `\`${cell(where)}\``;
+      const unprotected = action.status === "unprotected";
+      const problem = [unprotected && "No authorization check", action.validated === false && (unprotected ? "input not validated" : "Input not validated")].filter(Boolean).join(", ");
+      lines.push(`| ${unprotected ? "\u274C" : "\u26A0\uFE0F"} | \`${cell(action.name)}\` | ${link} | ${problem} |`);
+    }
+    if (found.length > limit) lines.push("", `\u2026and ${found.length - limit} more. Run \`npx server-action-audit\` to see them all.`);
+    if (summary.unprotected) {
+      lines.push(
+        "",
+        "Every Server Action is a public endpoint: anyone can call it with a POST request. Check the session inside each action, or mark intentional ones with `// @public-action`. See the [Next.js data security guide](https://nextjs.org/docs/app/guides/data-security)."
+      );
+    }
+  }
+  if (report.errors.length) {
+    lines.push("", `Skipped ${report.errors.length} file${report.errors.length === 1 ? "" : "s"} that could not be parsed: ${report.errors.map((error) => `\`${error.file}\``).join(", ")}.`);
+  }
+  return lines.join("\n");
+}
 function formatSarif(report, version) {
   const rules = [
     {
@@ -147,8 +192,70 @@ function formatSarif(report, version) {
   );
 }
 
+// src/github.ts
+import { readFileSync } from "fs";
+
+// src/version.ts
+var VERSION = "0.2.0";
+
+// src/github.ts
+var COMMENT_MARKER = "<!-- server-action-audit -->";
+function pullRequestFromEnv(env = process.env) {
+  if (!env.GITHUB_REPOSITORY || !env.GITHUB_EVENT_PATH) return "not running in GitHub Actions";
+  if (!env.GITHUB_TOKEN) return "GITHUB_TOKEN is not set";
+  const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, "utf8"));
+  if (!event.pull_request) return `the "${env.GITHUB_EVENT_NAME ?? "unknown"}" event is not about a pull request`;
+  return {
+    apiUrl: env.GITHUB_API_URL || "https://api.github.com",
+    serverUrl: env.GITHUB_SERVER_URL || "https://github.com",
+    repository: env.GITHUB_REPOSITORY,
+    number: event.pull_request.number,
+    headSha: event.pull_request.head?.sha,
+    token: env.GITHUB_TOKEN
+  };
+}
+async function upsertComment(pr, body, options) {
+  const request = async (method, path, payload) => {
+    const response = await (options.fetch ?? fetch)(`${pr.apiUrl}${path}`, {
+      method,
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${pr.token}`,
+        "user-agent": `server-action-audit/${VERSION}`,
+        "x-github-api-version": "2022-11-28",
+        ...payload ? { "content-type": "application/json" } : {}
+      },
+      body: payload ? JSON.stringify(payload) : void 0
+    });
+    if (!response.ok) {
+      const message = await response.json().then(
+        (error) => error.message,
+        () => void 0
+      );
+      throw Object.assign(new Error(`${method} ${path} answered ${response.status}${message ? ` ${message}` : ""}`), { status: response.status });
+    }
+    return await response.json();
+  };
+  let previous;
+  for (let page = 1; !previous; page++) {
+    const comments = await request("GET", `/repos/${pr.repository}/issues/${pr.number}/comments?per_page=100&page=${page}`);
+    previous = comments.find((comment) => comment.body?.startsWith(COMMENT_MARKER));
+    if (comments.length < 100) break;
+  }
+  const text = `${COMMENT_MARKER}
+${body}`;
+  if (previous) {
+    if (previous.body === text) return "skipped";
+    await request("PATCH", `/repos/${pr.repository}/issues/comments/${previous.id}`, { body: text });
+    return "updated";
+  }
+  if (options.clean) return "skipped";
+  await request("POST", `/repos/${pr.repository}/issues/${pr.number}/comments`, { body: text });
+  return "created";
+}
+
 // src/scan.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, readdirSync } from "fs";
 import { join as join2, relative, sep } from "path";
 
 // src/ast.ts
@@ -684,7 +791,7 @@ function analyzeModule(input, options, resolver) {
 }
 
 // src/resolve.ts
-import { existsSync, readFileSync, statSync } from "fs";
+import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
 import { dirname, join, resolve } from "path";
 import { parse } from "@typescript-eslint/typescript-estree";
 var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
@@ -750,7 +857,7 @@ function pathMapping(fromDir) {
     const file = join(fromDir, name);
     if (!existsSync(file)) continue;
     try {
-      const config = parseJsonc(readFileSync(file, "utf8"));
+      const config = parseJsonc(readFileSync2(file, "utf8"));
       const options = config.compilerOptions ?? {};
       if (options.paths) mapping = { base: resolve(fromDir, options.baseUrl ?? "."), paths: options.paths };
     } catch {
@@ -807,7 +914,7 @@ function createNodeResolver() {
     if (cached && cached.mtime === mtime) return cached.module;
     let module = null;
     try {
-      module = { ast: parseModule(readFileSync(file, "utf8"), file), filename: file };
+      module = { ast: parseModule(readFileSync2(file, "utf8"), file), filename: file };
     } catch {
       module = null;
     }
@@ -842,12 +949,12 @@ function* sourceFiles(dir) {
   }
 }
 function loadConfig(root, configPath) {
-  if (configPath) return JSON.parse(readFileSync2(configPath, "utf8"));
+  if (configPath) return JSON.parse(readFileSync3(configPath, "utf8"));
   const file = join2(root, "server-action-audit.config.json");
-  if (existsSync2(file)) return JSON.parse(readFileSync2(file, "utf8"));
+  if (existsSync2(file)) return JSON.parse(readFileSync3(file, "utf8"));
   const pkg = join2(root, "package.json");
   if (existsSync2(pkg)) {
-    const config = JSON.parse(readFileSync2(pkg, "utf8")).serverActionAudit;
+    const config = JSON.parse(readFileSync3(pkg, "utf8")).serverActionAudit;
     if (config) return config;
   }
   return {};
@@ -860,7 +967,7 @@ function scanProject(root, options = {}) {
   for (const path of sourceFiles(root)) {
     const file = relative(root, path).split(sep).join("/");
     if (ignore.some((pattern) => pattern.test(file))) continue;
-    const text = readFileSync2(path, "utf8");
+    const text = readFileSync3(path, "utf8");
     if (!text.includes("use server")) continue;
     let actions;
     try {
@@ -881,9 +988,6 @@ function scanProject(root, options = {}) {
   return report;
 }
 
-// src/version.ts
-var VERSION = "0.1.0";
-
 // src/cli.ts
 var HELP = `Usage: server-action-audit [dir] [options]
 
@@ -892,9 +996,13 @@ flags the ones without an authorization check.
 
 Options
   --fail-on <level>   unprotected (default) | unvalidated | never
-  --format <format>   pretty (default) | json | github | sarif
+  --format <format>   pretty (default) | json | github | sarif | markdown
                       github: annotations on pull requests (GitHub Actions)
                       sarif: for GitHub code scanning
+                      markdown: for a job summary
+  --pr-comment        In GitHub Actions, also post the report as a comment
+                      on the pull request, updated on every push. Uses
+                      GITHUB_TOKEN, which needs pull-requests: write
   --json              Same as --format json
   --quiet             Only show problems (pretty format)
   --config <file>     Options file (default: server-action-audit.config.json,
@@ -904,10 +1012,42 @@ Options
 
 Exit codes: 0 ok, 1 problems found, 2 usage error.
 `;
-function main(argv) {
+function sourceUrl(root, serverUrl, repository, sha) {
+  const path = relative2(process.env.GITHUB_WORKSPACE || process.cwd(), root);
+  if (!sha || path.startsWith("..") || isAbsolute(path)) return void 0;
+  return `${serverUrl}/${repository}/blob/${sha}/${path ? `${path.split(sep2).join("/")}/` : ""}`;
+}
+async function commentOnPullRequest(report, root) {
+  let pr;
+  try {
+    pr = pullRequestFromEnv();
+  } catch (error) {
+    pr = `cannot read the event (${error.message})`;
+  }
+  if (typeof pr === "string") {
+    process.stderr.write(`--pr-comment: no comment, ${pr}.
+`);
+    return;
+  }
+  const { unprotected, unvalidated } = report.summary;
+  try {
+    const body = formatMarkdown(report, { sourceUrl: sourceUrl(root, pr.serverUrl, pr.repository, pr.headSha) });
+    const result = await upsertComment(pr, body, { clean: !unprotected && !unvalidated });
+    const done = { created: "commented on", updated: "updated its comment on", skipped: "nothing new to post on" }[result];
+    process.stderr.write(`--pr-comment: ${done} pull request #${pr.number}.
+`);
+  } catch (error) {
+    const { message, status } = error;
+    const hint = status === 403 || status === 404 ? ' The job needs "permissions: pull-requests: write" (pull requests from forks only get a read-only token).' : "";
+    process.stderr.write(`::warning title=server-action-audit::Could not comment on pull request #${pr.number}: ${message}.${hint}
+`);
+  }
+}
+async function main(argv) {
   let dir = ".";
   let format = "pretty";
   let quiet = false;
+  let prComment = false;
   let failOn = "unprotected";
   let configPath;
   for (let i = 0; i < argv.length; i++) {
@@ -924,6 +1064,7 @@ function main(argv) {
     if (arg === "--json") format = "json";
     else if (arg === "--format" || arg.startsWith("--format=")) format = arg.includes("=") ? arg.split("=")[1] : argv[++i] ?? "";
     else if (arg === "--quiet") quiet = true;
+    else if (arg === "--pr-comment") prComment = true;
     else if (arg === "--fail-on" || arg.startsWith("--fail-on=")) failOn = arg.includes("=") ? arg.split("=")[1] : argv[++i] ?? "";
     else if (arg === "--config" || arg.startsWith("--config=")) configPath = arg.includes("=") ? arg.split("=")[1] : argv[++i];
     else if (arg.startsWith("-")) {
@@ -933,8 +1074,8 @@ ${HELP}`);
       return 2;
     } else dir = arg;
   }
-  if (!["pretty", "json", "github", "sarif"].includes(format)) {
-    process.stderr.write(`--format must be pretty, json, github or sarif (got "${format}").
+  if (!["pretty", "json", "github", "sarif", "markdown"].includes(format)) {
+    process.stderr.write(`--format must be pretty, json, github, sarif or markdown (got "${format}").
 `);
     return 2;
   }
@@ -952,13 +1093,14 @@ ${HELP}`);
 `);
     return 2;
   }
-  const output = format === "json" ? formatJson(report) : format === "github" ? formatGithub(report) : format === "sarif" ? formatSarif(report, VERSION) : formatPretty(report, { quiet });
+  const output = format === "json" ? formatJson(report) : format === "github" ? formatGithub(report) : format === "sarif" ? formatSarif(report, VERSION) : format === "markdown" ? formatMarkdown(report) : formatPretty(report, { quiet });
   process.stdout.write(`${output}
 `);
+  if (prComment) await commentOnPullRequest(report, root);
   const { unprotected, unvalidated } = report.summary;
   if (failOn === "unprotected" && unprotected) return 1;
   if (failOn === "unvalidated" && (unprotected || unvalidated)) return 1;
   return 0;
 }
-process.exitCode = main(process.argv.slice(2));
+process.exitCode = await main(process.argv.slice(2));
 //# sourceMappingURL=cli.js.map