specshield 2.0.1 → 3.1.1

package/src/core/projectConfig.js

@@ -0,0 +1,189 @@
+'use strict';
+
+/**
+ * Load `.specshield.yml` from the working directory (or any ancestor) and
+ * apply its defaults to a parsed CLI options object.
+ *
+ * Precedence at call time:
+ *   CLI flag  >  env var  >  .specshield.yml  >  hard-coded default
+ *
+ * Each `bdct` subcommand calls `applyBdctDefaults(opts, command)` after
+ * parsing args. Required-field validation happens here too — that way the
+ * CLI flags can stop being `requiredOption(...)` and fall through gracefully
+ * to the project config when the user is running from a configured repo.
+ */
+
+const fs   = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+const logger = require('../utils/logger');
+
+/**
+ * Walk upward from `start` looking for `.specshield.yml` or `.specshield.yaml`.
+ * Returns the absolute path of the first hit, or null.
+ */
+function findProjectConfigFile(start = process.cwd()) {
+  let dir = path.resolve(start);
+  // Bound walk to a sensible depth — never escape the user's home directory.
+  for (let i = 0; i < 20; i++) {
+    for (const name of ['.specshield.yml', '.specshield.yaml']) {
+      const candidate = path.join(dir, name);
+      if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
+        return candidate;
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+let cached = null;
+let cachedFor = null;
+
+/**
+ * Returns the parsed config object (or an empty `{}` if no file is found).
+ * Cached per-process for the same starting directory; tests can pass
+ * `{ noCache: true }` or call `clearCache()` to refetch.
+ */
+function loadProjectConfig(start = process.cwd(), { noCache = false } = {}) {
+  if (!noCache && cached !== null && cachedFor === start) return cached;
+
+  const file = findProjectConfigFile(start);
+  if (!file) {
+    cached = {}; cachedFor = start;
+    return cached;
+  }
+
+  let parsed = {};
+  try {
+    const raw = fs.readFileSync(file, 'utf8');
+    parsed = yaml.load(raw) || {};
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+      logger.warn(`Ignoring ${file}: top-level must be a YAML mapping.`);
+      parsed = {};
+    }
+  } catch (err) {
+    logger.warn(`Failed to read ${file}: ${err.message}. Continuing without project config.`);
+    parsed = {};
+  }
+
+  cached = { ...parsed, _file: file };
+  cachedFor = start;
+  return cached;
+}
+
+function clearCache() { cached = null; cachedFor = null; }
+
+/**
+ * Required-field declaration per BDCT subcommand. Same source-of-truth the
+ * old `requiredOption(...)` checks used; centralised here so missing fields
+ * produce a single, friendly error.
+ */
+const REQUIRED_FIELDS = {
+  'publish-provider': ['org', 'provider', 'version', 'spec'],
+  'publish-consumer': ['org', 'consumer', 'provider', 'version', 'contract'],
+  'verify':           ['org', 'consumer', 'consumerVersion', 'provider', 'providerVersion'],
+  'can-i-deploy':     ['org', 'service', 'version'],
+  'matrix':           ['org'],
+  'list':             ['org'],
+  'list-providers':   ['org'],
+  'list-consumers':   ['org'],
+};
+
+/**
+ * Map a CLI option name to a path inside `.specshield.yml > bdct`.
+ * Returns null when there is no defaulting rule for that option.
+ */
+function bdctDefaultFor(bdct, name, command) {
+  if (!bdct) return undefined;
+  switch (name) {
+    case 'org':         return bdct.org;
+    case 'server':      return bdct.server;
+    case 'env':         return bdct.environment;
+
+    case 'provider': {
+      // For consumer-side operations the provider lives under `bdct.consumer.provider`.
+      if (command === 'publish-consumer' || command === 'verify') {
+        return bdct.consumer && bdct.consumer.provider;
+      }
+      // For everything else it's the project's own provider name.
+      return bdct.provider && bdct.provider.name;
+    }
+    case 'consumer':    return bdct.consumer && bdct.consumer.name;
+    case 'service': {
+      // can-i-deploy service is whichever role the project owns.
+      return (bdct.provider && bdct.provider.name)
+          || (bdct.consumer && bdct.consumer.name);
+    }
+    case 'spec':        return bdct.provider && bdct.provider.spec;
+    case 'contract':    return bdct.consumer && bdct.consumer.contract;
+    case 'format':      return bdct.consumer && bdct.consumer.format;
+    case 'branch':      return bdct.provider && bdct.provider.branch;
+    default:            return undefined;
+  }
+}
+
+/**
+ * Mutates `opts` in place: for every CLI option that is currently undefined
+ * (or empty string), look up a default in the loaded project config.
+ *
+ * Then verify every required field for the given `command` is present.
+ * Throws an Error listing all missing fields if not.
+ */
+function applyBdctDefaults(opts, command, { cwd = process.cwd() } = {}) {
+  const cfg = loadProjectConfig(cwd);
+  const bdct = cfg.bdct;
+
+  const FIELDS = [
+    'org', 'server', 'env',
+    'provider', 'consumer', 'service',
+    'version', 'consumerVersion', 'providerVersion',
+    'spec', 'contract', 'format', 'branch',
+  ];
+
+  // Paths in the config file are interpreted relative to the config file's
+  // directory (not the CWD where the command was invoked). This lets a user
+  // run `specshield bdct publish-provider` from any subdirectory.
+  const configDir = cfg._file ? path.dirname(cfg._file) : cwd;
+  const resolvePath = (v) =>
+    !v || path.isAbsolute(v) ? v : path.resolve(configDir, v);
+
+  for (const f of FIELDS) {
+    if (opts[f] !== undefined && opts[f] !== '') continue;
+    const def = bdctDefaultFor(bdct, f, command);
+    if (def === undefined || def === null || def === '') continue;
+    opts[f] = (f === 'spec' || f === 'contract') ? resolvePath(def) : def;
+  }
+
+  // Required-field check.
+  const required = REQUIRED_FIELDS[command] || [];
+  const missing  = required.filter(k => !opts[k]);
+  if (missing.length > 0) {
+    const flagFor = (k) => '--' + k.replace(/[A-Z]/g, m => '-' + m.toLowerCase());
+    const msg = [
+      `Missing required ${missing.length === 1 ? 'option' : 'options'} for \`bdct ${command}\`: `
+        + missing.map(flagFor).join(', '),
+    ];
+    if (cfg._file) {
+      msg.push(`Set them as CLI flags or add them under \`bdct\` in ${cfg._file}.`);
+    } else {
+      msg.push('Pass them as CLI flags, or run `specshield init` to write a `.specshield.yml`.');
+    }
+    const err = new Error(msg.join('\n'));
+    err.code = 'MISSING_REQUIRED_OPTIONS';
+    err.missing = missing;
+    throw err;
+  }
+
+  return opts;
+}
+
+module.exports = {
+  findProjectConfigFile,
+  loadProjectConfig,
+  clearCache,
+  applyBdctDefaults,
+  REQUIRED_FIELDS,
+};

package/src/core/projectDetect.js

@@ -0,0 +1,180 @@
+'use strict';
+
+/**
+ * Detect project context for `specshield init`.
+ *
+ * Pure I/O: reads files inside `cwd`, returns a plain object.
+ * No prompting, no network. Each detector is independent and never throws —
+ * unknown values come back as `null` so callers can decide whether to
+ * prompt or fail.
+ */
+
+const fs   = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+const cp   = require('child_process');
+
+// Glob order matters — first hit wins for the auto-detected default,
+// later hits become "alternates" the wizard can offer in a multi-select.
+const SPEC_CANDIDATES = [
+  'api/openapi.yaml',  'api/openapi.yml',  'api/openapi.json',
+  'openapi.yaml',      'openapi.yml',      'openapi.json',
+  'spec/openapi.yaml', 'spec/openapi.yml', 'spec/openapi.json',
+  'docs/openapi.yaml', 'docs/openapi.yml', 'docs/openapi.json',
+  'swagger.yaml',      'swagger.yml',      'swagger.json',
+];
+
+function fileExists(p) {
+  try { return fs.statSync(p).isFile(); } catch { return false; }
+}
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+function readText(p) {
+  try { return fs.readFileSync(p, 'utf8'); } catch { return null; }
+}
+
+function safeLoadYaml(p) {
+  try { return yaml.load(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+/**
+ * Returns true if the parsed object looks like an OpenAPI 3.x or Swagger 2.x spec.
+ * Cheap structural check — does not validate the full schema.
+ */
+function looksLikeOpenApi(parsed) {
+  if (!parsed || typeof parsed !== 'object') return false;
+  if (typeof parsed.openapi === 'string' && parsed.openapi.startsWith('3.')) return true;
+  if (typeof parsed.swagger === 'string') return true;
+  return false;
+}
+
+/**
+ * Find every plausible OpenAPI spec under `cwd` from the candidate list.
+ * Returns absolute paths in canonical order; the first entry is the
+ * "best" guess (existing-file order in `SPEC_CANDIDATES`).
+ */
+function findSpecCandidates(cwd) {
+  const matches = [];
+  for (const rel of SPEC_CANDIDATES) {
+    const abs = path.join(cwd, rel);
+    if (fileExists(abs)) {
+      const parsed = safeLoadYaml(abs);
+      matches.push({ rel, abs, valid: looksLikeOpenApi(parsed) });
+    }
+  }
+  return matches;
+}
+
+/**
+ * Best-guess service / provider name in priority order:
+ *   package.json name (with @scope stripped)
+ *   pyproject.toml [project] name
+ *   go.mod module last segment
+ *   Cargo.toml [package] name
+ *   pom.xml <artifactId>
+ *   directory name
+ */
+function detectServiceName(cwd) {
+  // package.json
+  const pkg = readJson(path.join(cwd, 'package.json'));
+  if (pkg && typeof pkg.name === 'string') {
+    return { source: 'package.json', name: pkg.name.replace(/^@[^/]+\//, '') };
+  }
+  // pyproject.toml — read just enough to find the name without a TOML parser
+  const pyproject = readText(path.join(cwd, 'pyproject.toml'));
+  if (pyproject) {
+    const m = pyproject.match(/^\s*name\s*=\s*["']([^"']+)["']/m);
+    if (m) return { source: 'pyproject.toml', name: m[1] };
+  }
+  // go.mod
+  const goMod = readText(path.join(cwd, 'go.mod'));
+  if (goMod) {
+    const m = goMod.match(/^module\s+(\S+)/m);
+    if (m) return { source: 'go.mod', name: m[1].split('/').pop() };
+  }
+  // Cargo.toml
+  const cargo = readText(path.join(cwd, 'Cargo.toml'));
+  if (cargo) {
+    const m = cargo.match(/^\s*name\s*=\s*["']([^"']+)["']/m);
+    if (m) return { source: 'Cargo.toml', name: m[1] };
+  }
+  // pom.xml — naive single-line artifactId match (good enough for detection)
+  const pom = readText(path.join(cwd, 'pom.xml'));
+  if (pom) {
+    const m = pom.match(/<artifactId>([^<]+)<\/artifactId>/);
+    if (m) return { source: 'pom.xml', name: m[1] };
+  }
+  // Fallback — directory name
+  return { source: 'directory', name: path.basename(path.resolve(cwd)) };
+}
+
+/**
+ * Read git remote + current branch. Returns `{ remote, owner, repo, branch }`
+ * with all fields null if the directory is not a git working tree.
+ */
+function detectGit(cwd) {
+  const out = (cmd) => {
+    try {
+      return cp.execSync(cmd, { cwd, stdio: ['ignore', 'pipe', 'ignore'] })
+               .toString().trim();
+    } catch { return null; }
+  };
+
+  const remote = out('git config --get remote.origin.url');
+  const branch = out('git symbolic-ref --short HEAD') || null;
+
+  let owner = null, repo = null;
+  if (remote) {
+    // Match git@host:owner/repo.git OR https://host/owner/repo(.git)?
+    const m = remote.match(/[:/]([^/:]+)\/([^/]+?)(?:\.git)?$/);
+    if (m) { owner = m[1]; repo = m[2]; }
+  }
+  return { remote, owner, repo, branch };
+}
+
+/**
+ * Suggest a default environment based on the current branch.
+ * `main` / `master` → "production", anything else → "staging".
+ */
+function suggestEnvironment(branch) {
+  if (!branch) return 'staging';
+  if (branch === 'main' || branch === 'master') return 'production';
+  return 'staging';
+}
+
+/**
+ * Top-level: run every detector and return one combined snapshot.
+ */
+function detectAll(cwd = process.cwd()) {
+  const specs    = findSpecCandidates(cwd);
+  const service  = detectServiceName(cwd);
+  const git      = detectGit(cwd);
+  const env      = suggestEnvironment(git.branch);
+  const existing = fileExists(path.join(cwd, '.specshield.yml'))
+                || fileExists(path.join(cwd, '.specshield.yaml'));
+
+  return {
+    cwd,
+    specs,
+    spec:        specs.find(s => s.valid)?.rel || specs[0]?.rel || null,
+    service,
+    serviceName: service.name,
+    git,
+    branch:      git.branch,
+    environment: env,
+    existing,
+  };
+}
+
+module.exports = {
+  SPEC_CANDIDATES,
+  looksLikeOpenApi,
+  findSpecCandidates,
+  detectServiceName,
+  detectGit,
+  suggestEnvironment,
+  detectAll,
+};

package/src/api/contractsClient.js

@@ -1,88 +0,0 @@
-'use strict';
-
-const axios = require('axios');
-const { version } = require('../../package.json');
-
-const DEFAULT_SERVER = 'https://specshield.io';
-const TIMEOUT = 15000;
-
-function buildClient(server, apiToken) {
-  const baseURL = (server || DEFAULT_SERVER).replace(/\/$/, '');
-  const headers = {
-    'Content-Type': 'application/json',
-    'X-SpecShield-Client': 'cli',
-    'X-SpecShield-Version': version,
-  };
-  if (apiToken) headers['X-Api-Key'] = apiToken;
-  return axios.create({ baseURL, timeout: TIMEOUT, headers });
-}
-
-function apiError(err) {
-  if (err.response) {
-    const data = err.response.data;
-    const msg = (data && (data.message || data.error || data.title))
-      || `HTTP ${err.response.status}`;
-    return new Error(`API error (${err.response.status}): ${msg}`);
-  }
-  if (err.request) return new Error(`No response from server: ${err.message}`);
-  return new Error(`Request failed: ${err.message}`);
-}
-
-async function publishContract(server, apiToken, payload) {
-  try {
-    const res = await buildClient(server, apiToken).post('/api/contracts/publish', payload);
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-async function listContracts(server, apiToken, { org, consumer, provider, contractName, status, page = 0, size = 20 } = {}) {
-  try {
-    const params = { page, size };
-    if (org) params.orgKey = org;
-    if (consumer) params.consumerServiceKey = consumer;
-    if (provider) params.providerServiceKey = provider;
-    if (contractName) params.contractName = contractName;
-    if (status) params.status = status;
-    const res = await buildClient(server, apiToken).get('/api/contracts', { params });
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-async function getLatestContract(server, apiToken, { org, consumer, provider, contractName } = {}) {
-  try {
-    const params = {};
-    if (org) params.orgKey = org;
-    if (consumer) params.consumerServiceKey = consumer;
-    if (provider) params.providerServiceKey = provider;
-    if (contractName) params.contractName = contractName;
-    const res = await buildClient(server, apiToken).get('/api/contracts/latest', { params });
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-async function verifyContract(server, apiToken, contractId, payload) {
-  try {
-    const res = await buildClient(server, apiToken).post(`/api/contracts/${contractId}/verify`, payload);
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-async function getVerificationHistory(server, apiToken, contractId) {
-  try {
-    const res = await buildClient(server, apiToken).get(`/api/contracts/${contractId}/verifications`);
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-async function canIDeploy(server, apiToken, { provider, version: ver, environment } = {}) {
-  try {
-    const params = { version: ver };
-    if (environment) params.environment = environment;
-    const res = await buildClient(server, apiToken).get(
-      `/api/providers/${encodeURIComponent(provider)}/can-i-deploy`, { params }
-    );
-    return res.data;
-  } catch (err) { throw apiError(err); }
-}
-
-module.exports = { publishContract, listContracts, getLatestContract, verifyContract, getVerificationHistory, canIDeploy };