supasec 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +155 -0
- package/PUBLISHING.md +51 -0
- package/README.md +1 -1
- package/package.json +70 -69
- package/scripts/publish.js +93 -0
- package/.env +0 -1
- package/npm-publishing-guide.md +0 -38
package/AGENTS.md
ADDED
|
@@ -0,0 +1,155 @@
|
|
|
1
|
+
# SupaSec Development Guide
|
|
2
|
+
|
|
3
|
+
## Project Overview
|
|
4
|
+
|
|
5
|
+
SupaSec is a free, open-source CLI tool for comprehensive Supabase security auditing. It scans Supabase-powered websites and applications for security vulnerabilities including exposed secrets, misconfigured RLS policies, and authentication weaknesses.
|
|
6
|
+
|
|
7
|
+
**GitHub:** https://github.com/Interpoolx/supasec
|
|
8
|
+
**NPM:** https://www.npmjs.com/package/supasec
|
|
9
|
+
|
|
10
|
+
## Quick Commands
|
|
11
|
+
|
|
12
|
+
### Development
|
|
13
|
+
```bash
|
|
14
|
+
npm install # Install dependencies
|
|
15
|
+
npm run build # Compile TypeScript to dist/
|
|
16
|
+
npm run dev # Watch mode for development
|
|
17
|
+
npm run lint # Run ESLint
|
|
18
|
+
npm test # Run Jest tests
|
|
19
|
+
npm start # Run CLI locally
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
### Publishing
|
|
23
|
+
```bash
|
|
24
|
+
# Publish using current version in package.json
|
|
25
|
+
node scripts/publish.js
|
|
26
|
+
|
|
27
|
+
# Publish as specific version (updates package.json + README)
|
|
28
|
+
node scripts/publish.js 1.0.5
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
## Project Structure
|
|
32
|
+
|
|
33
|
+
```
|
|
34
|
+
src/
|
|
35
|
+
├── cli.ts # Entry point and CLI setup
|
|
36
|
+
├── commands/ # CLI command handlers
|
|
37
|
+
│ ├── scan.ts # Main scan command
|
|
38
|
+
│ ├── fix.ts # Auto-fix command
|
|
39
|
+
│ └── report.ts # Report generation
|
|
40
|
+
├── scanners/ # Security scanning modules
|
|
41
|
+
│ ├── rls/ # Row Level Security analyzer
|
|
42
|
+
│ ├── secrets/ # Secrets detector
|
|
43
|
+
│ ├── auth/ # Authentication analyzer
|
|
44
|
+
│ ├── storage/ # Storage security checker
|
|
45
|
+
│ └── api/ # API security checker
|
|
46
|
+
├── models/ # Data models
|
|
47
|
+
│ ├── finding.ts # Finding interface
|
|
48
|
+
│ ├── scan-result.ts # Scan result model
|
|
49
|
+
│ └── remediation.ts # Fix recommendations
|
|
50
|
+
├── reporters/ # Output formatters
|
|
51
|
+
│ ├── terminal.ts # Terminal/CLI output
|
|
52
|
+
│ ├── json.ts # JSON output
|
|
53
|
+
│ └── html.ts # HTML report generation
|
|
54
|
+
└── utils/ # Utility functions
|
|
55
|
+
├── supabase-client.ts # Supabase API client
|
|
56
|
+
├── puppeteer-helper.ts # Browser automation
|
|
57
|
+
└── logger.ts # Logging utilities
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
## Key Files
|
|
61
|
+
|
|
62
|
+
| File | Purpose |
|
|
63
|
+
|------|---------|
|
|
64
|
+
| `package.json` | Dependencies and scripts |
|
|
65
|
+
| `tsconfig.json` | TypeScript configuration |
|
|
66
|
+
| `.eslintrc.json` | Linting rules |
|
|
67
|
+
| `scripts/publish.js` | Smart publish script |
|
|
68
|
+
|
|
69
|
+
## Development Workflow
|
|
70
|
+
|
|
71
|
+
1. **Make changes** in `src/`
|
|
72
|
+
2. **Build locally** with `npm run build`
|
|
73
|
+
3. **Test with** `npm start -- scan <url>`
|
|
74
|
+
4. **Lint with** `npm run lint` (fix with `npm run lint -- --fix`)
|
|
75
|
+
5. **Commit and push** to GitHub
|
|
76
|
+
6. **Publish** with `node scripts/publish.js <version>`
|
|
77
|
+
|
|
78
|
+
## Publishing Process
|
|
79
|
+
|
|
80
|
+
The `scripts/publish.js` script automates:
|
|
81
|
+
- ✓ Version management (package.json)
|
|
82
|
+
- ✓ README updates with new version
|
|
83
|
+
- ✓ TypeScript compilation
|
|
84
|
+
- ✓ npm publish
|
|
85
|
+
|
|
86
|
+
**Setup token once:**
|
|
87
|
+
```bash
|
|
88
|
+
npm config set //registry.npmjs.org/:_authToken npm_YOUR_TOKEN_HERE
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
**Then publish:**
|
|
92
|
+
```bash
|
|
93
|
+
node scripts/publish.js 1.0.6
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
## Common Issues
|
|
97
|
+
|
|
98
|
+
| Issue | Solution |
|
|
99
|
+
|-------|----------|
|
|
100
|
+
| Build fails | Run `npm install` then `npm run build` |
|
|
101
|
+
| Lint errors | Run `npm run lint -- --fix` |
|
|
102
|
+
| npm publish fails | Check token: `npm config set //registry.npmjs.org/:_authToken YOUR_TOKEN` |
|
|
103
|
+
| Outdated deps | Run `npm audit fix` or `npm update` |
|
|
104
|
+
|
|
105
|
+
## Dependencies
|
|
106
|
+
|
|
107
|
+
**Main:**
|
|
108
|
+
- `@supabase/supabase-js` - Supabase client
|
|
109
|
+
- `axios` - HTTP requests
|
|
110
|
+
- `chalk` - Terminal colors
|
|
111
|
+
- `commander` - CLI framework
|
|
112
|
+
- `puppeteer` - Browser automation (for frontend scanning)
|
|
113
|
+
|
|
114
|
+
**Dev:**
|
|
115
|
+
- `typescript` - Language
|
|
116
|
+
- `eslint` & `@typescript-eslint` - Linting
|
|
117
|
+
- `jest` & `ts-jest` - Testing
|
|
118
|
+
|
|
119
|
+
## Testing
|
|
120
|
+
|
|
121
|
+
```bash
|
|
122
|
+
npm test # Run all tests
|
|
123
|
+
npm test -- --watch # Watch mode
|
|
124
|
+
npm test -- --coverage # Coverage report
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
## Debugging
|
|
128
|
+
|
|
129
|
+
```bash
|
|
130
|
+
# Run with verbose logging
|
|
131
|
+
DEBUG=supasec:* npm start -- scan <url>
|
|
132
|
+
|
|
133
|
+
# Build in watch mode
|
|
134
|
+
npm run dev
|
|
135
|
+
|
|
136
|
+
# Check compiled output
|
|
137
|
+
cat dist/cli.js
|
|
138
|
+
```
|
|
139
|
+
|
|
140
|
+
## Releasing
|
|
141
|
+
|
|
142
|
+
1. Update version: `node scripts/publish.js X.Y.Z`
|
|
143
|
+
2. This automatically:
|
|
144
|
+
- Updates `package.json`
|
|
145
|
+
- Updates `README.md`
|
|
146
|
+
- Compiles TypeScript
|
|
147
|
+
- Publishes to npm
|
|
148
|
+
3. Create GitHub release with tag `vX.Y.Z`
|
|
149
|
+
|
|
150
|
+
## Resources
|
|
151
|
+
|
|
152
|
+
- [SupaSec Documentation](https://github.com/Interpoolx/supasec/wiki)
|
|
153
|
+
- [Supabase Docs](https://supabase.com/docs)
|
|
154
|
+
- [TypeScript Handbook](https://www.typescriptlang.org/docs)
|
|
155
|
+
- [Commander.js Guide](https://github.com/tj/commander.js)
|
package/PUBLISHING.md
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# Publishing Guide
|
|
2
|
+
|
|
3
|
+
## One-time Setup
|
|
4
|
+
|
|
5
|
+
1. **Get npm token** from https://www.npmjs.com/settings/~/tokens
|
|
6
|
+
2. **Set globally:**
|
|
7
|
+
```bash
|
|
8
|
+
npm config set //registry.npmjs.org/:_authToken npm_YOUR_TOKEN_HERE
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Publishing
|
|
12
|
+
|
|
13
|
+
### Using current version in package.json
|
|
14
|
+
```bash
|
|
15
|
+
node scripts/publish.js
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
### Publishing as new version
|
|
19
|
+
```bash
|
|
20
|
+
node scripts/publish.js 1.0.5
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
The script automatically:
|
|
24
|
+
- ✓ Updates `package.json` version
|
|
25
|
+
- ✓ Updates `README.md` with new version
|
|
26
|
+
- ✓ Runs `npm run build`
|
|
27
|
+
- ✓ Publishes to npm
|
|
28
|
+
|
|
29
|
+
## Verify Publication
|
|
30
|
+
|
|
31
|
+
```bash
|
|
32
|
+
npm view supasec version
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
## Install Latest Version
|
|
36
|
+
|
|
37
|
+
```bash
|
|
38
|
+
npx supasec scan <url>
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
## What the Script Does
|
|
42
|
+
|
|
43
|
+
| Step | Command |
|
|
44
|
+
|------|---------|
|
|
45
|
+
| 1. Set version | Updates `package.json` |
|
|
46
|
+
| 2. Update docs | Updates `README.md` version tags |
|
|
47
|
+
| 3. Build | Runs `npm run build` |
|
|
48
|
+
| 4. Publish | Runs `npm publish` |
|
|
49
|
+
| 5. Confirm | Shows installation instructions |
|
|
50
|
+
|
|
51
|
+
If anything fails, the script reverts `package.json` to the previous version.
|
package/README.md
CHANGED
|
@@ -126,7 +126,7 @@ SupaSec performs comprehensive security checks across multiple categories:
|
|
|
126
126
|
## 📊 Example Output
|
|
127
127
|
|
|
128
128
|
```
|
|
129
|
-
🔍 SupaSec - Supabase Security Audit v1.0.
|
|
129
|
+
🔍 SupaSec - Supabase Security Audit v1.0.1
|
|
130
130
|
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
131
131
|
|
|
132
132
|
🎯 Target: https://myapp.com
|
package/package.json
CHANGED
|
@@ -1,69 +1,70 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "supasec",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "A free, open-source CLI tool for comprehensive Supabase security auditing",
|
|
5
|
-
"main": "dist/index.js",
|
|
6
|
-
"types": "dist/index.d.ts",
|
|
7
|
-
"bin": {
|
|
8
|
-
"supasec": "dist/cli.js"
|
|
9
|
-
},
|
|
10
|
-
"scripts": {
|
|
11
|
-
"build": "tsc",
|
|
12
|
-
"dev": "tsc --watch",
|
|
13
|
-
"start": "node dist/cli.js",
|
|
14
|
-
"lint": "eslint src/**/*.ts",
|
|
15
|
-
"test": "jest",
|
|
16
|
-
"prepare": "npm run build"
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
"
|
|
21
|
-
"
|
|
22
|
-
"
|
|
23
|
-
"
|
|
24
|
-
"
|
|
25
|
-
"
|
|
26
|
-
"
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
"
|
|
30
|
-
"
|
|
31
|
-
|
|
32
|
-
"
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
"
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
"
|
|
44
|
-
"
|
|
45
|
-
"
|
|
46
|
-
"
|
|
47
|
-
"
|
|
48
|
-
"
|
|
49
|
-
"
|
|
50
|
-
"
|
|
51
|
-
"
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
"@humanwhocodes/
|
|
56
|
-
"@
|
|
57
|
-
"@types/
|
|
58
|
-
"@types/
|
|
59
|
-
"@types/
|
|
60
|
-
"@
|
|
61
|
-
"@typescript-eslint/
|
|
62
|
-
"eslint": "^
|
|
63
|
-
"
|
|
64
|
-
"
|
|
65
|
-
"
|
|
66
|
-
"
|
|
67
|
-
"
|
|
68
|
-
|
|
69
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "supasec",
|
|
3
|
+
"version": "1.0.1",
|
|
4
|
+
"description": "A free, open-source CLI tool for comprehensive Supabase security auditing",
|
|
5
|
+
"main": "dist/index.js",
|
|
6
|
+
"types": "dist/index.d.ts",
|
|
7
|
+
"bin": {
|
|
8
|
+
"supasec": "dist/cli.js"
|
|
9
|
+
},
|
|
10
|
+
"scripts": {
|
|
11
|
+
"build": "tsc",
|
|
12
|
+
"dev": "tsc --watch",
|
|
13
|
+
"start": "node dist/cli.js",
|
|
14
|
+
"lint": "eslint src/**/*.ts",
|
|
15
|
+
"test": "jest",
|
|
16
|
+
"prepare": "npm run build",
|
|
17
|
+
"publish-version": "node scripts/publish.js"
|
|
18
|
+
},
|
|
19
|
+
"keywords": [
|
|
20
|
+
"supabase",
|
|
21
|
+
"security",
|
|
22
|
+
"audit",
|
|
23
|
+
"cli",
|
|
24
|
+
"rls",
|
|
25
|
+
"scanner",
|
|
26
|
+
"vulnerability",
|
|
27
|
+
"pentesting"
|
|
28
|
+
],
|
|
29
|
+
"author": "SupaSec Team",
|
|
30
|
+
"license": "MIT",
|
|
31
|
+
"repository": {
|
|
32
|
+
"type": "git",
|
|
33
|
+
"url": "git+https://github.com/yourusername/supasec.git"
|
|
34
|
+
},
|
|
35
|
+
"bugs": {
|
|
36
|
+
"url": "https://github.com/yourusername/supasec/issues"
|
|
37
|
+
},
|
|
38
|
+
"homepage": "https://github.com/yourusername/supasec#readme",
|
|
39
|
+
"engines": {
|
|
40
|
+
"node": ">=18.0.0"
|
|
41
|
+
},
|
|
42
|
+
"dependencies": {
|
|
43
|
+
"@supabase/supabase-js": "^2.38.0",
|
|
44
|
+
"axios": "^1.6.0",
|
|
45
|
+
"boxen": "^7.1.1",
|
|
46
|
+
"chalk": "^4.1.2",
|
|
47
|
+
"cheerio": "^1.0.0-rc.12",
|
|
48
|
+
"cli-table3": "^0.6.3",
|
|
49
|
+
"commander": "^11.1.0",
|
|
50
|
+
"enquirer": "^2.4.1",
|
|
51
|
+
"ora": "^7.0.1",
|
|
52
|
+
"puppeteer": "^21.5.0"
|
|
53
|
+
},
|
|
54
|
+
"devDependencies": {
|
|
55
|
+
"@humanwhocodes/config-array": "^0.13.0",
|
|
56
|
+
"@humanwhocodes/object-schema": "^2.0.3",
|
|
57
|
+
"@types/jest": "^29.5.0",
|
|
58
|
+
"@types/json-schema": "^7.0.15",
|
|
59
|
+
"@types/node": "^20.8.0",
|
|
60
|
+
"@types/phoenix": "^1.6.7",
|
|
61
|
+
"@typescript-eslint/eslint-plugin": "^8.54.0",
|
|
62
|
+
"@typescript-eslint/parser": "^8.54.0",
|
|
63
|
+
"eslint": "^9.39.2",
|
|
64
|
+
"glob": "^13.0.0",
|
|
65
|
+
"jest": "^29.7.0",
|
|
66
|
+
"rimraf": "^6.1.2",
|
|
67
|
+
"ts-jest": "^29.1.0",
|
|
68
|
+
"typescript": "^5.2.0"
|
|
69
|
+
}
|
|
70
|
+
}
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* Smart npm publish script
|
|
5
|
+
* Handles versioning, building, and README updates
|
|
6
|
+
*
|
|
7
|
+
* Usage:
|
|
8
|
+
* node scripts/publish.js (uses version from package.json)
|
|
9
|
+
* node scripts/publish.js 1.0.5 (publishes as 1.0.5)
|
|
10
|
+
*/
|
|
11
|
+
|
|
12
|
+
const fs = require('fs');
|
|
13
|
+
const path = require('path');
|
|
14
|
+
const { execSync } = require('child_process');
|
|
15
|
+
|
|
16
|
+
const rootDir = path.join(__dirname, '..');
|
|
17
|
+
const packageJsonPath = path.join(rootDir, 'package.json');
|
|
18
|
+
const readmePath = path.join(rootDir, 'README.md');
|
|
19
|
+
|
|
20
|
+
// Parse arguments
|
|
21
|
+
const args = process.argv.slice(2);
|
|
22
|
+
let targetVersion = args[0];
|
|
23
|
+
|
|
24
|
+
// Read current package.json
|
|
25
|
+
const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
|
|
26
|
+
const currentVersion = packageJson.version;
|
|
27
|
+
|
|
28
|
+
// Determine version to use
|
|
29
|
+
if (!targetVersion) {
|
|
30
|
+
targetVersion = currentVersion;
|
|
31
|
+
console.log(`📦 No version provided. Using current version: ${targetVersion}`);
|
|
32
|
+
} else {
|
|
33
|
+
console.log(`📦 Publishing version: ${targetVersion}`);
|
|
34
|
+
|
|
35
|
+
// Update package.json with new version
|
|
36
|
+
packageJson.version = targetVersion;
|
|
37
|
+
fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
|
|
38
|
+
console.log(`✓ Updated package.json to version ${targetVersion}`);
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
// Update README.md with version
|
|
42
|
+
try {
|
|
43
|
+
let readme = fs.readFileSync(readmePath, 'utf-8');
|
|
44
|
+
|
|
45
|
+
// Update version in example output (if present)
|
|
46
|
+
readme = readme.replace(
|
|
47
|
+
/v\d+\.\d+\.\d+/g,
|
|
48
|
+
`v${targetVersion}`
|
|
49
|
+
);
|
|
50
|
+
|
|
51
|
+
// Update version badge URL (if present)
|
|
52
|
+
readme = readme.replace(
|
|
53
|
+
/\/js\/supasec@[^\s]*/g,
|
|
54
|
+
`/js/supasec@${targetVersion}`
|
|
55
|
+
);
|
|
56
|
+
|
|
57
|
+
fs.writeFileSync(readmePath, readme);
|
|
58
|
+
console.log(`✓ Updated README.md with version ${targetVersion}`);
|
|
59
|
+
} catch (err) {
|
|
60
|
+
console.warn(`⚠️ Could not update README.md: ${err.message}`);
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
// Build
|
|
64
|
+
try {
|
|
65
|
+
console.log('\n🔨 Building...');
|
|
66
|
+
execSync('npm run build', { stdio: 'inherit' });
|
|
67
|
+
console.log('✓ Build successful');
|
|
68
|
+
} catch (err) {
|
|
69
|
+
console.error('❌ Build failed');
|
|
70
|
+
process.exit(1);
|
|
71
|
+
}
|
|
72
|
+
|
|
73
|
+
// Publish
|
|
74
|
+
try {
|
|
75
|
+
console.log('\n🚀 Publishing to npm...');
|
|
76
|
+
execSync(`npm publish`, { stdio: 'inherit' });
|
|
77
|
+
console.log(`✓ Published version ${targetVersion}`);
|
|
78
|
+
|
|
79
|
+
console.log(`\n✨ Success! SupaSec v${targetVersion} is now available on npm`);
|
|
80
|
+
console.log(` npm install supasec@${targetVersion}`);
|
|
81
|
+
console.log(` npx supasec@${targetVersion} scan <url>`);
|
|
82
|
+
} catch (err) {
|
|
83
|
+
console.error('❌ Publish failed');
|
|
84
|
+
|
|
85
|
+
// Revert package.json if we changed it
|
|
86
|
+
if (targetVersion !== currentVersion) {
|
|
87
|
+
packageJson.version = currentVersion;
|
|
88
|
+
fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
|
|
89
|
+
console.log(`⚠️ Reverted package.json to version ${currentVersion}`);
|
|
90
|
+
}
|
|
91
|
+
|
|
92
|
+
process.exit(1);
|
|
93
|
+
}
|
package/.env
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
NPM_TOKEN=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
|
package/npm-publishing-guide.md
DELETED
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
Using authentication tokens (CI/CD)
|
|
2
|
-
Generate token at https://www.npmjs.com/settings/~/tokens → "Create Token"
|
|
3
|
-
|
|
4
|
-
Select "Automation" or "Publish" type
|
|
5
|
-
Add to .npmrc (local or CI):
|
|
6
|
-
|
|
7
|
-
//registry.npmjs.org/:_authToken=YOUR_TOKEN_HERE
|
|
8
|
-
Or set as environment variable:
|
|
9
|
-
|
|
10
|
-
npm set //registry.npmjs.org/:_authToken $NPM_TOKEN
|
|
11
|
-
For GitHub Actions, add secret and use:
|
|
12
|
-
|
|
13
|
-
- run: npm publish
|
|
14
|
-
env:
|
|
15
|
-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
16
|
-
Before publishing, update version in package.json and run npm run build.
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
Option 1: Local Publishing (One-time)
|
|
20
|
-
Set token globally:
|
|
21
|
-
|
|
22
|
-
npm config set //registry.npmjs.org/:_authToken npm_TmTE
|
|
23
|
-
Verify it worked:
|
|
24
|
-
|
|
25
|
-
npm config get //registry.npmjs.org/:_authToken
|
|
26
|
-
(Should show your token)
|
|
27
|
-
|
|
28
|
-
Update version in package.json:
|
|
29
|
-
|
|
30
|
-
npm version minor
|
|
31
|
-
(Or manually edit "version": "1.0.1")
|
|
32
|
-
|
|
33
|
-
Build:
|
|
34
|
-
|
|
35
|
-
npm run build
|
|
36
|
-
Publish:
|
|
37
|
-
|
|
38
|
-
npm publish
|