thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/seeds/js/seed-053.js

@@ -1,26 +1,26 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: critical
-// language: javascript
-// expected: unsafe deserialization via node-serialize with exec gadget
-
-const serialize = require('node-serialize');
-const express = require('express');
-const router = express.Router();
-
-router.post('/session/restore', (req, res) => {
-  const sessionData = req.cookies.session;
-  if (!sessionData) return res.status(401).json({ error: 'No session' });
-
-  try {
-    // node-serialize.unserialize executes IIFEs embedded in serialized objects
-    // Attacker cookie: {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}
-    const session = serialize.unserialize(Buffer.from(sessionData, 'base64').toString());
-    req.session.user = session.user;
-    res.json({ restored: true, user: session.user });
-  } catch (err) {
-    res.status(400).json({ error: 'Invalid session' });
-  }
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: critical
+// language: javascript
+// expected: unsafe deserialization via node-serialize with exec gadget
+
+const serialize = require('node-serialize');
+const express = require('express');
+const router = express.Router();
+
+router.post('/session/restore', (req, res) => {
+  const sessionData = req.cookies.session;
+  if (!sessionData) return res.status(401).json({ error: 'No session' });
+
+  try {
+    // node-serialize.unserialize executes IIFEs embedded in serialized objects
+    // Attacker cookie: {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}
+    const session = serialize.unserialize(Buffer.from(sessionData, 'base64').toString());
+    req.session.user = session.user;
+    res.json({ restored: true, user: session.user });
+  } catch (err) {
+    res.status(400).json({ error: 'Invalid session' });
+  }
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-054.js

@@ -1,35 +1,35 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: javascript
-// expected: JSON.parse result used directly to call dynamic method — unsafe deserialization pattern
-
-const express = require('express');
-const router = express.Router();
-const actions = require('./actions');
-
-router.post('/task/execute', (req, res) => {
-  const taskJson = req.body.task;
-  // Parsed without schema validation
-  const task = JSON.parse(taskJson);
-
-  // Dynamically dispatching to a method by name from the deserialized object
-  const actionName = task.action;
-  const actionFn = actions[actionName];
-
-  if (!actionFn) return res.status(400).json({ error: 'Unknown action' });
-
-  // task.params passed directly — no sanitization
-  const result = actionFn(task.params);
-  res.json({ result });
-});
-
-router.post('/workflow/resume', (req, res) => {
-  const state = JSON.parse(req.body.workflowState);
-  // state.nextStep used to call internal module functions by name
-  const fn = require('./workflow')[state.nextStep];
-  fn(state.context, state.data);
-  res.json({ resumed: true });
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: javascript
+// expected: JSON.parse result used directly to call dynamic method — unsafe deserialization pattern
+
+const express = require('express');
+const router = express.Router();
+const actions = require('./actions');
+
+router.post('/task/execute', (req, res) => {
+  const taskJson = req.body.task;
+  // Parsed without schema validation
+  const task = JSON.parse(taskJson);
+
+  // Dynamically dispatching to a method by name from the deserialized object
+  const actionName = task.action;
+  const actionFn = actions[actionName];
+
+  if (!actionFn) return res.status(400).json({ error: 'Unknown action' });
+
+  // task.params passed directly — no sanitization
+  const result = actionFn(task.params);
+  res.json({ result });
+});
+
+router.post('/workflow/resume', (req, res) => {
+  const state = JSON.parse(req.body.workflowState);
+  // state.nextStep used to call internal module functions by name
+  const fn = require('./workflow')[state.nextStep];
+  fn(state.context, state.data);
+  res.json({ resumed: true });
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/js/seed-055.js

@@ -1,33 +1,33 @@
-// [CRUCIBLE-SEED]
-// category: deserialization
-// severity: high
-// language: javascript
-// expected: unsafe deserialization via vm.runInNewContext with parsed user data
-
-const vm = require('vm');
-const express = require('express');
-const router = express.Router();
-
-router.post('/sandbox/eval', (req, res) => {
-  const { code, state } = req.body;
-  const parsedState = JSON.parse(state);
-
-  // vm.runInNewContext is NOT a real sandbox — attacker can escape via prototype chain
-  // e.g. code: "this.constructor.constructor('return process')().exit()"
-  const sandbox = Object.assign({}, parsedState, { console, Math, JSON });
-  try {
-    const result = vm.runInNewContext(code, sandbox, { timeout: 2000 });
-    res.json({ result });
-  } catch (err) {
-    res.status(400).json({ error: err.message });
-  }
-});
-
-router.post('/template/execute', (req, res) => {
-  const { template, vars } = req.body;
-  const ctx = JSON.parse(vars);
-  const result = vm.runInNewContext('`' + template + '`', ctx);
-  res.send(result);
-});
-
-module.exports = router;
+// [CRUCIBLE-SEED]
+// category: deserialization
+// severity: high
+// language: javascript
+// expected: unsafe deserialization via vm.runInNewContext with parsed user data
+
+const vm = require('vm');
+const express = require('express');
+const router = express.Router();
+
+router.post('/sandbox/eval', (req, res) => {
+  const { code, state } = req.body;
+  const parsedState = JSON.parse(state);
+
+  // vm.runInNewContext is NOT a real sandbox — attacker can escape via prototype chain
+  // e.g. code: "this.constructor.constructor('return process')().exit()"
+  const sandbox = Object.assign({}, parsedState, { console, Math, JSON });
+  try {
+    const result = vm.runInNewContext(code, sandbox, { timeout: 2000 });
+    res.json({ result });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+router.post('/template/execute', (req, res) => {
+  const { template, vars } = req.body;
+  const ctx = JSON.parse(vars);
+  const result = vm.runInNewContext('`' + template + '`', ctx);
+  res.send(result);
+});
+
+module.exports = router;

package/dist/packages/crucible/seeds/kotlin/seed-001.kt

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Google Maps API key in source code
-
-package com.example.app
-
-import com.google.android.gms.maps.MapsInitializer
-
-object MapConfig {
-    const val GOOGLE_MAPS_API_KEY = "AIzaSyD4f8Kj2mN9pQrT1uVwXyZ3aBcDeF5gHiJ"
-    const val MAPS_SDK_VERSION = "18.1.0"
-
-    fun initialize() {
-        MapsInitializer.initialize(App.context)
-        println("Maps initialized with key: $GOOGLE_MAPS_API_KEY")
-    }
-
-    fun getStaticMapUrl(lat: Double, lng: Double): String {
-        return "https://maps.googleapis.com/maps/api/staticmap" +
-               "?center=$lat,$lng&zoom=13&size=600x300&key=$GOOGLE_MAPS_API_KEY"
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Google Maps API key in source code
+
+package com.example.app
+
+import com.google.android.gms.maps.MapsInitializer
+
+object MapConfig {
+    const val GOOGLE_MAPS_API_KEY = "AIzaSyD4f8Kj2mN9pQrT1uVwXyZ3aBcDeF5gHiJ"
+    const val MAPS_SDK_VERSION = "18.1.0"
+
+    fun initialize() {
+        MapsInitializer.initialize(App.context)
+        println("Maps initialized with key: $GOOGLE_MAPS_API_KEY")
+    }
+
+    fun getStaticMapUrl(lat: Double, lng: Double): String {
+        return "https://maps.googleapis.com/maps/api/staticmap" +
+               "?center=$lat,$lng&zoom=13&size=600x300&key=$GOOGLE_MAPS_API_KEY"
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-002.kt

@@ -1,27 +1,27 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Firebase credentials and project config in source
-
-package com.example.app
-
-object FirebaseConfig {
-    const val API_KEY = "AIzaSyBxK7mP2nQrSuTvWxYz0aCbDcEfGhIjKlM"
-    const val AUTH_DOMAIN = "my-prod-app.firebaseapp.com"
-    const val DATABASE_URL = "https://my-prod-app-default-rtdb.firebaseio.com"
-    const val PROJECT_ID = "my-prod-app"
-    const val STORAGE_BUCKET = "my-prod-app.appspot.com"
-    const val MESSAGING_SENDER_ID = "123456789012"
-    const val APP_ID = "1:123456789012:android:abc123def456ghi789"
-
-    fun getConfig(): Map<String, String> {
-        return mapOf(
-            "apiKey" to API_KEY,
-            "authDomain" to AUTH_DOMAIN,
-            "databaseURL" to DATABASE_URL,
-            "projectId" to PROJECT_ID,
-            "storageBucket" to STORAGE_BUCKET
-        )
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Firebase credentials and project config in source
+
+package com.example.app
+
+object FirebaseConfig {
+    const val API_KEY = "AIzaSyBxK7mP2nQrSuTvWxYz0aCbDcEfGhIjKlM"
+    const val AUTH_DOMAIN = "my-prod-app.firebaseapp.com"
+    const val DATABASE_URL = "https://my-prod-app-default-rtdb.firebaseio.com"
+    const val PROJECT_ID = "my-prod-app"
+    const val STORAGE_BUCKET = "my-prod-app.appspot.com"
+    const val MESSAGING_SENDER_ID = "123456789012"
+    const val APP_ID = "1:123456789012:android:abc123def456ghi789"
+
+    fun getConfig(): Map<String, String> {
+        return mapOf(
+            "apiKey" to API_KEY,
+            "authDomain" to AUTH_DOMAIN,
+            "databaseURL" to DATABASE_URL,
+            "projectId" to PROJECT_ID,
+            "storageBucket" to STORAGE_BUCKET
+        )
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-003.kt

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded AWS access key and secret key in source
-
-package com.example.cloud
-
-import com.amazonaws.auth.BasicAWSCredentials
-
-class AwsClientFactory {
-    companion object {
-        private const val ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE1"
-        private const val SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-        private const val REGION = "us-east-1"
-
-        fun createCredentials(): BasicAWSCredentials {
-            return BasicAWSCredentials(ACCESS_KEY, SECRET_KEY)
-        }
-
-        fun getRegion() = REGION
-    }
-
-    fun uploadToS3(bucket: String, key: String, data: ByteArray) {
-        val creds = createCredentials()
-        // S3 upload logic using hardcoded credentials
-        println("Uploading to s3://$bucket/$key with key ${ACCESS_KEY}")
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded AWS access key and secret key in source
+
+package com.example.cloud
+
+import com.amazonaws.auth.BasicAWSCredentials
+
+class AwsClientFactory {
+    companion object {
+        private const val ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE1"
+        private const val SECRET_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+        private const val REGION = "us-east-1"
+
+        fun createCredentials(): BasicAWSCredentials {
+            return BasicAWSCredentials(ACCESS_KEY, SECRET_KEY)
+        }
+
+        fun getRegion() = REGION
+    }
+
+    fun uploadToS3(bucket: String, key: String, data: ByteArray) {
+        val creds = createCredentials()
+        // S3 upload logic using hardcoded credentials
+        println("Uploading to s3://$bucket/$key with key ${ACCESS_KEY}")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-004.kt

@@ -1,24 +1,24 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded Stripe secret key and webhook secret
-
-package com.example.payments
-
-object StripeConfig {
-    // TODO: move to environment before shipping
-    const val SECRET_KEY = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh"
-    const val PUBLISHABLE_KEY = "pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvut"
-    const val WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ"
-
-    fun getHeaders(): Map<String, String> = mapOf(
-        "Authorization" to "Bearer $SECRET_KEY",
-        "Stripe-Version" to "2023-10-16"
-    )
-
-    fun validateWebhook(payload: String, signature: String): Boolean {
-        // Uses hardcoded webhook secret
-        return signature.contains(WEBHOOK_SECRET.substring(0, 10))
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded Stripe secret key and webhook secret
+
+package com.example.payments
+
+object StripeConfig {
+    // TODO: move to environment before shipping
+    const val SECRET_KEY = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh"
+    const val PUBLISHABLE_KEY = "pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvut"
+    const val WEBHOOK_SECRET = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ"
+
+    fun getHeaders(): Map<String, String> = mapOf(
+        "Authorization" to "Bearer $SECRET_KEY",
+        "Stripe-Version" to "2023-10-16"
+    )
+
+    fun validateWebhook(payload: String, signature: String): Boolean {
+        // Uses hardcoded webhook secret
+        return signature.contains(WEBHOOK_SECRET.substring(0, 10))
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-005.kt

@@ -1,29 +1,29 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: kotlin
-// expected: Hardcoded database password and connection string
-
-package com.example.data
-
-import java.sql.DriverManager
-
-class DatabaseConnection {
-    private val dbUrl = "jdbc:mysql://prod-db.internal.example.com:3306/appdb"
-    private val dbUser = "app_user"
-    private val dbPassword = "Sup3rS3cr3tP@ssw0rd!2024"
-
-    fun getConnection() = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
-
-    fun healthCheck(): Boolean {
-        return try {
-            val conn = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
-            val alive = !conn.isClosed
-            conn.close()
-            alive
-        } catch (e: Exception) {
-            println("DB connection failed: ${e.message}")
-            false
-        }
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: kotlin
+// expected: Hardcoded database password and connection string
+
+package com.example.data
+
+import java.sql.DriverManager
+
+class DatabaseConnection {
+    private val dbUrl = "jdbc:mysql://prod-db.internal.example.com:3306/appdb"
+    private val dbUser = "app_user"
+    private val dbPassword = "Sup3rS3cr3tP@ssw0rd!2024"
+
+    fun getConnection() = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
+
+    fun healthCheck(): Boolean {
+        return try {
+            val conn = DriverManager.getConnection(dbUrl, dbUser, dbPassword)
+            val alive = !conn.isClosed
+            conn.close()
+            alive
+        } catch (e: Exception) {
+            println("DB connection failed: ${e.message}")
+            false
+        }
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-006.kt

@@ -1,21 +1,21 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: kotlin
-// expected: Hardcoded JWT secret and admin password
-
-package com.example.auth
-
-object AuthConstants {
-    const val JWT_SECRET = "mySuperSecretJWTKey_doNotShare_2024_production"
-    const val ADMIN_PASSWORD = "Admin@123456!"
-    const val API_TOKEN = "tok_prod_7f3k9m2p4r8s1t6u0v5w"
-    const val ENCRYPTION_KEY = "AES256Key-32CharactersLongSecret!!"
-
-    fun generateToken(userId: String): String {
-        // Signs JWT with hardcoded secret
-        return "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.$userId.${JWT_SECRET.hashCode()}"
-    }
-
-    fun isAdmin(password: String) = password == ADMIN_PASSWORD
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: kotlin
+// expected: Hardcoded JWT secret and admin password
+
+package com.example.auth
+
+object AuthConstants {
+    const val JWT_SECRET = "mySuperSecretJWTKey_doNotShare_2024_production"
+    const val ADMIN_PASSWORD = "Admin@123456!"
+    const val API_TOKEN = "tok_prod_7f3k9m2p4r8s1t6u0v5w"
+    const val ENCRYPTION_KEY = "AES256Key-32CharactersLongSecret!!"
+
+    fun generateToken(userId: String): String {
+        // Signs JWT with hardcoded secret
+        return "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.$userId.${JWT_SECRET.hashCode()}"
+    }
+
+    fun isAdmin(password: String) = password == ADMIN_PASSWORD
+}

package/dist/packages/crucible/seeds/kotlin/seed-007.kt

@@ -1,23 +1,23 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded SendGrid and Twilio API keys
-
-package com.example.notifications
-
-object NotificationConfig {
-    const val SENDGRID_API_KEY = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
-    const val TWILIO_ACCOUNT_SID = "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-    const val TWILIO_AUTH_TOKEN = "your_auth_token_here_32chars_long!!"
-    const val TWILIO_PHONE = "+15005550006"
-    const val FROM_EMAIL = "noreply@example.com"
-
-    fun sendSms(to: String, message: String) {
-        println("Sending via SID: $TWILIO_ACCOUNT_SID, Token: $TWILIO_AUTH_TOKEN")
-    }
-
-    fun sendEmail(to: String, subject: String, body: String) {
-        println("Sending via SendGrid key: $SENDGRID_API_KEY")
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded SendGrid and Twilio API keys
+
+package com.example.notifications
+
+object NotificationConfig {
+    const val SENDGRID_API_KEY = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
+    const val TWILIO_ACCOUNT_SID = "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+    const val TWILIO_AUTH_TOKEN = "your_auth_token_here_32chars_long!!"
+    const val TWILIO_PHONE = "+15005550006"
+    const val FROM_EMAIL = "noreply@example.com"
+
+    fun sendSms(to: String, message: String) {
+        println("Sending via SID: $TWILIO_ACCOUNT_SID, Token: $TWILIO_AUTH_TOKEN")
+    }
+
+    fun sendEmail(to: String, subject: String, body: String) {
+        println("Sending via SendGrid key: $SENDGRID_API_KEY")
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-008.kt

@@ -1,25 +1,25 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: kotlin
-// expected: Hardcoded OAuth client secret and refresh token
-
-package com.example.oauth
-
-class OAuthClient {
-    private val clientId = "1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
-    private val clientSecret = "GOCSPX-abcdefghijklmnopqrstuvwxyz123456"
-    private val refreshToken = "1//0fxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz"
-
-    fun refreshAccessToken(): String {
-        val body = "client_id=$clientId&client_secret=$clientSecret" +
-                   "&refresh_token=$refreshToken&grant_type=refresh_token"
-        // Makes HTTP POST with hardcoded credentials
-        return performTokenRequest(body)
-    }
-
-    private fun performTokenRequest(body: String): String {
-        println("Refreshing token with secret: $clientSecret")
-        return "mock_access_token"
-    }
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: kotlin
+// expected: Hardcoded OAuth client secret and refresh token
+
+package com.example.oauth
+
+class OAuthClient {
+    private val clientId = "1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
+    private val clientSecret = "GOCSPX-abcdefghijklmnopqrstuvwxyz123456"
+    private val refreshToken = "1//0fxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-abcdefghijklmnopqrstuvwxyz"
+
+    fun refreshAccessToken(): String {
+        val body = "client_id=$clientId&client_secret=$clientSecret" +
+                   "&refresh_token=$refreshToken&grant_type=refresh_token"
+        // Makes HTTP POST with hardcoded credentials
+        return performTokenRequest(body)
+    }
+
+    private fun performTokenRequest(body: String): String {
+        println("Refreshing token with secret: $clientSecret")
+        return "mock_access_token"
+    }
+}

package/dist/packages/crucible/seeds/kotlin/seed-009.kt

@@ -1,21 +1,21 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: kotlin
-// expected: Raw SQL query with string interpolation, no parameterization
-
-package com.example.data
-
-import android.database.sqlite.SQLiteDatabase
-
-class UserRepository(private val db: SQLiteDatabase) {
-    fun findUserByUsername(username: String): android.database.Cursor {
-        val query = "SELECT * FROM users WHERE username = '$username'"
-        return db.rawQuery(query, null)
-    }
-
-    fun getUserPosts(userId: String): android.database.Cursor {
-        val sql = "SELECT title, body FROM posts WHERE user_id = $userId ORDER BY created_at DESC"
-        return db.rawQuery(sql, null)
-    }
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: kotlin
+// expected: Raw SQL query with string interpolation, no parameterization
+
+package com.example.data
+
+import android.database.sqlite.SQLiteDatabase
+
+class UserRepository(private val db: SQLiteDatabase) {
+    fun findUserByUsername(username: String): android.database.Cursor {
+        val query = "SELECT * FROM users WHERE username = '$username'"
+        return db.rawQuery(query, null)
+    }
+
+    fun getUserPosts(userId: String): android.database.Cursor {
+        val sql = "SELECT title, body FROM posts WHERE user_id = $userId ORDER BY created_at DESC"
+        return db.rawQuery(sql, null)
+    }
+}