thuban 0.4.3 → 0.4.5

package/dist/packages/crucible/seeds/ts/seed-005 2.ts

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
-
-import sgMail from '@sendgrid/mail';
-import nodemailer from 'nodemailer';
-
-const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_KEY);
-
-interface EmailOptions {
-  to: string;
-  subject: string;
-  text?: string;
-  html?: string;
-}
-
-export async function sendTransactional(opts: EmailOptions): Promise<void> {
-  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
-}
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.myapp.com',
-  port: 587,
-  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
-});
-
-export async function sendInternal(opts: EmailOptions): Promise<void> {
-  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}

package/dist/packages/crucible/seeds/ts/seed-005.ts

@@ -1,32 +1,32 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
-
-import sgMail from '@sendgrid/mail';
-import nodemailer from 'nodemailer';
-
-const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
-sgMail.setApiKey(SENDGRID_KEY);
-
-interface EmailOptions {
-  to: string;
-  subject: string;
-  text?: string;
-  html?: string;
-}
-
-export async function sendTransactional(opts: EmailOptions): Promise<void> {
-  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
-}
-
-const smtpTransport = nodemailer.createTransport({
-  host: 'smtp.myapp.com',
-  port: 587,
-  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
-});
-
-export async function sendInternal(opts: EmailOptions): Promise<void> {
-  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded SendGrid API key and SMTP credentials in typed mailer service
+
+import sgMail from '@sendgrid/mail';
+import nodemailer from 'nodemailer';
+
+const SENDGRID_KEY = 'SG.abcDEFghiJKLmnoPQRstUVwxYZ.1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcd';
+sgMail.setApiKey(SENDGRID_KEY);
+
+interface EmailOptions {
+  to: string;
+  subject: string;
+  text?: string;
+  html?: string;
+}
+
+export async function sendTransactional(opts: EmailOptions): Promise<void> {
+  await sgMail.send({ ...opts, from: 'noreply@myapp.com' });
+}
+
+const smtpTransport = nodemailer.createTransport({
+  host: 'smtp.myapp.com',
+  port: 587,
+  auth: { user: 'mailer@myapp.com', pass: 'Smtp$Pass#2024!' },
+});
+
+export async function sendInternal(opts: EmailOptions): Promise<void> {
+  await smtpTransport.sendMail({ ...opts, from: 'internal@myapp.com' });
+}

package/dist/packages/crucible/seeds/ts/seed-006 2.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
-
-import { Octokit } from '@octokit/rest';
-import axios from 'axios';
-
-interface IntegrationConfig {
-  githubToken: string;
-  slackWebhookUrl: string;
-  slackSigningSecret: string;
-}
-
-const config: IntegrationConfig = {
-  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
-  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
-  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
-};
-
-const octokit = new Octokit({ auth: config.githubToken });
-
-export async function postToSlack(text: string): Promise<void> {
-  await axios.post(config.slackWebhookUrl, { text });
-}
-
-export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
-  const { data } = await octokit.issues.create({ owner, repo, title });
-  return data.number;
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
+
+import { Octokit } from '@octokit/rest';
+import axios from 'axios';
+
+interface IntegrationConfig {
+  githubToken: string;
+  slackWebhookUrl: string;
+  slackSigningSecret: string;
+}
+
+const config: IntegrationConfig = {
+  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
+  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
+  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
+};
+
+const octokit = new Octokit({ auth: config.githubToken });
+
+export async function postToSlack(text: string): Promise<void> {
+  await axios.post(config.slackWebhookUrl, { text });
+}
+
+export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
+  const { data } = await octokit.issues.create({ owner, repo, title });
+  return data.number;
+}

package/dist/packages/crucible/seeds/ts/seed-006.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: critical
-// language: typescript
-// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
-
-import { Octokit } from '@octokit/rest';
-import axios from 'axios';
-
-interface IntegrationConfig {
-  githubToken: string;
-  slackWebhookUrl: string;
-  slackSigningSecret: string;
-}
-
-const config: IntegrationConfig = {
-  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
-  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
-  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
-};
-
-const octokit = new Octokit({ auth: config.githubToken });
-
-export async function postToSlack(text: string): Promise<void> {
-  await axios.post(config.slackWebhookUrl, { text });
-}
-
-export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
-  const { data } = await octokit.issues.create({ owner, repo, title });
-  return data.number;
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: typescript
+// expected: hardcoded GitHub token and Slack webhook URL in typed integration config
+
+import { Octokit } from '@octokit/rest';
+import axios from 'axios';
+
+interface IntegrationConfig {
+  githubToken: string;
+  slackWebhookUrl: string;
+  slackSigningSecret: string;
+}
+
+const config: IntegrationConfig = {
+  githubToken: 'ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890',
+  slackWebhookUrl: 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX',
+  slackSigningSecret: 'abc123def456ghi789jkl012mno345pqr678stu',
+};
+
+const octokit = new Octokit({ auth: config.githubToken });
+
+export async function postToSlack(text: string): Promise<void> {
+  await axios.post(config.slackWebhookUrl, { text });
+}
+
+export async function createIssue(owner: string, repo: string, title: string): Promise<number> {
+  const { data } = await octokit.issues.create({ owner, repo, title });
+  return data.number;
+}

package/dist/packages/crucible/seeds/ts/seed-007 2.ts

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded encryption key and static IV in typed crypto utility
-
-import * as crypto from 'crypto';
-
-const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
-const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
-
-export function encrypt(plaintext: string): string {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-}
-
-export function decrypt(ciphertext: string): string {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-export function hashToken(token: string): string {
-  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded encryption key and static IV in typed crypto utility
+
+import * as crypto from 'crypto';
+
+const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
+const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
+
+export function encrypt(plaintext: string): string {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  return encrypted;
+}
+
+export function decrypt(ciphertext: string): string {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+export function hashToken(token: string): string {
+  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-007.ts

@@ -1,28 +1,28 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded encryption key and static IV in typed crypto utility
-
-import * as crypto from 'crypto';
-
-const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
-const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
-
-export function encrypt(plaintext: string): string {
-  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-}
-
-export function decrypt(ciphertext: string): string {
-  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
-  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
-  decrypted += decipher.final('utf8');
-  return decrypted;
-}
-
-export function hashToken(token: string): string {
-  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
-}
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded encryption key and static IV in typed crypto utility
+
+import * as crypto from 'crypto';
+
+const ENCRYPTION_KEY: Buffer = Buffer.from('12345678901234567890123456789012', 'utf8'); // 32 bytes
+const STATIC_IV: Buffer = Buffer.from('abcdef1234567890', 'utf8'); // 16 bytes — never rotated
+
+export function encrypt(plaintext: string): string {
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  return encrypted;
+}
+
+export function decrypt(ciphertext: string): string {
+  const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, STATIC_IV);
+  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+export function hashToken(token: string): string {
+  return crypto.createHash('md5').update(token + 'static-pepper').digest('hex');
+}

package/dist/packages/crucible/seeds/ts/seed-008 2.ts

@@ -1,40 +1,40 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded OAuth2 client credentials and admin API key in typed config
-
-import { Router, Request, Response } from 'express';
-
-interface OAuthConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-interface AdminConfig {
-  apiKey: string;
-  adminPassword: string;
-}
-
-const oauthConfig: OAuthConfig = {
-  clientId: 'oauth2-client-production-id-abc123',
-  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
-  redirectUri: 'https://app.company.com/oauth/callback',
-};
-
-const adminConfig: AdminConfig = {
-  apiKey: 'admin-api-key-supersecret-prod-2024',
-  adminPassword: 'AdminP@ssw0rd!#$',
-};
-
-const router = Router();
-
-router.post('/oauth/token', (req: Request, res: Response) => {
-  if (req.body.client_secret !== oauthConfig.clientSecret) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  res.json({ access_token: 'generated', token_type: 'bearer' });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded OAuth2 client credentials and admin API key in typed config
+
+import { Router, Request, Response } from 'express';
+
+interface OAuthConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+}
+
+interface AdminConfig {
+  apiKey: string;
+  adminPassword: string;
+}
+
+const oauthConfig: OAuthConfig = {
+  clientId: 'oauth2-client-production-id-abc123',
+  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
+  redirectUri: 'https://app.company.com/oauth/callback',
+};
+
+const adminConfig: AdminConfig = {
+  apiKey: 'admin-api-key-supersecret-prod-2024',
+  adminPassword: 'AdminP@ssw0rd!#$',
+};
+
+const router = Router();
+
+router.post('/oauth/token', (req: Request, res: Response) => {
+  if (req.body.client_secret !== oauthConfig.clientSecret) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  res.json({ access_token: 'generated', token_type: 'bearer' });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-008.ts

@@ -1,40 +1,40 @@
-// [CRUCIBLE-SEED]
-// category: hardcoded_secret
-// severity: high
-// language: typescript
-// expected: hardcoded OAuth2 client credentials and admin API key in typed config
-
-import { Router, Request, Response } from 'express';
-
-interface OAuthConfig {
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-interface AdminConfig {
-  apiKey: string;
-  adminPassword: string;
-}
-
-const oauthConfig: OAuthConfig = {
-  clientId: 'oauth2-client-production-id-abc123',
-  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
-  redirectUri: 'https://app.company.com/oauth/callback',
-};
-
-const adminConfig: AdminConfig = {
-  apiKey: 'admin-api-key-supersecret-prod-2024',
-  adminPassword: 'AdminP@ssw0rd!#$',
-};
-
-const router = Router();
-
-router.post('/oauth/token', (req: Request, res: Response) => {
-  if (req.body.client_secret !== oauthConfig.clientSecret) {
-    return res.status(401).json({ error: 'invalid_client' });
-  }
-  res.json({ access_token: 'generated', token_type: 'bearer' });
-});
-
-export default router;
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: typescript
+// expected: hardcoded OAuth2 client credentials and admin API key in typed config
+
+import { Router, Request, Response } from 'express';
+
+interface OAuthConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+}
+
+interface AdminConfig {
+  apiKey: string;
+  adminPassword: string;
+}
+
+const oauthConfig: OAuthConfig = {
+  clientId: 'oauth2-client-production-id-abc123',
+  clientSecret: 'oauth2-client-secret-XyZ9876543210abcdefGHIJKL',
+  redirectUri: 'https://app.company.com/oauth/callback',
+};
+
+const adminConfig: AdminConfig = {
+  apiKey: 'admin-api-key-supersecret-prod-2024',
+  adminPassword: 'AdminP@ssw0rd!#$',
+};
+
+const router = Router();
+
+router.post('/oauth/token', (req: Request, res: Response) => {
+  if (req.body.client_secret !== oauthConfig.clientSecret) {
+    return res.status(401).json({ error: 'invalid_client' });
+  }
+  res.json({ access_token: 'generated', token_type: 'bearer' });
+});
+
+export default router;

package/dist/packages/crucible/seeds/ts/seed-009 2.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection via TypeORM query() with string concatenation
-
-import { AppDataSource } from '../data-source';
-
-export async function findUserByUsername(username: string) {
-  // Raw query with direct string interpolation — bypasses parameterization
-  const result = await AppDataSource.query(
-    `SELECT * FROM users WHERE username = '${username}'`
-  );
-  return result[0] ?? null;
-}
-
-export async function searchProducts(term: string, category: string) {
-  const sql = `
-    SELECT p.*, c.name as category_name
-    FROM products p
-    JOIN categories c ON p.category_id = c.id
-    WHERE p.name ILIKE '%` + term + `%'
-    AND c.slug = '` + category + `'
-    ORDER BY p.created_at DESC
-  `;
-  return AppDataSource.query(sql);
-}
-
-export async function deleteUserSessions(userId: string) {
-  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: typescript
+// expected: SQL injection via TypeORM query() with string concatenation
+
+import { AppDataSource } from '../data-source';
+
+export async function findUserByUsername(username: string) {
+  // Raw query with direct string interpolation — bypasses parameterization
+  const result = await AppDataSource.query(
+    `SELECT * FROM users WHERE username = '${username}'`
+  );
+  return result[0] ?? null;
+}
+
+export async function searchProducts(term: string, category: string) {
+  const sql = `
+    SELECT p.*, c.name as category_name
+    FROM products p
+    JOIN categories c ON p.category_id = c.id
+    WHERE p.name ILIKE '%` + term + `%'
+    AND c.slug = '` + category + `'
+    ORDER BY p.created_at DESC
+  `;
+  return AppDataSource.query(sql);
+}
+
+export async function deleteUserSessions(userId: string) {
+  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
+}

package/dist/packages/crucible/seeds/ts/seed-009.ts

@@ -1,31 +1,31 @@
-// [CRUCIBLE-SEED]
-// category: sql_injection
-// severity: critical
-// language: typescript
-// expected: SQL injection via TypeORM query() with string concatenation
-
-import { AppDataSource } from '../data-source';
-
-export async function findUserByUsername(username: string) {
-  // Raw query with direct string interpolation — bypasses parameterization
-  const result = await AppDataSource.query(
-    `SELECT * FROM users WHERE username = '${username}'`
-  );
-  return result[0] ?? null;
-}
-
-export async function searchProducts(term: string, category: string) {
-  const sql = `
-    SELECT p.*, c.name as category_name
-    FROM products p
-    JOIN categories c ON p.category_id = c.id
-    WHERE p.name ILIKE '%` + term + `%'
-    AND c.slug = '` + category + `'
-    ORDER BY p.created_at DESC
-  `;
-  return AppDataSource.query(sql);
-}
-
-export async function deleteUserSessions(userId: string) {
-  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
-}
+// [CRUCIBLE-SEED]
+// category: sql_injection
+// severity: critical
+// language: typescript
+// expected: SQL injection via TypeORM query() with string concatenation
+
+import { AppDataSource } from '../data-source';
+
+export async function findUserByUsername(username: string) {
+  // Raw query with direct string interpolation — bypasses parameterization
+  const result = await AppDataSource.query(
+    `SELECT * FROM users WHERE username = '${username}'`
+  );
+  return result[0] ?? null;
+}
+
+export async function searchProducts(term: string, category: string) {
+  const sql = `
+    SELECT p.*, c.name as category_name
+    FROM products p
+    JOIN categories c ON p.category_id = c.id
+    WHERE p.name ILIKE '%` + term + `%'
+    AND c.slug = '` + category + `'
+    ORDER BY p.created_at DESC
+  `;
+  return AppDataSource.query(sql);
+}
+
+export async function deleteUserSessions(userId: string) {
+  await AppDataSource.query('DELETE FROM sessions WHERE user_id = ' + userId);
+}