vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/report-engine.js

@@ -0,0 +1,626 @@
+/**
+ * Report Engine - Enterprise Data Processing
+ * 
+ * Handles:
+ * - Data normalization from multiple scan sources
+ * - Trend analysis from historical reports
+ * - Export to multiple formats (JSON, SARIF, CSV, Markdown)
+ * - Fix time estimation based on severity and type
+ * - Category scoring and aggregation
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+// Severity weights for scoring
+const SEVERITY_WEIGHTS = {
+  critical: 25,
+  high: 15,
+  medium: 5,
+  low: 1,
+  info: 0,
+};
+
+// Fix time estimates in minutes by severity
+const FIX_TIME_ESTIMATES = {
+  critical: { min: 45, max: 120, avg: 60 },
+  high: { min: 30, max: 60, avg: 45 },
+  medium: { min: 15, max: 30, avg: 20 },
+  low: { min: 5, max: 15, avg: 10 },
+  info: { min: 2, max: 10, avg: 5 },
+};
+
+// Fix time by finding type
+const TYPE_MULTIPLIERS = {
+  secret: 1.5, // Requires key rotation
+  auth: 2.0, // Complex logic
+  billing: 2.5, // Critical + testing
+  injection: 1.5,
+  xss: 1.2,
+  config: 0.8,
+  quality: 0.5,
+  mock: 0.6,
+  error: 0.7,
+};
+
+/**
+ * Build comprehensive report data from scan results
+ */
+function buildReportData(shipResults, opts = {}) {
+  const { projectName = "Unknown", repoRoot = ".", includeTrends = false } = opts;
+  
+  // Normalize findings
+  const rawFindings = shipResults?.findings || [];
+  const findings = rawFindings.map((f, i) => normalizeFinding(f, i));
+  
+  // Calculate severity counts
+  const severityCounts = {
+    critical: findings.filter(f => f.severity === "critical").length,
+    high: findings.filter(f => f.severity === "high").length,
+    medium: findings.filter(f => f.severity === "medium").length,
+    low: findings.filter(f => f.severity === "low").length,
+    info: findings.filter(f => f.severity === "info").length,
+  };
+  
+  // Calculate score
+  const score = calculateScore(severityCounts, findings.length);
+  
+  // Determine verdict
+  const verdict = determineVerdict(severityCounts, score);
+  
+  // Group by category
+  const byCategory = groupByCategory(findings);
+  const categoryScores = calculateCategoryScores(byCategory);
+  
+  // Calculate fix estimates
+  const fixEstimates = calculateFixEstimates(findings);
+  
+  // Process truthpack
+  const truthpack = processTruthpack(shipResults?.truthpack);
+  
+  // Process reality data
+  const reality = processReality(shipResults?.reality);
+  
+  // Load trends if requested
+  let trends = null;
+  if (includeTrends) {
+    trends = loadTrends(repoRoot);
+  }
+  
+  return {
+    meta: {
+      projectName,
+      generatedAt: new Date().toISOString(),
+      version: "2.0.0",
+      reportId: generateReportId(),
+      repoRoot,
+    },
+    summary: {
+      score,
+      verdict,
+      totalFindings: findings.length,
+      severityCounts,
+      categoryScores,
+      topBlockers: findings.filter(f => f.severity === "critical").slice(0, 5),
+    },
+    findings,
+    fixEstimates,
+    truthpack,
+    reality,
+    trends,
+  };
+}
+
+/**
+ * Normalize a finding to consistent format
+ */
+function normalizeFinding(f, index) {
+  const severity = normalizeSeverity(f.severity);
+  const type = normalizeType(f.type || f.category);
+  
+  return {
+    id: f.id || `F${String(index + 1).padStart(3, "0")}`,
+    severity,
+    type,
+    title: f.title || f.message || "Unknown issue",
+    message: f.message || f.title || "",
+    description: f.description || "",
+    file: f.file || f.path || null,
+    line: f.line || f.lineNumber || null,
+    column: f.column || null,
+    fix: f.fix || f.recommendation || f.suggestion || null,
+    cwe: f.cwe || null,
+    references: f.references || [],
+    confidence: f.confidence || "high",
+    falsePositive: f.falsePositive || false,
+  };
+}
+
+/**
+ * Normalize severity to standard values
+ */
+function normalizeSeverity(sev) {
+  const s = String(sev || "").toLowerCase();
+  if (s === "block" || s === "critical" || s === "blocker") return "critical";
+  if (s === "high" || s === "error") return "high";
+  if (s === "warn" || s === "warning" || s === "medium") return "medium";
+  if (s === "info" || s === "low" || s === "note") return "low";
+  return "info";
+}
+
+/**
+ * Normalize finding type
+ */
+function normalizeType(type) {
+  const t = String(type || "").toLowerCase();
+  const typeMap = {
+    secret: ["secret", "credential", "key", "token", "password", "api_key"],
+    auth: ["auth", "authentication", "authorization", "session", "jwt"],
+    billing: ["billing", "payment", "stripe", "subscription", "checkout"],
+    injection: ["injection", "sql", "nosql", "command", "ldap"],
+    xss: ["xss", "cross-site", "script"],
+    config: ["config", "configuration", "env", "environment"],
+    quality: ["quality", "lint", "style", "format"],
+    mock: ["mock", "stub", "fake", "dummy", "placeholder"],
+    error: ["error", "exception", "catch", "handling"],
+    route: ["route", "endpoint", "path", "url"],
+  };
+  
+  for (const [category, keywords] of Object.entries(typeMap)) {
+    if (keywords.some(k => t.includes(k))) return category;
+  }
+  return "other";
+}
+
+/**
+ * Calculate overall score
+ */
+function calculateScore(severityCounts, totalFindings) {
+  if (totalFindings === 0) return 100;
+  
+  const deductions =
+    severityCounts.critical * SEVERITY_WEIGHTS.critical +
+    severityCounts.high * SEVERITY_WEIGHTS.high +
+    severityCounts.medium * SEVERITY_WEIGHTS.medium +
+    severityCounts.low * SEVERITY_WEIGHTS.low;
+  
+  // Cap deductions at 100
+  const score = Math.max(0, 100 - deductions);
+  return Math.round(score);
+}
+
+/**
+ * Determine verdict from score and findings
+ */
+function determineVerdict(severityCounts, score) {
+  if (severityCounts.critical > 0) return "BLOCK";
+  if (severityCounts.high > 2 || score < 60) return "BLOCK";
+  if (severityCounts.high > 0 || severityCounts.medium > 5 || score < 80) return "WARN";
+  return "SHIP";
+}
+
+/**
+ * Group findings by category
+ */
+function groupByCategory(findings) {
+  const groups = {};
+  for (const f of findings) {
+    const cat = f.type || "other";
+    if (!groups[cat]) groups[cat] = [];
+    groups[cat].push(f);
+  }
+  return groups;
+}
+
+/**
+ * Calculate category scores
+ */
+function calculateCategoryScores(byCategory) {
+  const scores = {};
+  
+  for (const [cat, findings] of Object.entries(byCategory)) {
+    const deductions = findings.reduce((sum, f) => {
+      return sum + (SEVERITY_WEIGHTS[f.severity] || 0);
+    }, 0);
+    
+    scores[cat] = Math.max(0, Math.min(100, 100 - deductions));
+  }
+  
+  return scores;
+}
+
+/**
+ * Calculate fix time estimates
+ */
+function calculateFixEstimates(findings) {
+  let totalMin = 0;
+  let totalMax = 0;
+  let totalAvg = 0;
+  
+  const bySeverity = {};
+  
+  for (const f of findings) {
+    const sev = f.severity;
+    const type = f.type;
+    const base = FIX_TIME_ESTIMATES[sev] || FIX_TIME_ESTIMATES.medium;
+    const multiplier = TYPE_MULTIPLIERS[type] || 1.0;
+    
+    totalMin += Math.round(base.min * multiplier);
+    totalMax += Math.round(base.max * multiplier);
+    totalAvg += Math.round(base.avg * multiplier);
+    
+    if (!bySeverity[sev]) bySeverity[sev] = { count: 0, minutes: 0 };
+    bySeverity[sev].count++;
+    bySeverity[sev].minutes += Math.round(base.avg * multiplier);
+  }
+  
+  return {
+    totalMinutes: totalAvg,
+    range: { min: totalMin, max: totalMax },
+    humanReadable: formatDuration(totalAvg),
+    rangeReadable: `${formatDuration(totalMin)} - ${formatDuration(totalMax)}`,
+    bySeverity,
+  };
+}
+
+/**
+ * Format duration in minutes to human readable
+ */
+function formatDuration(minutes) {
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.round(minutes / 60 * 10) / 10;
+  if (hours < 8) return `${hours}h`;
+  const days = Math.round(hours / 8 * 10) / 10;
+  return `${days}d`;
+}
+
+/**
+ * Process truthpack data
+ */
+function processTruthpack(truthpack) {
+  if (!truthpack) return null;
+  
+  return {
+    routes: Array.isArray(truthpack.routes?.server) ? truthpack.routes.server.length : 0,
+    envVars: Array.isArray(truthpack.env?.vars) ? truthpack.env.vars.length : 0,
+    hasAuth: !!(truthpack.auth?.nextMiddleware?.length || truthpack.auth?.middleware?.length),
+    hasBilling: !!(truthpack.billing?.webhooks?.length || truthpack.billing?.stripeConfig),
+    rawCounts: {
+      serverRoutes: truthpack.routes?.server?.length || 0,
+      clientRoutes: truthpack.routes?.client?.length || 0,
+      envVars: truthpack.env?.vars?.length || 0,
+      authMiddleware: truthpack.auth?.nextMiddleware?.length || truthpack.auth?.middleware?.length || 0,
+      webhooks: truthpack.billing?.webhooks?.length || 0,
+    },
+  };
+}
+
+/**
+ * Process reality mode data
+ */
+function processReality(reality) {
+  if (!reality) return null;
+  
+  return {
+    coverage: reality.coverage || {},
+    brokenFlows: reality.brokenFlows || [],
+    unmappedRequests: reality.unmappedRequests || [],
+    latencyP95: reality.latencyP95 || null,
+    latencySparkline: reality.latencySparkline || [],
+    requestsOverTime: reality.requestsOverTime || [],
+    totalRequests: reality.totalRequests || 0,
+  };
+}
+
+/**
+ * Load historical trends
+ */
+function loadTrends(repoRoot) {
+  const historyDir = path.join(repoRoot, ".vibecheck", "history");
+  if (!fs.existsSync(historyDir)) return null;
+  
+  try {
+    const files = fs.readdirSync(historyDir)
+      .filter(f => f.endsWith(".json"))
+      .sort()
+      .slice(-30); // Last 30 entries
+    
+    const dataPoints = files.map(f => {
+      try {
+        const data = JSON.parse(fs.readFileSync(path.join(historyDir, f), "utf8"));
+        return {
+          date: f.replace(".json", ""),
+          score: data.summary?.score || 0,
+          findings: data.summary?.totalFindings || 0,
+          critical: data.summary?.severityCounts?.critical || 0,
+        };
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+    
+    if (dataPoints.length === 0) return null;
+    
+    // Calculate trend
+    const scores = dataPoints.map(d => d.score);
+    const trend = scores.length >= 2 ? scores[scores.length - 1] - scores[0] : 0;
+    
+    return {
+      dataPoints,
+      trend,
+      trendDirection: trend > 0 ? "improving" : trend < 0 ? "declining" : "stable",
+      averageScore: Math.round(scores.reduce((a, b) => a + b, 0) / scores.length),
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Generate unique report ID
+ */
+function generateReportId() {
+  const timestamp = Date.now().toString(36).toUpperCase();
+  const random = Math.random().toString(36).substring(2, 6).toUpperCase();
+  return `VC-${timestamp}-${random}`;
+}
+
+// ============================================================================
+// EXPORT FORMATS
+// ============================================================================
+
+/**
+ * Export to JSON
+ */
+function exportToJSON(reportData) {
+  return JSON.stringify(reportData, null, 2);
+}
+
+/**
+ * Export to SARIF format
+ */
+function exportToSARIF(reportData) {
+  const rules = new Map();
+  const results = [];
+  
+  for (const f of reportData.findings) {
+    // Build rule if not exists
+    if (!rules.has(f.id)) {
+      rules.set(f.id, {
+        id: f.id,
+        name: f.type ? `${f.type}/${f.id}` : f.id,
+        shortDescription: { text: f.title },
+        fullDescription: { text: f.description || f.message },
+        defaultConfiguration: {
+          level: sarifLevel(f.severity),
+        },
+        helpUri: f.references?.[0] || "https://vibecheck.dev/docs",
+        properties: {
+          category: f.type,
+          cwe: f.cwe,
+        },
+      });
+    }
+    
+    // Build result
+    const result = {
+      ruleId: f.id,
+      level: sarifLevel(f.severity),
+      message: { text: f.message || f.title },
+      locations: [],
+    };
+    
+    if (f.file) {
+      result.locations.push({
+        physicalLocation: {
+          artifactLocation: { uri: f.file },
+          region: f.line ? { startLine: f.line, startColumn: f.column || 1 } : undefined,
+        },
+      });
+    }
+    
+    if (f.fix) {
+      result.fixes = [{
+        description: { text: f.fix },
+      }];
+    }
+    
+    results.push(result);
+  }
+  
+  return {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: {
+        driver: {
+          name: "VibeCheck",
+          version: reportData.meta.version,
+          informationUri: "https://vibecheck.dev",
+          rules: Array.from(rules.values()),
+        },
+      },
+      results,
+      invocations: [{
+        executionSuccessful: true,
+        endTimeUtc: reportData.meta.generatedAt,
+      }],
+    }],
+  };
+}
+
+/**
+ * Convert severity to SARIF level
+ */
+function sarifLevel(severity) {
+  const levels = { critical: "error", high: "error", medium: "warning", low: "note", info: "none" };
+  return levels[severity] || "warning";
+}
+
+/**
+ * Export to CSV
+ */
+function exportToCSV(reportData) {
+  const headers = [
+    "ID",
+    "Severity",
+    "Type",
+    "Title",
+    "File",
+    "Line",
+    "Fix",
+    "CWE",
+    "Confidence",
+  ];
+  
+  const rows = reportData.findings.map(f => [
+    f.id,
+    f.severity,
+    f.type,
+    csvEscape(f.title),
+    f.file || "",
+    f.line || "",
+    csvEscape(f.fix || ""),
+    f.cwe || "",
+    f.confidence,
+  ]);
+  
+  return [
+    headers.join(","),
+    ...rows.map(r => r.join(",")),
+  ].join("\n");
+}
+
+/**
+ * Escape CSV value
+ */
+function csvEscape(val) {
+  if (!val) return "";
+  const str = String(val);
+  if (str.includes(",") || str.includes('"') || str.includes("\n")) {
+    return `"${str.replace(/"/g, '""')}"`;
+  }
+  return str;
+}
+
+/**
+ * Export to Markdown
+ */
+function exportToMarkdown(reportData, opts = {}) {
+  const { meta, summary, findings, fixEstimates, reality } = reportData;
+  const redactPaths = opts.redactPaths || false;
+  
+  let md = `# VibeCheck Report
+
+**Project:** ${meta.projectName}  
+**Generated:** ${new Date(meta.generatedAt).toLocaleString()}  
+**Report ID:** ${meta.reportId}
+
+---
+
+## Summary
+
+| Metric | Value |
+|--------|-------|
+| Score | **${summary.score}/100** |
+| Verdict | **${summary.verdict}** |
+| Total Findings | ${summary.totalFindings} |
+| Critical | ${summary.severityCounts.critical} |
+| High | ${summary.severityCounts.high} |
+| Medium | ${summary.severityCounts.medium} |
+| Low | ${summary.severityCounts.low} |
+| Est. Fix Time | ${fixEstimates?.humanReadable || 'N/A'} |
+
+---
+
+## Findings
+
+`;
+
+  // Group by severity
+  const bySeverity = {
+    critical: findings.filter(f => f.severity === "critical"),
+    high: findings.filter(f => f.severity === "high"),
+    medium: findings.filter(f => f.severity === "medium"),
+    low: findings.filter(f => f.severity === "low"),
+  };
+  
+  for (const [sev, items] of Object.entries(bySeverity)) {
+    if (items.length === 0) continue;
+    
+    md += `### ${sev.toUpperCase()} (${items.length})\n\n`;
+    
+    for (const f of items.slice(0, 20)) {
+      const file = redactPaths && f.file ? redactPath(f.file) : f.file;
+      md += `- **${f.title}**\n`;
+      if (file) md += `  - File: \`${file}${f.line ? `:${f.line}` : ''}\`\n`;
+      if (f.fix) md += `  - Fix: ${f.fix}\n`;
+      md += "\n";
+    }
+    
+    if (items.length > 20) {
+      md += `_...and ${items.length - 20} more ${sev} findings_\n\n`;
+    }
+  }
+  
+  // Reality section if available
+  if (reality && (reality.brokenFlows?.length > 0 || Object.keys(reality.coverage).length > 0)) {
+    md += `---\n\n## Reality Mode\n\n`;
+    
+    if (Object.keys(reality.coverage).length > 0) {
+      md += `### Coverage\n\n`;
+      for (const [key, val] of Object.entries(reality.coverage)) {
+        md += `- ${formatCoverageKey(key)}: **${val}%**\n`;
+      }
+      md += "\n";
+    }
+    
+    if (reality.brokenFlows?.length > 0) {
+      md += `### Broken Flows (${reality.brokenFlows.length})\n\n`;
+      for (const flow of reality.brokenFlows.slice(0, 5)) {
+        md += `- **${flow.title}** (${flow.severity})\n`;
+        if (flow.steps) {
+          md += `  - Steps: ${flow.steps.map(s => s.label).join(' → ')}\n`;
+        }
+      }
+      md += "\n";
+    }
+  }
+  
+  md += `---\n\n*Generated by [VibeCheck](https://vibecheck.dev)*\n`;
+  
+  return md;
+}
+
+/**
+ * Helper: redact file path
+ */
+function redactPath(p) {
+  if (!p) return p;
+  const parts = p.split("/");
+  if (parts.length <= 2) return p;
+  return ".../" + parts.slice(-2).join("/");
+}
+
+/**
+ * Helper: format coverage key
+ */
+function formatCoverageKey(key) {
+  return key
+    .replace(/([A-Z])/g, " $1")
+    .replace(/^./, s => s.toUpperCase())
+    .trim();
+}
+
+module.exports = {
+  buildReportData,
+  exportToJSON,
+  exportToSARIF,
+  exportToCSV,
+  exportToMarkdown,
+  // Expose helpers for testing
+  normalizeFinding,
+  normalizeSeverity,
+  calculateScore,
+  calculateFixEstimates,
+};