vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/auth-truth.js

@@ -0,0 +1,193 @@
+// bin/runners/lib/auth-truth.js
+// Auth Truth v1 - Detects auth/protection patterns in Next + Fastify codebases
+const fg = require("fast-glob");
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+function sha256(text) {
+  return "sha256:" + crypto.createHash("sha256").update(text).digest("hex");
+}
+
+function safeRead(fileAbs) {
+  return fs.readFileSync(fileAbs, "utf8");
+}
+
+function evidenceFromLine({ fileAbs, repoRoot, lineNo, reason }) {
+  const fileRel = path.relative(repoRoot, fileAbs).replace(/\\/g, "/");
+  const lines = safeRead(fileAbs).split(/\r?\n/);
+  const idx = Math.max(0, Math.min(lines.length - 1, lineNo - 1));
+  const snippet = lines[idx] || "";
+  return {
+    id: `ev_${crypto.randomBytes(4).toString("hex")}`,
+    file: fileRel,
+    lines: `${lineNo}-${lineNo}`,
+    snippetHash: sha256(snippet),
+    reason
+  };
+}
+
+function findLineMatches(code, regex) {
+  const out = [];
+  const lines = code.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    if (regex.test(lines[i])) out.push(i + 1);
+  }
+  return out;
+}
+
+function guessAuthSignalsFromCode(code) {
+  const signals = [];
+
+  const patterns = [
+    { key: "next_middleware", rx: /\bNextResponse\.(redirect|rewrite)\b/ },
+    { key: "next_auth", rx: /\bgetServerSession\b|\bNextAuth\b|\bauth\(\)\b/ },
+    { key: "clerk", rx: /\bclerkMiddleware\b|\bauthMiddleware\b|@clerk\/nextjs/ },
+    { key: "supabase", rx: /\bcreateRouteHandlerClient\b|\bcreateServerClient\b|@supabase/ },
+    { key: "jwt_verify", rx: /\b(jwtVerify|verifyJWT|verifyToken|authorization|bearer)\b/i },
+    { key: "session", rx: /\b(session|cookie|setCookie|getCookie)\b/i },
+    { key: "rbac", rx: /\b(role|roles|permissions|rbac|isAdmin|adminOnly)\b/i },
+    { key: "fastify_hook", rx: /\.addHook\(\s*['"](onRequest|preHandler|preValidation)['"]/ },
+    { key: "fastify_jwt", rx: /@fastify\/jwt|fastify-jwt|fastify\.jwt/i },
+  ];
+
+  for (const p of patterns) {
+    if (p.rx.test(code)) signals.push(p.key);
+  }
+  return Array.from(new Set(signals));
+}
+
+async function resolveNextMiddleware(repoRoot) {
+  const candidates = await fg(
+    ["middleware.@(ts|js)", "src/middleware.@(ts|js)"],
+    { cwd: repoRoot, absolute: true, onlyFiles: true }
+  );
+
+  const middlewares = [];
+
+  for (const fileAbs of candidates) {
+    const code = safeRead(fileAbs);
+    const fileRel = path.relative(repoRoot, fileAbs).replace(/\\/g, "/");
+
+    const matcherLines = findLineMatches(code, /\bmatcher\b/);
+    const redirectLines = findLineMatches(code, /\bNextResponse\.(redirect|rewrite)\b/);
+
+    const evidence = [];
+    for (const ln of matcherLines.slice(0, 5)) {
+      evidence.push(evidenceFromLine({ fileAbs, repoRoot, lineNo: ln, reason: "Next middleware matcher config" }));
+    }
+    for (const ln of redirectLines.slice(0, 5)) {
+      evidence.push(evidenceFromLine({ fileAbs, repoRoot, lineNo: ln, reason: "Next middleware redirect/rewrite" }));
+    }
+
+    const matcher = [];
+    const matcherBlock = code.match(/matcher\s*:\s*(\[[\s\S]*?\])/);
+    if (matcherBlock && matcherBlock[1]) {
+      const raw = matcherBlock[1];
+      const strings = Array.from(raw.matchAll(/['"`]([^'"`]+)['"`]/g)).map(m => m[1]);
+      matcher.push(...strings);
+    }
+
+    middlewares.push({
+      file: fileRel,
+      matcher,
+      signals: guessAuthSignalsFromCode(code),
+      evidence
+    });
+  }
+
+  return middlewares;
+}
+
+async function resolveFastifyAuthSignals(repoRoot, truthpackRoutes) {
+  const handlerFiles = new Set((truthpackRoutes || []).map(r => r.handler).filter(Boolean));
+  const signals = [];
+  const evidence = [];
+
+  for (const fileRel of handlerFiles) {
+    const fileAbs = path.join(repoRoot, fileRel);
+    if (!fs.existsSync(fileAbs)) continue;
+
+    const code = safeRead(fileAbs);
+    const sigs = guessAuthSignalsFromCode(code);
+    if (!sigs.length) continue;
+
+    for (const s of sigs) signals.push({ type: s, file: fileRel });
+
+    const authLinePatterns = [
+      { rx: /\.addHook\(\s*['"](onRequest|preHandler|preValidation)['"]/, reason: "Fastify hook likely used for auth" },
+      { rx: /\b(jwtVerify|authorization|bearer)\b/i, reason: "JWT/Authorization verification signal" },
+      { rx: /@fastify\/jwt|fastify\.jwt/i, reason: "Fastify JWT plugin signal" },
+      { rx: /\b(isAdmin|adminOnly|permissions|rbac)\b/i, reason: "RBAC/permissions signal" },
+    ];
+
+    const lines = code.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const p of authLinePatterns) {
+        if (p.rx.test(line)) {
+          evidence.push({
+            id: `ev_${crypto.randomBytes(4).toString("hex")}`,
+            file: fileRel,
+            lines: `${i + 1}-${i + 1}`,
+            snippetHash: sha256(line),
+            reason: p.reason
+          });
+        }
+      }
+      if (evidence.length > 30) break;
+    }
+  }
+
+  const uniqueTypes = Array.from(new Set(signals.map(s => s.type)));
+
+  return {
+    signalTypes: uniqueTypes,
+    signals,
+    evidence
+  };
+}
+
+function matcherCoversPath(matcherList, p) {
+  if (!Array.isArray(matcherList) || !matcherList.length) return false;
+  const pathStr = p.startsWith("/") ? p : `/${p}`;
+
+  return matcherList.some(m => {
+    if (!m) return false;
+
+    if (m.includes(":path*")) {
+      const prefix = m.split(":path*")[0].replace(/\/$/, "");
+      return pathStr.startsWith(prefix || "/");
+    }
+    if (m.includes("(.*)")) {
+      const prefix = m.split("(.*)")[0].replace(/\/$/, "");
+      return pathStr.startsWith(prefix || "/");
+    }
+
+    if (m === pathStr) return true;
+    if (pathStr.startsWith(m.endsWith("/") ? m : m + "/")) return true;
+
+    return false;
+  });
+}
+
+async function buildAuthTruth(repoRoot, routesServer) {
+  const middlewares = await resolveNextMiddleware(repoRoot);
+  const matchers = middlewares.flatMap(mw => mw.matcher || []);
+  const fastify = await resolveFastifyAuthSignals(repoRoot, routesServer);
+
+  return {
+    nextMiddleware: middlewares,
+    nextMatcherPatterns: matchers,
+    fastify,
+    helpers: {
+      matcherCoversPath: "runtime-only"
+    }
+  };
+}
+
+module.exports = {
+  buildAuthTruth,
+  matcherCoversPath,
+  guessAuthSignalsFromCode
+};

package/bin/runners/lib/auth.js

@@ -0,0 +1,215 @@
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+// Config paths
+function getConfigPath() {
+  const home = os.homedir();
+  if (process.platform === "win32") {
+    return path.join(
+      process.env.APPDATA || path.join(home, "AppData", "Roaming"),
+      "vibecheck",
+      "config.json",
+    );
+  }
+  return path.join(home, ".config", "vibecheck", "config.json");
+}
+
+function ensureConfigDir(configPath) {
+  const dir = path.dirname(configPath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+}
+
+// 1. Get API Key
+function getApiKey() {
+  // 1. Env var (CI/Production)
+  if (process.env.VIBECHECK_API_KEY) {
+    return { key: process.env.VIBECHECK_API_KEY, source: "env" };
+  }
+
+  // 2. User config
+  try {
+    const configPath = getConfigPath();
+    if (fs.existsSync(configPath)) {
+      const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      if (config.apiKey) {
+        return { key: config.apiKey, source: "user" };
+      }
+    }
+  } catch (err) {
+    // ignore config errors
+  }
+
+  return { key: null, source: null };
+}
+
+// 2. Save API Key
+function saveApiKey(apiKey) {
+  const configPath = getConfigPath();
+  ensureConfigDir(configPath);
+
+  let config = {};
+  try {
+    if (fs.existsSync(configPath)) {
+      config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    }
+  } catch (err) {
+    // ignore, start fresh
+  }
+
+  config.apiKey = apiKey;
+  // Also save a basic user structure if needed, but for now just key
+
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
+    mode: 0o600,
+  });
+}
+
+// 3. Delete API Key
+function deleteApiKey() {
+  const configPath = getConfigPath();
+  try {
+    if (fs.existsSync(configPath)) {
+      const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      delete config.apiKey;
+      fs.writeFileSync(configPath, JSON.stringify(config, null, 2), {
+        mode: 0o600,
+      });
+    }
+  } catch (err) {
+    // ignore
+  }
+}
+
+// 4. Get Entitlements (Mocked for now, but ready for API)
+// In real world: fetch from GET /v1/auth/whoami
+async function getEntitlements(apiKey) {
+  if (!apiKey) return null;
+
+  // Check cache first
+  const configPath = getConfigPath();
+  const cachePath = path.join(
+    path.dirname(configPath),
+    "entitlements-cache.json",
+  );
+
+  try {
+    if (fs.existsSync(cachePath)) {
+      const cache = JSON.parse(fs.readFileSync(cachePath, "utf8"));
+      // Check if same key and fresh (10 mins)
+      if (
+        cache.keyHash === Buffer.from(apiKey).toString("base64") &&
+        Date.now() - cache.timestamp < 10 * 60 * 1000
+      ) {
+        return cache.data;
+      }
+    }
+  } catch (err) {
+    // ignore cache errors
+  }
+
+  // Simulate API delay
+  // await new Promise(r => setTimeout(r, 100));
+
+  // Call the real API endpoint
+  let res;
+  try {
+    // Try production API first, then fallback to localhost for development
+    const apiUrl =
+      process.env.VIBECHECK_API_URL || "https://api.vibecheckai.dev";
+    const urls = [apiUrl, "http://localhost:3000"];
+
+    for (const url of urls) {
+      try {
+        res = await fetch(`${url}/v1/auth/whoami`, {
+          headers: {
+            Authorization: `Bearer ${apiKey}`,
+          },
+          signal: AbortSignal.timeout(5000), // 5 second timeout
+        });
+        if (res.ok) break;
+      } catch (e) {
+        // Try next URL
+        continue;
+      }
+    }
+
+    if (!res || !res.ok) {
+      throw new Error("API unavailable");
+    }
+  } catch (error) {
+    // SECURITY: Do not fallback to mock entitlements
+    // If API is unavailable, fail gracefully with clear error message
+    throw new Error(
+      "Cannot connect to vibecheck API. API connection required for this feature. " +
+      "Please check your network connection and ensure VIBECHECK_API_URL is set correctly."
+    );
+  }
+
+  if (!res.ok) {
+    throw new Error(`API returned ${res.status}: ${res.statusText}`);
+  }
+
+  const result = await res.json();
+
+  // Write to cache
+  try {
+    ensureConfigDir(cachePath);
+    fs.writeFileSync(
+      cachePath,
+      JSON.stringify(
+        {
+          keyHash: Buffer.from(apiKey).toString("base64"),
+          timestamp: Date.now(),
+          data: result,
+        },
+        null,
+        2,
+      ),
+    );
+  } catch (err) {
+    // ignore cache write errors
+  }
+
+  return result;
+}
+
+// 5. Check Entitlement
+async function checkEntitlement(requiredScope) {
+  const { key } = getApiKey();
+  if (!key) {
+    return {
+      allowed: false,
+      reason:
+        'No API key found. Run "vibecheck login" or set VIBECHECK_API_KEY.',
+    };
+  }
+
+  const entitlements = await getEntitlements(key);
+  if (!entitlements) {
+    return { allowed: false, reason: "Invalid API key." };
+  }
+
+  if (
+    entitlements.scopes.includes(requiredScope) ||
+    entitlements.scopes.includes("*")
+  ) {
+    return { allowed: true, plan: entitlements.plan };
+  }
+
+  return {
+    allowed: false,
+    reason: `Plan '${entitlements.plan}' does not support this feature. Required scope: ${requiredScope}`,
+  };
+}
+
+module.exports = {
+  getApiKey,
+  saveApiKey,
+  deleteApiKey,
+  getEntitlements,
+  checkEntitlement,
+  getConfigPath,
+};