apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/core/config.py

@@ -0,0 +1,528 @@
+"""
+Configuration management for apisec-code-bolt.
+
+Uses Pydantic for type-safe configuration with validation.
+Configuration can come from:
+1. Configuration file (.codebolt.yaml)
+2. Environment variables (CODEBOLT_*)
+3. CLI arguments (highest priority)
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Literal
+
+from pydantic import BaseModel, Field, field_validator, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+DEFAULT_API_URL = "https://api.apisec.ai"
+
+
+# =============================================================================
+# File Discovery Configuration
+# =============================================================================
+
+
+class FileDiscoveryConfig(BaseModel):
+    """Configuration for file discovery."""
+
+    # Always excluded directories (hardcoded for safety)
+    ALWAYS_EXCLUDE: frozenset[str] = frozenset(
+        {
+            # Version control
+            ".git",
+            ".svn",
+            ".hg",
+            # Dependencies
+            "node_modules",
+            "vendor",
+            "venv",
+            ".venv",
+            "env",
+            ".env",
+            # Build artifacts
+            "build",
+            "dist",
+            "target",
+            "out",
+            ".gradle",
+            "__pycache__",
+            ".pytest_cache",
+            ".mypy_cache",
+            ".ruff_cache",
+            "*.egg-info",
+            # IDE
+            ".idea",
+            ".vscode",
+            ".eclipse",
+            # Generated
+            "generated",
+            "gen",
+        }
+    )
+
+    # User-configurable exclusions (in addition to ALWAYS_EXCLUDE)
+    exclude_patterns: list[str] = Field(
+        default_factory=lambda: [
+            "tests/**",
+            "**/*_test.py",
+            "**/test_*.py",
+            "**/migrations/**",
+            "**/conftest.py",
+        ],
+        description="Glob patterns to exclude from analysis",
+    )
+
+    include_tests: bool = Field(
+        default=False,
+        description="Whether to analyze test files",
+    )
+
+    max_files: int = Field(
+        default=10_000,
+        ge=1,
+        le=100_000,
+        description="Maximum number of files to analyze",
+    )
+
+    max_file_size_mb: float = Field(
+        default=10.0,
+        ge=0.001,
+        le=100.0,
+        description="Maximum file size in MB (skip larger files)",
+    )
+
+    respect_gitignore: bool = Field(
+        default=True,
+        description="Whether to respect .gitignore patterns",
+    )
+
+    follow_symlinks: bool = Field(
+        default=False,
+        description="Whether to follow symbolic links",
+    )
+
+
+# =============================================================================
+# Data Flow Analysis Configuration
+# =============================================================================
+
+
+class DataFlowConfig(BaseModel):
+    """Configuration for data flow analysis."""
+
+    mode: Literal["intra_procedural", "inter_procedural"] = Field(
+        default="inter_procedural",
+        description="Data flow tracking mode",
+    )
+
+    max_depth: int = Field(
+        default=10,
+        ge=1,
+        le=50,
+        description="Maximum call depth for inter-procedural analysis",
+    )
+
+    track_through_libraries: bool = Field(
+        default=False,
+        description="Whether to trace into third-party library code",
+    )
+
+    track_lambdas: bool = Field(
+        default=True,
+        description="Whether to track data flow through lambdas/closures",
+    )
+
+    track_callbacks: bool = Field(
+        default=True,
+        description="Whether to track data flow through callbacks",
+    )
+
+    max_flows_per_origin: int = Field(
+        default=100,
+        ge=1,
+        le=1000,
+        description="Maximum data flows to track per origin (prevents explosion)",
+    )
+
+
+# =============================================================================
+# JVM Analyzer Configuration
+# =============================================================================
+
+
+class JvmConfig(BaseModel):
+    """Configuration for JVM (Java/Kotlin) analysis."""
+
+    enabled: bool = Field(
+        default=True,
+        description="Whether to analyze JVM files (requires Java runtime)",
+    )
+
+    java_home: Path | None = Field(
+        default=None,
+        description="Path to Java installation (auto-detected if not set)",
+    )
+
+    heap_mb: int = Field(
+        default=512,
+        ge=128,
+        le=8192,
+        description="JVM heap size in MB",
+    )
+
+    batch_size: int = Field(
+        default=200,
+        ge=10,
+        le=1000,
+        description="Number of files per JVM batch",
+    )
+
+    max_parallel_batches: int = Field(
+        default=4,
+        ge=1,
+        le=16,
+        description="Maximum parallel JVM processes",
+    )
+
+    timeout_per_batch_seconds: int = Field(
+        default=300,
+        ge=30,
+        le=3600,
+        description="Timeout per batch in seconds",
+    )
+
+
+# =============================================================================
+# Cloud Communication Configuration
+# =============================================================================
+
+
+class CloudConfig(BaseModel):
+    """Configuration for cloud communication."""
+
+    enabled: bool = Field(
+        default=True,
+        description="Whether to upload manifests to cloud",
+    )
+
+    api_url: str = Field(
+        default=DEFAULT_API_URL,
+        description="Cloud API base URL",
+    )
+
+    api_key: str | None = Field(
+        default=None,
+        description="API key for authentication (can also use CODEBOLT_API_KEY env var)",
+    )
+
+    timeout_seconds: int = Field(
+        default=60,
+        ge=10,
+        le=300,
+        description="HTTP request timeout in seconds",
+    )
+
+    retry_attempts: int = Field(
+        default=3,
+        ge=0,
+        le=10,
+        description="Number of retry attempts for failed requests",
+    )
+
+    verify_ssl: bool = Field(
+        default=True,
+        description="Whether to verify SSL certificates",
+    )
+
+
+# =============================================================================
+# Query API Configuration
+# =============================================================================
+
+
+class QueryApiConfig(BaseModel):
+    """Configuration for Query API (extended analysis)."""
+
+    enabled: bool = Field(
+        default=True,
+        description="Whether to enable Query API for verification queries",
+    )
+
+    max_wait_seconds: int = Field(
+        default=300,
+        ge=30,
+        le=1800,
+        description="Maximum time to wait for queries from cloud",
+    )
+
+    max_batches: int = Field(
+        default=10,
+        ge=1,
+        le=50,
+        description="Maximum number of query batches to process",
+    )
+
+    poll_timeout_seconds: int = Field(
+        default=30,
+        ge=5,
+        le=60,
+        description="Long-poll timeout for each request",
+    )
+
+
+# =============================================================================
+# Analysis Configuration
+# =============================================================================
+
+
+class AnalysisConfig(BaseModel):
+    """Configuration for the analysis process."""
+
+    timeout_seconds: int = Field(
+        default=3600,
+        ge=60,
+        le=14400,
+        description="Total analysis timeout in seconds",
+    )
+
+    framework_hints: list[str] = Field(
+        default_factory=list,
+        description="Framework hints to guide detection (e.g., ['fastapi', 'sqlalchemy'])",
+    )
+
+    # Sub-configurations
+    file_discovery: FileDiscoveryConfig = Field(
+        default_factory=FileDiscoveryConfig,
+    )
+
+    data_flow: DataFlowConfig = Field(
+        default_factory=DataFlowConfig,
+    )
+
+    jvm: JvmConfig = Field(
+        default_factory=JvmConfig,
+    )
+
+
+# =============================================================================
+# Output Configuration
+# =============================================================================
+
+
+class OutputConfig(BaseModel):
+    """Configuration for output generation."""
+
+    format: Literal["json", "yaml"] = Field(
+        default="json",
+        description="Output format",
+    )
+
+    pretty_print: bool = Field(
+        default=False,
+        description="Whether to pretty-print output",
+    )
+
+    output_file: Path | None = Field(
+        default=None,
+        description="Output file path (stdout if not set)",
+    )
+
+    include_source_snippets: bool = Field(
+        default=False,
+        description="NEVER enable in production - would include raw code",
+    )
+
+    @field_validator("include_source_snippets")
+    @classmethod
+    def warn_source_snippets(cls, v: bool) -> bool:
+        """Warn if source snippets are enabled."""
+        if v:
+            import warnings
+
+            warnings.warn(
+                "include_source_snippets=True would expose raw source code. "
+                "This should NEVER be enabled in production.",
+                UserWarning,
+                stacklevel=2,
+            )
+        return v
+
+
+# =============================================================================
+# Main Configuration
+# =============================================================================
+
+
+class CodeBoltConfig(BaseSettings):
+    """
+    Main configuration for apisec-code-bolt.
+
+    Configuration priority (highest to lowest):
+    1. CLI arguments
+    2. Environment variables (CODEBOLT_*)
+    3. Configuration file (.codebolt.yaml)
+    4. Defaults
+    """
+
+    model_config = SettingsConfigDict(
+        env_prefix="CODEBOLT_",
+        env_nested_delimiter="__",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    # Project settings
+    project_root: Path = Field(
+        default_factory=Path.cwd,
+        description="Root directory of the project to analyze",
+    )
+
+    config_file: Path | None = Field(
+        default=None,
+        description="Path to configuration file",
+    )
+
+    # Sub-configurations
+    analysis: AnalysisConfig = Field(
+        default_factory=AnalysisConfig,
+    )
+
+    cloud: CloudConfig = Field(
+        default_factory=CloudConfig,
+    )
+
+    query_api: QueryApiConfig = Field(
+        default_factory=QueryApiConfig,
+    )
+
+    output: OutputConfig = Field(
+        default_factory=OutputConfig,
+    )
+
+    # Runtime flags
+    verbose: bool = Field(
+        default=False,
+        description="Enable verbose output",
+    )
+
+    quiet: bool = Field(
+        default=False,
+        description="Suppress non-essential output",
+    )
+
+    debug: bool = Field(
+        default=False,
+        description="Enable debug mode",
+    )
+
+    @model_validator(mode="after")
+    def validate_config(self) -> CodeBoltConfig:
+        """Validate configuration consistency."""
+        if self.verbose and self.quiet:
+            raise ValueError("Cannot enable both verbose and quiet modes")
+
+        if not self.project_root.exists():
+            raise ValueError(f"Project root does not exist: {self.project_root}")
+
+        if not self.project_root.is_dir():
+            raise ValueError(f"Project root is not a directory: {self.project_root}")
+
+        return self
+
+    @classmethod
+    def from_file(cls, config_path: Path) -> CodeBoltConfig:
+        """Load configuration from a YAML file."""
+        import yaml
+
+        if not config_path.exists():
+            raise FileNotFoundError(f"Configuration file not found: {config_path}")
+
+        with open(config_path) as f:
+            data = yaml.safe_load(f) or {}
+
+        return cls(**data)
+
+    @classmethod
+    def from_cli(
+        cls,
+        project_root: Path,
+        config_file: Path | None = None,
+        **overrides: Any,
+    ) -> CodeBoltConfig:
+        """
+        Create configuration from CLI arguments.
+
+        Merges config file (if provided) with CLI overrides.
+        """
+        base_config: dict[str, Any] = {}
+
+        # Load from config file if provided
+        if config_file and config_file.exists():
+            import yaml
+
+            with open(config_file) as f:
+                base_config = yaml.safe_load(f) or {}
+
+        # Apply CLI overrides
+        base_config["project_root"] = project_root
+        if config_file:
+            base_config["config_file"] = config_file
+
+        # Deep merge overrides
+        for key, value in overrides.items():
+            if value is not None:
+                cls._deep_set(base_config, key, value)
+
+        return cls(**base_config)
+
+    @staticmethod
+    def _deep_set(d: dict[str, Any], key: str, value: Any) -> None:
+        """Set a nested key in a dictionary."""
+        keys = key.split(".")
+        for k in keys[:-1]:
+            d = d.setdefault(k, {})
+        d[keys[-1]] = value
+
+
+# =============================================================================
+# Configuration Helpers
+# =============================================================================
+
+
+def get_default_config() -> CodeBoltConfig:
+    """Get default configuration."""
+    return CodeBoltConfig()
+
+
+def load_config(
+    project_root: Path | None = None,
+    config_file: Path | None = None,
+) -> CodeBoltConfig:
+    """
+    Load configuration with auto-detection.
+
+    Looks for .codebolt.yaml in project root if config_file not specified.
+    """
+    root = project_root or Path.cwd()
+
+    # Auto-detect config file
+    if config_file is None:
+        for name in [
+            ".surface.yaml",
+            ".surface.yml",
+            ".codebolt.yaml",
+            ".codebolt.yml",
+            "codebolt.yaml",
+            "codebolt.yml",
+        ]:
+            candidate = root / name
+            if candidate.exists():
+                config_file = candidate
+                break
+
+    if config_file:
+        return CodeBoltConfig.from_file(config_file)
+
+    return CodeBoltConfig(project_root=root)

apisec_code_bolt/core/credentials.py

@@ -0,0 +1,65 @@
+"""API key credential storage for the CLI.
+
+Stores credentials in ~/.config/apisec-code-bolt/credentials.json.
+The file is created with restricted permissions (600).
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import stat
+from dataclasses import dataclass
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+CONFIG_DIR = Path.home() / ".config" / "apisec-code-bolt"
+CREDENTIALS_FILE = CONFIG_DIR / "credentials.json"
+
+
+@dataclass
+class StoredCredentials:
+    """Stored API credentials."""
+
+    api_key: str
+    api_url: str
+
+
+def store_credentials(api_key: str, api_url: str) -> Path:
+    """Store API key and URL. Creates directory and file with restricted permissions."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    os.chmod(CONFIG_DIR, stat.S_IRWXU)
+    data = json.dumps({"api_key": api_key, "api_url": api_url}, indent=2)
+    fd = os.open(
+        str(CREDENTIALS_FILE),
+        os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
+        0o600,
+    )
+    with os.fdopen(fd, "w") as f:
+        f.write(data)
+    logger.info("Credentials stored at %s", CREDENTIALS_FILE)
+    return CREDENTIALS_FILE
+
+
+def load_credentials() -> StoredCredentials | None:
+    """Load stored credentials. Returns None if not found."""
+    if not CREDENTIALS_FILE.exists():
+        return None
+    try:
+        data = json.loads(CREDENTIALS_FILE.read_text())
+        return StoredCredentials(
+            api_key=data.get("api_key", ""),
+            api_url=data.get("api_url", ""),
+        )
+    except Exception:
+        logger.warning("Failed to load credentials from %s", CREDENTIALS_FILE, exc_info=True)
+        return None
+
+
+def clear_credentials() -> None:
+    """Remove stored credentials."""
+    if CREDENTIALS_FILE.exists():
+        CREDENTIALS_FILE.unlink()
+        logger.info("Credentials removed")