apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/capability_tagger.py

@@ -0,0 +1,322 @@
+"""
+Capability tagging.
+
+Infers high-level business capabilities from detected integrations,
+routes, and env-var patterns. Capabilities are factual labels like
+``PAYMENT``, ``USER_AUTH``, ``FILE_STORAGE`` that help the cloud
+understand **what the application does** at a business level.
+
+Each capability includes evidence (integration IDs, route patterns)
+so the cloud can audit the inference.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from ..core.manifest import (
+        CapabilityModel,
+        ConfigurationModel,
+        IntegrationModel,
+        RouteModel,
+    )
+
+
+# ============================================================================
+# Capability constants
+# ============================================================================
+
+
+class Capability:
+    PAYMENT = "PAYMENT"
+    USER_AUTH = "USER_AUTH"
+    DATA_PERSISTENCE = "DATA_PERSISTENCE"
+    CACHING = "CACHING"
+    ASYNC_MESSAGING = "ASYNC_MESSAGING"
+    FILE_STORAGE = "FILE_STORAGE"
+    EMAIL_NOTIFICATION = "EMAIL_NOTIFICATION"
+    EXTERNAL_API = "EXTERNAL_API"
+    CLOUD_INFRASTRUCTURE = "CLOUD_INFRASTRUCTURE"
+    CRYPTOGRAPHIC_OPERATIONS = "CRYPTOGRAPHIC_OPERATIONS"
+    TEMPLATE_RENDERING = "TEMPLATE_RENDERING"
+    MONITORING = "MONITORING"
+    SEARCH = "SEARCH"
+    XML_PROCESSING = "XML_PROCESSING"
+    SERIALIZATION = "SERIALIZATION"
+    OS_COMMAND_EXECUTION = "OS_COMMAND_EXECUTION"
+    DIRECTORY_SERVICE = "DIRECTORY_SERVICE"
+
+
+# ============================================================================
+# Rules: integration type → capabilities
+# ============================================================================
+
+_INTEGRATION_TYPE_TO_CAPABILITY: dict[str, str] = {
+    "database": Capability.DATA_PERSISTENCE,
+    "cache": Capability.CACHING,
+    "message_queue": Capability.ASYNC_MESSAGING,
+    "http_client": Capability.EXTERNAL_API,
+    "cloud_service": Capability.CLOUD_INFRASTRUCTURE,
+    "serialization": Capability.SERIALIZATION,
+    "xml_parser": Capability.XML_PROCESSING,
+    "template_engine": Capability.TEMPLATE_RENDERING,
+    "crypto": Capability.CRYPTOGRAPHIC_OPERATIONS,
+    "directory_service": Capability.DIRECTORY_SERVICE,
+    "email": Capability.EMAIL_NOTIFICATION,
+    "file_system": Capability.FILE_STORAGE,
+    "os_command": Capability.OS_COMMAND_EXECUTION,
+    "monitoring": Capability.MONITORING,
+    "logging": Capability.MONITORING,
+    "auth_provider": Capability.USER_AUTH,
+}
+
+# Integration names that indicate payment capability
+_PAYMENT_NAMES: set[str] = {
+    "stripe",
+    "braintree",
+    "adyen",
+    "paypal",
+    "square",
+}
+
+# Integration names that indicate search capability
+_SEARCH_NAMES: set[str] = {
+    "elasticsearch",
+    "opensearch",
+    "solr",
+    "meilisearch",
+    "typesense",
+    "algolia",
+}
+
+# Route patterns that suggest auth capability
+_AUTH_ROUTE_PATTERNS: set[str] = {
+    "login",
+    "logout",
+    "signin",
+    "signup",
+    "register",
+    "auth",
+    "token",
+    "refresh",
+    "password",
+    "reset",
+    "verify",
+    "oauth",
+    "callback",
+    "session",
+    "sso",
+}
+
+# Route patterns that suggest payment capability
+_PAYMENT_ROUTE_PATTERNS: set[str] = {
+    "payment",
+    "checkout",
+    "charge",
+    "refund",
+    "invoice",
+    "subscription",
+    "billing",
+    "order",
+    "cart",
+    "purchase",
+}
+
+# Route patterns that suggest file storage
+_FILE_ROUTE_PATTERNS: set[str] = {
+    "upload",
+    "download",
+    "file",
+    "attachment",
+    "media",
+    "image",
+    "document",
+    "asset",
+    "blob",
+    "storage",
+}
+
+# Env-var names that suggest capabilities
+_ENV_CAPABILITY_PATTERNS: dict[str, str] = {
+    "STRIPE": Capability.PAYMENT,
+    "PAYPAL": Capability.PAYMENT,
+    "BRAINTREE": Capability.PAYMENT,
+    "SENDGRID": Capability.EMAIL_NOTIFICATION,
+    "MAILGUN": Capability.EMAIL_NOTIFICATION,
+    "SMTP": Capability.EMAIL_NOTIFICATION,
+    "SENTRY": Capability.MONITORING,
+    "DATADOG": Capability.MONITORING,
+    "ELASTICSEARCH": Capability.SEARCH,
+    "OPENSEARCH": Capability.SEARCH,
+    "AUTH0": Capability.USER_AUTH,
+    "OKTA": Capability.USER_AUTH,
+    "COGNITO": Capability.USER_AUTH,
+    "FIREBASE_AUTH": Capability.USER_AUTH,
+    "S3_BUCKET": Capability.FILE_STORAGE,
+    "GCS_BUCKET": Capability.FILE_STORAGE,
+}
+
+
+# ============================================================================
+# Detected capability (internal)
+# ============================================================================
+
+
+@dataclass
+class DetectedCapability:
+    tag: str
+    evidence: list[str] = field(default_factory=list)
+    confidence: str = "MEDIUM"
+
+
+# ============================================================================
+# CapabilityTagger
+# ============================================================================
+
+
+class CapabilityTagger:
+    """
+    Infers business capabilities from integrations, routes, and env vars.
+    """
+
+    def tag(
+        self,
+        integrations: list[IntegrationModel],
+        routes: list[RouteModel] | None = None,
+        configuration: ConfigurationModel | None = None,
+    ) -> list[CapabilityModel]:
+        """Run all tagging rules and return deduplicated capabilities."""
+        caps: dict[str, DetectedCapability] = {}
+
+        self._tag_from_integrations(integrations, caps)
+        if routes:
+            self._tag_from_routes(routes, caps)
+        if configuration:
+            self._tag_from_env_vars(configuration, caps)
+
+        # Promote confidence when multiple evidence sources agree
+        for cap in caps.values():
+            if len(cap.evidence) >= 3:
+                cap.confidence = "HIGH"
+            elif len(cap.evidence) >= 2:
+                cap.confidence = "MEDIUM"
+
+        return self._to_manifest_models(caps)
+
+    # ------------------------------------------------------------------
+    # Integration-based
+    # ------------------------------------------------------------------
+
+    def _tag_from_integrations(
+        self,
+        integrations: list[IntegrationModel],
+        caps: dict[str, DetectedCapability],
+    ) -> None:
+        for integration in integrations:
+            # Type-based capability
+            cap_tag = _INTEGRATION_TYPE_TO_CAPABILITY.get(integration.type)
+            if cap_tag:
+                self._add(caps, cap_tag, f"integration:{integration.id}")
+
+            # Payment-specific names
+            name_lower = integration.name.lower()
+            for pay_name in _PAYMENT_NAMES:
+                if pay_name in name_lower:
+                    self._add(caps, Capability.PAYMENT, f"integration:{integration.id}")
+                    break
+
+            # Search-specific names
+            for search_name in _SEARCH_NAMES:
+                if search_name in name_lower:
+                    self._add(caps, Capability.SEARCH, f"integration:{integration.id}")
+                    break
+
+            # Cloud sub-services can indicate specific capabilities
+            for sub in integration.metadata.get("services", []):
+                sub_lower = sub.lower()
+                if sub_lower in ("s3", "gcs", "blob"):
+                    self._add(caps, Capability.FILE_STORAGE, f"integration:{integration.id}:{sub}")
+                elif sub_lower in ("sqs", "sns", "pubsub", "eventbridge"):
+                    self._add(
+                        caps, Capability.ASYNC_MESSAGING, f"integration:{integration.id}:{sub}"
+                    )
+                elif sub_lower in ("ses",):
+                    self._add(
+                        caps, Capability.EMAIL_NOTIFICATION, f"integration:{integration.id}:{sub}"
+                    )
+                elif sub_lower in ("cognito", "iam"):
+                    self._add(caps, Capability.USER_AUTH, f"integration:{integration.id}:{sub}")
+                elif sub_lower in ("dynamodb", "rds", "aurora"):
+                    self._add(
+                        caps, Capability.DATA_PERSISTENCE, f"integration:{integration.id}:{sub}"
+                    )
+
+    # ------------------------------------------------------------------
+    # Route-based
+    # ------------------------------------------------------------------
+
+    def _tag_from_routes(
+        self,
+        routes: list[RouteModel],
+        caps: dict[str, DetectedCapability],
+    ) -> None:
+        for route in routes:
+            path_lower = route.path.lower()
+            segments = set(path_lower.strip("/").split("/"))
+
+            for pattern in _AUTH_ROUTE_PATTERNS:
+                if pattern in segments or pattern in path_lower:
+                    self._add(caps, Capability.USER_AUTH, f"route:{route.id}")
+                    break
+
+            for pattern in _PAYMENT_ROUTE_PATTERNS:
+                if pattern in segments or pattern in path_lower:
+                    self._add(caps, Capability.PAYMENT, f"route:{route.id}")
+                    break
+
+            for pattern in _FILE_ROUTE_PATTERNS:
+                if pattern in segments or pattern in path_lower:
+                    self._add(caps, Capability.FILE_STORAGE, f"route:{route.id}")
+                    break
+
+    # ------------------------------------------------------------------
+    # Env-var based
+    # ------------------------------------------------------------------
+
+    def _tag_from_env_vars(
+        self,
+        configuration: ConfigurationModel,
+        caps: dict[str, DetectedCapability],
+    ) -> None:
+        for env_var in configuration.env_vars_used:
+            name_upper = env_var.name.upper()
+            for pattern, cap_tag in _ENV_CAPABILITY_PATTERNS.items():
+                if pattern in name_upper:
+                    self._add(caps, cap_tag, f"env:{env_var.name}")
+                    break
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _add(caps: dict[str, DetectedCapability], tag: str, evidence: str) -> None:
+        if tag not in caps:
+            caps[tag] = DetectedCapability(tag=tag)
+        if evidence not in caps[tag].evidence:
+            caps[tag].evidence.append(evidence)
+
+    @staticmethod
+    def _to_manifest_models(caps: dict[str, DetectedCapability]) -> list[CapabilityModel]:
+        from ..core.manifest import CapabilityModel
+
+        return [
+            CapabilityModel(
+                tag=cap.tag,
+                evidence=cap.evidence[:20],
+                confidence=cap.confidence,
+            )
+            for cap in sorted(caps.values(), key=lambda c: c.tag)
+        ]

apisec_code_bolt/analysis/config_scanner.py

@@ -0,0 +1,197 @@
+"""
+Configuration file scanner.
+
+Discovers and parses configuration files within the project:
+
+- **.env files** — Extracts variable names (never values) and detects
+  connection strings, secret patterns, and service references.
+- **Known config files** — Identifies ``settings.py``, ``config.yaml``,
+  ``application.yml``, ``pyproject.toml``, ``docker-compose.yml``, etc.
+
+The scanner never includes sensitive values in its output. Variable names
+and file paths are the only data emitted.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from ..core.manifest import ConfigFileModel, EnvVarUsageModel
+
+
+# ============================================================================
+# Known config file patterns
+# ============================================================================
+
+_CONFIG_FILE_PATTERNS: dict[str, str] = {
+    ".env": "env",
+    ".env.local": "env",
+    ".env.development": "env",
+    ".env.production": "env",
+    ".env.staging": "env",
+    ".env.test": "env",
+    ".env.example": "env",
+    ".env.sample": "env",
+    "settings.py": "python",
+    "config.py": "python",
+    "config.yaml": "yaml",
+    "config.yml": "yaml",
+    "application.yml": "yaml",
+    "application.yaml": "yaml",
+    "application.properties": "properties",
+    "docker-compose.yml": "yaml",
+    "docker-compose.yaml": "yaml",
+    "Dockerfile": "dockerfile",
+    "pyproject.toml": "toml",
+    "setup.cfg": "ini",
+    ".flaskenv": "env",
+    "alembic.ini": "ini",
+}
+
+# Env var name patterns that indicate connection strings
+_CONNECTION_VAR_PATTERNS = re.compile(
+    r"(?:DATABASE_URL|DB_URL|REDIS_URL|MONGO_URI|BROKER_URL|AMQP_URL|"
+    r"CELERY_BROKER_URL|CACHE_URL|ELASTICSEARCH_URL|SQLALCHEMY_DATABASE_URI)",
+    re.IGNORECASE,
+)
+
+
+# ============================================================================
+# Parsed env-file entry
+# ============================================================================
+
+
+@dataclass
+class EnvFileEntry:
+    """A variable found in a .env file (value is never stored)."""
+
+    name: str
+    has_value: bool
+    is_connection_string: bool = False
+    is_secret_name: bool = False
+
+
+# ============================================================================
+# ConfigScanner
+# ============================================================================
+
+
+class ConfigScanner:
+    """
+    Scans project root for configuration files and .env variable names.
+    """
+
+    def __init__(self, project_root: Path) -> None:
+        self._root = project_root
+
+    def discover_config_files(self) -> list[tuple[str, str]]:
+        """Return (relative_path, type) for known config files found."""
+        found: list[tuple[str, str]] = []
+
+        for name, file_type in _CONFIG_FILE_PATTERNS.items():
+            # Check root-level
+            candidate = self._root / name
+            if candidate.is_file():
+                found.append((name, file_type))
+
+            # Check common subdirectories
+            for subdir in ("config", "conf", "deploy", ".docker"):
+                candidate = self._root / subdir / name
+                if candidate.is_file():
+                    found.append((f"{subdir}/{name}", file_type))
+
+        return found
+
+    def parse_env_files(self) -> list[EnvFileEntry]:
+        """Parse all .env* files and extract variable names (never values)."""
+        entries: list[EnvFileEntry] = []
+        seen: set[str] = set()
+
+        for name, file_type in _CONFIG_FILE_PATTERNS.items():
+            if file_type != "env":
+                continue
+            path = self._root / name
+            if not path.is_file():
+                continue
+
+            try:
+                content = path.read_text(errors="replace")
+            except OSError:
+                continue
+
+            for line in content.splitlines():
+                line = line.strip()
+                if not line or line.startswith("#"):
+                    continue
+
+                # Parse NAME=value or NAME=
+                if "=" not in line:
+                    continue
+
+                var_name = line.split("=", 1)[0].strip()
+                if not var_name or not var_name[0].isalpha():
+                    continue
+
+                if var_name in seen:
+                    continue
+                seen.add(var_name)
+
+                is_conn = bool(_CONNECTION_VAR_PATTERNS.search(var_name))
+                is_secret = bool(
+                    re.search(
+                        r"(?:PASSWORD|SECRET|PRIVATE_KEY|API_KEY|TOKEN|CREDENTIALS?)",
+                        var_name,
+                        re.IGNORECASE,
+                    )
+                )
+
+                entries.append(
+                    EnvFileEntry(
+                        name=var_name,
+                        has_value=len(line.split("=", 1)[1].strip()) > 0,
+                        is_connection_string=is_conn,
+                        is_secret_name=is_secret,
+                    )
+                )
+
+        return entries
+
+    # ------------------------------------------------------------------
+    # Conversion to manifest models
+    # ------------------------------------------------------------------
+
+    def to_config_file_models(self) -> list[ConfigFileModel]:
+        """Return ConfigFileModel list for all discovered config files."""
+        from ..core.manifest import ConfigFileModel
+
+        return [
+            ConfigFileModel(path=path, type=file_type)
+            for path, file_type in self.discover_config_files()
+        ]
+
+    def to_env_var_models(self) -> list[EnvVarUsageModel]:
+        """Return EnvVarUsageModel list from .env file variable names."""
+        from ..core.manifest import EnvVarUsageModel
+
+        entries = self.parse_env_files()
+        models: list[EnvVarUsageModel] = []
+        for entry in entries:
+            default_val = None
+            if entry.is_connection_string:
+                default_val = "(connection_string)"
+            elif entry.is_secret_name:
+                default_val = "(secret)"
+
+            models.append(
+                EnvVarUsageModel(
+                    name=entry.name,
+                    locations=[],
+                    default_value=default_val,
+                )
+            )
+
+        return models