codedna-analyzer 1.4.0__py3-none-any.whl

codedna/compliance/__init__.py

@@ -0,0 +1,5 @@
+"""Compliance and Software Bill of Materials (SBOM) Subsystem."""
+
+from .sbom import SBOMGenerator
+
+__all__ = ["SBOMGenerator"]

codedna/compliance/sbom.py

@@ -0,0 +1,410 @@
+"""Software Bill of Materials (SBOM) Engine for CodeDNA.
+
+Discovers multi-ecosystem project dependencies and generates industry-standard
+CycloneDX (v1.5 JSON) and SPDX (v2.3 JSON) software manifests.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+IGNORE_DIRS = {
+    ".git", ".svn", ".hg", "node_modules", "venv", ".venv", "env",
+    "__pycache__", ".pytest_cache", "build", "dist", "target", "vendor"
+}
+
+
+class SBOMGenerator:
+    """Discovers project dependencies and exports CycloneDX / SPDX SBOM specifications."""
+
+    def __init__(self, repo_path: str | Path = ".") -> None:
+        self.repo_path = Path(repo_path).resolve()
+
+    def discover_dependencies(self) -> List[Dict[str, Any]]:
+        """Scans workspace manifests across Python, Node.js, Rust, and Go ecosystems."""
+        dependencies: List[Dict[str, Any]] = []
+        seen_keys = set()
+
+        for root, dirs, files in os.walk(self.repo_path):
+            dirs[:] = [d for d in dirs if d not in IGNORE_DIRS and not d.startswith(".")]
+
+            # 1. Python: pyproject.toml
+            if "pyproject.toml" in files:
+                pyproject_path = Path(root) / "pyproject.toml"
+                deps = self._parse_pyproject(pyproject_path)
+                for d in deps:
+                    key = (d["name"], d.get("version", "*"), d["ecosystem"])
+                    if key not in seen_keys:
+                        seen_keys.add(key)
+                        dependencies.append(d)
+
+            # 2. Python: requirements.txt
+            for f in files:
+                if f == "requirements.txt" or f.endswith(".requirements.txt"):
+                    req_path = Path(root) / f
+                    deps = self._parse_requirements_txt(req_path)
+                    for d in deps:
+                        key = (d["name"], d.get("version", "*"), d["ecosystem"])
+                        if key not in seen_keys:
+                            seen_keys.add(key)
+                            dependencies.append(d)
+
+            # 3. Node.js: package.json & package-lock.json
+            if "package.json" in files:
+                pkg_path = Path(root) / "package.json"
+                lock_path = Path(root) / "package-lock.json" if "package-lock.json" in files else None
+                deps = self._parse_package_json(pkg_path, lock_path)
+                for d in deps:
+                    key = (d["name"], d.get("version", "*"), d["ecosystem"])
+                    if key not in seen_keys:
+                        seen_keys.add(key)
+                        dependencies.append(d)
+
+            # 4. Rust: Cargo.toml & Cargo.lock
+            if "Cargo.toml" in files:
+                cargo_path = Path(root) / "Cargo.toml"
+                cargo_lock = Path(root) / "Cargo.lock" if "Cargo.lock" in files else None
+                deps = self._parse_cargo_toml(cargo_path, cargo_lock)
+                for d in deps:
+                    key = (d["name"], d.get("version", "*"), d["ecosystem"])
+                    if key not in seen_keys:
+                        seen_keys.add(key)
+                        dependencies.append(d)
+
+            # 5. Go: go.mod
+            if "go.mod" in files:
+                go_mod_path = Path(root) / "go.mod"
+                deps = self._parse_go_mod(go_mod_path)
+                for d in deps:
+                    key = (d["name"], d.get("version", "*"), d["ecosystem"])
+                    if key not in seen_keys:
+                        seen_keys.add(key)
+                        dependencies.append(d)
+
+        dependencies.sort(key=lambda x: (x["ecosystem"], x["name"]))
+        return dependencies
+
+    def _parse_pyproject(self, path: Path) -> List[Dict[str, Any]]:
+        results = []
+        try:
+            content = path.read_text(encoding="utf-8", errors="ignore")
+            # 1. Standard PEP 621 dependencies = [...]
+            pep621_match = re.search(r"dependencies\s*=\s*\[(.*?)\]", content, re.DOTALL)
+            if pep621_match:
+                raw_deps = pep621_match.group(1)
+                for item in re.finditer(r'["\']([A-Za-z0-9_.\-]+)(?:([><=~!^]+.*?)?)?["\']', raw_deps):
+                    name = item.group(1).strip()
+                    ver = item.group(2).strip() if item.group(2) else "*"
+                    results.append({
+                        "name": name,
+                        "version": ver,
+                        "ecosystem": "pypi",
+                        "manifest": str(path.relative_to(self.repo_path)),
+                        "scope": "required",
+                        "purl": f"pkg:pypi/{name.lower()}@{ver}" if ver != "*" else f"pkg:pypi/{name.lower()}"
+                    })
+
+            # 2. Poetry tool.poetry.dependencies
+            poetry_match = re.search(r"\[tool\.poetry\.dependencies\](.*?)(?:\[|\Z)", content, re.DOTALL)
+            if poetry_match:
+                for line in poetry_match.group(1).splitlines():
+                    line = line.strip()
+                    if not line or line.startswith("#") or line.startswith("python"):
+                        continue
+                    m = re.match(r'([A-Za-z0-9_.\-]+)\s*=\s*["\']?([^"\']+)["\']?', line)
+                    if m:
+                        name = m.group(1).strip()
+                        ver = m.group(2).strip()
+                        results.append({
+                            "name": name,
+                            "version": ver,
+                            "ecosystem": "pypi",
+                            "manifest": str(path.relative_to(self.repo_path)),
+                            "scope": "required",
+                            "purl": f"pkg:pypi/{name.lower()}@{ver}"
+                        })
+        except Exception as e:
+            logger.debug("Failed to parse pyproject.toml at %s: %s", path, e)
+        return results
+
+    def _parse_requirements_txt(self, path: Path) -> List[Dict[str, Any]]:
+        results = []
+        try:
+            content = path.read_text(encoding="utf-8", errors="ignore")
+            for line in content.splitlines():
+                line = line.strip()
+                if not line or line.startswith("#") or line.startswith("-"):
+                    continue
+                m = re.match(r"^([A-Za-z0-9_.\-]+)(?:([><=~!^]+[A-Za-z0-9_.\-+]+))?", line)
+                if m:
+                    name = m.group(1).strip()
+                    ver = m.group(2).strip() if m.group(2) else "*"
+                    results.append({
+                        "name": name,
+                        "version": ver,
+                        "ecosystem": "pypi",
+                        "manifest": str(path.relative_to(self.repo_path)),
+                        "scope": "required",
+                        "purl": f"pkg:pypi/{name.lower()}@{ver}" if ver != "*" else f"pkg:pypi/{name.lower()}"
+                    })
+        except Exception as e:
+            logger.debug("Failed to parse requirements.txt at %s: %s", path, e)
+        return results
+
+    def _parse_package_json(self, path: Path, lock_path: Optional[Path] = None) -> List[Dict[str, Any]]:
+        results = []
+        locked_versions: Dict[str, str] = {}
+        if lock_path and lock_path.exists():
+            try:
+                lock_data = json.loads(lock_path.read_text(encoding="utf-8", errors="ignore"))
+                packages = lock_data.get("packages", {})
+                for pkg_key, pkg_info in packages.items():
+                    name = pkg_key.replace("node_modules/", "")
+                    if name and "version" in pkg_info:
+                        locked_versions[name] = pkg_info["version"]
+                for name, info in lock_data.get("dependencies", {}).items():
+                    if "version" in info:
+                        locked_versions[name] = info["version"]
+            except Exception as e:
+                logger.debug("Failed to parse package-lock.json: %s", e)
+
+        try:
+            data = json.loads(path.read_text(encoding="utf-8", errors="ignore"))
+            manifest_str = str(path.relative_to(self.repo_path))
+
+            # Runtime dependencies
+            for name, ver in data.get("dependencies", {}).items():
+                resolved_ver = locked_versions.get(name, str(ver))
+                results.append({
+                    "name": name,
+                    "version": resolved_ver,
+                    "declared_version": str(ver),
+                    "ecosystem": "npm",
+                    "manifest": manifest_str,
+                    "scope": "required",
+                    "purl": f"pkg:npm/{name}@{resolved_ver}"
+                })
+
+            # Dev dependencies
+            for name, ver in data.get("devDependencies", {}).items():
+                resolved_ver = locked_versions.get(name, str(ver))
+                results.append({
+                    "name": name,
+                    "version": resolved_ver,
+                    "declared_version": str(ver),
+                    "ecosystem": "npm",
+                    "manifest": manifest_str,
+                    "scope": "optional",
+                    "purl": f"pkg:npm/{name}@{resolved_ver}"
+                })
+        except Exception as e:
+            logger.debug("Failed to parse package.json at %s: %s", path, e)
+        return results
+
+    def _parse_cargo_toml(self, path: Path, lock_path: Optional[Path] = None) -> List[Dict[str, Any]]:
+        results = []
+        try:
+            content = path.read_text(encoding="utf-8", errors="ignore")
+            in_deps = False
+            for line in content.splitlines():
+                line = line.strip()
+                if line.startswith("[dependencies]") or line.startswith("[dev-dependencies]"):
+                    in_deps = True
+                    continue
+                if line.startswith("[") and in_deps:
+                    in_deps = False
+                    continue
+                if in_deps and "=" in line and not line.startswith("#"):
+                    name, val = line.split("=", 1)
+                    name = name.strip()
+                    val = val.strip().strip('"\'')
+                    ver = val
+                    if "version" in val:
+                        m = re.search(r'version\s*=\s*["\']([^"\']+)["\']', val)
+                        if m:
+                            ver = m.group(1)
+                    results.append({
+                        "name": name,
+                        "version": ver,
+                        "ecosystem": "cargo",
+                        "manifest": str(path.relative_to(self.repo_path)),
+                        "scope": "required",
+                        "purl": f"pkg:cargo/{name}@{ver}"
+                    })
+        except Exception as e:
+            logger.debug("Failed to parse Cargo.toml at %s: %s", path, e)
+        return results
+
+    def _parse_go_mod(self, path: Path) -> List[Dict[str, Any]]:
+        results = []
+        try:
+            content = path.read_text(encoding="utf-8", errors="ignore")
+            in_require = False
+            for line in content.splitlines():
+                line = line.strip()
+                if line.startswith("require ("):
+                    in_require = True
+                    continue
+                if in_require and line == ")":
+                    in_require = False
+                    continue
+                if in_require and line and not line.startswith("//"):
+                    parts = line.split()
+                    if len(parts) >= 2:
+                        name = parts[0]
+                        ver = parts[1]
+                        results.append({
+                            "name": name,
+                            "version": ver,
+                            "ecosystem": "golang",
+                            "manifest": str(path.relative_to(self.repo_path)),
+                            "scope": "required",
+                            "purl": f"pkg:golang/{name}@{ver}"
+                        })
+                elif line.startswith("require ") and not in_require:
+                    parts = line.replace("require ", "").split()
+                    if len(parts) >= 2:
+                        name = parts[0]
+                        ver = parts[1]
+                        results.append({
+                            "name": name,
+                            "version": ver,
+                            "ecosystem": "golang",
+                            "manifest": str(path.relative_to(self.repo_path)),
+                            "scope": "required",
+                            "purl": f"pkg:golang/{name}@{ver}"
+                        })
+        except Exception as e:
+            logger.debug("Failed to parse go.mod at %s: %s", path, e)
+        return results
+
+    def generate_cyclonedx_json(self) -> Dict[str, Any]:
+        """Generates an OASIS / OWASP CycloneDX v1.5 JSON standard document."""
+        deps = self.discover_dependencies()
+        now = datetime.now(timezone.utc).isoformat()
+        root_name = self.repo_path.name or "application"
+
+        components = []
+        dependencies_refs = []
+
+        for d in deps:
+            comp_id = f"{d['ecosystem']}-{d['name']}-{d['version']}".replace("/", "-")
+            comp = {
+                "bom-ref": comp_id,
+                "type": "library",
+                "name": d["name"],
+                "version": d["version"],
+                "purl": d["purl"],
+                "scope": d["scope"],
+                "properties": [
+                    {"name": "codedna:ecosystem", "value": d["ecosystem"]},
+                    {"name": "codedna:manifest", "value": d["manifest"]}
+                ]
+            }
+            components.append(comp)
+            dependencies_refs.append(comp_id)
+
+        doc = {
+            "bomFormat": "CycloneDX",
+            "specVersion": "1.5",
+            "serialNumber": f"urn:uuid:{uuid.uuid4()}",
+            "version": 1,
+            "metadata": {
+                "timestamp": now,
+                "tools": [
+                    {
+                        "vendor": "CodeDNA",
+                        "name": "codedna-sbom-engine",
+                        "version": "1.4.0"
+                    }
+                ],
+                "component": {
+                    "type": "application",
+                    "name": root_name,
+                    "version": "latest",
+                    "bom-ref": f"app-{root_name}"
+                }
+            },
+            "components": components,
+            "dependencies": [
+                {
+                    "ref": f"app-{root_name}",
+                    "dependsOn": dependencies_refs
+                }
+            ]
+        }
+        return doc
+
+    def generate_spdx_json(self) -> Dict[str, Any]:
+        """Generates a Linux Foundation SPDX v2.3 JSON specification document."""
+        deps = self.discover_dependencies()
+        now = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+        doc_name = self.repo_path.name or "codedna-project"
+
+        packages = [
+            {
+                "name": doc_name,
+                "SPDXID": "SPDXRef-RootPackage",
+                "versionInfo": "1.0.0",
+                "downloadLocation": "NOASSERTION",
+                "filesAnalyzed": False,
+                "licenseConcluded": "NOASSERTION",
+                "licenseDeclared": "NOASSERTION"
+            }
+        ]
+        relationships = [
+            {
+                "spdxElementId": "SPDXRef-DOCUMENT",
+                "relatedSpdxElement": "SPDXRef-RootPackage",
+                "relationshipType": "DESCRIBES"
+            }
+        ]
+
+        for idx, d in enumerate(deps, start=1):
+            spdx_id = f"SPDXRef-Package-{idx}-{re.sub(r'[^A-Za-z0-9.-]', '-', d['name'])}"
+            pkg = {
+                "name": d["name"],
+                "SPDXID": spdx_id,
+                "versionInfo": d["version"],
+                "downloadLocation": "NOASSERTION",
+                "filesAnalyzed": False,
+                "licenseConcluded": "NOASSERTION",
+                "licenseDeclared": "NOASSERTION",
+                "externalRefs": [
+                    {
+                        "referenceCategory": "PACKAGE-MANAGER",
+                        "referenceType": "purl",
+                        "referenceLocator": d["purl"]
+                    }
+                ]
+            }
+            packages.append(pkg)
+            relationships.append({
+                "spdxElementId": "SPDXRef-RootPackage",
+                "relatedSpdxElement": spdx_id,
+                "relationshipType": "DEPENDS_ON"
+            })
+
+        doc = {
+            "spdxVersion": "SPDX-2.3",
+            "dataLicense": "CC0-1.0",
+            "SPDXID": "SPDXRef-DOCUMENT",
+            "name": f"{doc_name}-SBOM",
+            "documentNamespace": f"https://spdx.org/spdxdocs/{doc_name}-{uuid.uuid4()}",
+            "creationInfo": {
+                "creators": ["Tool: CodeDNA-1.4.0", "Organization: CodeDNA Intelligence"],
+                "created": now
+            },
+            "packages": packages,
+            "relationships": relationships
+        }
+        return doc

codedna/config.py

@@ -0,0 +1,167 @@
+"""CodeDNA Configuration Loader — supports codedna.toml and pyproject.toml [tool.codedna]."""
+
+from __future__ import annotations
+
+import fnmatch
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+
+@dataclass
+class CodeDNAConfig:
+    """Configuration options for CodeDNA analysis, security, and CI quality gates."""
+
+    # Gatekeeper policies
+    min_health: str = "Fair"
+    max_critical_smells: int = 0
+    max_smells: int | None = None
+    fail_on_secrets: bool = True
+    fail_on_circular: bool = False
+    max_density: float | None = None
+    max_drift: float = 20.0
+    max_cyclomatic_complexity: int | None = None
+    min_maintainability_index: float | None = None
+
+    # Path exclusions
+    ignore_paths: list[str] = field(default_factory=list)
+
+    # Security whitelisting
+    whitelisted_secrets: list[str] = field(default_factory=list)
+
+    # Smell thresholds
+    max_file_lines: int = 500
+    max_function_lines: int = 80
+    god_class_methods: int = 15
+    large_module_files: int = 20
+
+    @property
+    def gate(self) -> CodeDNAConfig:
+        """Alias to self for structured access to gatekeeper configuration."""
+        return self
+
+    @property
+    def smells(self) -> CodeDNAConfig:
+        """Alias to self for structured access to smell thresholds."""
+        return self
+
+    def is_path_ignored(self, rel_path: str) -> bool:
+        """Check if relative file path matches any ignore glob patterns."""
+        normalized = rel_path.replace("\\", "/").strip("/")
+        for pattern in self.ignore_paths:
+            norm_pattern = pattern.replace("\\", "/").strip("/")
+            clean_base = norm_pattern.rstrip("/*")
+            if (
+                normalized == clean_base
+                or normalized.startswith(clean_base + "/")
+                or fnmatch.fnmatch(normalized, norm_pattern)
+                or fnmatch.fnmatch(Path(normalized).name, norm_pattern)
+            ):
+                return True
+        return False
+
+    def is_secret_whitelisted(self, secret_text: str) -> bool:
+        """Check if detected secret matches any whitelisted keywords or tokens."""
+        clean = secret_text.strip()
+        for allowed in self.whitelisted_secrets:
+            if allowed in clean or fnmatch.fnmatch(clean, allowed):
+                return True
+        return False
+
+
+def load_config(root_path: Path | str) -> CodeDNAConfig:
+    """Load configuration from codedna.toml, .codedna.toml, or pyproject.toml."""
+    root = Path(root_path)
+    candidates = [
+        root / "codedna.toml",
+        root / ".codedna.toml",
+        root / "pyproject.toml",
+    ]
+
+    for candidate in candidates:
+        if candidate.is_file():
+            try:
+                content = candidate.read_bytes()
+                data = tomllib.loads(content.decode("utf-8", errors="replace"))
+
+                section: dict[str, Any] = {}
+                if candidate.name == "pyproject.toml":
+                    section = data.get("tool", {}).get("codedna", {})
+                else:
+                    section = data.get("codedna", data)
+
+                if not section and candidate.name == "pyproject.toml":
+                    continue
+
+                smell_cfg = section.get("smells", {})
+                gate_cfg = section.get("gate", section)
+
+                return CodeDNAConfig(
+                    min_health=str(gate_cfg.get("min_health", section.get("min_health", "Fair"))),
+                    max_critical_smells=int(gate_cfg.get("max_critical_smells", section.get("max_critical_smells", 0))),
+                    max_smells=int(gate_cfg["max_smells"]) if "max_smells" in gate_cfg and gate_cfg["max_smells"] is not None else None,
+                    fail_on_secrets=bool(gate_cfg.get("fail_on_secrets", section.get("fail_on_secrets", True))),
+                    fail_on_circular=bool(gate_cfg.get("fail_on_circular", section.get("fail_on_circular", False))),
+                    max_density=float(gate_cfg["max_density"]) if "max_density" in gate_cfg and gate_cfg["max_density"] is not None else None,
+                    max_drift=float(gate_cfg.get("max_drift", section.get("max_drift", 20.0))),
+                    max_cyclomatic_complexity=int(gate_cfg["max_cyclomatic_complexity"]) if "max_cyclomatic_complexity" in gate_cfg and gate_cfg["max_cyclomatic_complexity"] is not None else None,
+                    min_maintainability_index=float(gate_cfg["min_maintainability_index"]) if "min_maintainability_index" in gate_cfg and gate_cfg["min_maintainability_index"] is not None else None,
+                    ignore_paths=list(section.get("ignore_paths", [])),
+                    whitelisted_secrets=list(section.get("whitelisted_secrets", [])),
+                    max_file_lines=int(smell_cfg.get("max_file_lines", section.get("max_file_lines", 500))),
+                    max_function_lines=int(smell_cfg.get("max_function_lines", section.get("max_function_lines", 80))),
+                    god_class_methods=int(smell_cfg.get("god_class_methods", section.get("god_class_methods", 15))),
+                    large_module_files=int(smell_cfg.get("large_module_files", section.get("large_module_files", 20))),
+                )
+            except Exception:
+                continue
+
+    return CodeDNAConfig()
+
+
+def generate_default_config_toml() -> str:
+    """Generate default starter codedna.toml file content."""
+    return '''# CodeDNA Configuration File (codedna.toml)
+# https://github.com/shenald-dev/codedna
+
+# Paths to exclude from analysis, smell checks, and security scans
+ignore_paths = [
+    "tests/*",
+    "docs/*",
+    "build/*",
+    "dist/*",
+    "*.min.js",
+]
+
+# Whitelist false-positive tokens or development test fixtures
+whitelisted_secrets = [
+    "PUBLIC_KEY",
+    "EXAMPLE_KEY",
+]
+
+[gate]
+# Minimum acceptable health rating ("Healthy", "Fair", "Needs Attention", "Critical")
+min_health = "Fair"
+
+# Maximum allowable critical smells (0 enforces zero-tolerance)
+max_critical_smells = 0
+
+# Maximum allowable total smells (omit or leave empty for no cap)
+# max_smells = 50
+
+# Fail CI immediately if secrets/credentials or circular dependencies are found
+fail_on_secrets = true
+fail_on_circular = false
+
+# Maximum acceptable genetic drift percentage during drift regression gates (0-100)
+max_drift = 20.0
+
+[smells]
+# Thresholds for architectural smell detection
+max_file_lines = 500
+max_function_lines = 80
+god_class_methods = 15
+large_module_files = 20
+'''
+

codedna/mcp/__init__.py

@@ -0,0 +1,5 @@
+"""CodeDNA Model Context Protocol (MCP 2024-11-05) Gateway."""
+
+from .server import CodeDNAMCPServer
+
+__all__ = ["CodeDNAMCPServer"]

codedna/mcp/protocol.py

@@ -0,0 +1,65 @@
+"""Model Context Protocol (MCP) JSON-RPC 2.0 schemas and protocol primitives."""
+
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass, field
+from typing import Any
+
+
+@dataclass
+class MCPToolDefinition:
+    """Definition of an exposed MCP tool with JSON Schema parameters."""
+
+    name: str
+    description: str
+    inputSchema: dict[str, Any]  # noqa: N815
+
+    def to_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class JSONRPCRequest:
+    """Standard JSON-RPC 2.0 request payload."""
+
+    jsonrpc: str
+    id: str | int | None
+    method: str
+    params: dict[str, Any] = field(default_factory=dict)
+
+    @classmethod
+    def from_dict(cls, data: Any) -> JSONRPCRequest:
+        if not isinstance(data, dict):
+            return cls(jsonrpc="2.0", id=None, method="", params={})
+        raw_params = data.get("params")
+        params = raw_params if isinstance(raw_params, dict) else {}
+        return cls(
+            jsonrpc=str(data.get("jsonrpc", "2.0")),
+            id=data.get("id"),
+            method=str(data.get("method", "")),
+            params=params,
+        )
+
+
+@dataclass
+class JSONRPCResponse:
+    """Standard JSON-RPC 2.0 response payload."""
+
+    jsonrpc: str = "2.0"
+    id: str | int | None = None
+    result: Any = None
+    error: dict[str, Any] | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        data: dict[str, Any] = {"jsonrpc": self.jsonrpc, "id": self.id}
+        if self.error is not None:
+            data["error"] = self.error
+        else:
+            data["result"] = self.result
+        return data
+
+
+# Standard Error Codes
+
+
+METHOD_NOT_FOUND = -32601