hubric 0.5.0__py3-none-any.whl

hubric/__init__.py

@@ -0,0 +1,6 @@
+"""
+Hubric — Zero-Config, LLM-Powered API Load Tester.
+"""
+
+__version__ = "0.5.0"
+

hubric/__main__.py

@@ -0,0 +1,5 @@
+import sys
+from hubric.cli.main import main
+
+if __name__ == "__main__":
+    sys.exit(main())

hubric/auth/__init__.py

@@ -0,0 +1,8 @@
+from .store import load_auth, save_auth, delete_credentials, auth_file_exists
+from .interviewer import run_auth_interview
+from .resolver import resolve_headers
+
+__all__ = [
+    "load_auth", "save_auth", "delete_credentials", "auth_file_exists",
+    "run_auth_interview", "resolve_headers",
+]

hubric/auth/classifier.py

@@ -0,0 +1,187 @@
+"""
+Auth classification rules and pattern detection.
+
+Categorizes endpoints into:
+  - token_source: login, register, signup (creates tokens; tested with payloads)
+  - untestable: email verification, OAuth callbacks, password resets, OTP/MFA
+  - external_dep: Stripe, Resend, Twilio, etc.
+"""
+
+import re
+
+# Routes that generate tokens from public credentials — should never require a token to be tested
+TOKEN_SOURCE_SIGNALS = (
+    "/login", "/register", "/signup", "/sign-up", "/sign_up",
+    "/token", "/auth/token", "/refresh", "/auth/refresh",
+    "/signin", "/sign-in", "/sign_in", "/api/login", "/api/auth/login",
+    "/api/authenticate", "/authenticate", "/oauth/token", "/oauth2/token",
+    "/users/login", "/user/login", "/session"
+)
+
+# Routes that depend on out-of-band flows — can never be load tested
+UNTESTABLE_PATTERNS = [
+    # Email / phone verification & confirmation & activation
+    r"verify.*(email|phone|account|user|mobile)",
+    r"(email|phone|account|user|mobile).*verify",
+    r"confirm.*(email|phone|account|user)",
+    r"(email|phone|account|user).*confirm",
+    r"activate.*(account|user)",
+    r"(account|user).*activate",
+    r"resend.*(verif|email|code|otp|token|activation)",
+    r"(send|request).*(verif|code|otp|activation)",
+
+    # Password recovery & reset
+    r"reset.*password",
+    r"password.*reset",
+    r"forgot.*password",
+    r"password.*forgot",
+    r"recover.*password",
+    r"password.*recover",
+    r"change.*password.*token",
+
+    # Two-factor / MFA / Passkey / OTP
+    r"\bmfa\b", r"\b2fa\b", r"sms.*code",
+    r"\btotp\b", r"\bwebauthn\b", r"\bfido\b",
+    r"magic.?link",
+    r"send.?otp",
+
+    # Outbound notifications / invites / dispatches (trigger external email/SMS without testable state)
+    r"resend",
+    r"\binvite(s|d)?\b",
+    r"\binvitations?\b",
+    r"request.*(otp|code|token|verif|link)",
+    r"dispatch.*(email|sms|notification)",
+
+    # OAuth / SAML / Webhook callbacks
+    r"oauth.*callback",
+    r"auth0.*callback",
+    r"saml.*acs",
+    r"webhook.*callback",
+    r"/callbacks?(/|$)",
+]
+
+# Patterns specifically identifying outbound dispatch triggers
+OUTBOUND_DISPATCH_PATTERNS = [
+    r"resend",
+    r"send.?otp",
+    r"magic.?link",
+    r"\binvite(s|d)?\b",
+    r"\binvitations?\b",
+    r"request.*(otp|code|token|verif|link)",
+    r"dispatch.*(email|sms|notification)",
+]
+
+def _is_outbound_dispatch(text: str) -> bool:
+    """Returns True if text indicates an outbound notification or invitation route."""
+    text_lower = text.lower()
+    return any(re.search(p, text_lower) for p in OUTBOUND_DISPATCH_PATTERNS)
+
+
+# Known external service signals in route, summary, description, body fields
+EXTERNAL_SERVICE_PATTERNS = [
+    r"stripe",   r"paystack",  r"flutterwave", r"paypal",
+    r"resend",   r"sendgrid",  r"mailgun",     r"twilio",
+    r"webhook",  r"callback",
+    r"auth0", r"cognito", r"clerk", r"supabase", r"firebase", r"okta", r"kinde",
+    r"square", r"braintree", r"razorpay", r"paddle", r"lemonsqueezy",
+    r"aws-sns", r"plaid", r"hubspot", r"salesforce"
+]
+
+# Parameter and body field names that indicate out-of-band flows (email codes, OTPs, magic links)
+OOB_BODY_SIGNALS = {
+    "oob_code", "oobCode", "otp", "otp_code", "otpCode",
+    "verification_code", "verificationCode", "verify_code", "verifyCode",
+    "activation_token", "activationToken", "activation_code", "activationCode",
+    "reset_token", "resetToken", "reset_code", "resetCode",
+    "confirm_token", "confirmToken", "confirmation_code", "confirmationCode",
+    "magic_link_token", "magicLinkToken",
+    "email_token", "emailToken", "email_code", "emailCode",
+    "sms_code", "smsCode", "mfa_token", "mfaToken", "mfa_code", "mfaCode",
+    "totp", "totp_code", "totpCode", "two_factor_code", "two_factor_token",
+    "passcode"
+}
+
+
+def _is_token_source(ep: dict) -> bool:
+    """
+    Returns True if this endpoint generates tokens rather than consuming them.
+    These need valid request payloads, not Authorization headers.
+    Rubric tests them as public endpoints with synthesized bodies.
+    """
+    route = ep.get("route", "").lower()
+    return any(signal in route for signal in TOKEN_SOURCE_SIGNALS)
+
+
+def _is_refresh_endpoint(ep: dict) -> bool:
+    """Returns True if this endpoint is a token refresh endpoint."""
+    route = ep.get("route", "").lower()
+    summary = ep.get("summary", "").lower()
+    description = ep.get("description", "").lower()
+    text = f"{route} {summary} {description}"
+    return bool(
+        re.search(r"\b(auth/)?(token/)?refresh\b", text)
+        or "/refresh" in route
+        or "refresh token" in text
+    )
+
+
+def _detect_untestable(ep: dict) -> bool:
+    """Returns True if the endpoint requires an out-of-band flow.
+    
+    Detection strategy:
+      1. Route/summary/description regex matching against UNTESTABLE_PATTERNS
+      2. Parameter inspection — if ANY body, query, or path parameter
+         matches OOB_BODY_SIGNALS, the endpoint requires an external code/token
+         that Rubric cannot synthesize (e.g. resetToken, otp, email_code).
+      3. Parameter inspection for generic 'token' or 'code' on verification/reset routes.
+    """
+    text = " ".join([
+        ep.get("route", ""),
+        ep.get("summary", ""),
+        ep.get("description", ""),
+    ]).lower()
+    if any(re.search(p, text) for p in UNTESTABLE_PATTERNS) or _is_outbound_dispatch(text):
+        return True
+
+    # Collect parameter names across body, query, and path params
+    param_names = set()
+    for p in ep.get("query_params", []) + ep.get("path_params", []):
+        param_names.add(p.get("name", "").lower())
+
+    body_schema = ep.get("body_schema") or {}
+    properties = body_schema.get("properties") or {}
+    param_names.update(k.lower() for k in properties.keys())
+
+    oob_lower = {k.lower() for k in OOB_BODY_SIGNALS}
+    if param_names.intersection(oob_lower):
+        return True
+
+    # Generic token/code on verification/reset endpoints
+    if ("token" in param_names or "code" in param_names) and any(
+        kw in text for kw in ("verify", "confirm", "reset", "activate", "unlock")
+    ):
+        return True
+
+    return False
+
+
+def _detect_external(ep: dict) -> str | None:
+    """
+    Returns a short label if the endpoint looks like an external service dep.
+    Checks route, summary, description, tags, and body field names.
+    """
+    targets = [
+        ep.get("route", ""),
+        ep.get("summary", ""),
+        ep.get("description", ""),
+        " ".join(ep.get("tags", [])),
+    ]
+    body = ep.get("body_schema") or {}
+    targets += list((body.get("properties") or {}).keys())
+    text = " ".join(targets).lower()
+
+    for pattern in EXTERNAL_SERVICE_PATTERNS:
+        if re.search(pattern, text):
+            match = re.search(pattern, text)
+            return match.group(0) if match else "external service"
+    return None