patchi 0.7.5__py3-none-any.whl

patchi/core/security/defenders/crypto_fix.py

@@ -0,0 +1,118 @@
+"""Adapter: crypto_fix — replace weak crypto with modern algorithms."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from pathlib import Path
+
+from patchi.core.fix.patch import FileChange, Patch
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.crypto_fix")
+
+# Known bad → good replacements (in order of specificity)
+_CRYPTO_REPLACEMENTS: list[tuple[str, str]] = [
+    ("hashlib.md5(", "hashlib.sha256("),
+    ("hashlib.sha1(", "hashlib.sha256("),
+    (
+        "from cryptography.hazmat.primitives.ciphers.algorithms import ARC4",
+        "from cryptography.hazmat.primitives.ciphers.algorithms import ChaCha20",
+    ),
+    ("ARC4.new(", "ChaCha20.new("),
+    ("DES.new(", "AES.new("),
+    ("DES3.new(", "AES.new("),
+    ("RSA.generate(1024", "RSA.generate(2048"),
+    ("RSA.generate(512", "RSA.generate(2048"),
+    ("DSA.generate(512", "RSA.generate(2048"),
+    ("DSA.generate(1024", "RSA.generate(2048"),
+    ("PBKDF2", "PBKDF2HMAC"),
+]
+
+
+class CryptoFixAdapter(BaseAdapter):
+    """Replace weak crypto with modern algorithms."""
+
+    action_type = "crypto_fix"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        if not action.target or not Path(action.target).exists():
+            return DefendResult(
+                action="skipped",
+                reason=f"File does not exist: {action.target}",
+                defense_action=action,
+            )
+        fpath = Path(action.target)
+        try:
+            content = fpath.read_text(encoding="utf-8", errors="ignore")
+        except OSError as e:
+            return DefendResult(action="blocked", reason=f"Read error: {e}", defense_action=action)
+
+        changes = []
+        for old, new in _CRYPTO_REPLACEMENTS:
+            if old in content:
+                lines = content.splitlines()
+                for _i, line in enumerate(lines):
+                    if old in line:
+                        change = FileChange(
+                            path=str(fpath),
+                            original=line,
+                            proposed=line.replace(old, new),
+                        )
+                        changes.append(change)
+                        break
+
+        if not changes:
+            return DefendResult(
+                action="skipped",
+                reason="No weak crypto patterns found in file",
+                defense_action=action,
+            )
+
+        patch = Patch(
+            id=uuid.uuid4().hex[:12],
+            agent=action.finding.agent,
+            finding_id=action.finding.type,
+            patch_type="SECURITY",
+            changes=changes,
+            description="Replace weak cryptography with modern algorithms",
+            risk_score=20,
+            confidence=90,
+            blast_radius=1,
+        )
+        gate_result = self.risk_gate.evaluate(patch)
+        if gate_result.is_auto:
+            try:
+                patch.apply()
+                return DefendResult(
+                    action="applied",
+                    reason="Crypto fix auto-applied",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Apply failed: {e}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+        elif gate_result.is_blocked:
+            return DefendResult(
+                action="blocked",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )
+        else:
+            return DefendResult(
+                action="queued",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )

patchi/core/security/defenders/enforce_rate_limit.py

@@ -0,0 +1,108 @@
+"""Adapter: enforce_rate_limit — add rate limiting middleware."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from pathlib import Path
+
+from patchi.core.fix.patch import FileChange, Patch
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.enforce_rate_limit")
+
+
+class EnforceRateLimitAdapter(BaseAdapter):
+    """Enforce rate limiting on an endpoint by adding middleware."""
+
+    action_type = "enforce_rate_limit"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        if not action.target or not Path(action.target).exists():
+            return DefendResult(
+                action="skipped",
+                reason=f"File does not exist: {action.target}",
+                defense_action=action,
+            )
+        fpath = Path(action.target)
+        try:
+            content = fpath.read_text(encoding="utf-8", errors="ignore")
+        except OSError as e:
+            return DefendResult(action="blocked", reason=f"Read error: {e}", defense_action=action)
+
+        changes = []
+        if "flask" in content.lower():
+            if "from flask_limiter import Limiter" not in content:
+                changes.append(
+                    FileChange(
+                        path=str(fpath),
+                        original=content,
+                        proposed=(
+                            "from flask_limiter import Limiter\n"
+                            "from flask_limiter.util import get_remote_address\n\n"
+                            "limiter = Limiter(key_func=get_remote_address)\n" + content
+                        ),
+                    )
+                )
+        elif "fastapi" in content.lower():
+            if (
+                "from slowapi import Limiter" not in content
+                and "from fastapi import Depends" in content
+            ):
+                changes.append(
+                    FileChange(
+                        path=str(fpath),
+                        original=content,
+                        proposed=(
+                            "from slowapi import Limiter, _rate_limit_exceeded_handler\n"
+                            "from slowapi.util import get_remote_address\n" + content
+                        ),
+                    )
+                )
+
+        if not changes:
+            return DefendResult(
+                action="queued",
+                reason="Add rate limit middleware manually — no framework template matched",
+                defense_action=action,
+            )
+
+        patch = Patch(
+            id=uuid.uuid4().hex[:12],
+            agent=action.finding.agent,
+            finding_id=action.finding.type,
+            patch_type="CONFIG",
+            changes=changes,
+            description="Add rate limiting middleware",
+            risk_score=15,
+            confidence=65,
+            blast_radius=1,
+        )
+        gate_result = self.risk_gate.evaluate(patch)
+        if gate_result.is_auto:
+            try:
+                patch.apply()
+                return DefendResult(
+                    action="applied",
+                    reason="Rate limit middleware template added",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Apply failed: {e}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+        else:
+            return DefendResult(
+                action="queued" if not gate_result.is_blocked else "blocked",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )

patchi/core/security/defenders/fix_code.py

@@ -0,0 +1,93 @@
+"""Adapter: fix_code — create Patch, pass through RiskGate, apply if allowed."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from pathlib import Path
+
+from patchi.core.fix.patch import FileChange, Patch
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.fix_code")
+
+# Human-readable labels for each action type (shared across adapters)
+ACTION_LABELS: dict[str, str] = {
+    "fix_code": "Fix code vulnerability",
+    "update_dependency": "Update vulnerable dependency",
+    "block_ip": "Block malicious IP",
+    "rotate_secret": "Rotate exposed secret",
+    "patch_config": "Patch security configuration",
+    "crypto_fix": "Replace weak crypto with modern algorithms",
+    "auth_middleware": "Add authentication middleware",
+    "invalidate_session": "Invalidate active sessions",
+    "enforce_rate_limit": "Enforce rate limiting middleware",
+    "suspend_account": "Suspend compromised account",
+    "block_ws_origin": "Block WebSocket origin",
+    "escalate": "Escalate for human review",
+}
+
+
+class FixCodeAdapter(BaseAdapter):
+    """Create a Patch and pass through RiskGate for mode-based decision."""
+
+    action_type = "fix_code"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        if not action.target or not Path(action.target).exists():
+            return DefendResult(
+                action="skipped",
+                reason=f"File does not exist: {action.target}",
+                defense_action=action,
+            )
+
+        change = FileChange(path=action.target, original="", proposed=action.fix_code)
+        patch = Patch(
+            id=uuid.uuid4().hex[:12],
+            agent=action.finding.agent,
+            finding_id=action.finding.type,
+            patch_type="SECURITY",
+            changes=[change],
+            description=ACTION_LABELS.get(action.type, "Security fix"),
+            risk_score=self._estimate_risk(action),
+            confidence=90,
+            blast_radius=0,
+        )
+
+        gate_result = self.risk_gate.evaluate(patch)
+
+        if gate_result.is_auto:
+            try:
+                patch.apply()
+                return DefendResult(
+                    action="applied",
+                    reason=f"Auto-applied: {gate_result.reason}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Apply failed: {e}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+        elif gate_result.is_blocked:
+            return DefendResult(
+                action="blocked",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )
+        else:
+            return DefendResult(
+                action="queued",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )

patchi/core/security/defenders/invalidate_session.py

@@ -0,0 +1,40 @@
+"""Adapter: invalidate_session — queue session invalidation for compromised users."""
+
+from __future__ import annotations
+
+import json
+import logging
+import time
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.invalidate_session")
+
+
+class InvalidateSessionAdapter(BaseAdapter):
+    """Invalidate all active sessions for a user."""
+
+    action_type = "invalidate_session"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        inval_path = self.root / ".patchi" / "invalidate_sessions.json"
+        target = action.target or "unknown_user"
+        pending: dict = {}
+        if inval_path.exists():
+            try:
+                pending = json.loads(inval_path.read_text(encoding="utf-8"))
+            except Exception as e:
+                _log.warning("InvalidateSessionAdapter read failed: %s", e)
+                pending = {}
+        pending[target] = {
+            "timestamp": time.time(),
+            "reason": action.finding.message or "Session compromise detected",
+            "finding_type": action.finding.type,
+        }
+        inval_path.parent.mkdir(parents=True, exist_ok=True)
+        inval_path.write_text(json.dumps(pending, indent=2), encoding="utf-8")
+        return DefendResult(
+            action="applied",
+            reason=f"Queued session invalidation for {target} — written to .patchi/invalidate_sessions.json",
+            defense_action=action,
+        )

patchi/core/security/defenders/patch_config.py

@@ -0,0 +1,70 @@
+"""Adapter: patch_config — edit config file with known-good values."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from pathlib import Path
+
+from patchi.core.fix.patch import FileChange, Patch
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+from .fix_code import ACTION_LABELS
+
+_log = logging.getLogger("patchi.security.defenders.patch_config")
+
+
+class PatchConfigAdapter(BaseAdapter):
+    """Patch a configuration file with known-good values."""
+
+    action_type = "patch_config"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        if not action.target or not Path(action.target).exists():
+            return DefendResult(
+                action="skipped",
+                reason=f"Config file does not exist: {action.target}",
+                defense_action=action,
+            )
+
+        change = FileChange(path=action.target, original="", proposed=action.fix_code)
+        patch = Patch(
+            id=uuid.uuid4().hex[:12],
+            agent=action.finding.agent,
+            finding_id=action.finding.type,
+            patch_type="CONFIG",
+            changes=[change],
+            description=ACTION_LABELS.get(action.type, "Config patch"),
+            risk_score=self._estimate_risk(action),
+            confidence=85,
+            blast_radius=0,
+        )
+
+        gate_result = self.risk_gate.evaluate(patch)
+
+        if gate_result.is_auto:
+            try:
+                patch.apply()
+                return DefendResult(
+                    action="applied",
+                    reason=f"Config auto-patched: {gate_result.reason}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Config patch failed: {e}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+        else:
+            return DefendResult(
+                action="queued" if not gate_result.is_blocked else "blocked",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )

patchi/core/security/defenders/rotate_secret.py

@@ -0,0 +1,54 @@
+"""Adapter: rotate_secret — generate new secret and update .env."""
+
+from __future__ import annotations
+
+import logging
+import re
+import secrets as sec
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.rotate_secret")
+
+
+class RotateSecretAdapter(BaseAdapter):
+    """Generate a new secret and update the code."""
+
+    action_type = "rotate_secret"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        new_secret = sec.token_urlsafe(32)
+        env_path = self.root / ".env"
+        if env_path.exists():
+            try:
+                content = env_path.read_text(encoding="utf-8")
+                var_name = (
+                    action.target if action.target and "=" not in action.target else "SECRET_KEY"
+                )
+                if var_name in content:
+                    content = re.sub(
+                        rf"^{re.escape(var_name)}=.*$",
+                        f"{var_name}={new_secret}",
+                        content,
+                        count=1,
+                        flags=re.MULTILINE,
+                    )
+                else:
+                    content = f"{content.rstrip()}\n{var_name}={new_secret}\n"
+                env_path.write_text(content, encoding="utf-8")
+                return DefendResult(
+                    action="applied",
+                    reason=f"Rotated {var_name} in .env — new 256-bit secret generated",
+                    defense_action=action,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Failed to rotate secret: {e}",
+                    defense_action=action,
+                )
+        return DefendResult(
+            action="queued",
+            reason="No .env file found — create one and add the rotated secret manually",
+            defense_action=action,
+        )

patchi/core/security/defenders/suspend_account.py

@@ -0,0 +1,41 @@
+"""Adapter: suspend_account — suspend a compromised account (hosted mode only)."""
+
+from __future__ import annotations
+
+import json
+import logging
+import time
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.suspend_account")
+
+
+class SuspendAccountAdapter(BaseAdapter):
+    """Suspend a compromised account (hosted mode only)."""
+
+    action_type = "suspend_account"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        susp_path = self.root / ".patchi" / "suspend_accounts.json"
+        target = action.target or "unknown_account"
+        pending: dict = {}
+        if susp_path.exists():
+            try:
+                pending = json.loads(susp_path.read_text(encoding="utf-8"))
+            except Exception as e:
+                _log.warning("SuspendAccountAdapter read failed: %s", e)
+                pending = {}
+        pending[target] = {
+            "timestamp": time.time(),
+            "reason": action.finding.message or "Account compromise detected",
+            "finding_type": action.finding.type,
+            "severity": action.severity,
+        }
+        susp_path.parent.mkdir(parents=True, exist_ok=True)
+        susp_path.write_text(json.dumps(pending, indent=2), encoding="utf-8")
+        return DefendResult(
+            action="applied",
+            reason=f"Queued account suspension for {target} — written to .patchi/suspend_accounts.json",
+            defense_action=action,
+        )

patchi/core/security/defenders/update_dependency.py

@@ -0,0 +1,160 @@
+"""Adapter: update_dependency — detect package manager, update vulnerable package."""
+
+from __future__ import annotations
+
+import logging
+import subprocess
+from pathlib import Path
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.update_dep")
+
+# Package managers and their update commands
+_PACKAGE_MANAGERS: list[dict] = [
+    {
+        "name": "pip",
+        "check": ["pip", "--version"],
+        "update": ["pip", "install", "--upgrade"],
+        "files": ["requirements.txt", "Pipfile", "pyproject.toml"],
+    },
+    {
+        "name": "npm",
+        "check": ["npm", "--version"],
+        "update": ["npm", "update"],
+        "files": ["package.json"],
+    },
+    {
+        "name": "yarn",
+        "check": ["yarn", "--version"],
+        "update": ["yarn", "upgrade"],
+        "files": ["package.json"],
+    },
+    {
+        "name": "cargo",
+        "check": ["cargo", "--version"],
+        "update": ["cargo", "update"],
+        "files": ["Cargo.toml"],
+    },
+    {"name": "go", "check": ["go", "version"], "update": ["go", "get", "-u"], "files": ["go.mod"]},
+    {
+        "name": "gem",
+        "check": ["gem", "--version"],
+        "update": ["gem", "update"],
+        "files": ["Gemfile"],
+    },
+    {
+        "name": "nuget",
+        "check": ["dotnet", "--version"],
+        "update": ["dotnet", "package", "update"],
+        "files": ["*.csproj", "packages.config"],
+    },
+    {
+        "name": "composer",
+        "check": ["composer", "--version"],
+        "update": ["composer", "update"],
+        "files": ["composer.json"],
+    },
+]
+
+
+def detect_package_manager(root: Path) -> str | None:
+    """Detect which package manager is available in the project."""
+    for pm in _PACKAGE_MANAGERS:
+        try:
+            r = subprocess.run(pm["check"], capture_output=True, text=True, timeout=5)
+            if r.returncode == 0:
+                for f in pm["files"]:
+                    matches = list(root.glob(f))
+                    if matches:
+                        return pm["name"]
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            continue
+    return None
+
+
+def detect_manifest(root: Path) -> Path | None:
+    """Detect project manifest file."""
+    for pattern in [
+        "pyproject.toml",
+        "package.json",
+        "Cargo.toml",
+        "go.mod",
+        "Gemfile",
+        "build.gradle",
+        "pom.xml",
+    ]:
+        matches = list(root.glob(pattern))
+        if matches:
+            return matches[0]
+    return None
+
+
+class UpdateDependencyAdapter(BaseAdapter):
+    """Update a vulnerable dependency via detected package manager."""
+
+    action_type = "update_dependency"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        pkg = Path(action.target).name if action.target else ""
+        if not pkg:
+            return DefendResult(
+                action="skipped",
+                reason="No package specified for update",
+                defense_action=action,
+            )
+
+        pm_name = detect_package_manager(self.root)
+        if not pm_name:
+            return DefendResult(
+                action="queued",
+                reason="No supported package manager detected (tried pip, npm, yarn, cargo, go, gem, nuget, composer)",
+                defense_action=action,
+            )
+
+        pm_config = next((p for p in _PACKAGE_MANAGERS if p["name"] == pm_name), None)
+        if not pm_config:
+            return DefendResult(
+                action="blocked",
+                reason=f"Package manager '{pm_name}' config not found",
+                defense_action=action,
+            )
+
+        try:
+            cmd = pm_config["update"] + [pkg]
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+            if result.returncode == 0:
+                manifest = detect_manifest(self.root)
+                if manifest and manifest.exists():
+                    try:
+                        text = manifest.read_text(encoding="utf-8")
+                        text = text.replace(
+                            f"{pkg}==",
+                            f"{pkg}==  # updated by Patchi",
+                        )
+                        manifest.write_text(text, encoding="utf-8")
+                    except Exception as e:
+                        _log.warning("UpdateDependencyAdapter failed to annotate manifest: %s", e)
+                return DefendResult(
+                    action="applied",
+                    reason=f"Updated {pkg} via {pm_name} successfully",
+                    defense_action=action,
+                )
+            else:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"{pm_name} update failed: {result.stderr[:200]}",
+                    defense_action=action,
+                )
+        except FileNotFoundError:
+            return DefendResult(
+                action="skipped",
+                reason=f"{pm_name} not found — cannot update dependencies",
+                defense_action=action,
+            )
+        except subprocess.TimeoutExpired:
+            return DefendResult(
+                action="blocked",
+                reason=f"{pm_name} update timed out",
+                defense_action=action,
+            )