speculynx 0.1.0__py3-none-any.whl

speculynx/dast.py

@@ -0,0 +1,154 @@
+import httpx
+import json
+import time
+from pathlib import Path
+from typing import Optional
+import typer
+
+# ==============================================================================
+# FORGE DE REQUÊTES
+# ==============================================================================
+
+def forge_url(base_url: str, path: str, params: dict) -> str:
+    """Remplace les path params {id} par des valeurs de test."""
+    url = base_url.rstrip("/") + path
+    for param_name in params:
+        url = url.replace(f"{{{param_name}}}", "1")
+    return url
+
+def get_path_params(methods: dict) -> dict:
+    """Extrait les paramètres de path depuis la spec."""
+    params = {}
+    for method, config in methods.items():
+        if isinstance(config, dict):
+            for p in config.get("parameters", []):
+                if p.get("in") == "path":
+                    params[p.get("name")] = "1"
+    return params
+
+# ==============================================================================
+# CHECKS DAST
+# ==============================================================================
+
+def check_dast_auth_bypass(client: httpx.Client, base_url: str, openapi_data: dict) -> dict:
+    """DAST-01 : Vérifie si des endpoints répondent 200 sans authentification."""
+    findings = []
+    paths = openapi_data.get("paths", {})
+
+    for path, methods in list(paths.items())[:5]:  # limite à 5 paths pour le MVP
+        path_params = get_path_params(methods)
+        url = forge_url(base_url, path, path_params)
+        for method in ["get", "post", "put", "delete"]:
+            if method not in methods:
+                continue
+            try:
+                resp = client.request(method.upper(), url, timeout=5)
+                if resp.status_code == 200:
+                    findings.append(f"{method.upper()} {url} → 200 sans token")
+            except Exception:
+                pass
+
+    passed = len(findings) == 0
+    return {
+        "id": "DAST-01",
+        "name": "Auth Bypass",
+        "severity": "CRITIQUE",
+        "passed": passed,
+        "dynamic": True,
+        "description": "Envoie des requêtes sans token et vérifie si l'API répond 200.",
+        "fail_message": f"Endpoints accessibles sans auth : {findings}" if findings else None
+    }
+
+
+def check_dast_verbose_errors(client: httpx.Client, base_url: str, openapi_data: dict) -> dict:
+    """DAST-03 : Envoie des données malformées et cherche des stack traces."""
+    findings = []
+    paths = openapi_data.get("paths", {})
+    error_keywords = ["traceback", "exception", "error at line", "syntaxerror",
+                      "nameerror", "typeerror", "file \"/", "line "]
+
+    for path, methods in list(paths.items())[:5]:
+        path_params = get_path_params(methods)
+        url = forge_url(base_url, path, path_params)
+        if "post" in methods or "put" in methods:
+            method = "post" if "post" in methods else "put"
+            try:
+                resp = client.request(
+                    method.upper(), url,
+                    json={"id": "'; DROP TABLE users; --", "value": None},
+                    timeout=5
+                )
+                body = resp.text.lower()
+                if any(kw in body for kw in error_keywords):
+                    findings.append(f"{method.upper()} {url} → stack trace détectée")
+            except Exception:
+                pass
+
+    passed = len(findings) == 0
+    return {
+        "id": "DAST-03",
+        "name": "Verbose Errors / Info Leak",
+        "severity": "ÉLEVÉE",
+        "passed": passed,
+        "dynamic": True,
+        "description": "Envoie des payloads malformés et détecte les stack traces dans les réponses.",
+        "fail_message": f"Info leak détecté : {findings}" if findings else None
+    }
+
+
+def check_dast_rate_limit(client: httpx.Client, base_url: str, openapi_data: dict) -> dict:
+    """DAST-05 : Envoie 20 requêtes rapides et vérifie si un 429 est retourné."""
+    paths = openapi_data.get("paths", {})
+    if not paths:
+        return {"id": "DAST-05", "passed": True, "dynamic": True,
+                "name": "Rate Limiting", "severity": "MOYENNE",
+                "description": "Aucun path trouvé.", "fail_message": None}
+
+    first_path = list(paths.keys())[0]
+    path_params = get_path_params(paths[first_path])
+    url = forge_url(base_url, first_path, path_params)
+
+    got_429 = False
+    for _ in range(20):
+        try:
+            resp = client.get(url, timeout=3)
+            if resp.status_code == 429:
+                got_429 = True
+                break
+        except Exception:
+            break
+
+    return {
+        "id": "DAST-05",
+        "name": "Rate Limiting absent",
+        "severity": "MOYENNE",
+        "passed": got_429,
+        "dynamic": True,
+        "description": "Envoie 20 requêtes rapides et vérifie si l'API applique un rate limit (HTTP 429).",
+        "fail_message": f"Aucun rate limit détecté sur {url} après 20 requêtes." if not got_429 else None
+    }
+
+# ==============================================================================
+# CHEF D'ORCHESTRE DAST
+# ==============================================================================
+
+def run_dast_audit(file_path: Path, base_url: str) -> list:
+    """
+    Lance l'audit DAST complet.
+    base_url : ex. https://api.example.com
+    """
+    from speculynx.scanner import load_openapi_file
+    openapi_data = load_openapi_file(file_path)
+
+    typer.echo(typer.style(f"\n🌐 Cible DAST : {base_url}", fg=typer.colors.CYAN))
+    typer.echo(typer.style("⚠️  Mode DAST : requêtes réelles envoyées à l'API cible\n", fg=typer.colors.YELLOW))
+
+    # Client HTTP sans authentification (test d'auth bypass)
+    with httpx.Client(verify=False, follow_redirects=True) as client:
+        results = [
+            check_dast_auth_bypass(client, base_url, openapi_data),
+            check_dast_verbose_errors(client, base_url, openapi_data),
+            check_dast_rate_limit(client, base_url, openapi_data),
+        ]
+
+    return results

speculynx/main.py

@@ -0,0 +1,120 @@
+import typer
+import os
+from typing import Optional
+from pathlib import Path
+from speculynx.scanner import run_audit
+from speculynx.dast import run_dast_audit
+from speculynx.utils import load_api_key, save_api_key, verify_license_online, generate_pdf_report
+
+app = typer.Typer(
+    name="speculynx",
+    help="Speculynx : L'outil CLI d'audit de sécurité pour API REST.",
+    add_completion=False
+)
+
+def remove_local_license():
+    config_path = os.path.expanduser("~/.speculynx.json")
+    if os.path.exists(config_path):
+        os.remove(config_path)
+
+@app.command()
+def login():
+    """Connecte la CLI à votre compte Speculynx Pro."""
+    typer.echo(typer.style("🔑 Connexion à Speculynx Pro", fg=typer.colors.MAGENTA, bold=True))
+    api_key = typer.prompt("Entrez votre clé de licence Speculynx Pro")
+    typer.echo("Vérification auprès du serveur cloud...")
+    license_info = verify_license_online(api_key)
+    if license_info.get("status") == "active":
+        save_api_key(api_key)
+        typer.echo(typer.style("✅ Authentification réussie !", fg=typer.colors.GREEN, bold=True))
+    else:
+        typer.echo(typer.style("❌ Clé invalide.", fg=typer.colors.RED))
+
+@app.command()
+def info():
+    """Affiche les détails de votre licence actuelle."""
+    saved_key = load_api_key()
+    if not saved_key:
+        typer.echo("Aucune licence trouvée. Faites 'speculynx login'.")
+        return
+    license_info = verify_license_online(saved_key)
+    if license_info.get("status") == "active":
+        typer.echo(typer.style("💎 État : Speculynx Pro", fg=typer.colors.CYAN, bold=True))
+    else:
+        typer.echo(typer.style("⚡ État : Speculynx Free", fg=typer.colors.YELLOW, bold=True))
+        remove_local_license()
+
+@app.command()
+def scan(
+    file: Path = typer.Option(..., "--file", "-f", help="Fichier OpenAPI à auditer.", exists=True),
+    export: Optional[Path] = typer.Option(None, "--export", "-e", help="[Pro] Exporter le rapport PDF.")
+):
+    """Lance l'audit de sécurité statique sur une spec OpenAPI."""
+    saved_key = load_api_key()
+    is_pro = False
+    if saved_key:
+        license_info = verify_license_online(saved_key)
+        if license_info.get("status") == "active":
+            is_pro = True
+        else:
+            remove_local_license()
+
+    typer.echo(typer.style("👑 MODE PRO ACTIVÉ", fg=typer.colors.MAGENTA, bold=True) if is_pro else typer.style("⚡ MODE FREE", fg=typer.colors.YELLOW))
+    audit_results = run_audit(file, is_pro=is_pro)
+    _print_results(audit_results)
+
+    if export:
+        if is_pro:
+            generate_pdf_report(file.name, audit_results, export)
+            typer.echo(f"✅ Rapport exporté : {export}")
+        else:
+            typer.echo(typer.style("🛑 Export refusé. Membres Pro uniquement.", fg=typer.colors.RED))
+
+@app.command(name="scan-live")
+def scan_live(
+    file: Path = typer.Option(..., "--file", "-f", help="Fichier OpenAPI à auditer.", exists=True),
+    target: str = typer.Option(..., "--target", "-t", help="URL de base de l'API cible (ex: https://api.example.com)"),
+    export: Optional[Path] = typer.Option(None, "--export", "-e", help="[Pro] Exporter le rapport PDF.")
+):
+    """[Pro] Lance un audit DAST : envoie de vraies requêtes à l'API cible."""
+    saved_key = load_api_key()
+    is_pro = False
+    if saved_key:
+        license_info = verify_license_online(saved_key)
+        if license_info.get("status") == "active":
+            is_pro = True
+        else:
+            remove_local_license()
+
+    if not is_pro:
+        typer.echo(typer.style("🛑 scan-live est réservé aux membres Pro.", fg=typer.colors.RED))
+        typer.echo("👉 Abonnez-vous sur https://speculynx.dev")
+        raise typer.Exit(code=1)
+
+    typer.echo(typer.style("👑 MODE PRO ACTIVÉ — DAST", fg=typer.colors.MAGENTA, bold=True))
+    typer.echo(typer.style(f"🌐 Cible : {target}", fg=typer.colors.CYAN))
+    typer.echo(typer.style("⚠️  Des requêtes réelles vont être envoyées à l'API cible.\n", fg=typer.colors.YELLOW))
+
+    dast_results = run_dast_audit(file, target)
+    _print_results(dast_results)
+
+    if export:
+        generate_pdf_report(file.name, dast_results, export)
+        typer.echo(f"✅ Rapport DAST exporté : {export}")
+
+def _print_results(results: list):
+    typer.echo("")
+    passed_count = sum(1 for r in results if r["passed"])
+    failed_count = len(results) - passed_count
+    for result in results:
+        badge = "🌐" if result.get("dynamic") else "📄"
+        if result["passed"]:
+            typer.echo(typer.style(f"{badge} ✅ [OK] {result['name']}", fg=typer.colors.GREEN))
+        else:
+            typer.echo(typer.style(f"{badge} 🚨 [{result['severity']}] {result['name']}", fg=typer.colors.RED))
+            typer.echo(f"   ↳ {result['fail_message']}")
+    typer.echo("")
+    typer.echo(typer.style(f"📊 Résultat : {passed_count} OK / {failed_count} échec(s)", bold=True))
+
+if __name__ == "__main__":
+    app()

speculynx/scanner.py

@@ -0,0 +1,124 @@
+import json
+import yaml
+from pathlib import Path
+import typer
+
+def load_openapi_file(file_path: Path) -> dict:
+    suffix = file_path.suffix.lower()
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            if suffix in ['.yaml', '.yml']: return yaml.safe_load(f)
+            elif suffix == '.json': return json.load(f)
+            else: raise ValueError("Format non supporté.")
+    except Exception as e:
+        typer.echo(typer.style(f"❌ Erreur : {e}", fg=typer.colors.RED))
+        raise typer.Exit(code=1)
+
+# ==============================================================================
+# PACK DE RÈGLES GRATUITES (FREEMIUM)
+# ==============================================================================
+
+def check_free_key_exposure(openapi_data: dict) -> dict:
+    passed = True
+    paths = openapi_data.get('paths', {})
+    for path, methods in paths.items():
+        for method, config in methods.items():
+            params = config.get('parameters', [])
+            for p in params:
+                if p.get('in') == 'query' and any(k in p.get('name', '').lower() for k in ['apikey', 'api_key', 'key']):
+                    passed = False
+                    break
+    return {
+        "id": "KEY-EXP-01",
+        "name": "Clés exposées dans l'URL",
+        "severity": "ÉLEVÉE",
+        "passed": passed,
+        "description": "Vérifie si les clés API transitent de manière non sécurisée dans la Query string.",
+        "fail_message": "Des clés API sont passées en paramètres de requête (Query string)."
+    }
+
+def check_free_no_expiration(openapi_data: dict) -> dict:
+    passed = True
+    content_str = json.dumps(openapi_data).lower()
+    if 'key' in content_str and not any(exp in content_str for exp in ['exp', 'ttl', 'expire', 'duration']):
+        passed = False
+    return {
+        "id": "KEY-EXP-02",
+        "name": "Absence d'expiration des clés",
+        "severity": "MOYENNE",
+        "passed": passed,
+        "description": "Vérifie si les clés d'accès intègrent un mécanisme de cycle de vie ou d'expiration.",
+        "fail_message": "Les clés d'accès n'ont pas de date d'expiration ou de cycle de vie défini."
+    }
+
+# ==============================================================================
+# PACK DE RÈGLES AVANCÉES (VERSION PRO - ZERO TRUST & AI AGENTS)
+# ==============================================================================
+
+def check_pro_identity_context(openapi_data: dict) -> dict:
+    passed = True
+    components = openapi_data.get('components', {})
+    security_schemes = components.get('securitySchemes', {})
+    for name, scheme in security_schemes.items():
+        if scheme.get('type') == 'apiKey':
+            passed = False
+    return {
+        "id": "KEY-PRO-01",
+        "name": "Manque d'identité dynamique",
+        "severity": "ÉLEVÉE",
+        "passed": passed,
+        "description": "Vérifie l'utilisation de protocoles d'identité modernes (OAuth2/JWT) avec contexte.",
+        "fail_message": "L'API utilise des clés statiques sans contexte d'identité dynamique (IP, géo, rôle)."
+    }
+
+def check_pro_ai_agent_risk(openapi_data: dict) -> dict:
+    passed = True
+    paths = openapi_data.get('paths', {})
+    destructive_keywords = ['delete', 'drop', 'purge', 'clear', 'truncate', 'destroy']
+    for path, methods in paths.items():
+        if 'delete' in methods or any(k in path.lower() for k in destructive_keywords):
+            content_str = json.dumps(methods).lower()
+            if not any(mfa in content_str for mfa in ['mfa', 'confirm', 'just-in-time', 'verification']):
+                passed = False
+                break
+    return {
+        "id": "KEY-PRO-02",
+        "name": "Risque d'action par Agent IA",
+        "severity": "CRITIQUE",
+        "passed": passed,
+        "description": "Vérifie si les routes destructrices possèdent une double validation contre les bugs d'IA.",
+        "fail_message": "Routes destructrices exposées à des agents IA sans validation d'intention en temps réel."
+    }
+
+def check_pro_over_permissioned(openapi_data: dict) -> dict:
+    passed = True
+    components = openapi_data.get('components', {})
+    security_schemes = components.get('securitySchemes', {})
+    for name, scheme in security_schemes.items():
+        if scheme.get('type') == 'oauth2':
+            flows = scheme.get('flows', {})
+            for flow_name, flow_data in flows.items():
+                if not flow_data.get('scopes'):
+                    passed = False
+    return {
+        "id": "KEY-PRO-03",
+        "name": "Permissions sur-permissionnées",
+        "severity": "ÉLEVÉE",
+        "passed": passed,
+        "description": "Vérifie si le contrôle d'accès applique le principe du moindre privilège via des scopes.",
+        "fail_message": "L'accès à l'API ne définit pas de restrictions par granularité fine (scopes)."
+    }
+
+# ==============================================================================
+# CHEF D'ORCHESTRE
+# ==============================================================================
+
+def run_audit(file_path: Path, is_pro: bool = False) -> list:
+    openapi_data = load_openapi_file(file_path)
+    rules_to_run = [check_free_key_exposure, check_free_no_expiration]
+    if is_pro:
+        rules_to_run.extend([check_pro_identity_context, check_pro_ai_agent_risk, check_pro_over_permissioned])
+    results = []
+    for rule in rules_to_run:
+        results.append(rule(openapi_data))
+    return results

speculynx/utils.py

@@ -0,0 +1,60 @@
+import httpx
+import json
+from pathlib import Path
+from fpdf import FPDF
+
+BACKEND_URL = "https://api.speculynx.dev"
+CONFIG_FILE = Path.home() / ".speculynx.json"
+
+def save_api_key(api_key: str):
+    try:
+        CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True)
+        with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+            json.dump({"api_key": api_key}, f)
+    except Exception as e:
+        print(f"⚠️ Impossible de sauvegarder la clé : {e}")
+
+def load_api_key() -> str:
+    if CONFIG_FILE.exists():
+        try:
+            with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                data = json.load(f)
+                return data.get("api_key", "")
+        except:
+            return ""
+    return ""
+
+def verify_license_online(api_key: str) -> dict:
+    try:
+        response = httpx.get(
+            f"{BACKEND_URL}/v1/verify", 
+            params={"key": api_key},
+            timeout=5
+        )
+        if response.status_code == 200:
+            return response.json()
+        return {"status": "expired"}
+    except httpx.RequestError:
+        return {"status": "network_error"}
+
+class SpeculynxPDF(FPDF):
+    def header(self):
+        self.set_font("Helvetica", "B", 16)
+        self.set_text_color(128, 0, 128)
+        self.cell(0, 10, "SPECULYNX - RAPPORT D'AUDIT", ln=True, align="C")
+        self.line(10, 22, 200, 22)
+
+    def footer(self):
+        self.set_y(-15)
+        self.set_font("Helvetica", "I", 8)
+        self.cell(0, 10, "Document genere par Speculynx Pro", align="C")
+
+def generate_pdf_report(target_file: str, audit_results: list, output_path: Path):
+    pdf = SpeculynxPDF()
+    pdf.add_page()
+    pdf.set_font("Helvetica", size=10)
+    pdf.cell(0, 10, f"Fichier: {target_file}", ln=True)
+    for result in audit_results:
+        status = "OK" if result["passed"] else "FAIL"
+        pdf.cell(0, 10, f"{result['name']} : {status}", ln=True)
+    pdf.output(str(output_path))

speculynx-0.1.0.dist-info/METADATA

@@ -0,0 +1,10 @@
+Metadata-Version: 2.4
+Name: speculynx
+Version: 0.1.0
+Summary: Outil d'audit de sécurité pour API REST
+Author: Sami Hameg
+Requires-Python: >=3.10
+Requires-Dist: typer>=0.12
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: fpdf2>=2.7
+Requires-Dist: httpx>=0.27

speculynx-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+speculynx/dast.py,sha256=2xtyrgZJwKvOGhaiyNqdLuicIIRZ9yHOdtpEy1enYU8,6029
+speculynx/main.py,sha256=DPcn2VyrANzeKiZTs2xYk3Z5YQeowEhCe4RSxxHxRt4,4988
+speculynx/scanner.py,sha256=17hl1LHY6JQyuL2Er1KCbndc0ms1pLs4TKPWs3gA44Y,5505
+speculynx/utils.py,sha256=QDhxvT6-vQ_RwviVCmFvz6SncXYsglNQ7A1nm4kOjbs,1934
+speculynx-0.1.0.dist-info/METADATA,sha256=Wqf9owtmWrzbVTd65S5dnXXfL4Lf5hNvltSHeT4BFOA,254
+speculynx-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+speculynx-0.1.0.dist-info/entry_points.txt,sha256=OnWALNqjboQmFmyQiakgZbHeMBsrP9U1i6hhPA9wMdg,49
+speculynx-0.1.0.dist-info/top_level.txt,sha256=eKsQLu7ibbYbkcCuum1jczRjxB8KjD_tyOYIGqr5TWk,10
+speculynx-0.1.0.dist-info/RECORD,,

speculynx-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

speculynx-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+speculynx = speculynx.main:app

speculynx-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+speculynx