Merge branch 'dev' into feat/dataset-explorer

scripts/check-banned-deps.mjs

@@ -0,0 +1,220 @@
+#!/usr/bin/env node
+// AZ-482 — static deny-list enforcement driven by tests/security/banned-deps.json.
+//
+// One canonical implementation that the run-tests.sh static profile delegates to,
+// so adding or removing a banned dependency / pattern is a one-file change visible
+// in code review (per AZ-482 constraint).
+//
+// Usage:
+//   node scripts/check-banned-deps.mjs --kind=<key> [--root=<repo-root>]
+//
+// Exit code 0 on PASS (no hits); non-zero on FAIL (writes the hit list to stderr).
+
+import { readFileSync, statSync, readdirSync } from 'node:fs'
+import { join, dirname, resolve, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
+
+function parseArgs(argv) {
+  const out = { kind: null, root: resolve(__dirname, '..') }
+  for (const a of argv.slice(2)) {
+    if (a.startsWith('--kind=')) out.kind = a.slice('--kind='.length)
+    else if (a.startsWith('--root=')) out.root = resolve(a.slice('--root='.length))
+    else if (a === '-h' || a === '--help') {
+      // eslint-disable-next-line no-console
+      console.error('Usage: check-banned-deps.mjs --kind=<key> [--root=<repo-root>]')
+      process.exit(0)
+    }
+  }
+  if (!out.kind) {
+    process.stderr.write('check-banned-deps: --kind is required\n')
+    process.exit(2)
+  }
+  return out
+}
+
+function loadDenylist(root) {
+  const path = join(root, 'tests', 'security', 'banned-deps.json')
+  return JSON.parse(readFileSync(path, 'utf8'))
+}
+
+function loadPackageJson(root) {
+  return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+}
+
+function namesFromPackageJson(pkg) {
+  return Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })
+}
+
+function checkPackageJson(section, root) {
+  const pkg = loadPackageJson(root)
+  const names = namesFromPackageJson(pkg)
+  const regexes = section.patterns.map((p) => new RegExp(p, 'i'))
+  const hits = []
+  for (const name of names) {
+    for (const re of regexes) {
+      if (re.test(name)) {
+        hits.push(`${name} matched /${re.source}/i`)
+        break
+      }
+    }
+  }
+  return hits
+}
+
+// File walker — yields paths under `dir` that match the included extensions.
+// Skips dist/, node_modules/, test-output/, and any `*.test.{ts,tsx}` /
+// `*.spec.{ts,tsx}` files (production source only, mirrors run-tests.sh src_grep).
+const IGNORED_DIRS = new Set([
+  'node_modules', 'dist', 'build', 'test-output', 'test-results',
+  'coverage', '.git', '.cache', 'playwright-report', 'blob-report',
+])
+const SOURCE_EXT = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']
+const TEST_NAME_RE = /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs)$/i
+
+function* walkSourceFiles(rootDir) {
+  let entries
+  try {
+    entries = readdirSync(rootDir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    const full = join(rootDir, entry.name)
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue
+      yield* walkSourceFiles(full)
+    } else if (entry.isFile()) {
+      const ext = '.' + entry.name.split('.').pop()
+      if (!SOURCE_EXT.includes(ext)) continue
+      if (TEST_NAME_RE.test(entry.name)) continue
+      yield full
+    }
+  }
+}
+
+function checkSourceTree(section, root, subdirs) {
+  const regexes = section.patterns.map((p) => new RegExp(p, 'i'))
+  const allowlist = new Set((section.allowlist ?? []).map((p) => p.replaceAll('\\', '/')))
+  const hits = []
+  for (const sub of subdirs) {
+    const full = join(root, sub)
+    try { statSync(full) } catch { continue }
+    for (const file of walkSourceFiles(full)) {
+      const relPath = relative(root, file).replaceAll('\\', '/')
+      if (allowlist.has(relPath)) continue
+      let text
+      try { text = readFileSync(file, 'utf8') } catch { continue }
+      const lines = text.split('\n')
+      lines.forEach((line, idx) => {
+        for (const re of regexes) {
+          if (re.test(line)) {
+            hits.push(`${relPath}:${idx + 1}: ${line.trim().slice(0, 200)} (matched /${re.source}/i)`)
+            break
+          }
+        }
+      })
+    }
+  }
+  return hits
+}
+
+function checkDestructiveSurfaces(section, root, subdirs) {
+  const regexes = section.patterns.map((p) => new RegExp(p))
+  const gated = new Set((section.gated ?? []).map((p) => p.replaceAll('\\', '/')))
+  const drift = new Set((section.drift ?? []).map((p) => p.replaceAll('\\', '/')))
+  const known = new Set([...gated, ...drift])
+  const hits = []
+  for (const sub of subdirs) {
+    const full = join(root, sub)
+    try { statSync(full) } catch { continue }
+    for (const file of walkSourceFiles(full)) {
+      const relPath = relative(root, file).replaceAll('\\', '/')
+      let text
+      try { text = readFileSync(file, 'utf8') } catch { continue }
+      const matches = regexes.some((re) => re.test(text))
+      if (!matches) continue
+      if (known.has(relPath)) continue
+      hits.push(
+        `${relPath}: contains destructive call but is not in gated/drift allowlist; ` +
+        `add to tests/security/banned-deps.json (destructive_surfaces) with a code-review note`,
+      )
+    }
+  }
+  return hits
+}
+
+function* walkAnyFiles(rootDir) {
+  let entries
+  try {
+    entries = readdirSync(rootDir, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    const full = join(rootDir, entry.name)
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue
+      yield* walkAnyFiles(full)
+    } else if (entry.isFile()) {
+      yield full
+    }
+  }
+}
+
+function checkDistTree(section, root) {
+  const dist = join(root, 'dist')
+  try { statSync(dist) } catch {
+    process.stderr.write('dist/ missing — run `bun run build` before this check\n')
+    process.exit(1)
+  }
+  const hits = []
+  for (const file of walkAnyFiles(dist)) {
+    let text
+    try { text = readFileSync(file, 'utf8') } catch { continue }
+    for (const literal of section.patterns) {
+      if (text.includes(literal)) {
+        hits.push(`${relative(root, file)} contains banned literal: ${literal}`)
+      }
+    }
+  }
+  return hits
+}
+
+function main() {
+  const { kind, root } = parseArgs(process.argv)
+  const denylist = loadDenylist(root)
+  const section = denylist[kind]
+  if (!section) {
+    process.stderr.write(`unknown --kind=${kind}; available: ${Object.keys(denylist).filter((k) => !k.startsWith('$')).join(', ')}\n`)
+    process.exit(2)
+  }
+
+  let hits = []
+  if (kind === 'owm_key_in_dist') {
+    hits = checkDistTree(section, root)
+  } else if (
+    kind === 'legacy_integrations' ||
+    kind === 'concurrent_edit_patterns' ||
+    kind === 'alert_calls' ||
+    kind === 'owm_key_in_source' ||
+    kind === 'google_key_in_source'
+  ) {
+    hits = checkSourceTree(section, root, ['src', 'mission-planner'])
+  } else if (kind === 'destructive_surfaces') {
+    hits = checkDestructiveSurfaces(section, root, ['src'])
+  } else {
+    hits = checkPackageJson(section, root)
+  }
+
+  if (hits.length) {
+    process.stderr.write(`banned (${kind} / ${section.ac}):\n`)
+    for (const h of hits) process.stderr.write(`  ${h}\n`)
+    process.exit(1)
+  }
+  process.exit(0)
+}
+
+main()