Automated Security Testing

# .github/workflows/security.yml
name: security
on:
  pull_request:
  push: { branches: [main] }
  schedule: [{ cron: '0 6 * * *' }]        # daily: today's safe package is not

jobs:
  static:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }           # full history for secret scanning

      # 1. Secrets — in the diff AND in history
      - uses: gitleaks/gitleaks-action@v2
        env: { GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}' }

      # 2. SAST
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/javascript
            p/secrets
            .semgrep/custom.yml            # ← your own rules matter most

      # 3. Dependencies
      - run: npm ci --ignore-scripts
      - run: npm audit --audit-level=high

      # 4. Your own greps for what a linter cannot express
      - run: ./scripts/security-grep.sh

  authorization:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci --ignore-scripts
      # 5. THE ONE NO TOOL PROVIDES — generated from the route inventory
      - run: npm run test:authz

  dynamic:
    runs-on: ubuntu-latest
    steps:
      - run: docker compose up -d && ./scripts/wait-for-healthy.sh

      # 6. DAST against the running app, driven by the OpenAPI spec so it
      #    tests YOUR endpoints rather than guessing at paths.
      - uses: zaproxy/action-api-scan@v0
        with:
          target: 'http://localhost:3000/openapi.json'
          rules_file_name: '.zap/rules.tsv'
          fail_action: true

      # 7. Post-deploy reality check
      - run: BASE=http://localhost:3000 ./scripts/authz-smoke.sh
      - run: ./scripts/misconfig-scan.sh http://localhost:3000

# ── Custom Semgrep rules, which find more than the generic packs ─────
# .semgrep/custom.yml
rules:
  - id: unscoped-find-by-id
    languages: [javascript, typescript]
    severity: ERROR
    message: >-
      Lookup by a request-supplied id with no ownership filter. Scope the
      query to req.user.id or req.user.tenant.
    patterns:
      - pattern: $DB.$TABLE.findById(req.params.$ID)
      - pattern-not-inside: |
          $DB.$TABLE.findOne({..., user_id: ...})

  - id: model-serialised-directly
    languages: [javascript]
    severity: WARNING
    message: Use a Serializer view rather than returning a model.
    pattern: res.json($MODEL)

  - id: jwt-verify-without-options
    languages: [javascript]
    severity: ERROR
    message: jwt.verify must pin algorithms and check issuer and audience.
    pattern: jwt.verify($TOKEN, $KEY)

// Fuzzing finds what you did not think to test: crashes, hangs, and unhandled
// types in parsers and validators.
import fc from 'fast-check';

describe('input handling is robust', () => {
  it('never crashes on arbitrary JSON', async () => {
    await fc.assert(fc.asyncProperty(fc.jsonValue(), async (body) => {
      const res = await request(app).post('/api/invoices')
        .set('Authorization', `Bearer ${token}`).send(body);

      // Any 4xx is fine. A 5xx means an unhandled input reached the code.
      expect(res.status).toBeLessThan(500);
    }), { numRuns: 1000 });
  });

  it('handles adversarial strings in every field', async () => {
    const nasty = fc.oneof(
      fc.string({ maxLength: 100_000 }),        // very long
      fc.constant(''),                          // empty
      fc.constant('\0\0\0'),                    // null bytes
      fc.constant('../../../etc/passwd'),
      fc.constant("'; DROP TABLE users;--"),
      fc.constant('<script>alert(1)</script>'),
      fc.constant('{{7*7}}'),                   // template injection
      fc.constant('${jndi:ldap://x}'),
      fc.constant('\u202e\u0000'),              // unicode direction + null
      fc.constant('👨‍👩‍👧‍👦'.repeat(1000)),        // grapheme clusters
      fc.constant('a'.repeat(40) + '!'),        // ReDoS trigger
    );

    await fc.assert(fc.asyncProperty(nasty, async (value) => {
      const started = Date.now();
      const res = await request(app).patch('/api/users/me')
        .set('Authorization', `Bearer ${token}`).send({ name: value });

      expect(res.status).toBeLessThan(500);
      // A slow response on a short input is the ReDoS signature.
      expect(Date.now() - started).toBeLessThan(1000);
    }), { numRuns: 500 });
  });

  it('rejects deeply nested and oversized structures', async () => {
    const deep = Array.from({ length: 10_000 })
      .reduce((acc) => ({ a: acc }), { a: 1 });

    const res = await request(app).post('/api/invoices')
      .set('Authorization', `Bearer ${token}`).send(deep);
    expect([400, 413]).toContain(res.status);      // not a 500, not a hang
  });

  it('never changes state on a rejected request', async () => {
    await fc.assert(fc.asyncProperty(fc.jsonValue(), async (body) => {
      const before = await db('invoices').count('* as c').first();
      const res = await request(app).post('/api/invoices')
        .set('Authorization', `Bearer ${token}`).send(body);
      const after = await db('invoices').count('* as c').first();

      if (res.status >= 400) expect(after.c).toBe(before.c);
    }), { numRuns: 300 });
  });
});

// The last property is the most valuable and the least commonly tested:
// a rejected request must not have partially completed.

// Generate authorization coverage from the route inventory, so new routes are
// tested the day they merge rather than when someone remembers.
import routes from '../route-inventory.json' with { type: 'json' };

describe('security properties across every route', () => {
  // ── 1. Authorization matrix (no tool can do this) ──────────────────
  describe('object authorization', () => {
    for (const route of routes.filter((r) => r.takesId)) {
      it(`${route.method} ${route.path} → 404 for another user's object`, async () => {
        const res = await call(route, { as: alice, targeting: bobsObject(route) });
        expect(res.status).toBe(404);
      });
      it(`${route.method} ${route.path} → 404 for another tenant's object`, async () => {
        const res = await call(route, { as: alice, targeting: globexObject(route) });
        expect(res.status).toBe(404);
      });
    }
  });

  // ── 2. Function authorization ──────────────────────────────────────
  describe('function authorization', () => {
    for (const route of routes.filter((r) => r.adminOnly)) {
      it(`${route.method} ${route.path} → 403 for a normal user`, async () => {
        expect((await call(route, { as: alice })).status).toBe(403);
      });
    }
  });

  // ── 3. Mass assignment ─────────────────────────────────────────────
  describe('property authorization', () => {
    const FORBIDDEN_FIELDS = ['role', 'isAdmin', 'tenantId', 'userId',
                              'emailVerified', 'balance', 'createdAt'];
    for (const route of routes.filter((r) => ['POST','PATCH','PUT'].includes(r.method))) {
      it(`${route.method} ${route.path} ignores privileged fields`, async () => {
        const before = await snapshotUser(alice.id);
        await call(route, { as: alice,
          body: Object.fromEntries(FORBIDDEN_FIELDS.map((f) => [f, 'INJECTED'])) });
        expect(await snapshotUser(alice.id)).toEqual(before);
      });
    }
  });

  // ── 4. Output shaping ──────────────────────────────────────────────
  describe('data exposure', () => {
    for (const route of routes.filter((r) => r.method === 'GET')) {
      it(`${route.method} ${route.path} exposes no sensitive fields`, async () => {
        const res = await call(route, { as: alice });
        if (res.status !== 200) return;
        expect(findSensitiveFields(res.body)).toEqual([]);
      });
    }
  });

  // ── 5. Resource bounds ─────────────────────────────────────────────
  describe('resource limits', () => {
    for (const route of routes.filter((r) => r.returnsCollection)) {
      it(`${route.method} ${route.path} caps the page size`, async () => {
        const res = await call(route, { as: alice, query: { limit: 1_000_000 } });
        const items = res.body.data ?? res.body;
        expect(Array.isArray(items) ? items.length : 0).toBeLessThanOrEqual(100);
      });
    }
  });
});

// This suite is generated, so it grows with the API automatically. That is the
// property that matters — hand-written security tests cover what someone
// remembered on the day, and the codebase moves faster than memory.