ubon/dist/utils/config.js

Security scanner for AI-generated apps (Cursor, Lovable, Windsurf, v0). Catches hardcoded secrets, prompt injection, hallucinated imports, Server Actions / Edge runtime mistakes, and the vibe-coded vulnerabilities traditional linters miss.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.loadConfig = loadConfig;
exports.mergeOptions = mergeOptions;
const fs_1 = require("fs");
const path_1 = require("path");
/**
 * Load Ubon configuration. Order of precedence:
 *   1. `ubon.config.json` (always loaded — pure data)
 *   2. `ubon.config.js`   (only loaded if `--allow-config-js` was passed or
 *                          `UBON_ALLOW_CONFIG_JS=1` is set; executes user code)
 *   3. `package.json` "ubon" field (always loaded — pure data)
 *
 * Gating the JS variant matters because Ubon is frequently invoked in CI
 * against untrusted PR branches; loading arbitrary user JS at config time
 * would expand the supply-chain attack surface.
 */
function loadConfig(directory, opts = {}) {
    try {
        const jsonPath = (0, path_1.join)(directory, 'ubon.config.json');
        if ((0, fs_1.existsSync)(jsonPath)) {
            const data = JSON.parse((0, fs_1.readFileSync)(jsonPath, 'utf-8'));
            return data;
        }
        const jsPath = (0, path_1.join)(directory, 'ubon.config.js');
        if ((0, fs_1.existsSync)(jsPath)) {
            const allowed = opts.allowConfigJs === true || process.env.UBON_ALLOW_CONFIG_JS === '1';
            if (!allowed) {
                if (process.env.UBON_VERBOSE) {
                    console.error(`🪷 ubon: ignoring ubon.config.js (untrusted code). Pass --allow-config-js or set UBON_ALLOW_CONFIG_JS=1 to opt in.`);
                }
            }
            else {
                const data = require(jsPath);
                return (data && data.default) ? data.default : data;
            }
        }
        const pkgPath = (0, path_1.join)(directory, 'package.json');
        if ((0, fs_1.existsSync)(pkgPath)) {
            const pkg = JSON.parse((0, fs_1.readFileSync)(pkgPath, 'utf-8'));
            if (pkg.ubon && typeof pkg.ubon === 'object') {
                return pkg.ubon;
            }
        }
    }
    catch {
        // ignore config errors, fall back to defaults/CLI
    }
    return {};
}
function mergeOptions(config, cli) {
    const merged = { ...config, ...cli };
    // For arrays, prefer CLI if provided, else config
    merged.enabledRules = cli.enabledRules !== undefined ? cli.enabledRules : config.enabledRules;
    merged.disabledRules = cli.disabledRules !== undefined ? cli.disabledRules : config.disabledRules;
    merged.changedFiles = cli.changedFiles !== undefined ? cli.changedFiles : config.changedFiles;
    // For numbers and booleans, CLI undefined means use config
    merged.minConfidence = cli.minConfidence !== undefined ? cli.minConfidence : config.minConfidence;
    merged.useBaseline = cli.useBaseline !== undefined ? cli.useBaseline : config.useBaseline;
    merged.baselinePath = cli.baselinePath !== undefined ? cli.baselinePath : config.baselinePath;
    merged.failOn = cli.failOn !== undefined ? cli.failOn : config.failOn;
    return merged;
}
//# sourceMappingURL=config.js.map