skillguard/artifacts/api-server/src/lib/aiAnalysis.ts

import type { AiProvider, Prompt } from "@workspace/db";
import type { ParsedFile, RawFinding, Severity, Axis } from "./ruleCatalog";

const SEVERITIES: Severity[] = ["critical", "high", "medium", "low", "info"];
const AXES: Axis[] = ["security", "privacy"];

export type AiResult = {
  findings: RawFinding[];
  error: string | null;
};

const FETCH_TIMEOUT_MS = 60000;

function redactSecrets(text: string, token: string | null | undefined): string {
  let out = text;
  if (token && token.length >= 4) {
    out = out.split(token).join("[REDACTED]");
  }
  out = out.replace(/(Bearer\s+)[A-Za-z0-9._\-]+/gi, "$1[REDACTED]");
  out = out.replace(/\bsk-[A-Za-z0-9._\-]{8,}\b/g, "[REDACTED]");
  return out;
}

async function fetchWithTimeout(
  url: string,
  init: RequestInit,
): Promise<Response> {
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
  try {
    return await fetch(url, { ...init, signal: controller.signal });
  } finally {
    clearTimeout(timer);
  }
}

function buildSkillPayload(files: ParsedFile[]): string {
  const parts: string[] = [];
  let budget = 60000;
  for (const f of files) {
    if (f.content === "") continue;
    const header = `\n===== DATEI: ${f.path} (${f.kind}) =====\n`;
    const body = f.content.slice(0, 16000);
    if (header.length + body.length > budget) {
      parts.push(header + body.slice(0, Math.max(0, budget - header.length)));
      break;
    }
    parts.push(header + body);
    budget -= header.length + body.length;
  }
  return parts.join("\n");
}

function coerceFinding(raw: unknown): RawFinding | null {
  if (!raw || typeof raw !== "object") return null;
  const o = raw as Record<string, unknown>;
  const axis = AXES.includes(o.axis as Axis) ? (o.axis as Axis) : "security";
  const severity = SEVERITIES.includes(o.severity as Severity)
    ? (o.severity as Severity)
    : "medium";
  const title = typeof o.title === "string" ? o.title.slice(0, 200) : null;
  if (!title) return null;
  return {
    ruleId: typeof o.ruleId === "string" ? o.ruleId : "AI-FINDING",
    axis,
    severity,
    title,
    description:
      typeof o.description === "string" ? o.description.slice(0, 2000) : title,
    remediation:
      typeof o.remediation === "string" ? o.remediation.slice(0, 2000) : null,
    file: typeof o.file === "string" ? o.file.slice(0, 400) : null,
    line: typeof o.line === "number" ? o.line : null,
    snippet: typeof o.snippet === "string" ? o.snippet.slice(0, 400) : null,
    detectedBy: "ai",
  };
}

function extractJson(text: string): unknown {
  const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/i);
  const candidate = fence ? fence[1] : text;
  const start = candidate.indexOf("{");
  const end = candidate.lastIndexOf("}");
  if (start === -1 || end === -1 || end <= start) {
    throw new Error("Keine JSON-Antwort von der KI erhalten.");
  }
  return JSON.parse(candidate.slice(start, end + 1));
}

async function callOpenAiCompatible(
  provider: AiProvider,
  system: string,
  user: string,
): Promise<string> {
  const base = provider.baseUrl.replace(/\/$/, "");
  const url = `${base}/chat/completions`;
  const res = await fetchWithTimeout(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${provider.apiToken ?? ""}`,
    },
    body: JSON.stringify({
      model: provider.model,
      messages: [
        { role: "system", content: system },
        { role: "user", content: user },
      ],
      temperature: 0.1,
    }),
  });
  if (!res.ok) {
    const body = await res.text();
    throw new Error(
      `HTTP ${res.status}: ${redactSecrets(body.slice(0, 300), provider.apiToken)}`,
    );
  }
  const data = (await res.json()) as {
    choices?: { message?: { content?: string } }[];
  };
  return data.choices?.[0]?.message?.content ?? "";
}

async function callAnthropic(
  provider: AiProvider,
  system: string,
  user: string,
): Promise<string> {
  const base = provider.baseUrl.replace(/\/$/, "");
  const url = `${base}/messages`;
  const res = await fetchWithTimeout(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": provider.apiToken ?? "",
      "anthropic-version": "2023-06-01",
    },
    body: JSON.stringify({
      model: provider.model,
      max_tokens: 4096,
      system,
      messages: [{ role: "user", content: user }],
    }),
  });
  if (!res.ok) {
    const body = await res.text();
    throw new Error(
      `HTTP ${res.status}: ${redactSecrets(body.slice(0, 300), provider.apiToken)}`,
    );
  }
  const data = (await res.json()) as { content?: { text?: string }[] };
  return data.content?.[0]?.text ?? "";
}

export async function callProvider(
  provider: AiProvider,
  system: string,
  user: string,
): Promise<string> {
  if (provider.apiType === "anthropic") {
    return callAnthropic(provider, system, user);
  }
  return callOpenAiCompatible(provider, system, user);
}

export async function runAiAnalysis(
  provider: AiProvider,
  prompts: Prompt[],
  files: ParsedFile[],
): Promise<AiResult> {
  const systemPrompt = prompts.find((p) => p.key === "system")?.content ?? "";
  const analysisPrompt =
    prompts.find((p) => p.key === "analysis")?.content ?? "";
  const payload = buildSkillPayload(files);
  const user = `${analysisPrompt}\n\nHier ist das zu prüfende Skill:\n${payload}`;
  try {
    const content = await callProvider(provider, systemPrompt, user);
    const parsed = extractJson(content) as { findings?: unknown[] };
    const findingsRaw = Array.isArray(parsed.findings) ? parsed.findings : [];
    const findings = findingsRaw
      .map(coerceFinding)
      .filter((f): f is RawFinding => f !== null);
    return { findings, error: null };
  } catch (err) {
    return {
      findings: [],
      error: err instanceof Error ? err.message : "Unbekannter KI-Fehler",
    };
  }
}