feat: support audit-scoped template secrets

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

scripts/__tests__/template-library-live-audit-utils.test.ts

@@ -10,6 +10,7 @@ import {
   summarizeTemplateValidationLedgerFreshness,
   renderTemplateAuditMarkdown,
   parseTemplateAuditCliOptions,
+  resolveTemplateAuditSecretMappings,
   shouldSkipTemplateValidation,
   summarizeNodeIoNode,
   upsertTemplateValidationLedger,
@@ -28,6 +29,43 @@ describe('template library live audit helpers', () => {
     expect(inputs['GitHub Repo Dependency CVE Triage']).not.toHaveProperty('manifestPaths');
   });
 
+  it('includes a bounded Discord report live fixture input', () => {
+    const inputs = createTemplateLiveAuditInputs();
+
+    expect(inputs['Security Scan Discord Report']).toEqual({
+      imageRef: 'alpine:3.18',
+    });
+  });
+
+  it('resolves audit secret mappings from explicit JSON and per-secret env variables', () => {
+    const resolved = resolveTemplateAuditSecretMappings(
+      ['DISCORD_WEBHOOK_URL', 'API-TOKEN', 'MISSING_SECRET'],
+      {
+        TEMPLATE_AUDIT_SECRET_MAPPINGS: JSON.stringify({
+          DISCORD_WEBHOOK_URL: 'https://discord.com/api/webhooks/example',
+        }),
+        TEMPLATE_AUDIT_SECRET_API_TOKEN: 'token-from-env',
+      },
+    );
+
+    expect(resolved).toEqual({
+      secretMappings: {
+        DISCORD_WEBHOOK_URL: 'https://discord.com/api/webhooks/example',
+        'API-TOKEN': 'token-from-env',
+      },
+      providedSecretNames: ['DISCORD_WEBHOOK_URL', 'API-TOKEN'],
+      missingSecretNames: ['MISSING_SECRET'],
+    });
+  });
+
+  it('rejects malformed audit secret JSON instead of silently skipping live validation', () => {
+    expect(() =>
+      resolveTemplateAuditSecretMappings(['DISCORD_WEBHOOK_URL'], {
+        TEMPLATE_AUDIT_SECRET_MAPPINGS: '{not-json',
+      }),
+    ).toThrow('TEMPLATE_AUDIT_SECRET_MAPPINGS must be a JSON object');
+  });
+
   it('parses cross-platform targeted audit CLI flags with environment fallbacks', () => {
     const options = parseTemplateAuditCliOptions(
       [

scripts/template-library-live-audit-utils.ts

@@ -111,6 +111,12 @@ export interface TemplateAuditCliOptions {
 
 export type TemplateLiveAuditInputs = Record<string, Record<string, unknown>>;
 
+export interface TemplateAuditSecretResolution {
+  secretMappings: Record<string, string>;
+  providedSecretNames: string[];
+  missingSecretNames: string[];
+}
+
 export type TemplateValidationFreshnessStatus =
   | 'current'
   | 'missing'
@@ -174,12 +180,14 @@ export function createTemplateLiveAuditInputs(): TemplateLiveAuditInputs {
     },
     'Container Image CVE Triage': {
       imageRef: 'alpine:3.18',
-      deploymentContext: 'Live audit fixture: small public Linux base image for bounded CVE triage.',
+      deploymentContext:
+        'Live audit fixture: small public Linux base image for bounded CVE triage.',
       authorizationNotes: 'Live audit fixture using a public container image.',
     },
     'Exposed Service CVE Mapper': {
       targets: ['scanme.nmap.org'],
-      authorizationNotes: 'Live audit fixture: Nmap-provided scan target for bounded service checks.',
+      authorizationNotes:
+        'Live audit fixture: Nmap-provided scan target for bounded service checks.',
     },
     'GitHub Repo Dependency CVE Triage': {
       repositoryUrl: 'https://github.com/OWASP/NodeGoat',
@@ -189,7 +197,8 @@ export function createTemplateLiveAuditInputs(): TemplateLiveAuditInputs {
     },
     'NPM Dependency CVE Hunt': {
       packageSpecs: ['lodash@4.17.20', 'minimist@0.0.8', 'axios@0.21.1'],
-      researchNotes: 'Live audit fixture using public npm packages with known historical advisories.',
+      researchNotes:
+        'Live audit fixture using public npm packages with known historical advisories.',
     },
     'Passive OSINT Subdomain Expansion': {
       domain: 'example.com',
@@ -235,6 +244,61 @@ export function createTemplateLiveAuditInputs(): TemplateLiveAuditInputs {
       outOfScopePaths: ['/logout', '/admin/delete'],
       scanIntensity: 'safe',
     },
+    'Security Scan Discord Report': {
+      imageRef: 'alpine:3.18',
+    },
+  };
+}
+
+function normalizeAuditSecretEnvName(secretName: string): string {
+  return `TEMPLATE_AUDIT_SECRET_${secretName.replace(/[^a-zA-Z0-9]+/g, '_').toUpperCase()}`;
+}
+
+function parseSecretMappingsJson(value: string | undefined): Record<string, string> {
+  if (!value?.trim()) return {};
+
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error('not-object');
+    }
+
+    const mappings: Record<string, string> = {};
+    for (const [key, rawValue] of Object.entries(parsed as Record<string, unknown>)) {
+      if (typeof rawValue === 'string' && rawValue.trim().length > 0) {
+        mappings[key] = rawValue;
+      }
+    }
+    return mappings;
+  } catch {
+    throw new Error('TEMPLATE_AUDIT_SECRET_MAPPINGS must be a JSON object');
+  }
+}
+
+export function resolveTemplateAuditSecretMappings(
+  requiredSecretNames: string[],
+  env: Record<string, string | undefined> = process.env,
+): TemplateAuditSecretResolution {
+  const jsonMappings = parseSecretMappingsJson(env.TEMPLATE_AUDIT_SECRET_MAPPINGS);
+  const uniqueRequiredNames = Array.from(
+    new Set(requiredSecretNames.map((name) => name.trim()).filter(Boolean)),
+  );
+  const secretMappings: Record<string, string> = {};
+
+  for (const secretName of uniqueRequiredNames) {
+    const jsonValue = jsonMappings[secretName];
+    const envValue = env[normalizeAuditSecretEnvName(secretName)];
+    const value =
+      typeof jsonValue === 'string' && jsonValue.trim().length > 0 ? jsonValue : envValue;
+    if (typeof value === 'string' && value.trim().length > 0) {
+      secretMappings[secretName] = value;
+    }
+  }
+
+  return {
+    secretMappings,
+    providedSecretNames: uniqueRequiredNames.filter((name) => Boolean(secretMappings[name])),
+    missingSecretNames: uniqueRequiredNames.filter((name) => !secretMappings[name]),
   };
 }
 

scripts/template-library-live-audit.ts

@@ -11,6 +11,7 @@ import {
   renderTemplateValidationLedgerFreshness,
   renderTemplateAuditMarkdown,
   parseTemplateAuditCliOptions,
+  resolveTemplateAuditSecretMappings,
   shouldSkipTemplateValidation,
   summarizeTemplateValidationLedgerFreshness,
   summarizeNodeIoNode,
@@ -312,7 +313,12 @@ function classifyTemplate(
 ): AuditResult['classification'] {
   const runtimeInputs = getRuntimeInputs(seed ?? template);
   const requiredSecrets = getRequiredSecretNames(seed ?? template);
-  if (LIVE_INPUTS[template.name] && requiredSecrets.length === 0) return 'live-run';
+  const secretResolution = resolveTemplateAuditSecretMappings(requiredSecrets);
+  const hasAllAuditSecrets =
+    requiredSecrets.length > 0 && secretResolution.missingSecretNames.length === 0;
+  const hasLiveInputs = Boolean(LIVE_INPUTS[template.name]);
+  if (hasLiveInputs && (requiredSecrets.length === 0 || hasAllAuditSecrets)) return 'live-run';
+  if (hasAllAuditSecrets && runtimeInputs.length === 0) return 'live-run';
   if (requiredSecrets.length > 0 && runtimeInputs.length > 0) return 'credential-gated';
   if (requiredSecrets.length > 0 && runtimeInputs.length === 0) return 'run-start-probe';
   return 'run-start-probe';
@@ -416,9 +422,13 @@ function analyzeRecommendation(
   }
 
   if (requiredSecrets.length > 0) {
+    const missingSecrets = resolveTemplateAuditSecretMappings(requiredSecrets).missingSecretNames;
     return {
       recommendation: 'review',
-      rationale: `Credential-gated template requires: ${requiredSecrets.join(', ')}.`,
+      rationale:
+        missingSecrets.length > 0
+          ? `Credential-gated template requires explicit audit secret mappings for: ${missingSecrets.join(', ')}.`
+          : `Credential-gated template requires: ${requiredSecrets.join(', ')}.`,
     };
   }
 
@@ -573,6 +583,7 @@ async function auditTemplate(
   const classification = classifyTemplate(template, seed);
   const components = getComponents(source);
   const requiredSecrets = getRequiredSecretNames(source);
+  const secretResolution = resolveTemplateAuditSecretMappings(requiredSecrets);
   const runtimeInputs = getRuntimeInputs(source);
   const validationFingerprint = createValidationFingerprint(template, seed, classification);
   const prefix = `${sanitizeFileName(template.name)}-${template.id.slice(0, 8)}`;
@@ -616,6 +627,9 @@ async function auditTemplate(
       method: 'POST',
       body: JSON.stringify({
         workflowName: `Template Live Audit - ${template.name} - ${new Date().toISOString()}`,
+        ...(requiredSecrets.length > 0 && secretResolution.missingSecretNames.length === 0
+          ? { secretMappings: secretResolution.secretMappings }
+          : {}),
       }),
     });
     workflowId = created.workflow?.id;