daemon-sec-lotl

validate-data.mjs (3940B)

---

 /**
  * `npm run validate:data` — validate the *committed* dataset without touching
  * vendor/ or regenerating anything. CI runs this on every push so a hand-edit
  * or a bad migration can never reach a deploy.
  *
  * Checks: every technique passes TechniqueSchema; ids are unique; every
  * technique's toolId exists in tools.json; every tool has >= 1 technique; the
  * facet counts in facets.json match the data; the vocabulary in
  * src/lib/taxonomy.ts still agrees with technique-schema.mjs; the committed
  * src/data/index-hash.json still describes this data (else `npm run build:index`).
  */
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
 import { validateTechniques, PLATFORMS, SOURCES, CAPABILITIES } from './technique-schema.mjs';
 import { buildIndex } from './build-index.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const read = (p) => JSON.parse(readFileSync(join(ROOT, p), 'utf8'));
 
 const techniques = read('src/data/techniques.json');
 const tools = read('src/data/tools.json');
 const facets = read('src/data/facets.json');
 
 const problems = validateTechniques(techniques);
 
 // Referential integrity.
 const toolIds = new Set(tools.map((t) => t.id));
 const used = new Set();
 for (const t of techniques) {
   used.add(t.toolId);
   if (!toolIds.has(t.toolId)) problems.push(`orphan technique ${t.id}: toolId ${t.toolId} not in tools.json`);
 }
 for (const tool of tools) {
   if (!used.has(tool.id)) problems.push(`orphan tool ${tool.id}: no techniques`);
 }
 const seenTools = new Set();
 for (const tool of tools) {
   if (seenTools.has(tool.id)) problems.push(`duplicate tool id ${tool.id}`);
   seenTools.add(tool.id);
 }
 
 // Facet counts must describe this exact dataset.
 const c = facets.counts || {};
 if (c.techniques !== techniques.length) problems.push(`facets.counts.techniques=${c.techniques} but data has ${techniques.length}`);
 if (c.tools !== tools.length) problems.push(`facets.counts.tools=${c.tools} but data has ${tools.length}`);
 const added = techniques.filter((t) => t.added).length;
 if (c.added !== added) problems.push(`facets.counts.added=${c.added} but data has ${added}`);
 const bySource = {};
 for (const t of techniques) bySource[t.source] = (bySource[t.source] || 0) + 1;
 for (const s of SOURCES) {
   if ((c.bySource || {})[s] !== (bySource[s] || undefined) && !(bySource[s] === undefined && (c.bySource || {})[s] === undefined)) {
     problems.push(`facets.counts.bySource.${s}=${(c.bySource || {})[s]} but data has ${bySource[s] || 0}`);
   }
 }
 
 // The content-addressed list index must be the one this data produces.
 try {
   const idx = JSON.parse(readFileSync(join(ROOT, 'src/data/index-hash.json'), 'utf8'));
   const fresh = buildIndex(techniques);
   if (idx.hash !== fresh.hash || idx.file !== fresh.file) problems.push(`src/data/index-hash.json is stale (${idx.file} vs ${fresh.file}) — run npm run build:index`);
 } catch (e) {
   problems.push(`src/data/index-hash.json missing or unreadable — run npm run build:index (${e.message})`);
 }
 
 // Vocabulary drift between the data contract and the UI taxonomy.
 const taxonomy = readFileSync(join(ROOT, 'src/lib/taxonomy.ts'), 'utf8');
 for (const [label, list] of [['platform', PLATFORMS], ['source', SOURCES], ['capability', CAPABILITIES]]) {
   for (const v of list) {
     if (!taxonomy.includes(`'${v}'`)) problems.push(`${label} '${v}' is in technique-schema.mjs but not in src/lib/taxonomy.ts`);
   }
 }
 
 if (problems.length) {
   console.error(`validate:data — ${problems.length} problem(s):`);
   for (const p of problems.slice(0, 40)) console.error(`  ✗ ${p}`);
   if (problems.length > 40) console.error(`  … and ${problems.length - 40} more`);
   process.exit(1);
 }
 console.log(`validate:data — OK: ${techniques.length} techniques, ${tools.length} tools, ${added} NEW; schema, ids, tool links and facet counts all consistent.`);