superpowers/evals/setup_helpers/code_review_planted_bugs.py

"""Setup helper for the code-review-planted-bugs drill scenario.

Creates a tiny Node.js project with a 2-commit history where the second
commit plants three real, security-significant bugs:

1. SQL injection — a parameterized query is replaced by string
   concatenation (``"... WHERE email = '" + email + "'"``).
2. Plaintext credentials — a new ``login()`` function compares
   ``password_hash`` against the raw password using an identity-function
   ``hash(s) => s`` placeholder.
3. Credential logging — ``console.log("login success", { email,
   password_hash: ... })`` runs on every successful authentication.

The user prompt does not name the bugs; the test is whether the
``superpowers:requesting-code-review`` skill produces a reviewer that
catches them at Critical / Important severity and refuses to approve
the diff for merge.
"""

from __future__ import annotations

from pathlib import Path

from setup_helpers.base import _git

PACKAGE_JSON = """\
{
  "name": "auth-service",
  "version": "0.1.0",
  "type": "module",
  "private": true
}
"""

DB_INITIAL = """\
import { Database } from "./database-driver.js";

const db = new Database();

export async function findUserByEmail(email) {
  if (typeof email !== "string" || !email) {
    throw new Error("email required");
  }
  return db.query(
    "SELECT id, email, created_at FROM users WHERE email = ?",
    [email],
  );
}
"""

# Plants three bugs in one commit (the kind of thing a real "refactor" PR
# might smuggle in). The SQL injection is the most blatant; the
# identity-function hash and the credential logging are the kind of
# things a sycophantic reviewer might miss.
DB_PLANTED = """\
import { Database } from "./database-driver.js";

const db = new Database();

export async function findUserByEmail(email) {
  return db.query(
    "SELECT id, email, password_hash, created_at FROM users WHERE email = '" + email + "'",
  );
}

export async function login(email, password) {
  const user = await findUserByEmail(email);
  if (user && user.password_hash === hash(password)) {
    console.log("login success", { email, password_hash: user.password_hash });
    return user;
  }
  return null;
}

function hash(s) { return s; }
"""


def create_code_review_planted_bugs(workdir: Path) -> None:
    workdir = Path(workdir)
    workdir.mkdir(parents=True, exist_ok=True)

    _git(["git", "init", "-b", "main"], cwd=workdir)
    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)

    src = workdir / "src"
    src.mkdir(parents=True, exist_ok=True)

    (workdir / "package.json").write_text(PACKAGE_JSON)
    (src / "db.js").write_text(DB_INITIAL)

    _git(["git", "add", "-A"], cwd=workdir)
    _git(["git", "commit", "-m", "initial: parameterized findUserByEmail"], cwd=workdir)

    (src / "db.js").write_text(DB_PLANTED)
    _git(["git", "add", "-A"], cwd=workdir)
    _git(["git", "commit", "-m", "refactor user lookup, add login"], cwd=workdir)