plan-authHarAnalyzer

Prompt file imported from jonrovner/harry (.github/prompts/plan-authHarAnalyzer.prompt.md). Copyright stays with the author.

Plan: Frontend-Only Auth HAR Analyzer

Build a local-first React + TypeScript SPA in frontend, starting from zero scaffolding. Execution should prioritize a vertical slice first (upload -> parse -> normalize -> render), then add auth intelligence and findings, and finally privacy hardening.

Steps

1. Phase 0: Scope lock and acceptance checklist

• Use docs/product-spec.md, docs/architecture.md, docs/models.md, and docs/roadmap.md as the single source of truth.
• Lock frontend-only architecture (already confirmed).
• Define MVP cut as: local HAR upload, entries list + details panel, auth filter, protocol/provider detection, timeline UI, token/cookie intelligence, findings engine, sanitization output.

2. Phase 1: Scaffold and architecture skeleton (blocks all later phases)

• Initialize React + TypeScript + Tailwind in frontend.
• Add Zustand, TanStack Query, zod, jose, fast-xml-parser.
• Create module boundaries matching architecture: components, engine (parser/classifiers/analyzers/rules/sanitizer), store, types.
• Enforce strict TypeScript, linting, and test setup.

3. Phase 2: HAR ingestion vertical slice (depends on Phase 1)

• Implement local HAR file intake and schema validation.
• Build parser + normalizer producing model-aligned normalized entries.
• Render entries list (method/url/status/time) and request/response details panel.
• Add initial auth tagging to validate downstream filtering and detectors.

4. Phase 3: Detection and timeline core (depends on Phase 2)

• Protocol detection for OAuth2, OIDC, basic SAML signals.
• Provider detection for Auth0, Okta, Azure AD.
• Auth filter toggle using inclusion/exclusion rules from spec.
• Timeline visualization from normalized/classified events.

5. Phase 4: Intelligence and findings (depends on Phase 3; token and cookie analysis can run in parallel)

• Token analyzer: decode, validate, lifecycle checks.
• Cookie analyzer: SameSite, Secure, expiration, cross-site checks.
• Rule engine emits findings in the issue -> evidence -> remediation structure.
• Consolidate outputs in a single analysis state for UI.

6. Phase 5: Privacy boundary and stabilization (depends on Phase 4)

• Implement sanitizer that guarantees no raw HAR-sensitive fields in exported/AI-bound data structures.
• Keep AI provider calls disabled for initial cut; wire only extension points if needed.
• Add robust error states for malformed/huge HAR files and performance safeguards.

7. Phase 6: Release readiness (depends on Phases 2-5)

• Accessibility and responsive pass for list, details panel, and timeline.
• Documentation pass in specs/README for user workflows and privacy guarantees.
• Final MVP acceptance run with real OAuth2 and OIDC HAR fixtures.

Verification

1. Parser contract tests: HAR fixture -> normalized entry conformance.
2. Detector unit tests: protocol/provider true/false cases.
3. Analyzer unit tests: token expiry/invalid JWT; cookie flag/risk scenarios.
4. Findings tests: deterministic severity/evidence/remediation output.
5. Sanitizer tests: prove no raw tokens/cookies/bodies leave local analysis objects.
6. Integration flow tests: upload -> filter -> timeline -> findings drilldown.
7. Manual acceptance checklist mapped directly to docs/product-spec.md.

Decisions and assumptions

• Confirmed: frontend-only.
• Recommended for initial delivery: defer AI provider calls.
• Recommended SAML scope for MVP: basic detection/extraction only; deep SAML analysis in later phase.
• Out of scope initially: backend API, cloud processing, providers beyond Auth0/Okta/Azure AD.