--- name: qa-check description: "[prprompts] Comprehensive compliance audit - generates QA_REPORT.md with score" category: Automation version: 4.0.0 tags: [prprompts, qa, compliance, audit, security] badge: NEW --- # /qa-check - Comprehensive Compliance Audit ๐Ÿ” **v4.0 Automation** - Complete quality assurance and compliance audit. Generates detailed `QA_REPORT.md` with scores, findings, and recommendations. ## Usage ```bash /qa-check ``` Or with specific compliance framework: ```bash /qa-check --framework hipaa /qa-check --framework pci-dss /qa-check --framework gdpr ``` ## What It Does Performs comprehensive audit across 8 categories: ### 1. Architecture Compliance (15%) - Clean Architecture structure - Feature separation - Dependency flow (presentation โ†’ domain โ†’ data) - Layer isolation ### 2. Code Quality (15%) - Static analysis (flutter analyze) - Linting rules - Code formatting - Complexity metrics - Duplicate code detection ### 3. Testing (20%) - Test coverage (โ‰ฅ85%) - Unit test quality - Widget test coverage - Integration test coverage - Test naming conventions ### 4. Security (20%) - Dependency vulnerabilities - Hardcoded secrets - Encryption implementation - Authentication flows - Authorization checks - Input validation - Secure storage usage ### 5. Compliance (15%) - HIPAA rules (if applicable) - PCI-DSS rules (if applicable) - GDPR rules (if applicable) - Custom compliance rules - Audit logging - Data retention policies ### 6. Performance (5%) - App startup time - Frame rendering (60fps) - Memory usage - Network efficiency - Build size ### 7. Accessibility (5%) - Semantic labels - Screen reader support - Color contrast - Font scaling - Keyboard navigation ### 8. Documentation (5%) - Code comments - README completeness - API documentation - Architecture diagrams - Deployment guides ## Example Session ``` /qa-check ๐Ÿ” Starting Comprehensive QA Audit... Project: HealthTracker Pro Compliance Frameworks: HIPAA, GDPR Date: 2025-01-15 14:23:45 โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 1. Architecture Compliance (15%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” โœ“ Clean Architecture structure โœ“ Feature modules properly separated โœ“ Dependency flow correct (presentation โ†’ domain โ†’ data) โœ“ No circular dependencies โœ“ Repository pattern implemented โœ“ Use case single responsibility โš  Minor: 2 presentation files importing data layer directly Score: 14/15 (93%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 2. Code Quality (15%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” Running flutter analyze... โœ“ 0 errors โœ“ 2 warnings (acceptable) โœ“ All files formatted (dart format) โœ“ Cyclomatic complexity avg: 4.2 (max: 8, target: <10) โœ“ No duplicate code detected โœ“ Naming conventions followed Warnings: lib/features/auth/presentation/pages/login_page.dart:47 - Prefer const constructors Score: 14/15 (93%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 3. Testing (20%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” Running tests... โœ“ Unit tests: 247 passed, 0 failed โœ“ Widget tests: 83 passed, 0 failed โœ“ Integration tests: 23 passed, 0 failed Coverage Analysis: โœ“ Overall: 87.3% (target: 85%) - lib/core/: 91.2% - lib/features/auth/: 89.4% - lib/features/appointments/: 87.1% - lib/features/messaging/: 85.3% - lib/features/records/: 82.7% โš  Below target โœ“ Test naming conventions โœ“ Arrange-Act-Assert pattern โœ“ Mock usage appropriate Issues: - Medical records feature below 85% coverage Score: 18/20 (90%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 4. Security (20%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” Dependency Scan: โœ“ 0 critical vulnerabilities โœ“ 0 high vulnerabilities โœ“ 2 medium vulnerabilities (non-blocking) Code Security Scan: โœ“ No hardcoded secrets โœ“ No hardcoded passwords/API keys โœ“ PHI encrypted with AES-256-GCM โœ“ Tokens stored in secure_storage โœ“ JWT RS256 implementation correct โœ“ Certificate pinning configured โœ“ Biometric auth secured โœ“ Input validation on all forms โœ“ SQL injection prevention (parameterized queries) โœ“ XSS prevention (HTML sanitization) Authentication & Authorization: โœ“ JWT token expiry: 15 min (acceptable) โœ“ Refresh token rotation implemented โœ“ Role-based access control (RBAC) โœ“ Multi-factor authentication (MFA) supported Issues: - 2 medium vulnerabilities in dependencies: 1. http 0.13.5 (update to 1.1.0) 2. intl 0.17.0 (update to 0.18.0) Score: 18/20 (90%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 5. Compliance - HIPAA (15%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” Technical Safeguards: โœ“ Access Controls (ยง164.312(a)(1)) - Unique user identification - Emergency access procedure - Automatic logoff (15 min) - Encryption and decryption โœ“ Audit Controls (ยง164.312(b)) - All PHI access logged - Audit logs encrypted - Log retention: 6 years โœ“ Integrity Controls (ยง164.312(c)(1)) - Mechanism to authenticate PHI - Digital signatures on records โœ“ Transmission Security (ยง164.312(e)(1)) - TLS 1.3 for data in transit - End-to-end encryption for messaging Physical Safeguards: โœ“ Device and Media Controls (ยง164.310(d)(1)) - Data disposal (secure deletion) - Media re-use (data wiping) Administrative Safeguards: โš  Security Management Process (ยง164.308(a)(1)) - Risk analysis documented โœ“ - Risk management plan โœ“ - Sanction policy โš  Missing - Information system activity review โœ“ Issues: - Missing sanction policy documentation Score: 14/15 (93%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 6. Performance (5%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” โœ“ Cold start time: 1.8s (target: <2s) โœ“ Frame rate: 60fps (no jank detected) โœ“ Memory usage: 147MB avg (acceptable for healthcare app) โœ“ Network efficiency: Request caching implemented โœ“ App size: 23.4MB (Android APK) โœ“ Build time: 42s (release build) Score: 5/5 (100%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 7. Accessibility (5%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” โœ“ Semantic labels on all interactive widgets โœ“ Screen reader tested (TalkBack/VoiceOver) โœ“ Color contrast ratio โ‰ฅ4.5:1 โœ“ Font scaling supported (up to 200%) โš  Keyboard navigation incomplete (2 screens missing) Score: 4/5 (80%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 8. Documentation (5%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” โœ“ README.md comprehensive โœ“ API documentation (35% of public APIs) โœ“ Architecture diagram exists โœ“ Deployment guide exists โš  Code comment coverage: 67% (target: 80%) Score: 4/5 (80%) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” ๐ŸŽฏ Overall QA Score: 91/100 (91%) Grade: A โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” ๐Ÿ“Š Category Breakdown: 1. Architecture Compliance: 93% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘] 2. Code Quality: 93% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘] 3. Testing: 90% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘] 4. Security: 90% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘] 5. Compliance (HIPAA): 93% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘] 6. Performance: 100% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“] 7. Accessibility: 80% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘โ–‘] 8. Documentation: 80% [โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–“โ–‘โ–‘] โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” ๐Ÿ”ด Critical Issues (0): None ๐ŸŸก Warnings (5): 1. 2 presentation files importing data layer directly 2. Medical records feature test coverage: 82.7% (target: 85%) 3. 2 medium dependency vulnerabilities 4. Missing HIPAA sanction policy documentation 5. Code comment coverage: 67% (target: 80%) โœ… Recommendations: 1. Fix layer violations in presentation files 2. Add tests to medical records feature (need 2.3% more) 3. Update dependencies: http, intl 4. Document sanction policy in docs/COMPLIANCE.md 5. Add code comments to public APIs 6. Complete keyboard navigation for 2 screens โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” ๐Ÿ“ Report saved to: QA_REPORT.md โœจ Great work! Your app is production-ready with minor improvements needed. Next Steps: 1. Review QA_REPORT.md 2. Fix warnings (estimated: 2 hours) 3. Re-run /qa-check to verify fixes 4. Deploy to staging environment ``` ## Generated Report Creates `QA_REPORT.md` with: - **Executive Summary:** Overall score and grade - **Category Scores:** Detailed breakdown with progress bars - **Critical Issues:** Must-fix items - **Warnings:** Should-fix items - **Recommendations:** Best practice improvements - **Detailed Findings:** Per-category analysis - **Compliance Matrices:** Framework-specific checklists - **Trend Analysis:** Comparison with previous audits - **Action Items:** Prioritized TODO list ## Grading Scale | Score | Grade | Status | |-------|-------|--------| | 95-100% | A+ | Excellent - Production ready | | 90-94% | A | Great - Minor improvements | | 85-89% | B+ | Good - Some work needed | | 80-84% | B | Acceptable - Several issues | | 75-79% | C+ | Fair - Significant work needed | | 70-74% | C | Passing - Major improvements required | | <70% | F | Failing - Not production ready | ## Compliance Frameworks ### HIPAA (Healthcare) - Technical safeguards - Physical safeguards - Administrative safeguards - Breach notification - Business associate agreements ### PCI-DSS (Payment Cards) - Build and maintain secure network - Protect cardholder data - Maintain vulnerability management - Implement strong access controls - Monitor and test networks - Maintain information security policy ### GDPR (Privacy) - Lawfulness, fairness, transparency - Purpose limitation - Data minimization - Accuracy - Storage limitation - Integrity and confidentiality - Accountability ## Options | Option | Description | |--------|-------------| | `--framework ` | Focus on specific compliance framework | | `--category ` | Audit specific category only | | `--verbose` | Include detailed explanations | | `--fix-suggestions` | Generate code fixes for issues | | `--compare ` | Compare with previous audit | ## Requirements - **Flutter SDK:** Installed - **Project:** Must be a Flutter project - **Tests:** Test infrastructure recommended ## Related Commands - `/review-and-commit` - Pre-commit validation - `/implement-next` - Implement features - `/full-cycle` - Auto-implement multiple features - `/bootstrap-from-prprompts` - Initial setup ## Automation Integration Use in CI/CD: ```yaml - name: QA Check run: gemini qa-check --ci --min-score 85 ``` Fails build if score < 85%. --- **Powered by PRPROMPTS v4.0** | **Quality Assurance** | [Docs](https://github.com/Kandil7/prprompts-flutter-generator#readme)