Added detector for JFrog Artifactory Reference Tokens

[shahzadhaider1]

Summary

Adds a new detector for JFrog Artifactory Reference Tokens. Unlike JWT tokens (which start with eyJ), reference tokens are base64-encoded strings with a predictable structure:

reftkn:01:<expiry>:<random_data>

When base64-encoded, this always produces a token starting with cmVmdGtu.

Detection

Regex pattern:

\b(cmVmdGtu[A-Za-z0-9]{56})\b

• Fixed prefix: cmVmdGtu (8 chars): base64 encoding of "reftkn"
• Variable suffix: 56 alphanumeric characters
• Total length: exactly 64 characters

Keyword: cmVmdGtu

Verification

Tokens are verified against the JFrog Access API:

GET https://<host>/access/api/v1/tokens/me
Authorization: Bearer <token>

This endpoint returns token metadata if valid. Available since Artifactory 7.53.1.

Response handling:

Status	Meaning	Result
200 + JSON	Valid token	Verified
200 + HTML	Invalid subdomain (redirects to login page)	Skip host
403	Valid token, insufficient permissions	Verified
401	Invalid or expired token	Not verified
404	Endpoint not found (old Artifactory version)	Verification error

References

• JFrog: What is a Reference Token?
• JFrog REST API: Get Token by ID

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Introduces a new network-verifying detector and a new protobuf detector type, which can affect verification behavior and compatibility if the API/host handling is incorrect, but changes are otherwise additive and localized.

Overview
Adds a new ArtifactoryReferenceToken detector that finds 64-char base64 tokens prefixed with cmVmdGtu and (optionally) verifies them by calling JFrog Access API GET /access/api/v1/tokens/me against discovered/configured *.jfrog.io endpoints.

Verification logic distinguishes valid tokens from invalid subdomains (e.g., 200+HTML treated as bad host), caches unreachable/invalid hosts to avoid repeat lookups, and records verification errors/analysis metadata when appropriate. The detector is wired into the default detector set, adds unit + integration coverage, and updates the engine cloud-endpoint initialization test to allow this new detector to have no cloud endpoint; protobuf enum/types are extended with DetectorType_ArtifactoryReferenceToken = 1042.

^{Written by Cursor Bugbot for commit 7a5f1db. This will update automatically on new commits. Configure here.}

[mustansir14]

LGTM.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}