@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/advancedSecurity/fileProvider/checkResult.js

@@ -0,0 +1,188 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { sortCandidateEvidence } from "../ordering.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverSecretSourceFiles } from "../secretCandidates/discoverSecretSourceFiles.js";
+export const ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID = "android-file-provider-audit";
+const FILE_PROVIDER_METADATA = "android.support.FILE_PROVIDER_PATHS";
+const PATH_TAGS = new Set(["root-path", "files-path", "cache-path", "external-path", "external-files-path", "external-cache-path", "external-media-path"]);
+const EXTERNAL_TAGS = new Set(["external-path", "external-files-path", "external-cache-path", "external-media-path"]);
+const MAX_PATH_ENTRIES = 256;
+const MAX_EVIDENCE_VALUE = 240;
+function sourceLocation(root, relativePath, line) {
+    return buildAndroidSourceLocation(root, path.join(root, relativePath), { line });
+}
+function standardProvider(name) {
+    return name === "androidx.core.content.FileProvider" || name === "android.support.v4.content.FileProvider";
+}
+function directCustomProviders(root, detection) {
+    const byModule = new Map();
+    const discovery = discoverSecretSourceFiles(root, detection.modules.map((module) => module.path));
+    for (const file of discovery.files.filter((candidate) => /\.(java|kt)$/.test(candidate.relativePath))) {
+        const moduleKey = file.modulePath ?? "";
+        const names = byModule.get(moduleKey) ?? new Set();
+        const executable = file.content.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\r\n]*/g, " ");
+        for (const match of executable.matchAll(/\bclass\s+([A-Za-z_]\w*)\s*(?:extends\s+|:\s*)(?:androidx\.core\.content\.|android\.support\.v4\.content\.)?FileProvider\s*(?:\(\s*\))?/g))
+            names.add(match[1]);
+        byModule.set(moduleKey, names);
+    }
+    return byModule;
+}
+function finding(ruleId, title, artifactPath, line, identity, severity) {
+    return makeAndroidFinding({ ruleId, title, severity, confidence: "high", description: `${title}. This is static manifest/XML evidence and does not prove runtime reachability, URI access, or file exposure.`, manifestPath: artifactPath, identity, location: line === undefined ? undefined : { line }, recommendation: "Keep FileProvider non-exported and restrict configured roots to the narrowest required paths." });
+}
+function candidate(ruleId, root, artifactPath, modulePath, line, summary, raw, state = "resolved", confidence = "medium") {
+    return makeCandidateEvidence({ ruleId, category: "android-file-provider", confidence, modulePath, location: sourceLocation(root, artifactPath, line), summary, rawValue: (raw ?? "(missing)").slice(0, MAX_EVIDENCE_VALUE), resolutionState: state, staticAnalysisLimitations: ["Manifest sources are not merged; resource overlays, installed authorities, URI grants, permission protection levels, and runtime filesystem behavior are not evaluated."] });
+}
+function protectedProvider(provider) {
+    return Boolean(provider.permission || provider.readPermission || provider.writePermission);
+}
+function broadPath(tag, rawPath) {
+    const value = (rawPath ?? "").trim().replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+    return tag === "root-path" || value === "" || value === "." || value === "/" || /(^|\/)\.\.(\/|$)/.test(value) || /^[A-Za-z]:\//.test(value) || value.startsWith("/") || (EXTERNAL_TAGS.has(tag) && value.split("/").filter(Boolean).length <= 1);
+}
+function analyzeAuthorities(root, entry, provider, seen, out) {
+    const raw = provider.authoritiesRaw;
+    if (raw === undefined || raw.trim() === "") {
+        out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority is missing or empty", raw, raw === undefined ? "missing" : "malformed"));
+        return;
+    }
+    const local = new Set();
+    for (const authority of raw.split(";")) {
+        const normalized = authority.trim();
+        if (!normalized) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority contains an empty entry", authority, "malformed"));
+            continue;
+        }
+        if (/\$\{[^}]+\}/.test(normalized)) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority contains an unresolved placeholder", normalized, "unresolved"));
+            continue;
+        }
+        if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider authority is malformed", normalized, "malformed"));
+            continue;
+        }
+        const key = normalized.toLowerCase();
+        if (local.has(key) || seen.has(key))
+            out.push(candidate("android-file-provider-exported", root, entry.manifestPath, entry.modulePath, provider.location?.line, `Duplicate FileProvider authority${seen.has(key) ? " across providers/modules" : " within provider"}`, normalized, "unresolved"));
+        local.add(key);
+        seen.set(key, `${entry.modulePath ?? ""}:${entry.manifestPath}:${provider.name}`);
+    }
+}
+export function auditAndroidFileProviders(targetRoot, detection, manifests) {
+    if (detection.projectKind === "non-android")
+        return { id: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, category: "android-file-provider", title: "Android FileProvider audit", status: "unsupported", requirementLevel: "optional", ran: false, skipped: true, skipInfo: { checkId: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, reason: "Target was not detected as Android.", requirementLevel: "optional", verdictImpact: "does not apply", recommendedNextAction: "Run against an Android project." }, evidence: [], findings: [], warnings: [], errors: [], sourcePaths: [], confidence: "unknown", environmentRequirements: [], candidateEvidence: [] };
+    const findings = [];
+    const candidates = [];
+    const sources = new Set();
+    const seenAuthorities = new Map();
+    const custom = directCustomProviders(targetRoot, detection);
+    for (const entry of manifests)
+        for (const provider of entry.manifest.providers) {
+            const simpleName = provider.name.split(".").at(-1) ?? provider.name;
+            const confirmed = standardProvider(provider.name) || (custom.get(entry.modulePath ?? "")?.has(simpleName) ?? false);
+            if (!confirmed) {
+                if (/FileProvider$/i.test(provider.name))
+                    candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider-like class is not a directly proven FileProvider subclass", provider.name, "unresolved", "low"));
+                continue;
+            }
+            sources.add(entry.manifestPath);
+            const library = entry.modulePath !== undefined && detection.libraryModules.includes(entry.modulePath);
+            analyzeAuthorities(targetRoot, entry, provider, seenAuthorities, candidates);
+            if (provider.exported === true) {
+                if (library)
+                    candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Library manifest explicitly exports a FileProvider; application merged behavior requires review", provider.name, "resolved"));
+                else
+                    findings.push(finding("android-file-provider-exported", "Confirmed FileProvider is explicitly exported", entry.manifestPath, provider.location?.line, provider.name, "major"));
+                // The generic exported-component audit already owns the exact unprotected-provider finding.
+                if (!protectedProvider(provider))
+                    candidates.push(candidate("android-file-provider-missing-protection", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Exported FileProvider has no provider/read/write permission (generic exported audit owns the equivalent finding)", provider.name, "resolved", "high"));
+            }
+            else if (provider.exported === undefined)
+                candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider exported state is missing or unresolved", provider.exportedRaw, provider.exportedRaw === undefined ? "missing" : "unresolved"));
+            if (provider.grantUriPermissions === undefined)
+                candidates.push(candidate("android-file-provider-exported", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider grantUriPermissions is missing or unresolved", provider.grantUriPermissionsRaw, provider.grantUriPermissionsRaw === undefined ? "missing" : "unresolved", "low"));
+            for (const value of [provider.permission, provider.readPermission, provider.writePermission].filter((item) => item !== undefined))
+                if (value.trim() === "" || /\$\{[^}]+\}/.test(value))
+                    candidates.push(candidate("android-file-provider-missing-protection", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "Provider permission value is empty or unresolved", value, value.trim() === "" ? "malformed" : "unresolved"));
+            const metadata = (provider.metadata ?? []).filter((item) => item.name === FILE_PROVIDER_METADATA);
+            if (metadata.length === 0) {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, entry.manifestPath, entry.modulePath, provider.location?.line, "FileProvider has no FILE_PROVIDER_PATHS metadata", undefined, "missing"));
+                continue;
+            }
+            const references = [...new Set(metadata.map((item) => item.resource ?? item.value ?? ""))];
+            if (references.length > 1) {
+                candidates.push(candidate("android-file-provider-unresolved-reference", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, "Conflicting FILE_PROVIDER_PATHS metadata entries were not selected arbitrarily", references.join(";"), "unresolved"));
+                continue;
+            }
+            const reference = references[0];
+            if (!reference || metadata.some((item) => !item.resource)) {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, "FILE_PROVIDER_PATHS metadata has no concrete android:resource", reference, reference ? "unsupported" : "missing"));
+                continue;
+            }
+            const resolution = resolveAndroidXmlResourceReference(targetRoot, path.join(targetRoot, entry.modulePath ?? "."), reference);
+            if (resolution.state !== "resolved") {
+                const state = resolution.state === "missing" ? "missing" : resolution.state === "malformed-reference" ? (/\$\{/.test(reference) ? "unresolved" : "malformed") : resolution.state === "unsupported-reference" ? "unsupported" : "unresolved";
+                candidates.push(candidate(resolution.state === "missing" ? "android-file-provider-missing-paths-xml" : "android-file-provider-unresolved-reference", targetRoot, entry.manifestPath, entry.modulePath, metadata[0].location?.line, `FILE_PROVIDER_PATHS resource is ${resolution.state}${resolution.state === "ambiguous" ? ` (${resolution.candidates.length} candidates)` : ""}`, reference, state));
+                continue;
+            }
+            const resource = resolution.candidates[0];
+            sources.add(resource.relativePath);
+            let xml;
+            try {
+                xml = fs.readFileSync(path.join(targetRoot, resource.relativePath), "utf8");
+            }
+            catch {
+                candidates.push(candidate("android-file-provider-missing-paths-xml", targetRoot, resource.relativePath, entry.modulePath, undefined, "Resolved paths XML could not be read", resource.relativePath, "missing"));
+                continue;
+            }
+            const parsed = parseXmlDocument(xml);
+            if (!parsed.ok) {
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.error.location.line, "FileProvider paths XML is malformed", parsed.error.message, "malformed"));
+                continue;
+            }
+            if (parsed.root.localName !== "paths") {
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.root.location.line, `Unsupported FileProvider paths root <${parsed.root.tagName}>`, parsed.root.tagName, "unsupported"));
+                continue;
+            }
+            if (parsed.root.children.length > MAX_PATH_ENTRIES)
+                candidates.push(candidate("android-file-provider-malformed-paths-xml", targetRoot, resource.relativePath, entry.modulePath, parsed.root.location.line, `FileProvider paths XML exceeds the ${MAX_PATH_ENTRIES}-entry analysis bound`, String(parsed.root.children.length), "unsupported"));
+            const identities = new Map();
+            const exact = new Set();
+            for (const child of parsed.root.children.slice(0, MAX_PATH_ENTRIES)) {
+                const name = child.attributes.find((attribute) => attribute.localName === "name")?.value;
+                const rawPath = child.attributes.find((attribute) => attribute.localName === "path")?.value;
+                if (!PATH_TAGS.has(child.localName)) {
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Unsupported FileProvider path element", child.tagName, "unsupported"));
+                    continue;
+                }
+                if (name === undefined || name.trim() === "")
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "FileProvider path entry has a missing or empty name", name, "malformed"));
+                if (rawPath === undefined)
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "FileProvider path entry is missing path", undefined, "malformed"));
+                const normalized = (rawPath ?? "").trim().replace(/\\/g, "/").replace(/\/{2,}/g, "/").slice(0, MAX_EVIDENCE_VALUE);
+                const exactKey = `${child.localName}:${name ?? ""}:${normalized}`;
+                const prior = identities.get(name ?? "");
+                if (exact.has(exactKey))
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Duplicate FileProvider path entry", exactKey, "unresolved"));
+                else if (name !== undefined && prior !== undefined && prior !== `${child.localName}:${normalized}`)
+                    candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, "Conflicting FileProvider path entries share the same name", `${name}:${prior}:${child.localName}:${normalized}`, "unresolved"));
+                exact.add(exactKey);
+                if (name !== undefined)
+                    identities.set(name, `${child.localName}:${normalized}`);
+                if (broadPath(child.localName, rawPath)) {
+                    if (provider.exported === true && !library)
+                        findings.push(finding("android-file-provider-broad-paths", `Exported FileProvider has broad <${child.localName}> path`, resource.relativePath, child.location.line, `${entry.modulePath ?? ""}:${provider.name}:${name ?? ""}:${normalized}`, "major"));
+                    else
+                        candidates.push(candidate("android-file-provider-broad-paths", targetRoot, resource.relativePath, entry.modulePath, child.location.line, `Potentially broad <${child.localName}> path`, normalized, "resolved"));
+                }
+            }
+        }
+    const uniqueFindings = [...new Map(findings.map((item) => [item.id, item])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const uniqueCandidates = [...new Map(candidates.map((item) => [item.id, item])).values()];
+    return { id: ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID, category: "android-file-provider", title: "Android FileProvider audit", status: uniqueFindings.length ? "failed" : "passed", requirementLevel: "required", ran: true, skipped: false, evidence: [`${sources.size} manifest/XML artifact(s) inspected`], findings: uniqueFindings, warnings: ["Static analysis only: manifests are not merged; resource overlays, runtime URI grants, installed authorities, and provider-backed filesystem access are not evaluated."], errors: [], sourcePaths: [...sources].sort((a, b) => a.localeCompare(b)), confidence: "high", environmentRequirements: [], candidateEvidence: sortCandidateEvidence(uniqueCandidates) };
+}

package/dist/src/mobile/android/advancedSecurity/fileProvider/index.js

@@ -0,0 +1 @@
+export { auditAndroidFileProviders, ANDROID_FILE_PROVIDER_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/analyzeFirebaseGoogleServices.js

@@ -0,0 +1,197 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverFirebaseArtifacts } from "./discoverFirebaseArtifacts.js";
+import { parseGoogleServicesConfig } from "./parseGoogleServicesConfig.js";
+import { parseFirebaseJson, parseFirebaseRc } from "./parseFirebaseConfig.js";
+import { parseDatabaseRules } from "./parseDatabaseRules.js";
+import { parseFirestoreOrStorageRules } from "./parseFirestoreStorageRules.js";
+import { collectAnalyticsEventEvidence, collectCollectionSetterEvidence, collectGradleServiceEvidence, collectManifestCollectionMetadata, collectSourceServiceEvidence, } from "./collectFirebaseServiceEvidence.js";
+function fileLocationLine(targetRoot, file, line) {
+    return buildAndroidSourceLocation(targetRoot, file.absolutePath, { line });
+}
+export function analyzeFirebaseGoogleServices(targetRoot, modulePaths) {
+    const candidates = [];
+    const findings = [];
+    const discovery = discoverFirebaseArtifacts(targetRoot, modulePaths);
+    const limitations = [
+        "Bounded static analysis of target-contained local files only; does not contact Firebase or Google services, does not verify deployed rules, and does not evaluate Gradle or resolve dependency selection.",
+    ];
+    const candidate = (ruleId, file, summary, rawValue, confidence = "medium", resolutionState = "resolved", line) => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-firebase-google-services",
+        confidence,
+        modulePath: file.modulePath,
+        location: fileLocationLine(targetRoot, file, line),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    const permissiveFinding = (ruleId, file, title, line, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId,
+        title,
+        severity: "major",
+        confidence: "high",
+        description: `${title}. This reflects a local rules file only; it is not proof of the currently deployed configuration.`,
+        manifestPath: file.relativePath,
+        identity: `${ruleId}:${line ?? 0}`,
+        location: { line },
+        evidenceDetails,
+        recommendation: "Restrict the rule to authenticated, authorized access before deploying, and verify the deployed rules match the local file.",
+    }));
+    // --- google-services.json -------------------------------------------------
+    const googleServicesConfigs = discovery.googleServicesFiles.map(parseGoogleServicesConfig);
+    for (const config of googleServicesConfigs) {
+        if (config.malformed) {
+            candidate("android-firebase-google-configuration-evidence", config.file, "google-services.json could not be parsed as JSON", undefined, "low", "malformed");
+            continue;
+        }
+        candidate("android-firebase-google-configuration-evidence", config.file, `google-services.json parsed: project=${config.projectId ?? "(none)"}, clients=${config.clients.length}, apiKeys=${config.clients.reduce((n, c) => n + c.apiKeyCount, 0)}`, config.projectId, "low", "not-applicable");
+        const manifestPackages = discovery.manifestFiles
+            .map((m) => /\bpackage\s*=\s*"([^"]+)"/.exec(m.content)?.[1])
+            .filter((v) => Boolean(v));
+        if (manifestPackages.length > 0) {
+            const matchingClients = config.clients.filter((c) => c.packageName !== undefined && manifestPackages.includes(c.packageName));
+            if (matchingClients.length === 0) {
+                candidate("android-firebase-google-configuration-evidence", config.file, "No google-services.json client matches the detected application package", undefined, "medium", "unresolved");
+            }
+            else if (matchingClients.length > 1) {
+                candidate("android-firebase-google-configuration-evidence", config.file, "Multiple google-services.json clients match the detected application package", undefined, "medium", "unresolved");
+            }
+        }
+    }
+    // --- firebase.json / .firebaserc ------------------------------------------
+    const firebaseJsonConfigs = discovery.firebaseJsonFiles.map(parseFirebaseJson);
+    for (const config of firebaseJsonConfigs) {
+        if (config.malformed) {
+            candidate("android-firebase-google-configuration-evidence", config.file, "firebase.json could not be parsed as JSON", undefined, "low", "malformed");
+        }
+    }
+    for (const rc of discovery.firebaseRcFiles.map(parseFirebaseRc)) {
+        if (rc.malformed) {
+            candidate("android-firebase-google-configuration-evidence", rc.file, ".firebaserc could not be parsed as JSON", undefined, "low", "malformed");
+        }
+        else if (Object.keys(rc.aliases).length > 0) {
+            candidate("android-firebase-google-configuration-evidence", rc.file, `.firebaserc project alias metadata: ${Object.keys(rc.aliases).join(", ")}`, rc.defaultProject, "low", "not-applicable");
+        }
+    }
+    // --- rules resolution (referenced by firebase.json, or conventional names) --
+    const referencedPaths = new Set(firebaseJsonConfigs.flatMap((c) => [...c.databaseRulesPaths, ...c.firestoreRulesPaths, ...c.storageRulesPaths]));
+    for (const firebaseJson of discovery.firebaseJsonFiles) {
+        const config = firebaseJsonConfigs.find((c) => c.file === firebaseJson);
+        if (!config)
+            continue;
+        for (const rulesPath of [...config.databaseRulesPaths, ...config.firestoreRulesPaths, ...config.storageRulesPaths]) {
+            const normalized = rulesPath.replace(/^\.?\//, "");
+            const resolved = discovery.databaseRulesJsonFiles.find((f) => f.relativePath.endsWith(normalized)) ??
+                discovery.rulesFiles.find((f) => f.relativePath.endsWith(normalized));
+            if (!resolved) {
+                candidate("android-firebase-missing-local-rules", firebaseJson, `firebase.json references "${rulesPath}", but that rules file was not found in the target`, rulesPath, "medium", "missing");
+            }
+        }
+    }
+    void referencedPaths;
+    // --- Realtime Database rules -----------------------------------------------
+    for (const dbRulesFile of discovery.databaseRulesJsonFiles) {
+        const result = parseDatabaseRules(dbRulesFile);
+        if (result.malformed) {
+            candidate("android-firebase-google-configuration-evidence", dbRulesFile, "database.rules.json could not be parsed as JSON", undefined, "low", "malformed");
+            continue;
+        }
+        for (const entry of result.entries) {
+            if ((entry.operation === ".read" || entry.operation === ".write") && entry.literalBoolean === true) {
+                permissiveFinding("android-firebase-realtime-database-permissive-rules", dbRulesFile, `Realtime Database ${entry.operation} rule at ${entry.jsonPath} is unconditionally true`, undefined, [`path=${entry.jsonPath}`, `operation=${entry.operation}`]);
+            }
+            else if (entry.operation === ".read" || entry.operation === ".write") {
+                candidate("android-firebase-google-configuration-evidence", dbRulesFile, `Realtime Database ${entry.operation} rule at ${entry.jsonPath}: ${entry.conditionSummary}`, entry.conditionSummary, "low", "not-applicable");
+            }
+        }
+    }
+    // --- Firestore / Storage rules ----------------------------------------------
+    for (const rulesFile of discovery.rulesFiles) {
+        const isStorage = /storage\.rules$/i.test(rulesFile.relativePath) || /service\s+firebase\.storage/.test(rulesFile.content);
+        const isFirestore = !isStorage && (/firestore\.rules$/i.test(rulesFile.relativePath) || /service\s+cloud\.firestore/.test(rulesFile.content));
+        if (!isStorage && !isFirestore)
+            continue;
+        const service = isStorage ? "storage" : "firestore";
+        const result = parseFirestoreOrStorageRules(rulesFile, service);
+        const ruleId = isStorage ? "android-firebase-storage-permissive-rules" : "android-firebase-firestore-permissive-rules";
+        for (const match of result.matches) {
+            if (match.isLiteralTrue && !match.hasAuthCondition) {
+                permissiveFinding(ruleId, rulesFile, `${service === "storage" ? "Storage" : "Firestore"} rule at ${match.matchPath} allows ${match.operations.join(", ")} unconditionally`, match.line, [
+                    `path=${match.matchPath}`,
+                    `operations=${match.operations.join(",")}`,
+                ]);
+            }
+            else if (match.isTestModeTimeCondition) {
+                candidate("android-firebase-google-configuration-evidence", rulesFile, `Time-limited test-mode rule at ${match.matchPath}: ${match.conditionSummary}`, match.conditionSummary, "medium", "not-applicable", match.line);
+            }
+            else if (!match.hasAuthCondition && !match.isLiteralFalse) {
+                candidate("android-firebase-google-configuration-evidence", rulesFile, `Unresolved/complex rule condition at ${match.matchPath}: ${match.conditionSummary}`, match.conditionSummary, "low", "unresolved", match.line);
+            }
+        }
+    }
+    // --- Gradle + source service-use evidence -----------------------------------
+    const allServiceEvidence = [
+        ...discovery.gradleFiles.flatMap(collectGradleServiceEvidence),
+        ...discovery.sourceFiles.flatMap(collectSourceServiceEvidence),
+    ];
+    const servicesUsed = new Set(allServiceEvidence.map((e) => e.service));
+    if (allServiceEvidence.length > 0) {
+        const gradleFile = discovery.gradleFiles[0] ?? discovery.sourceFiles[0];
+        if (gradleFile) {
+            candidate("android-firebase-google-configuration-evidence", gradleFile, `Firebase service-use evidence found for: ${[...servicesUsed].sort().join(", ")}`, undefined, "low", "not-applicable");
+        }
+    }
+    const anyRulesResolved = discovery.databaseRulesJsonFiles.length > 0 || discovery.rulesFiles.length > 0;
+    const anchorFile = discovery.gradleFiles[0] ?? discovery.sourceFiles[0];
+    if (anchorFile) {
+        if (servicesUsed.has("database") && discovery.databaseRulesJsonFiles.length === 0) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Realtime Database service use detected but no local database.rules.json was found", undefined, "medium", "missing");
+        }
+        if (servicesUsed.has("firestore") && !discovery.rulesFiles.some((f) => /firestore\.rules$/i.test(f.relativePath) || /service\s+cloud\.firestore/.test(f.content))) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Firestore service use detected but no local firestore.rules was found", undefined, "medium", "missing");
+        }
+        if (servicesUsed.has("storage") && !discovery.rulesFiles.some((f) => /storage\.rules$/i.test(f.relativePath) || /service\s+firebase\.storage/.test(f.content))) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Storage service use detected but no local storage.rules was found", undefined, "medium", "missing");
+        }
+    }
+    void anyRulesResolved;
+    // --- collection / auto-init metadata -----------------------------------------
+    for (const manifest of discovery.manifestFiles) {
+        for (const meta of collectManifestCollectionMetadata(manifest)) {
+            candidate("android-firebase-google-configuration-evidence", manifest, `${meta.name} manifest metadata is ${meta.state} (${meta.rawValue})`, meta.rawValue, "low", meta.state === "dynamic" ? "unresolved" : "not-applicable", meta.line);
+        }
+    }
+    for (const source of discovery.sourceFiles) {
+        for (const setter of collectCollectionSetterEvidence(source)) {
+            candidate("android-firebase-google-configuration-evidence", source, `${setter.service} collection setter called with state=${setter.state}`, undefined, "low", setter.state === "dynamic" ? "unresolved" : "not-applicable", setter.line);
+        }
+    }
+    // --- analytics event parameter review ------------------------------------------
+    for (const source of discovery.sourceFiles) {
+        for (const event of collectAnalyticsEventEvidence(source)) {
+            if (event.sensitiveParameterKey === undefined)
+                continue;
+            if (event.isDirectLiteralValue) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-firebase-google-configuration-evidence",
+                    title: "Direct sensitive value sent as a Firebase Analytics event parameter",
+                    severity: "major",
+                    confidence: "high",
+                    description: "A directly visible sensitive parameter key/value was passed to a Firebase Analytics logEvent() Bundle in the same method. Static source evidence only; does not prove the event was uploaded.",
+                    manifestPath: source.relativePath,
+                    identity: `analytics-event:${event.line}`,
+                    location: { line: event.line },
+                    evidenceDetails: [`key=${event.sensitiveParameterKey}`],
+                    recommendation: "Do not send credentials or highly sensitive personal data as analytics event parameters.",
+                }));
+            }
+            else {
+                candidate("android-firebase-google-configuration-evidence", source, `Sensitive-looking analytics event parameter key "${event.sensitiveParameterKey}" with a dynamic value`, event.sensitiveParameterValueExpression, "medium", "unresolved", event.line);
+            }
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/checkResult.js

@@ -0,0 +1,77 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeFirebaseGoogleServices } from "./analyzeFirebaseGoogleServices.js";
+import { discoverFirebaseArtifacts } from "./discoverFirebaseArtifacts.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android Firebase/Google services check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID = "android-firebase-google-services-audit";
+export function auditAndroidFirebaseGoogleServices(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+            category: "android-firebase-google-services",
+            title: "Android Firebase/Google services audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const discovery = discoverFirebaseArtifacts(targetRoot, modulePaths);
+    const { candidates, findings } = analyzeFirebaseGoogleServices(targetRoot, modulePaths);
+    const sortedFindings = [...new Map(findings.map((f) => [f.id, f])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...new Map(candidates.map((c) => [c.id, c])).values()]);
+    const hasReportableFinding = sortedFindings.some((f) => f.severity !== "informational");
+    const sourcePaths = [
+        ...discovery.googleServicesFiles,
+        ...discovery.firebaseJsonFiles,
+        ...discovery.firebaseRcFiles,
+        ...discovery.databaseRulesJsonFiles,
+        ...discovery.rulesFiles,
+        ...discovery.gradleFiles,
+        ...discovery.sourceFiles,
+        ...discovery.manifestFiles,
+    ].map((f) => f.relativePath);
+    return {
+        id: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+        category: "android-firebase-google-services",
+        title: "Android Firebase/Google services audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [
+            `${discovery.googleServicesFiles.length} google-services.json, ${discovery.firebaseJsonFiles.length} firebase.json, ${discovery.databaseRulesJsonFiles.length + discovery.rulesFiles.length} rules file(s) found`,
+        ],
+        findings: sortedFindings,
+        warnings: [
+            ...discovery.skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: local configuration/rules files are not proof of the deployed Firebase project configuration; no remote Firebase or Google service was contacted.",
+        ],
+        errors: [],
+        sourcePaths,
+        confidence: discovery.skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}