@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/analyzeFirebaseGoogleServices.js

@@ -0,0 +1,197 @@
+import { makeAndroidFinding } from "../../audit/androidFinding.js";
+import { makeCandidateEvidence } from "../candidateEvidence.js";
+import { buildAndroidSourceLocation } from "../sourceLocation.js";
+import { discoverFirebaseArtifacts } from "./discoverFirebaseArtifacts.js";
+import { parseGoogleServicesConfig } from "./parseGoogleServicesConfig.js";
+import { parseFirebaseJson, parseFirebaseRc } from "./parseFirebaseConfig.js";
+import { parseDatabaseRules } from "./parseDatabaseRules.js";
+import { parseFirestoreOrStorageRules } from "./parseFirestoreStorageRules.js";
+import { collectAnalyticsEventEvidence, collectCollectionSetterEvidence, collectGradleServiceEvidence, collectManifestCollectionMetadata, collectSourceServiceEvidence, } from "./collectFirebaseServiceEvidence.js";
+function fileLocationLine(targetRoot, file, line) {
+    return buildAndroidSourceLocation(targetRoot, file.absolutePath, { line });
+}
+export function analyzeFirebaseGoogleServices(targetRoot, modulePaths) {
+    const candidates = [];
+    const findings = [];
+    const discovery = discoverFirebaseArtifacts(targetRoot, modulePaths);
+    const limitations = [
+        "Bounded static analysis of target-contained local files only; does not contact Firebase or Google services, does not verify deployed rules, and does not evaluate Gradle or resolve dependency selection.",
+    ];
+    const candidate = (ruleId, file, summary, rawValue, confidence = "medium", resolutionState = "resolved", line) => candidates.push(makeCandidateEvidence({
+        ruleId,
+        category: "android-firebase-google-services",
+        confidence,
+        modulePath: file.modulePath,
+        location: fileLocationLine(targetRoot, file, line),
+        summary,
+        rawValue,
+        resolutionState,
+        staticAnalysisLimitations: limitations,
+    }));
+    const permissiveFinding = (ruleId, file, title, line, evidenceDetails) => findings.push(makeAndroidFinding({
+        ruleId,
+        title,
+        severity: "major",
+        confidence: "high",
+        description: `${title}. This reflects a local rules file only; it is not proof of the currently deployed configuration.`,
+        manifestPath: file.relativePath,
+        identity: `${ruleId}:${line ?? 0}`,
+        location: { line },
+        evidenceDetails,
+        recommendation: "Restrict the rule to authenticated, authorized access before deploying, and verify the deployed rules match the local file.",
+    }));
+    // --- google-services.json -------------------------------------------------
+    const googleServicesConfigs = discovery.googleServicesFiles.map(parseGoogleServicesConfig);
+    for (const config of googleServicesConfigs) {
+        if (config.malformed) {
+            candidate("android-firebase-google-configuration-evidence", config.file, "google-services.json could not be parsed as JSON", undefined, "low", "malformed");
+            continue;
+        }
+        candidate("android-firebase-google-configuration-evidence", config.file, `google-services.json parsed: project=${config.projectId ?? "(none)"}, clients=${config.clients.length}, apiKeys=${config.clients.reduce((n, c) => n + c.apiKeyCount, 0)}`, config.projectId, "low", "not-applicable");
+        const manifestPackages = discovery.manifestFiles
+            .map((m) => /\bpackage\s*=\s*"([^"]+)"/.exec(m.content)?.[1])
+            .filter((v) => Boolean(v));
+        if (manifestPackages.length > 0) {
+            const matchingClients = config.clients.filter((c) => c.packageName !== undefined && manifestPackages.includes(c.packageName));
+            if (matchingClients.length === 0) {
+                candidate("android-firebase-google-configuration-evidence", config.file, "No google-services.json client matches the detected application package", undefined, "medium", "unresolved");
+            }
+            else if (matchingClients.length > 1) {
+                candidate("android-firebase-google-configuration-evidence", config.file, "Multiple google-services.json clients match the detected application package", undefined, "medium", "unresolved");
+            }
+        }
+    }
+    // --- firebase.json / .firebaserc ------------------------------------------
+    const firebaseJsonConfigs = discovery.firebaseJsonFiles.map(parseFirebaseJson);
+    for (const config of firebaseJsonConfigs) {
+        if (config.malformed) {
+            candidate("android-firebase-google-configuration-evidence", config.file, "firebase.json could not be parsed as JSON", undefined, "low", "malformed");
+        }
+    }
+    for (const rc of discovery.firebaseRcFiles.map(parseFirebaseRc)) {
+        if (rc.malformed) {
+            candidate("android-firebase-google-configuration-evidence", rc.file, ".firebaserc could not be parsed as JSON", undefined, "low", "malformed");
+        }
+        else if (Object.keys(rc.aliases).length > 0) {
+            candidate("android-firebase-google-configuration-evidence", rc.file, `.firebaserc project alias metadata: ${Object.keys(rc.aliases).join(", ")}`, rc.defaultProject, "low", "not-applicable");
+        }
+    }
+    // --- rules resolution (referenced by firebase.json, or conventional names) --
+    const referencedPaths = new Set(firebaseJsonConfigs.flatMap((c) => [...c.databaseRulesPaths, ...c.firestoreRulesPaths, ...c.storageRulesPaths]));
+    for (const firebaseJson of discovery.firebaseJsonFiles) {
+        const config = firebaseJsonConfigs.find((c) => c.file === firebaseJson);
+        if (!config)
+            continue;
+        for (const rulesPath of [...config.databaseRulesPaths, ...config.firestoreRulesPaths, ...config.storageRulesPaths]) {
+            const normalized = rulesPath.replace(/^\.?\//, "");
+            const resolved = discovery.databaseRulesJsonFiles.find((f) => f.relativePath.endsWith(normalized)) ??
+                discovery.rulesFiles.find((f) => f.relativePath.endsWith(normalized));
+            if (!resolved) {
+                candidate("android-firebase-missing-local-rules", firebaseJson, `firebase.json references "${rulesPath}", but that rules file was not found in the target`, rulesPath, "medium", "missing");
+            }
+        }
+    }
+    void referencedPaths;
+    // --- Realtime Database rules -----------------------------------------------
+    for (const dbRulesFile of discovery.databaseRulesJsonFiles) {
+        const result = parseDatabaseRules(dbRulesFile);
+        if (result.malformed) {
+            candidate("android-firebase-google-configuration-evidence", dbRulesFile, "database.rules.json could not be parsed as JSON", undefined, "low", "malformed");
+            continue;
+        }
+        for (const entry of result.entries) {
+            if ((entry.operation === ".read" || entry.operation === ".write") && entry.literalBoolean === true) {
+                permissiveFinding("android-firebase-realtime-database-permissive-rules", dbRulesFile, `Realtime Database ${entry.operation} rule at ${entry.jsonPath} is unconditionally true`, undefined, [`path=${entry.jsonPath}`, `operation=${entry.operation}`]);
+            }
+            else if (entry.operation === ".read" || entry.operation === ".write") {
+                candidate("android-firebase-google-configuration-evidence", dbRulesFile, `Realtime Database ${entry.operation} rule at ${entry.jsonPath}: ${entry.conditionSummary}`, entry.conditionSummary, "low", "not-applicable");
+            }
+        }
+    }
+    // --- Firestore / Storage rules ----------------------------------------------
+    for (const rulesFile of discovery.rulesFiles) {
+        const isStorage = /storage\.rules$/i.test(rulesFile.relativePath) || /service\s+firebase\.storage/.test(rulesFile.content);
+        const isFirestore = !isStorage && (/firestore\.rules$/i.test(rulesFile.relativePath) || /service\s+cloud\.firestore/.test(rulesFile.content));
+        if (!isStorage && !isFirestore)
+            continue;
+        const service = isStorage ? "storage" : "firestore";
+        const result = parseFirestoreOrStorageRules(rulesFile, service);
+        const ruleId = isStorage ? "android-firebase-storage-permissive-rules" : "android-firebase-firestore-permissive-rules";
+        for (const match of result.matches) {
+            if (match.isLiteralTrue && !match.hasAuthCondition) {
+                permissiveFinding(ruleId, rulesFile, `${service === "storage" ? "Storage" : "Firestore"} rule at ${match.matchPath} allows ${match.operations.join(", ")} unconditionally`, match.line, [
+                    `path=${match.matchPath}`,
+                    `operations=${match.operations.join(",")}`,
+                ]);
+            }
+            else if (match.isTestModeTimeCondition) {
+                candidate("android-firebase-google-configuration-evidence", rulesFile, `Time-limited test-mode rule at ${match.matchPath}: ${match.conditionSummary}`, match.conditionSummary, "medium", "not-applicable", match.line);
+            }
+            else if (!match.hasAuthCondition && !match.isLiteralFalse) {
+                candidate("android-firebase-google-configuration-evidence", rulesFile, `Unresolved/complex rule condition at ${match.matchPath}: ${match.conditionSummary}`, match.conditionSummary, "low", "unresolved", match.line);
+            }
+        }
+    }
+    // --- Gradle + source service-use evidence -----------------------------------
+    const allServiceEvidence = [
+        ...discovery.gradleFiles.flatMap(collectGradleServiceEvidence),
+        ...discovery.sourceFiles.flatMap(collectSourceServiceEvidence),
+    ];
+    const servicesUsed = new Set(allServiceEvidence.map((e) => e.service));
+    if (allServiceEvidence.length > 0) {
+        const gradleFile = discovery.gradleFiles[0] ?? discovery.sourceFiles[0];
+        if (gradleFile) {
+            candidate("android-firebase-google-configuration-evidence", gradleFile, `Firebase service-use evidence found for: ${[...servicesUsed].sort().join(", ")}`, undefined, "low", "not-applicable");
+        }
+    }
+    const anyRulesResolved = discovery.databaseRulesJsonFiles.length > 0 || discovery.rulesFiles.length > 0;
+    const anchorFile = discovery.gradleFiles[0] ?? discovery.sourceFiles[0];
+    if (anchorFile) {
+        if (servicesUsed.has("database") && discovery.databaseRulesJsonFiles.length === 0) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Realtime Database service use detected but no local database.rules.json was found", undefined, "medium", "missing");
+        }
+        if (servicesUsed.has("firestore") && !discovery.rulesFiles.some((f) => /firestore\.rules$/i.test(f.relativePath) || /service\s+cloud\.firestore/.test(f.content))) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Firestore service use detected but no local firestore.rules was found", undefined, "medium", "missing");
+        }
+        if (servicesUsed.has("storage") && !discovery.rulesFiles.some((f) => /storage\.rules$/i.test(f.relativePath) || /service\s+firebase\.storage/.test(f.content))) {
+            candidate("android-firebase-missing-local-rules", anchorFile, "Storage service use detected but no local storage.rules was found", undefined, "medium", "missing");
+        }
+    }
+    void anyRulesResolved;
+    // --- collection / auto-init metadata -----------------------------------------
+    for (const manifest of discovery.manifestFiles) {
+        for (const meta of collectManifestCollectionMetadata(manifest)) {
+            candidate("android-firebase-google-configuration-evidence", manifest, `${meta.name} manifest metadata is ${meta.state} (${meta.rawValue})`, meta.rawValue, "low", meta.state === "dynamic" ? "unresolved" : "not-applicable", meta.line);
+        }
+    }
+    for (const source of discovery.sourceFiles) {
+        for (const setter of collectCollectionSetterEvidence(source)) {
+            candidate("android-firebase-google-configuration-evidence", source, `${setter.service} collection setter called with state=${setter.state}`, undefined, "low", setter.state === "dynamic" ? "unresolved" : "not-applicable", setter.line);
+        }
+    }
+    // --- analytics event parameter review ------------------------------------------
+    for (const source of discovery.sourceFiles) {
+        for (const event of collectAnalyticsEventEvidence(source)) {
+            if (event.sensitiveParameterKey === undefined)
+                continue;
+            if (event.isDirectLiteralValue) {
+                findings.push(makeAndroidFinding({
+                    ruleId: "android-firebase-google-configuration-evidence",
+                    title: "Direct sensitive value sent as a Firebase Analytics event parameter",
+                    severity: "major",
+                    confidence: "high",
+                    description: "A directly visible sensitive parameter key/value was passed to a Firebase Analytics logEvent() Bundle in the same method. Static source evidence only; does not prove the event was uploaded.",
+                    manifestPath: source.relativePath,
+                    identity: `analytics-event:${event.line}`,
+                    location: { line: event.line },
+                    evidenceDetails: [`key=${event.sensitiveParameterKey}`],
+                    recommendation: "Do not send credentials or highly sensitive personal data as analytics event parameters.",
+                }));
+            }
+            else {
+                candidate("android-firebase-google-configuration-evidence", source, `Sensitive-looking analytics event parameter key "${event.sensitiveParameterKey}" with a dynamic value`, event.sensitiveParameterValueExpression, "medium", "unresolved", event.line);
+            }
+        }
+    }
+    return { candidates, findings };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/checkResult.js

@@ -0,0 +1,77 @@
+import { sortCandidateEvidence } from "../ordering.js";
+import { analyzeFirebaseGoogleServices } from "./analyzeFirebaseGoogleServices.js";
+import { discoverFirebaseArtifacts } from "./discoverFirebaseArtifacts.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — standalone Android Firebase/Google services check result.
+// Follows the exact Batch 4/5 standalone pattern: not called from
+// validateAndroidTarget / any active orchestration, not rendered in reports,
+// no CLI effect. Batch 8 integrates.
+// ---------------------------------------------------------------------------
+export const ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID = "android-firebase-google-services-audit";
+export function auditAndroidFirebaseGoogleServices(targetRoot, detection) {
+    if (detection.projectKind === "non-android") {
+        return {
+            id: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+            category: "android-firebase-google-services",
+            title: "Android Firebase/Google services audit",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Re-run against an Android Gradle project, or verify project detection.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+    const modulePaths = detection.modules.map((m) => m.path);
+    const discovery = discoverFirebaseArtifacts(targetRoot, modulePaths);
+    const { candidates, findings } = analyzeFirebaseGoogleServices(targetRoot, modulePaths);
+    const sortedFindings = [...new Map(findings.map((f) => [f.id, f])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    const candidateEvidence = sortCandidateEvidence([...new Map(candidates.map((c) => [c.id, c])).values()]);
+    const hasReportableFinding = sortedFindings.some((f) => f.severity !== "informational");
+    const sourcePaths = [
+        ...discovery.googleServicesFiles,
+        ...discovery.firebaseJsonFiles,
+        ...discovery.firebaseRcFiles,
+        ...discovery.databaseRulesJsonFiles,
+        ...discovery.rulesFiles,
+        ...discovery.gradleFiles,
+        ...discovery.sourceFiles,
+        ...discovery.manifestFiles,
+    ].map((f) => f.relativePath);
+    return {
+        id: ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID,
+        category: "android-firebase-google-services",
+        title: "Android Firebase/Google services audit",
+        status: hasReportableFinding ? "failed" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [
+            `${discovery.googleServicesFiles.length} google-services.json, ${discovery.firebaseJsonFiles.length} firebase.json, ${discovery.databaseRulesJsonFiles.length + discovery.rulesFiles.length} rules file(s) found`,
+        ],
+        findings: sortedFindings,
+        warnings: [
+            ...discovery.skipped.map((s) => `${s.relativePath}: skipped (${s.reason}${s.detail ? `: ${s.detail}` : ""})`),
+            "Static analysis only: local configuration/rules files are not proof of the deployed Firebase project configuration; no remote Firebase or Google service was contacted.",
+        ],
+        errors: [],
+        sourcePaths,
+        confidence: discovery.skipped.length > 0 ? "medium" : "high",
+        environmentRequirements: [],
+        candidateEvidence,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/collectFirebaseServiceEvidence.js

@@ -0,0 +1,193 @@
+import { executableMask, lineForOffset, methodScopes, scopeAt } from "../sensitiveData/localSourceContext.js";
+import { splitTopLevelArguments } from "../sensitiveData/splitArguments.js";
+import { classifyDirectExpression } from "../sensitiveData/classifyDirectExpression.js";
+import { classifySensitiveIdentifier } from "../sensitiveData/classifySensitiveIdentifier.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded Firebase/Google service-use, collection-metadata,
+// and analytics-event evidence collection. Purely lexical: Gradle files are
+// never evaluated, no dependency graph is resolved, and no Bundle/object
+// contents are inferred beyond direct same-method arguments.
+// ---------------------------------------------------------------------------
+const GRADLE_PLUGIN = /\bid\s*\(?["']([\w.-]*google-services|com\.google\.firebase\.crashlytics)["']\)?/g;
+const GRADLE_DEPENDENCY = /["'](?:com\.google\.firebase:)?(firebase-(?:database|firestore|storage|auth|analytics|crashlytics|messaging|perf))[:"']/g;
+// Gradle dependency/plugin coordinates are always string literals, unlike
+// Java/Kotlin executable calls — masking string *contents* (executableMask)
+// would blank out exactly the text this scanner needs to match. Only
+// comments are masked here; string literals are left intact.
+const COMMENT_ONLY = /\/\/[^\n]*|\/\*[\s\S]*?\*\//g;
+function maskCommentsOnly(source) {
+    return source.replace(COMMENT_ONLY, (match) => match.replace(/[^\n]/g, " "));
+}
+const SERVICE_BY_ARTIFACT = {
+    "firebase-database": "database",
+    "firebase-firestore": "firestore",
+    "firebase-storage": "storage",
+    "firebase-auth": "auth",
+    "firebase-analytics": "analytics",
+    "firebase-crashlytics": "crashlytics",
+    "firebase-messaging": "messaging",
+    "firebase-perf": "performance",
+};
+const SOURCE_USAGE = [
+    [/\bFirebaseDatabase\b/, "database"],
+    [/\bFirebaseFirestore\b/, "firestore"],
+    [/\bFirebaseStorage\b/, "storage"],
+    [/\bFirebaseAuth\b/, "auth"],
+    [/\bFirebaseAnalytics\b/, "analytics"],
+    [/\bFirebaseCrashlytics\b/, "crashlytics"],
+    [/\bFirebaseMessaging(?:Service)?\b/, "messaging"],
+    [/\bFirebasePerformance\b/, "performance"],
+];
+export function collectGradleServiceEvidence(file) {
+    const evidence = [];
+    const mask = maskCommentsOnly(file.content);
+    for (const match of mask.matchAll(GRADLE_PLUGIN)) {
+        const offset = match.index ?? 0;
+        evidence.push({
+            service: match[1].includes("crashlytics") ? "crashlytics" : "database",
+            source: "gradle-plugin",
+            detail: match[1],
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    for (const match of mask.matchAll(GRADLE_DEPENDENCY)) {
+        const offset = match.index ?? 0;
+        const service = SERVICE_BY_ARTIFACT[match[1]];
+        if (!service)
+            continue;
+        evidence.push({
+            service,
+            source: "gradle-dependency",
+            detail: match[1],
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}
+export function collectSourceServiceEvidence(file) {
+    const evidence = [];
+    const mask = executableMask(file.content);
+    for (const [pattern, service] of SOURCE_USAGE) {
+        const re = new RegExp(pattern.source, "g");
+        for (const match of mask.matchAll(re)) {
+            const offset = match.index ?? 0;
+            evidence.push({
+                service,
+                source: /^import\b/.test(mask.slice(Math.max(0, offset - 8), offset)) ? "source-import" : "source-usage",
+                detail: match[0],
+                relativePath: file.relativePath,
+                modulePath: file.modulePath,
+                line: lineForOffset(file.content, offset),
+            });
+        }
+    }
+    return evidence;
+}
+const COLLECTION_SETTER = /\b(setAnalyticsCollectionEnabled|setCrashlyticsCollectionEnabled|setAutoInitEnabled)\s*\(([^;\n]*?)\)/gd;
+function realGroup(content, match, group) {
+    const span = match.indices?.[group];
+    return span ? content.slice(span[0], span[1]) : match[group];
+}
+const SETTER_SERVICE = {
+    setAnalyticsCollectionEnabled: "analytics",
+    setCrashlyticsCollectionEnabled: "crashlytics",
+    setAutoInitEnabled: "messaging",
+};
+function stateOf(argument) {
+    if (argument === undefined)
+        return "dynamic";
+    const classification = classifyDirectExpression(argument);
+    if (classification.kind === "boolean-literal")
+        return argument.trim() === "true" ? "true" : "false";
+    return "dynamic";
+}
+export function collectCollectionSetterEvidence(file) {
+    const mask = executableMask(file.content);
+    const evidence = [];
+    for (const match of mask.matchAll(COLLECTION_SETTER)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(file.content, match, 2) ?? "");
+        evidence.push({
+            service: SETTER_SERVICE[match[1]],
+            state: stateOf(args[0]),
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}
+const META_DATA_TAG = /<meta-data\b[^>]*\/?>(?:\s*<\/meta-data>)?/g;
+const NAME_ATTR = /android:name\s*=\s*"([^"]*)"/;
+const VALUE_ATTR = /android:value\s*=\s*"([^"]*)"/;
+const COLLECTION_META_NAMES = new Set([
+    "firebase_analytics_collection_enabled",
+    "firebase_crashlytics_collection_enabled",
+    "firebase_messaging_auto_init_enabled",
+    "firebase_performance_collection_enabled",
+]);
+export function collectManifestCollectionMetadata(file) {
+    const evidence = [];
+    for (const match of file.content.matchAll(META_DATA_TAG)) {
+        const tag = match[0];
+        const name = NAME_ATTR.exec(tag)?.[1];
+        if (!name || !COLLECTION_META_NAMES.has(name))
+            continue;
+        const rawValue = VALUE_ATTR.exec(tag)?.[1];
+        const state = rawValue === "true" ? "true" : rawValue === "false" ? "false" : "dynamic";
+        evidence.push({
+            name,
+            rawValue: rawValue ?? "(missing)",
+            state,
+            relativePath: file.relativePath,
+            line: lineForOffset(file.content, match.index ?? 0),
+        });
+    }
+    return evidence;
+}
+const LOG_EVENT_CALL = /\b(?:FirebaseAnalytics|analytics)\.getInstance\([^)]*\)\.logEvent\s*\(([^;\n]*?)\)|\blogEvent\s*\(([^;\n]*?)\)/gd;
+const BUNDLE_PUT = /([A-Za-z_][\w.]*)\.(putString|putLong|putDouble|putBoolean)\s*\(([^;\n]*?)\)/gd;
+export function collectAnalyticsEventEvidence(file) {
+    const mask = executableMask(file.content);
+    const scopes = methodScopes(mask);
+    const evidence = [];
+    const bundlePuts = [];
+    for (const match of mask.matchAll(BUNDLE_PUT)) {
+        const offset = match.index ?? 0;
+        const args = splitTopLevelArguments(realGroup(file.content, match, 3) ?? "");
+        bundlePuts.push({ key: args[0], value: args[1], offset, scopeId: scopeAt(scopes, offset)?.id });
+    }
+    for (const match of mask.matchAll(LOG_EVENT_CALL)) {
+        const offset = match.index ?? 0;
+        const rawArgs = realGroup(file.content, match, 1) ?? realGroup(file.content, match, 2) ?? "";
+        const args = splitTopLevelArguments(rawArgs);
+        const scopeId = scopeAt(scopes, offset)?.id;
+        let sensitiveKey;
+        let sensitiveValue;
+        let isDirectLiteral = false;
+        for (const put of bundlePuts.filter((p) => p.scopeId === scopeId)) {
+            const literal = put.key !== undefined && classifyDirectExpression(put.key).kind === "string-literal" ? classifyDirectExpression(put.key).literalValue : undefined;
+            const classification = literal !== undefined ? classifySensitiveIdentifier(literal) : undefined;
+            if (classification) {
+                sensitiveKey = put.key;
+                sensitiveValue = put.value;
+                isDirectLiteral = put.value !== undefined && classifyDirectExpression(put.value).kind === "string-literal";
+                break;
+            }
+        }
+        evidence.push({
+            eventNameExpression: args[0],
+            sensitiveParameterKey: sensitiveKey,
+            sensitiveParameterValueExpression: sensitiveValue,
+            isDirectLiteralValue: isDirectLiteral,
+            relativePath: file.relativePath,
+            modulePath: file.modulePath,
+            line: lineForOffset(file.content, offset),
+        });
+    }
+    return evidence;
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/discoverFirebaseArtifacts.js

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import { collectFilesForGlobs } from "../../../../core/fileGlobs.js";
+import { discoverSecretSourceFiles, MAX_SECRET_SCAN_FILE_BYTES } from "../secretCandidates/discoverSecretSourceFiles.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded, target-contained discovery of Firebase/Google
+// configuration and rules artifacts.
+//
+// google-services.json and firebase.json are already covered by Batch 4's
+// discoverSecretSourceFiles (its glob list includes **/*.json), so those are
+// reused directly rather than re-discovered. .firebaserc and *.rules files
+// are not covered by that glob list (dotfiles and a non-listed extension),
+// so a small supplemental scan reuses collectFilesForGlobs (the same
+// target-containment primitive discoverSecretSourceFiles itself wraps)
+// rather than introducing a second traversal engine.
+// ---------------------------------------------------------------------------
+const NUL_CHAR = String.fromCharCode(0);
+function readSupplemental(targetRoot, globs, knownModulePaths) {
+    const files = [];
+    const skipped = [];
+    const matches = [];
+    const seen = new Set();
+    for (const glob of globs) {
+        let globMatches;
+        try {
+            globMatches = collectFilesForGlobs(targetRoot, [glob]);
+        }
+        catch {
+            continue;
+        }
+        for (const match of globMatches) {
+            if (seen.has(match.relativePath))
+                continue;
+            seen.add(match.relativePath);
+            matches.push(match);
+        }
+    }
+    for (const match of matches) {
+        const relativePath = match.relativePath.replace(/\\/g, "/");
+        if (relativePath.includes("node_modules/") || relativePath.includes(".gradle/") || relativePath.includes("build/"))
+            continue;
+        let stat;
+        try {
+            stat = fs.statSync(match.absolutePath);
+        }
+        catch (error) {
+            skipped.push({ relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > MAX_SECRET_SCAN_FILE_BYTES) {
+            skipped.push({ relativePath, reason: "oversized", detail: `${stat.size} bytes exceeds ${MAX_SECRET_SCAN_FILE_BYTES}` });
+            continue;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(match.absolutePath, "utf8");
+        }
+        catch (error) {
+            skipped.push({ relativePath, reason: "unreadable", detail: error instanceof Error ? error.message : undefined });
+            continue;
+        }
+        if (content.indexOf(NUL_CHAR) !== -1) {
+            skipped.push({ relativePath, reason: "binary-like" });
+            continue;
+        }
+        const modulePath = knownModulePaths.find((m) => relativePath.startsWith(`${m}/`));
+        files.push({ relativePath, absolutePath: match.absolutePath, modulePath, content });
+    }
+    return { files, skipped };
+}
+export function discoverFirebaseArtifacts(targetRoot, knownModulePaths = []) {
+    const { files, skipped } = discoverSecretSourceFiles(targetRoot, knownModulePaths);
+    const googleServicesFiles = [];
+    const firebaseJsonFiles = [];
+    const databaseRulesJsonFiles = [];
+    const gradleFiles = [];
+    const sourceFiles = [];
+    const manifestFiles = [];
+    const foundRelativePaths = new Set();
+    for (const file of files) {
+        const lower = file.relativePath.toLowerCase();
+        foundRelativePaths.add(file.relativePath);
+        if (lower.endsWith("google-services.json"))
+            googleServicesFiles.push(file);
+        else if (lower.endsWith("/firebase.json") || lower === "firebase.json")
+            firebaseJsonFiles.push(file);
+        else if (lower.endsWith("database.rules.json"))
+            databaseRulesJsonFiles.push(file);
+        else if (/\.(gradle|gradle\.kts)$/.test(lower))
+            gradleFiles.push(file);
+        else if (/\.(java|kt)$/.test(lower))
+            sourceFiles.push(file);
+        else if (lower.endsWith("androidmanifest.xml"))
+            manifestFiles.push(file);
+    }
+    // Root-level filenames (e.g. a repo-root database.rules.json) are not
+    // matched by "**/*.json"-style globs, which require at least one path
+    // separator (the same limitation Batch 4's discovery module documents) —
+    // explicit root-level literals fill that gap for Firebase's well-known
+    // conventional filenames, deduplicated against what discoverSecretSourceFiles
+    // already found.
+    const rc = readSupplemental(targetRoot, ["**/.firebaserc", ".firebaserc"], knownModulePaths);
+    const rules = readSupplemental(targetRoot, ["**/*.rules", "firestore.rules", "storage.rules", "database.rules"], knownModulePaths);
+    const rootJson = readSupplemental(targetRoot, ["google-services.json", "firebase.json", "database.rules.json"], knownModulePaths);
+    for (const file of rootJson.files) {
+        if (foundRelativePaths.has(file.relativePath))
+            continue;
+        const lower = file.relativePath.toLowerCase();
+        if (lower.endsWith("google-services.json"))
+            googleServicesFiles.push(file);
+        else if (lower.endsWith("firebase.json"))
+            firebaseJsonFiles.push(file);
+        else if (lower.endsWith("database.rules.json"))
+            databaseRulesJsonFiles.push(file);
+    }
+    return {
+        googleServicesFiles,
+        firebaseJsonFiles,
+        firebaseRcFiles: rc.files,
+        databaseRulesJsonFiles,
+        rulesFiles: rules.files,
+        gradleFiles,
+        sourceFiles,
+        manifestFiles,
+        skipped: [...skipped, ...rc.skipped, ...rules.skipped, ...rootJson.skipped],
+    };
+}

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/index.js

@@ -0,0 +1 @@
+export { auditAndroidFirebaseGoogleServices, ANDROID_FIREBASE_GOOGLE_SERVICES_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/firebaseGoogle/parseDatabaseRules.js

@@ -0,0 +1,55 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 6 — bounded local Realtime Database rules parser.
+//
+// Recursively walks the parsed JSON tree collecting .read/.write/.validate/
+// .indexOn entries with their JSON path. This is not the Firebase rules
+// evaluator: no runtime auth is evaluated, and a local rules file is never
+// treated as proof of the deployed configuration.
+// ---------------------------------------------------------------------------
+const MAX_DEPTH = 40;
+const MAX_NODES = 20_000;
+const MAX_CONDITION_LENGTH = 200;
+const RULE_KEYS = new Set([".read", ".write", ".validate", ".indexOn"]);
+function summarize(value) {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    return text.length > MAX_CONDITION_LENGTH ? `${text.slice(0, MAX_CONDITION_LENGTH)}...` : text;
+}
+export function parseDatabaseRules(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(file.content);
+    }
+    catch {
+        return { file, malformed: true, entries: [], boundsExceeded: false };
+    }
+    const root = parsed && typeof parsed === "object" ? parsed.rules ?? parsed : parsed;
+    const entries = [];
+    let nodeCount = 0;
+    let boundsExceeded = false;
+    function walk(node, jsonPath, depth) {
+        if (boundsExceeded)
+            return;
+        nodeCount += 1;
+        if (nodeCount > MAX_NODES || depth > MAX_DEPTH) {
+            boundsExceeded = true;
+            return;
+        }
+        if (node === null || typeof node !== "object" || Array.isArray(node))
+            return;
+        for (const [key, value] of Object.entries(node)) {
+            if (RULE_KEYS.has(key)) {
+                entries.push({
+                    jsonPath,
+                    operation: key,
+                    literalBoolean: typeof value === "boolean" ? value : undefined,
+                    conditionSummary: summarize(value),
+                    depth,
+                });
+                continue;
+            }
+            walk(value, jsonPath === "/" ? `/${key}` : `${jsonPath}/${key}`, depth + 1);
+        }
+    }
+    walk(root, "/", 0);
+    return { file, malformed: false, entries, boundsExceeded };
+}