@empline/preflight 1.0.20

package/dist/checks/security/sql-injection-prevention.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * SQL Injection Prevention Preflight (BLOCKING)
+ *
+ * Detects patterns that could lead to SQL injection vulnerabilities:
+ * - Raw SQL queries with string concatenation
+ * - Template literals in $queryRaw/$executeRaw without proper escaping
+ * - User input directly in SQL strings
+ *
+ * Safe patterns (allowed):
+ * - Prisma's parameterized queries ($queryRaw with Prisma.sql tagged template)
+ * - Prisma's standard query methods (findMany, create, etc.)
+ * - TypedSQL files (.sql in prisma/sql/)
+ *
+ * Usage:
+ *   pnpm preflight:sql-injection
+ *   pnpm preflight:sql-injection:verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/sql-injection-prevention";
+exports.name = "Sql Injection Prevention";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "SQL Injection Prevention Preflight (BLOCKING)";
+exports.tags = ["security"];
+const issues = [];
+// Patterns that indicate potential SQL injection
+// NOTE: Prisma's $queryRaw`...${var}...` and $executeRaw`...${var}...` are SAFE
+// because Prisma automatically parameterizes tagged template literals.
+// We only flag string concatenation patterns, not tagged templates.
+const DANGEROUS_PATTERNS = [
+    {
+        // String concatenation building SQL (NOT tagged templates)
+        regex: /['"`]\s*SELECT\s+.*\s*['"`]\s*\+\s*\w+/gi,
+        message: "SQL string concatenation detected - use parameterized queries",
+        severity: "error",
+    },
+    {
+        // WHERE clause with string concat
+        regex: /WHERE\s+\w+\s*=\s*['"`]\s*\+\s*\w+/gi,
+        message: "WHERE clause with string concatenation - SQL injection risk",
+        severity: "error",
+    },
+    {
+        // ORDER BY with dynamic input (common injection vector)
+        regex: /ORDER\s+BY\s*['"`]\s*\+\s*\w+/gi,
+        message: "Dynamic ORDER BY - validate against allowlist",
+        severity: "warning",
+    },
+    {
+        // LIKE with unescaped input
+        regex: /LIKE\s*['"`]%?\s*\$\{[^}]+\}\s*%?['"`]/g,
+        message: "LIKE clause with template literal - escape special characters (%, _)",
+        severity: "warning",
+    },
+    {
+        // Raw query without Prisma.sql tag
+        regex: /prisma\.\$queryRawUnsafe\s*\(/g,
+        message: "$queryRawUnsafe is dangerous - use $queryRaw with Prisma.sql instead",
+        severity: "error",
+    },
+    {
+        // executeRawUnsafe
+        regex: /prisma\.\$executeRawUnsafe\s*\(/g,
+        message: "$executeRawUnsafe is dangerous - use $executeRaw with Prisma.sql instead",
+        severity: "error",
+    },
+];
+// Files/directories to skip
+const SKIP_PATTERNS = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES, [
+    "node_modules",
+    ".next",
+    "dist",
+    ".git",
+    "*.test.ts",
+    "*.spec.ts",
+    "__mocks__",
+    "tests/",
+    "scripts/",
+    "prisma/sql/",
+    "lib/database/optimization-manager.ts",
+    "lib/search/full-text-search.ts",
+    "lib/validation/anti-workaround.ts",
+]);
+function shouldSkip(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    return SKIP_PATTERNS.some((pattern) => {
+        if (pattern.startsWith("*")) {
+            return normalized.endsWith(pattern.slice(1));
+        }
+        return normalized.includes(pattern);
+    });
+}
+// CACHED FILE LISTS - Scan once, use everywhere
+let _cachedAllCodeFiles = null;
+async function getAllCodeFiles() {
+    if (!_cachedAllCodeFiles) {
+        _cachedAllCodeFiles = await file_cache_1.fileCache.getAllCodeFiles();
+    }
+    return _cachedAllCodeFiles;
+}
+async function scanFile(filePath) {
+    if (shouldSkip(filePath))
+        return;
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    for (const pattern of DANGEROUS_PATTERNS) {
+        let match;
+        const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
+        while ((match = regex.exec(content)) !== null) {
+            // Find line number
+            const beforeMatch = content.slice(0, match.index);
+            const lineNumber = beforeMatch.split("\n").length;
+            // Skip if in a comment
+            const line = lines[lineNumber - 1] || "";
+            if (line.trim().startsWith("//") || line.trim().startsWith("*")) {
+                continue;
+            }
+            issues.push({
+                file: filePath,
+                line: lineNumber,
+                pattern: match[0].slice(0, 60) + (match[0].length > 60 ? "..." : ""),
+                severity: pattern.severity,
+                message: pattern.message,
+            });
+        }
+    }
+}
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    const verbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+    console.log(`${console_chars_1.emoji.lock} SQL Injection Prevention Preflight`);
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    // Scan TypeScript/JavaScript files
+    const files = await getAllCodeFiles();
+    for (const file of files) {
+        await scanFile(file);
+    }
+    const errors = issues.filter((i) => i.severity === "error");
+    const warnings = issues.filter((i) => i.severity === "warning");
+    if (verbose || issues.length > 0) {
+        if (errors.length > 0) {
+            console.log(`\n${console_chars_1.emoji.error} ERRORS (blocking):`);
+            errors.forEach((issue) => {
+                console.log(`   ${issue.file}:${issue.line}`);
+                console.log(`      Pattern: ${issue.pattern}`);
+                console.log(`      ${issue.message}`);
+            });
+        }
+        if (warnings.length > 0) {
+            console.log(`\n${console_chars_1.emoji.warning}  WARNINGS:`);
+            warnings.forEach((issue) => {
+                console.log(`   ${issue.file}:${issue.line}`);
+                console.log(`      Pattern: ${issue.pattern}`);
+                console.log(`      ${issue.message}`);
+            });
+        }
+    }
+    console.log("\n" + (0, console_chars_1.createDivider)(60, "heavy"));
+    console.log(`Files scanned: ${files.length}`);
+    console.log(`Errors: ${errors.length}`);
+    console.log(`Warnings: ${warnings.length}`);
+    if (errors.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} SQL Injection Prevention FAILED`);
+        console.log("\nFix patterns:");
+        console.log(`  ${console_chars_1.emoji.error} prisma.$queryRaw\`SELECT * FROM users WHERE id = \${userId}\``);
+        console.log(`  ${console_chars_1.emoji.success} prisma.$queryRaw(Prisma.sql\`SELECT * FROM users WHERE id = \${userId}\`)`);
+        console.log(`  ${console_chars_1.emoji.success} prisma.user.findUnique({ where: { id: userId } })`);
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.success} SQL Injection Prevention PASSED`);
+}
+main().catch(console.error);
+//# sourceMappingURL=sql-injection-prevention.js.map

package/dist/checks/security/sql-injection-prevention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection-prevention.js","sourceRoot":"","sources":["../../../src/checks/security/sql-injection-prevention.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAiE;AACjE,wDAAoD;AACpD,8DAA+E;AAC/E,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,mCAAmC,CAAC;AACzC,QAAA,IAAI,GAAG,0BAA0B,CAAC;AAClC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,+CAA+C,CAAC;AAC9D,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAUjC,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,iDAAiD;AACjD,gFAAgF;AAChF,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,kBAAkB,GAAG;IACzB;QACE,2DAA2D;QAC3D,KAAK,EAAE,0CAA0C;QACjD,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,OAAgB;KAC3B;IACD;QACE,kCAAkC;QAClC,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EAAE,6DAA6D;QACtE,QAAQ,EAAE,OAAgB;KAC3B;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,iCAAiC;QACxC,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,SAAkB;KAC7B;IACD;QACE,4BAA4B;QAC5B,KAAK,EAAE,yCAAyC;QAChD,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,SAAkB;KAC7B;IACD;QACE,mCAAmC;QACnC,KAAK,EAAE,gCAAgC;QACvC,OAAO,EAAE,sEAAsE;QAC/E,QAAQ,EAAE,OAAgB;KAC3B;IACD;QACE,mBAAmB;QACnB,KAAK,EAAE,kCAAkC;QACzC,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,OAAgB;KAC3B;CACF,CAAC;AAEF,4BAA4B;AAC5B,MAAM,aAAa,GAAG,IAAA,8BAAc,EAAC,iCAAiB,EAAE;IACtD,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,WAAW;IACX,WAAW;IACX,WAAW;IACX,QAAQ;IACR,UAAU;IACV,aAAa;IACb,sCAAsC;IACtC,gCAAgC;IAChC,mCAAmC;CACpC,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gDAAgD;AAEhD,IAAI,mBAAmB,GAAoB,IAAI,CAAC;AAChD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,sBAAS,CAAC,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEjC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,mBAAmB;YACnB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAElD,uBAAuB;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,qCAAqC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,mCAAmC;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEhE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,qBAAqB,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,aAAa,CAAC,CAAC;YAC7C,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,kCAAkC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,gEAAgE,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CACT,KAAK,qBAAK,CAAC,OAAO,4EAA4E,CAC/F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AACpE,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/security/turnstile-scope-validation.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env tsx
+/**
+ * Turnstile Scope Validation Preflight
+ *
+ * Ensures Turnstile (Cloudflare CAPTCHA) is only used where appropriate:
+ * - ✅ REQUIRED: Public forms (contact, login, signup, password reset)
+ * - ❌ FORBIDDEN: Authenticated seller actions (listing creation, bulk upload)
+ *
+ * Rationale: Authenticated users have already passed verification at login.
+ * For seller actions, rate limiting + DRAFT status + admin approval provides
+ * sufficient protection without adding UX friction.
+ *
+ * BLOCKING: Turnstile on authenticated seller routes adds unnecessary friction
+ */
+export declare const id = "security/turnstile-scope-validation";
+export declare const name = "Turnstile Scope Validation";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Turnstile Scope Validation Preflight";
+export declare const tags: string[];
+//# sourceMappingURL=turnstile-scope-validation.d.ts.map

package/dist/checks/security/turnstile-scope-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile-scope-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/security/turnstile-scope-validation.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAQH,eAAO,MAAM,EAAE,wCAAwC,CAAC;AACxD,eAAO,MAAM,IAAI,+BAA+B,CAAC;AACjD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,yCAAyC,CAAC;AAClE,eAAO,MAAM,IAAI,UAA4B,CAAC"}

package/dist/checks/security/turnstile-scope-validation.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Turnstile Scope Validation Preflight
+ *
+ * Ensures Turnstile (Cloudflare CAPTCHA) is only used where appropriate:
+ * - ✅ REQUIRED: Public forms (contact, login, signup, password reset)
+ * - ❌ FORBIDDEN: Authenticated seller actions (listing creation, bulk upload)
+ *
+ * Rationale: Authenticated users have already passed verification at login.
+ * For seller actions, rate limiting + DRAFT status + admin approval provides
+ * sufficient protection without adding UX friction.
+ *
+ * BLOCKING: Turnstile on authenticated seller routes adds unnecessary friction
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const glob_1 = require("glob");
+const console_chars_1 = require("../../utils/console-chars");
+// Check metadata
+exports.id = "security/turnstile-scope-validation";
+exports.name = "Turnstile Scope Validation";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Turnstile Scope Validation Preflight";
+exports.tags = ["security", "validation"];
+const issues = [];
+// Routes where Turnstile SHOULD be used (public/unauthenticated)
+const TURNSTILE_REQUIRED_PATTERNS = [
+    { pattern: /auth.*signin|auth.*login/i, name: "Login" },
+    { pattern: /auth.*signup|auth.*register/i, name: "Registration" },
+    { pattern: /auth.*password|auth.*reset/i, name: "Password reset" },
+    { pattern: /contact/i, name: "Contact form" },
+];
+// Routes where Turnstile should NOT be used (authenticated seller actions)
+const TURNSTILE_FORBIDDEN_PATTERNS = [
+    { pattern: /listings\/bulk-create/i, name: "Bulk listing creation" },
+    { pattern: /listings\/submit-single/i, name: "Single listing submission" },
+    { pattern: /listings\/save-drafts/i, name: "Save drafts" },
+    { pattern: /store\/listings\/new/i, name: "New listing page" },
+    { pattern: /cards\/identify/i, name: "Card identification" },
+    { pattern: /upload\/r2/i, name: "Image upload (authenticated)" },
+    { pattern: /upload\/batch/i, name: "Batch upload" },
+];
+// Patterns that indicate actual Turnstile verification (not just utility imports)
+const TURNSTILE_VERIFICATION_PATTERNS = [
+    /verifyTurnstileToken\s*\(/,
+    /TurnstileCard/,
+    /TurnstileWidget/,
+    /<Turnstile\s/,
+];
+// Patterns that are just utility imports (not actual verification)
+const TURNSTILE_UTILITY_PATTERNS = [/import.*getClientIp.*from.*turnstile/];
+// Files to scan
+const SCAN_PATTERNS = [
+    "app/api/**/route.ts",
+    "app/store/**/page.tsx",
+    "app/store/**/*Client.tsx",
+    "components/**/*Turnstile*.tsx",
+];
+const EXCLUDE_PATTERNS = ["**/node_modules/**", "**/*.test.ts", "**/*.spec.ts"];
+function hasTurnstileUsage(content) {
+    const lines = content.split("\n");
+    // First check if this is just a utility import (getClientIp only)
+    let hasOnlyUtilityImport = false;
+    for (const line of lines) {
+        for (const pattern of TURNSTILE_UTILITY_PATTERNS) {
+            if (pattern.test(line) && !line.includes("verifyTurnstileToken")) {
+                hasOnlyUtilityImport = true;
+            }
+        }
+    }
+    // Check for actual verification patterns
+    for (let i = 0; i < lines.length; i++) {
+        for (const pattern of TURNSTILE_VERIFICATION_PATTERNS) {
+            if (pattern.test(lines[i])) {
+                return { found: true, line: i + 1 };
+            }
+        }
+    }
+    // If only utility import, not actual verification
+    return { found: false, line: 0 };
+}
+function isAuthenticatedRoute(content) {
+    // Check for auth() call or session check
+    return (content.includes("await auth()") ||
+        content.includes("const session = await auth") ||
+        content.includes("session?.user") ||
+        content.includes("if (!session)"));
+}
+async function scanFile(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const turnstileUsage = hasTurnstileUsage(content);
+    // Check if this is a forbidden route with Turnstile
+    for (const { pattern, name } of TURNSTILE_FORBIDDEN_PATTERNS) {
+        if (pattern.test(filePath)) {
+            if (turnstileUsage.found) {
+                issues.push({
+                    file: filePath,
+                    line: turnstileUsage.line,
+                    type: "error",
+                    message: `${name} should NOT use Turnstile - user is already authenticated`,
+                    suggestion: "Remove Turnstile. Use rate limiting + DRAFT status + admin approval instead.",
+                });
+            }
+            return;
+        }
+    }
+    // Check if this is a required route missing Turnstile
+    for (const { pattern, name } of TURNSTILE_REQUIRED_PATTERNS) {
+        if (pattern.test(filePath)) {
+            if (!turnstileUsage.found) {
+                issues.push({
+                    file: filePath,
+                    line: 1,
+                    type: "warning",
+                    message: `${name} should have Turnstile protection`,
+                    suggestion: "Add Turnstile verification to prevent bot abuse on public forms.",
+                });
+            }
+            return;
+        }
+    }
+    // For other authenticated routes, warn if Turnstile is used
+    if (isAuthenticatedRoute(content) && turnstileUsage.found) {
+        // Check if it's a high-risk action that might warrant Turnstile
+        const isHighRisk = content.includes("payment") ||
+            content.includes("payout") ||
+            content.includes("password") ||
+            content.includes("delete") ||
+            content.includes("admin");
+        if (!isHighRisk) {
+            issues.push({
+                file: filePath,
+                line: turnstileUsage.line,
+                type: "warning",
+                message: "Authenticated route uses Turnstile - consider if this is necessary",
+                suggestion: "Turnstile adds UX friction. For authenticated users, rate limiting is usually sufficient.",
+            });
+        }
+    }
+}
+async function main() {
+    console.log(`${console_chars_1.emoji.shield} Turnstile Scope Validation Preflight`);
+    console.log((0, console_chars_1.createDivider)(70, "heavy"));
+    console.log("Policy: Turnstile for public forms, NOT for authenticated seller actions\n");
+    // Get all files to scan
+    const allFiles = [];
+    for (const pattern of SCAN_PATTERNS) {
+        const files = await (0, glob_1.glob)(pattern, {
+            ignore: EXCLUDE_PATTERNS,
+            nodir: true,
+        });
+        allFiles.push(...files);
+    }
+    // Deduplicate
+    const uniqueFiles = [...new Set(allFiles)];
+    console.log(`Scanning ${uniqueFiles.length} files for Turnstile usage...\n`);
+    // Scan each file
+    for (const file of uniqueFiles) {
+        await scanFile(file);
+    }
+    // Report results
+    const errors = issues.filter((i) => i.type === "error");
+    const warnings = issues.filter((i) => i.type === "warning");
+    if (issues.length === 0) {
+        console.log(`${console_chars_1.emoji.success} Turnstile usage is correctly scoped`);
+        console.log("   - Public forms: Protected");
+        console.log("   - Authenticated seller actions: No unnecessary friction");
+        process.exit(0);
+    }
+    console.log(`Found ${errors.length} errors, ${warnings.length} warnings\n`);
+    if (errors.length > 0) {
+        console.log(`${console_chars_1.emoji.error} ERRORS - Turnstile in wrong places:`);
+        for (const issue of errors) {
+            console.log(`   ${issue.file}:${issue.line}`);
+            console.log(`      ${issue.message}`);
+            console.log(`      ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+        }
+    }
+    if (warnings.length > 0) {
+        console.log(`\n${console_chars_1.emoji.warning} WARNINGS - Review Turnstile usage:`);
+        for (const issue of warnings) {
+            console.log(`   ${issue.file}:${issue.line}`);
+            console.log(`      ${issue.message}`);
+            console.log(`      ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+        }
+    }
+    console.log("\n" + (0, console_chars_1.createDivider)(70, "heavy"));
+    console.log(`${console_chars_1.emoji.hint} Turnstile Policy:`);
+    console.log("   ✅ USE on: Login, Signup, Password Reset, Contact forms");
+    console.log("   ❌ SKIP on: Listing creation, uploads, authenticated actions");
+    console.log("   📋 Alternative: Rate limiting + DRAFT status + admin approval");
+    console.log((0, console_chars_1.createDivider)(70, "heavy"));
+    if (errors.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} BLOCKING: Remove Turnstile from authenticated seller routes`);
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.warning} Warnings found - review Turnstile placement`);
+    process.exit(0);
+}
+main().catch(console.error);
+//# sourceMappingURL=turnstile-scope-validation.js.map

package/dist/checks/security/turnstile-scope-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile-scope-validation.js","sourceRoot":"","sources":["../../../src/checks/security/turnstile-scope-validation.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,+BAA4B;AAC5B,6DAAiE;AAGjE,iBAAiB;AACJ,QAAA,EAAE,GAAG,qCAAqC,CAAC;AAC3C,QAAA,IAAI,GAAG,4BAA4B,CAAC;AACpC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,sCAAsC,CAAC;AACrD,QAAA,IAAI,GAAG,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC;AAU9C,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,iEAAiE;AACjE,MAAM,2BAA2B,GAAG;IAClC,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,OAAO,EAAE;IACvD,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE;IACjE,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;CAC9C,CAAC;AAEF,2EAA2E;AAC3E,MAAM,4BAA4B,GAAG;IACnC,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACpE,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC1E,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE;IAC1D,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC9D,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC5D,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAChE,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE;CACpD,CAAC;AAEF,kFAAkF;AAClF,MAAM,+BAA+B,GAAG;IACtC,2BAA2B;IAC3B,eAAe;IACf,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF,mEAAmE;AACnE,MAAM,0BAA0B,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAE5E,gBAAgB;AAChB,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAEhF,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,kEAAkE;IAClE,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACjE,oBAAoB,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,+BAA+B,EAAE,CAAC;YACtD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,yCAAyC;IACzC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAElD,oDAAoD;IACpD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,4BAA4B,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,cAAc,CAAC,IAAI;oBACzB,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,GAAG,IAAI,2DAA2D;oBAC3E,UAAU,EACR,8EAA8E;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,2BAA2B,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,GAAG,IAAI,mCAAmC;oBACnD,UAAU,EAAE,kEAAkE;iBAC/E,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,oEAAoE;gBAC7E,UAAU,EACR,2FAA2F;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,uCAAuC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAE1F,wBAAwB;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAA,WAAI,EAAC,OAAO,EAAE;YAChC,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,cAAc;IACd,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,CAAC,MAAM,iCAAiC,CAAC,CAAC;IAE7E,iBAAiB;IACjB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,MAAM,YAAY,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;IAE5E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,sCAAsC,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,SAAS,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,SAAS,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,8DAA8D,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/security/unvalidated-route-params.d.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env tsx
+/**
+ * Unvalidated Route Params Detection Preflight (BLOCKING)
+ *
+ * Detects API routes that use route parameters without validation,
+ * which can lead to SQL injection, path traversal, or other security issues.
+ *
+ * Patterns detected:
+ * - params.id used directly in queries without validation
+ * - params.slug used in file paths without sanitization
+ * - Dynamic route params passed to Prisma without type coercion
+ *
+ * Safe patterns (allowed):
+ * - Zod validation: schema.parse(params)
+ * - Type coercion: parseInt(params.id), Number(params.id)
+ * - Explicit validation: if (!isValidId(params.id))
+ *
+ * Usage:
+ *   pnpm preflight:unvalidated-route-params
+ *   pnpm preflight:unvalidated-route-params --verbose
+ */
+export declare const id = "security/unvalidated-route-params";
+export declare const name = "Unvalidated Route Params";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Unvalidated Route Params Detection Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=unvalidated-route-params.d.ts.map

package/dist/checks/security/unvalidated-route-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unvalidated-route-params.d.ts","sourceRoot":"","sources":["../../../src/checks/security/unvalidated-route-params.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,eAAO,MAAM,EAAE,sCAAsC,CAAC;AACtD,eAAO,MAAM,IAAI,6BAA6B,CAAC;AAC/C,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,4DAA4D,CAAC;AACrF,eAAO,MAAM,IAAI,UAAe,CAAC"}