@empline/preflight 1.0.20

package/dist/checks/auth/authenticated-redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-redirect.d.ts","sourceRoot":"","sources":["../../../src/checks/auth/authenticated-redirect.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,eAAO,MAAM,EAAE,gCAAgC,CAAC;AAChD,eAAO,MAAM,IAAI,2BAA2B,CAAC;AAC7C,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,0CAA0C,CAAC;AACnE,eAAO,MAAM,IAAI,UAAsB,CAAC;AAIxC,UAAU,KAAK;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AA+DD;;;GAGG;AACH,iBAAe,sBAAsB,IAAI,OAAO,CAAC,WAAW,CAAC,CAmF5D;AAED;;GAEG;AACH,iBAAe,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAmD3D;AAED;;GAEG;AACH,iBAAe,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CAgD7D;AAqID,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/checks/auth/authenticated-redirect.js

@@ -0,0 +1,389 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Authenticated User Redirect Preflight
+ *
+ * Validates that public auth pages (login, register, forgot-password) properly
+ * redirect authenticated users away. This is a UX best practice - showing a
+ * login page to an already-logged-in user is confusing and unnecessary.
+ *
+ * Required Patterns (at least one must be present):
+ * 1. Server-side: async page with auth() check and redirect() - PREFERRED (fastest)
+ * 2. Client-side: useSession hook with status check and router.replace - FALLBACK
+ *
+ * Best Practice: Use BOTH for defense in depth:
+ * - Server component: auth() + redirect() for instant redirect (no flash)
+ * - Client component: useSession for edge cases (session changes, etc.)
+ *
+ * Usage:
+ *   pnpm tsx scripts/active/preflights/auth/authenticated-redirect.ts
+ *   pnpm tsx scripts/active/preflights/auth/authenticated-redirect.ts --verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.checkAuthLoadingState = checkAuthLoadingState;
+exports.checkAuthPageRedirects = checkAuthPageRedirects;
+exports.checkServerSideRedirect = checkServerSideRedirect;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+// Check metadata
+exports.id = "auth/authenticated-redirect";
+exports.name = "Authenticated Redirect";
+exports.category = "auth";
+exports.blocking = true;
+exports.description = "Authenticated User Redirect Preflight";
+exports.tags = ["auth", "security"];
+// AUTH PAGES TO CHECK
+const AUTH_PAGES = [
+    {
+        name: "Login",
+        patterns: ["app/login/**/*.tsx", "app/(auth)/login/**/*.tsx"],
+        blocking: true,
+        // Client-side patterns
+        clientPatterns: [
+            /useSession\s*\(\s*\)/,
+            /status\s*===?\s*["']authenticated["']|session\?\.user/,
+            /router\.(push|replace)\s*\(|redirect\s*\(/,
+        ],
+        // Server-side patterns (preferred)
+        serverPatterns: [/await\s+auth\s*\(\s*\)/, /session\?\.user|session\.user/, /redirect\s*\(/],
+    },
+    {
+        name: "Register",
+        patterns: ["app/register/**/*.tsx", "app/(auth)/register/**/*.tsx"],
+        blocking: true,
+        clientPatterns: [
+            /useSession\s*\(\s*\)/,
+            /status\s*===?\s*["']authenticated["']|session\?\.user/,
+            /router\.(push|replace)\s*\(|redirect\s*\(/,
+        ],
+        serverPatterns: [/await\s+auth\s*\(\s*\)/, /session\?\.user|session\.user/, /redirect\s*\(/],
+    },
+    {
+        name: "Forgot Password",
+        patterns: ["app/forgot-password/**/*.tsx", "app/(auth)/forgot-password/**/*.tsx"],
+        blocking: false, // Warning only - less critical
+        clientPatterns: [
+            /useSession\s*\(\s*\)/,
+            /status\s*===?\s*["']authenticated["']|session\?\.user/,
+            /router\.(push|replace)\s*\(|redirect\s*\(/,
+        ],
+        serverPatterns: [/await\s+auth\s*\(\s*\)/, /session\?\.user|session\.user/, /redirect\s*\(/],
+    },
+];
+// CACHED FILE LISTS
+async function getAuthPageFiles(patterns) {
+    const allFiles = [];
+    for (const pattern of patterns) {
+        const files = await file_cache_1.fileCache.getFiles(pattern, { ignore: glob_patterns_1.STANDARD_EXCLUDES });
+        allFiles.push(...files);
+    }
+    return [...new Set(allFiles)];
+}
+// CHECKS
+/**
+ * Check that auth pages redirect authenticated users
+ * Accepts either server-side or client-side redirect patterns
+ */
+async function checkAuthPageRedirects() {
+    const issues = [];
+    for (const authPage of AUTH_PAGES) {
+        const files = await getAuthPageFiles(authPage.patterns);
+        if (files.length === 0) {
+            continue;
+        }
+        // Separate page.tsx (can be server component) from client components
+        const pageFile = files.find((f) => f.endsWith("page.tsx"));
+        const clientFiles = files.filter((f) => f.includes("Client") || f.includes("Form") || f.includes("Section"));
+        let hasServerRedirect = false;
+        let hasClientRedirect = false;
+        // Check server component (page.tsx) for server-side redirect
+        if (pageFile) {
+            const content = fs.readFileSync(pageFile, "utf8");
+            const isClientComponent = content.includes('"use client"') || content.includes("'use client'");
+            if (!isClientComponent) {
+                // Server component - check for auth() + redirect pattern
+                const hasAllServerPatterns = authPage.serverPatterns.every((pattern) => pattern.test(content));
+                if (hasAllServerPatterns) {
+                    hasServerRedirect = true;
+                }
+            }
+            else {
+                // page.tsx is a client component - check client patterns
+                const hasAllClientPatterns = authPage.clientPatterns.every((pattern) => pattern.test(content));
+                if (hasAllClientPatterns) {
+                    hasClientRedirect = true;
+                }
+            }
+        }
+        // Check client components for client-side redirect
+        for (const file of clientFiles) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!content.includes('"use client"') && !content.includes("'use client'")) {
+                continue;
+            }
+            const hasAllClientPatterns = authPage.clientPatterns.every((pattern) => pattern.test(content));
+            if (hasAllClientPatterns) {
+                hasClientRedirect = true;
+                break;
+            }
+        }
+        // Determine if we have adequate redirect coverage
+        const hasAnyRedirect = hasServerRedirect || hasClientRedirect;
+        if (!hasAnyRedirect) {
+            const mainFile = pageFile || clientFiles[0] || files[0];
+            issues.push({
+                file: mainFile,
+                type: "no-auth-redirect",
+                severity: authPage.blocking ? "error" : "warning",
+                message: `${authPage.name} page does not redirect authenticated users away`,
+                suggestion: `Add server-side redirect: const session = await auth(); if (session?.user) redirect("/account/dashboard");`,
+            });
+        }
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "Auth Page Redirects",
+        passed: !hasErrors,
+        blocking: true,
+        issues,
+    };
+}
+/**
+ * Check for loading state during auth check (prevents flash of content)
+ */
+async function checkAuthLoadingState() {
+    const issues = [];
+    for (const authPage of AUTH_PAGES) {
+        const files = await getAuthPageFiles(authPage.patterns);
+        const componentFiles = files.filter((f) => f.includes("Client") ||
+            f.includes("Form") ||
+            f.includes("Section") ||
+            f.endsWith("page.tsx"));
+        for (const file of componentFiles) {
+            const content = fs.readFileSync(file, "utf8");
+            // Only check client components
+            if (!content.includes('"use client"') && !content.includes("'use client'")) {
+                continue;
+            }
+            // Check if useSession is used
+            if (!content.includes("useSession")) {
+                continue;
+            }
+            // Check for loading state handling
+            const hasLoadingCheck = content.includes('status === "loading"') ||
+                content.includes("status === 'loading'") ||
+                content.includes("isLoading");
+            if (!hasLoadingCheck) {
+                issues.push({
+                    file,
+                    type: "missing-loading-state",
+                    severity: "warning",
+                    message: `${authPage.name} page doesn't handle loading state during auth check`,
+                    suggestion: 'Add: if (status === "loading") { return <LoadingSpinner />; } to prevent flash of login form',
+                });
+            }
+        }
+    }
+    return {
+        name: "Auth Loading State",
+        passed: true, // Warnings only
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check for server-side redirect (best practice for fastest UX)
+ */
+async function checkServerSideRedirect() {
+    const issues = [];
+    for (const authPage of AUTH_PAGES) {
+        const files = await getAuthPageFiles(authPage.patterns);
+        const pageFile = files.find((f) => f.endsWith("page.tsx"));
+        if (!pageFile) {
+            continue;
+        }
+        const content = fs.readFileSync(pageFile, "utf8");
+        const isClientComponent = content.includes('"use client"') || content.includes("'use client'");
+        if (isClientComponent) {
+            // page.tsx is a client component - recommend server-side redirect
+            issues.push({
+                file: pageFile,
+                type: "no-server-redirect",
+                severity: "info",
+                message: `${authPage.name} page.tsx is a client component - consider adding server-side redirect for faster UX`,
+                suggestion: `Convert to async server component with: const session = await auth(); if (session?.user) redirect("/account/dashboard");`,
+            });
+            continue;
+        }
+        // Server component - check for auth() + redirect pattern
+        const hasAuthCall = /await\s+auth\s*\(\s*\)/.test(content);
+        const hasSessionCheck = /session\?\.user|session\.user/.test(content);
+        const hasRedirect = /redirect\s*\(/.test(content);
+        if (!hasAuthCall || !hasSessionCheck || !hasRedirect) {
+            issues.push({
+                file: pageFile,
+                type: "incomplete-server-redirect",
+                severity: "info",
+                message: `${authPage.name} page.tsx is a server component but missing complete auth redirect pattern`,
+                suggestion: `Add: const session = await auth(); if (session?.user) redirect("/account/dashboard");`,
+            });
+        }
+    }
+    return {
+        name: "Server-Side Redirect (Best Practice)",
+        passed: true, // Info only
+        blocking: false,
+        issues,
+    };
+}
+// OUTPUT
+function printResults(checks, verbose) {
+    console.log("\n🔐 AUTHENTICATED USER REDIRECT PREFLIGHT");
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    let totalErrors = 0;
+    let totalWarnings = 0;
+    let totalInfo = 0;
+    for (const check of checks) {
+        const icon = check.passed
+            ? `${console_chars_1.emoji.success}`
+            : check.blocking
+                ? `${console_chars_1.emoji.error}`
+                : `${console_chars_1.emoji.warning}`;
+        const issueCount = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+        console.log(`\n${icon} ${check.name}${issueCount}`);
+        if (check.issues.length > 0) {
+            const errors = check.issues.filter((i) => i.severity === "error");
+            const warnings = check.issues.filter((i) => i.severity === "warning");
+            const infos = check.issues.filter((i) => i.severity === "info");
+            totalErrors += errors.length;
+            totalWarnings += warnings.length;
+            totalInfo += infos.length;
+            if (errors.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.error} ERRORS (${errors.length}):`);
+                for (const issue of errors) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (warnings.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.warning}  WARNINGS (${warnings.length}):`);
+                for (const issue of warnings) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (verbose && issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (verbose && infos.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.info} INFO (${infos.length}):`);
+                for (const issue of infos) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+        }
+    }
+    console.log("\n" + `${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    console.log(`${console_chars_1.emoji.chart} Summary: ${totalErrors} errors | ${totalWarnings} warnings | ${totalInfo} info`);
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+    if (hasBlockingFailure) {
+        console.log(`\n${console_chars_1.emoji.error} AUTH REDIRECT CHECK FAILED - fix errors before deploying\n`);
+    }
+    else if (totalWarnings > 0) {
+        console.log(`\n${console_chars_1.emoji.warning}  AUTH REDIRECT CHECK PASSED with warnings\n`);
+    }
+    else {
+        console.log(`\n${console_chars_1.emoji.success} AUTH REDIRECT CHECK PASSED\n`);
+    }
+    console.log(`${console_chars_1.emoji.clipboard} Best Practices:`);
+    console.log("   • Server-side: auth() + redirect() in page.tsx (fastest, no flash)");
+    console.log("   • Client-side: useSession() + router.replace() as fallback");
+    console.log('   • Show loading state while status === "loading" to prevent flash');
+    console.log("   • Redirect to callbackUrl if provided, otherwise to default dashboard\n");
+    return hasBlockingFailure;
+}
+function writeFindings(checks) {
+    const findingsPath = process.env.PREFLIGHT_FINDINGS_PATH || process.env.PREFLIGHT_FINDINGS_FILE;
+    if (!findingsPath)
+        return;
+    const findings = [];
+    for (const check of checks) {
+        for (const issue of check.issues) {
+            if (issue.severity === "info")
+                continue; // Skip info-level for findings
+            findings.push({
+                message: issue.message,
+                level: issue.severity === "error" ? "error" : "warning",
+                file: issue.file,
+                startLine: issue.line,
+                code: issue.type,
+            });
+        }
+    }
+    try {
+        const dir = path.dirname(findingsPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(findingsPath, JSON.stringify({ findings }, null, 2));
+    }
+    catch {
+        // Ignore write errors
+    }
+}
+// MAIN
+async function main() {
+    const args = process.argv.slice(2);
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    const checks = [];
+    checks.push(await checkAuthPageRedirects());
+    checks.push(await checkAuthLoadingState());
+    checks.push(await checkServerSideRedirect());
+    writeFindings(checks);
+    const failed = printResults(checks, verbose);
+    process.exit(failed ? 1 : 0);
+}
+main().catch(console.error);
+//# sourceMappingURL=authenticated-redirect.js.map

package/dist/checks/auth/authenticated-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-redirect.js","sourceRoot":"","sources":["../../../src/checks/auth/authenticated-redirect.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyaM,sDAAqB;AAAE,wDAAsB;AAAE,0DAAuB;AAva/E,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAuD;AACvD,wDAAoD;AACpD,8DAA+D;AAG/D,iBAAiB;AACJ,QAAA,EAAE,GAAG,6BAA6B,CAAC;AACnC,QAAA,IAAI,GAAG,wBAAwB,CAAC;AAChC,QAAA,QAAQ,GAAG,MAAM,CAAC;AAClB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,uCAAuC,CAAC;AACtD,QAAA,IAAI,GAAG,CAAC,MAAM,EAAC,UAAU,CAAC,CAAC;AA4BxC,sBAAsB;AAEtB,MAAM,UAAU,GAAG;IACjB;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;QAC7D,QAAQ,EAAE,IAAI;QACd,uBAAuB;QACvB,cAAc,EAAE;YACd,sBAAsB;YACtB,uDAAuD;YACvD,2CAA2C;SAC5C;QACD,mCAAmC;QACnC,cAAc,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,eAAe,CAAC;KAC7F;IACD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;QACnE,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE;YACd,sBAAsB;YACtB,uDAAuD;YACvD,2CAA2C;SAC5C;QACD,cAAc,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,eAAe,CAAC;KAC7F;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,CAAC,8BAA8B,EAAE,qCAAqC,CAAC;QACjF,QAAQ,EAAE,KAAK,EAAE,+BAA+B;QAChD,cAAc,EAAE;YACd,sBAAsB;YACtB,uDAAuD;YACvD,2CAA2C;SAC5C;QACD,cAAc,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,EAAE,eAAe,CAAC;KAC7F;CACF,CAAC;AAEF,oBAAoB;AAEpB,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iCAAiB,EAAE,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS;AAET;;;GAGG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,qEAAqE;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC3E,CAAC;QAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAE9B,6DAA6D;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,iBAAiB,GACrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,yDAAyD;gBACzD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CACtB,CAAC;gBACF,IAAI,oBAAoB,EAAE,CAAC;oBACzB,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yDAAyD;gBACzD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CACtB,CAAC;gBACF,IAAI,oBAAoB,EAAE,CAAC;oBACzB,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAE9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,MAAM,oBAAoB,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CACrE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CACtB,CAAC;YACF,IAAI,oBAAoB,EAAE,CAAC;gBACzB,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,cAAc,GAAG,iBAAiB,IAAI,iBAAiB,CAAC;QAE9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACjD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,kDAAkD;gBAC3E,UAAU,EAAE,4GAA4G;aACzH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,CAAC,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB;IAClC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACpB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzB,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAE9C,+BAA+B;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3E,SAAS;YACX,CAAC;YAED,8BAA8B;YAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YAED,mCAAmC;YACnC,MAAM,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACxC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;gBACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAEhC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI;oBACJ,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,sDAAsD;oBAC/E,UAAU,EACR,8FAA8F;iBACjG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,IAAI,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB;IACpC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE/F,IAAI,iBAAiB,EAAE,CAAC;YACtB,kEAAkE;YAClE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,sFAAsF;gBAC/G,UAAU,EAAE,0HAA0H;aACvI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,yDAAyD;QACzD,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElD,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,4BAA4B;gBAClC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,4EAA4E;gBACrG,UAAU,EAAE,uFAAuF;aACpG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,sCAAsC;QAC5C,MAAM,EAAE,IAAI,EAAE,YAAY;QAC1B,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS;AAET,SAAS,YAAY,CAAC,MAAqB,EAAE,OAAgB;IAC3D,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM;YACvB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE;YACpB,CAAC,CAAC,KAAK,CAAC,QAAQ;gBACd,CAAC,CAAC,GAAG,qBAAK,CAAC,KAAK,EAAE;gBAClB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;YAEhE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;YACjC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,OAAO,eAAe,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;gBACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,OAAO,IAAI,KAAK,CAAC,UAAU;wBAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,IAAI,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC1D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,aAAa,WAAW,aAAa,aAAa,eAAe,SAAS,OAAO,CAChG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,6DAA6D,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,SAAS,kBAAkB,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAE1F,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChG,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM;gBAAE,SAAS,CAAC,+BAA+B;YACxE,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED,OAAO;AAEP,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElE,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAAC;IAE7C,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/auth/role-validation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Role Validation Preflight
+ *
+ * Validates that user role checks use correct role names and patterns.
+ *
+ * Valid roles (from Prisma schema):
+ * - BUYER       - Regular users who can purchase
+ * - SELLER      - Users who can list and sell items
+ * - ADMIN       - Admin panel access, can approve listings
+ * - SUPER_ADMIN - Full admin + sensitive operations (user deletion, system settings)
+ *
+ * Role Hierarchy:
+ * - SUPER_ADMIN has all ADMIN privileges
+ * - When checking for admin access, ALWAYS check both: ['ADMIN', 'SUPER_ADMIN'].includes(role)
+ * - Use SUPER_ADMIN-only checks for sensitive operations
+ *
+ * Common issues detected:
+ * 1. Admin checks that only check ADMIN (missing SUPER_ADMIN - SUPER_ADMIN should have access too!)
+ * 2. Invalid role values
+ *
+ * Usage:
+ *   pnpm preflight:role-validation
+ *   pnpm preflight:role-validation:warn
+ */
+export declare const id = "auth/role-validation";
+export declare const name = "Role Validation";
+export declare const category = "auth";
+export declare const blocking = true;
+export declare const description = "Role Validation Preflight";
+export declare const tags: string[];
+//# sourceMappingURL=role-validation.d.ts.map

package/dist/checks/auth/role-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/auth/role-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,eAAO,MAAM,EAAE,yBAAyB,CAAC;AACzC,eAAO,MAAM,IAAI,oBAAoB,CAAC;AACtC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,8BAA8B,CAAC;AACvD,eAAO,MAAM,IAAI,UAAwB,CAAC"}