@empline/preflight 1.0.20

package/dist/checks/auth/role-validation.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * Role Validation Preflight
+ *
+ * Validates that user role checks use correct role names and patterns.
+ *
+ * Valid roles (from Prisma schema):
+ * - BUYER       - Regular users who can purchase
+ * - SELLER      - Users who can list and sell items
+ * - ADMIN       - Admin panel access, can approve listings
+ * - SUPER_ADMIN - Full admin + sensitive operations (user deletion, system settings)
+ *
+ * Role Hierarchy:
+ * - SUPER_ADMIN has all ADMIN privileges
+ * - When checking for admin access, ALWAYS check both: ['ADMIN', 'SUPER_ADMIN'].includes(role)
+ * - Use SUPER_ADMIN-only checks for sensitive operations
+ *
+ * Common issues detected:
+ * 1. Admin checks that only check ADMIN (missing SUPER_ADMIN - SUPER_ADMIN should have access too!)
+ * 2. Invalid role values
+ *
+ * Usage:
+ *   pnpm preflight:role-validation
+ *   pnpm preflight:role-validation:warn
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+// Check metadata
+exports.id = "auth/role-validation";
+exports.name = "Role Validation";
+exports.category = "auth";
+exports.blocking = true;
+exports.description = "Role Validation Preflight";
+exports.tags = ["auth", "validation"];
+// Valid roles from Prisma schema
+const VALID_ROLES = ["BUYER", "SELLER", "ADMIN", "SUPER_ADMIN"];
+// Files/directories to skip
+const SKIP_PATTERNS = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES, [
+    "node_modules",
+    ".next",
+    ".git",
+    "dist",
+    "build",
+    ".kiro",
+    "scripts/active/preflights/auth", // Don't check ourselves
+    "scripts/archived", // Old scripts
+    "scripts/active/database-tools", // Migration scripts
+    "prisma/schema.prisma", // Schema defines the enum
+    "*.md", // Documentation
+    "*.test.ts", // Test files often have intentional patterns
+    "*.test.tsx",
+    "__mocks__", // Mock files
+]);
+function shouldSkip(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    return SKIP_PATTERNS.some((pattern) => {
+        if (pattern.startsWith("*")) {
+            return normalized.endsWith(pattern.slice(1));
+        }
+        return normalized.includes(pattern);
+    });
+}
+function getAllFiles(dir, files = []) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (shouldSkip(fullPath))
+            continue;
+        if (entry.isDirectory()) {
+            getAllFiles(fullPath, files);
+        }
+        else if (entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx"))) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}
+function checkFile(filePath) {
+    const issues = [];
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    const relativePath = path.relative(process.cwd(), filePath).replace(/\\/g, "/");
+    // Skip files that don't have role checks
+    if (!content.includes(".role") &&
+        !content.includes("user.role") &&
+        !content.includes("session.user")) {
+        return issues;
+    }
+    lines.forEach((line, index) => {
+        const lineNum = index + 1;
+        // Skip comments
+        if (line.trim().startsWith("//") || line.trim().startsWith("*")) {
+            return;
+        }
+        // Check for admin checks that only check one role (actual role comparisons)
+        // Pattern: .role === 'ADMIN' or .role !== 'ADMIN' without SUPER_ADMIN
+        const adminOnlyPattern = /\.role\s*[!=]==?\s*["']ADMIN["']/;
+        if (adminOnlyPattern.test(line) &&
+            !line.includes("SUPER_ADMIN") &&
+            !line.includes("includes")) {
+            // Check if SUPER_ADMIN is checked nearby (within 5 lines)
+            const nearbyLines = lines.slice(Math.max(0, index - 5), index + 6).join("\n");
+            if (!nearbyLines.includes("SUPER_ADMIN")) {
+                issues.push({
+                    file: relativePath,
+                    line: lineNum,
+                    message: `Admin check only checks ADMIN role. Consider also checking SUPER_ADMIN: ['ADMIN', 'SUPER_ADMIN'].includes(role)`,
+                    severity: "warning",
+                    code: line.trim().slice(0, 100),
+                });
+            }
+        }
+        // Check for SUPER_ADMIN only checks (might be intentional for sensitive operations)
+        const superAdminOnlyPattern = /\.role\s*[!=]==?\s*["']SUPER_ADMIN["']/;
+        if (superAdminOnlyPattern.test(line) &&
+            !line.includes('"ADMIN"') &&
+            !line.includes("'ADMIN'") &&
+            !line.includes("includes")) {
+            // This is often intentional for sensitive operations, so just info
+            issues.push({
+                file: relativePath,
+                line: lineNum,
+                message: `Check only allows SUPER_ADMIN. If ADMIN should also have access, use: ['ADMIN', 'SUPER_ADMIN'].includes(role)`,
+                severity: "info",
+                code: line.trim().slice(0, 100),
+            });
+        }
+        // Check for invalid role values in actual role comparisons
+        // Pattern: .role === 'USER' (should be BUYER)
+        if (/\.role\s*[!=]==?\s*["']USER["']/.test(line)) {
+            issues.push({
+                file: relativePath,
+                line: lineNum,
+                message: `Invalid role "USER". Valid roles are: BUYER, SELLER, ADMIN, SUPER_ADMIN`,
+                severity: "error",
+                code: line.trim().slice(0, 100),
+            });
+        }
+    });
+    return issues;
+}
+function main() {
+    const args = process.argv.slice(2);
+    const warnOnly = args.includes("--warn") || args.includes("-w");
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    console.log("\n🔐 Role Validation Preflight\n");
+    console.log("Valid roles: BUYER, SELLER, ADMIN, SUPER_ADMIN\n");
+    const files = getAllFiles(process.cwd());
+    const allIssues = [];
+    for (const file of files) {
+        const issues = checkFile(file);
+        allIssues.push(...issues);
+    }
+    // Group by severity
+    const errors = allIssues.filter((i) => i.severity === "error");
+    const warnings = allIssues.filter((i) => i.severity === "warning");
+    const infos = allIssues.filter((i) => i.severity === "info");
+    // Print results
+    if (errors.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} ERRORS (${errors.length}):\n`);
+        for (const issue of errors) {
+            console.log(`  ${issue.file}:${issue.line}`);
+            console.log(`    ${issue.message}`);
+            if (verbose)
+                console.log(`    Code: ${issue.code}`);
+            console.log();
+        }
+    }
+    if (warnings.length > 0) {
+        console.log(`\n${console_chars_1.emoji.warning}  WARNINGS (${warnings.length}):\n`);
+        for (const issue of warnings) {
+            console.log(`  ${issue.file}:${issue.line}`);
+            console.log(`    ${issue.message}`);
+            if (verbose)
+                console.log(`    Code: ${issue.code}`);
+            console.log();
+        }
+    }
+    if (verbose && infos.length > 0) {
+        console.log(`\n${console_chars_1.emoji.info}  INFO (${infos.length}):\n`);
+        for (const issue of infos) {
+            console.log(`  ${issue.file}:${issue.line}`);
+            console.log(`    ${issue.message}`);
+            console.log();
+        }
+    }
+    // Summary
+    console.log("\n" + "=".repeat(60));
+    console.log(`Files scanned: ${files.length}`);
+    console.log(`Errors: ${errors.length}`);
+    console.log(`Warnings: ${warnings.length}`);
+    console.log(`Info: ${infos.length}`);
+    console.log("=".repeat(60) + "\n");
+    // Best practices
+    console.log(`${console_chars_1.emoji.clipboard} Best Practices:`);
+    console.log("  ${chars.bullet} SUPER_ADMIN has all ADMIN privileges - always check both for admin access");
+    console.log("  ${chars.bullet} Use ['ADMIN', 'SUPER_ADMIN'].includes(role) OR isAdmin() from @/lib/auth-utils");
+    console.log("  ${chars.bullet} Use isSuperAdmin() for sensitive operations (user deletion, system settings)");
+    console.log("  ${chars.bullet} Role names are UPPERCASE with underscores (SUPER_ADMIN, not SuperAdmin)\n");
+    // Exit code
+    if (errors.length > 0 && !warnOnly) {
+        console.log(`${console_chars_1.emoji.error} Preflight FAILED - fix errors before committing\n`);
+        process.exit(1);
+    }
+    else if (warnings.length > 0 && !warnOnly) {
+        console.log(`${console_chars_1.emoji.warning}  Preflight passed with warnings\n`);
+        process.exit(0);
+    }
+    else {
+        console.log(`${console_chars_1.emoji.success} Preflight PASSED\n`);
+        process.exit(0);
+    }
+}
+main();
+//# sourceMappingURL=role-validation.js.map

package/dist/checks/auth/role-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-validation.js","sourceRoot":"","sources":["../../../src/checks/auth/role-validation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAkD;AAClD,8DAA+E;AAG/E,iBAAiB;AACJ,QAAA,EAAE,GAAG,sBAAsB,CAAC;AAC5B,QAAA,IAAI,GAAG,iBAAiB,CAAC;AACzB,QAAA,QAAQ,GAAG,MAAM,CAAC;AAClB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,2BAA2B,CAAC;AAC1C,QAAA,IAAI,GAAG,CAAC,MAAM,EAAC,YAAY,CAAC,CAAC;AAE1C,iCAAiC;AACjC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAU,CAAC;AAEzE,4BAA4B;AAC5B,MAAM,aAAa,GAAG,IAAA,8BAAc,EAAC,iCAAiB,EAAE;IACtD,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,gCAAgC,EAAE,wBAAwB;IAC1D,kBAAkB,EAAE,cAAc;IAClC,+BAA+B,EAAE,oBAAoB;IACrD,sBAAsB,EAAE,0BAA0B;IAClD,MAAM,EAAE,gBAAgB;IACxB,WAAW,EAAE,6CAA6C;IAC1D,YAAY;IACZ,WAAW,EAAE,aAAa;CAC3B,CAAC,CAAC;AAUH,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,QAAkB,EAAE;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhF,yCAAyC;IACzC,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9B,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC;QAE1B,gBAAgB;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAC5D,IACE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC7B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;YACD,0DAA0D;YAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,iHAAiH;oBAC1H,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,MAAM,qBAAqB,GAAG,wCAAwC,CAAC;QACvE,IACE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACzB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;YACD,mEAAmE;YACnE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,+GAA+G;gBACxH,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,8CAA8C;QAC9C,IAAI,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,yEAAyE;gBAClF,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,SAAS,GAAY,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,oBAAoB;IACpB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE7D,gBAAgB;IAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,eAAe,QAAQ,CAAC,MAAM,MAAM,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,IAAI,WAAW,KAAK,CAAC,MAAM,MAAM,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED,UAAU;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnC,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,SAAS,kBAAkB,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,6FAA6F,CAC9F,CAAC;IACF,OAAO,CAAC,GAAG,CACT,kGAAkG,CACnG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,6FAA6F,CAC9F,CAAC;IAEF,YAAY;IACZ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,oDAAoD,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/checks/auth/session-integrity-validation.d.ts

@@ -0,0 +1,58 @@
+#!/usr/bin/env tsx
+/**
+ * Session Integrity Validation Preflight
+ *
+ * Ensures that session validation checks for user.id, not just user existence.
+ * This prevents corrupted/stale sessions (with empty user objects) from being
+ * treated as authenticated, which can cause:
+ * - Redirect loops on login pages
+ * - "Guest" users accessing protected pages
+ * - Prisma errors when user.id is undefined
+ *
+ * Required Patterns:
+ * 1. Login page redirect must check session.user.id, not just session.user
+ * 2. requireAuth helper must validate user.id exists
+ * 3. Session callback should handle missing token.id
+ *
+ * Usage:
+ *   pnpm tsx scripts/active/preflights/auth/session-integrity-validation.ts
+ */
+export declare const id = "auth/session-integrity-validation";
+export declare const name = "Session Integrity Validation";
+export declare const description = "Ensures session validation checks user.id, not just user existence";
+export declare const category = "auth";
+export declare const blocking = true;
+export declare const tags: string[];
+interface Issue {
+    file: string;
+    line?: number;
+    type: string;
+    severity: "error" | "warning";
+    message: string;
+    suggestion?: string;
+    snippet?: string;
+}
+interface CheckResult {
+    name: string;
+    passed: boolean;
+    blocking: boolean;
+    issues: Issue[];
+}
+/**
+ * Check that login page validates user.id before redirecting
+ */
+declare function checkLoginPageRedirect(): CheckResult;
+/**
+ * Check that requireAuth validates user.id
+ */
+declare function checkRequireAuthHelper(): CheckResult;
+/**
+ * Check that session callback handles missing token.id
+ */
+declare function checkSessionCallback(): CheckResult;
+/**
+ * Check API routes use session?.user?.id pattern
+ */
+declare function checkApiRoutePatterns(): CheckResult;
+export { checkApiRoutePatterns, checkLoginPageRedirect, checkRequireAuthHelper, checkSessionCallback, };
+//# sourceMappingURL=session-integrity-validation.d.ts.map

package/dist/checks/auth/session-integrity-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-integrity-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/auth/session-integrity-validation.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AAMH,eAAO,MAAM,EAAE,sCAAsC,CAAC;AACtD,eAAO,MAAM,IAAI,iCAAiC,CAAC;AACnD,eAAO,MAAM,WAAW,uEAAuE,CAAC;AAChG,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,IAAI,UAAgD,CAAC;AAUlE,UAAU,KAAK;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAkBD;;GAEG;AACH,iBAAS,sBAAsB,IAAI,WAAW,CAyE7C;AAED;;GAEG;AACH,iBAAS,sBAAsB,IAAI,WAAW,CAgE7C;AAGD;;GAEG;AACH,iBAAS,oBAAoB,IAAI,WAAW,CA6D3C;AAED;;GAEG;AACH,iBAAS,qBAAqB,IAAI,WAAW,CAkC5C;AA0HD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,CAAC"}