@empline/preflight 1.1.0

package/dist/checks/security/permission-security-validation.js

@@ -0,0 +1,332 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Permission Security Validation Preflight
+ *
+ * Ensures permission-gated actions are properly secured:
+ * - API routes check permissions before performing actions
+ * - Team member actions verify role/permissions
+ * - Store owner actions verify ownership
+ * - Permission groups are validated before assignment
+ *
+ * BLOCKING: Missing permission checks enable unauthorized access
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const file_cache_1 = require("../../shared/file-cache");
+const console_chars_1 = require("../../utils/console-chars");
+const exclusions_1 = require("../../shared/exclusions");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const glob_1 = require("glob");
+// Check metadata
+exports.id = "security/permission-security-validation";
+exports.name = "Permission Security Validation";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Permission Security Validation Preflight";
+exports.tags = ["security", "validation"];
+const issues = [];
+// Actions that MUST have permission checks
+const PERMISSION_REQUIRED_PATTERNS = [
+    {
+        pattern: /\.delete\s*\(|deleteMany|DELETE_LISTINGS|deleteListing/i,
+        name: "Delete listing",
+        permission: "DELETE_LISTINGS",
+        excludePaths: [/notifications/],
+    },
+    {
+        pattern: /\.update\s*\(|updateMany|EDIT_LISTINGS|editListing/i,
+        name: "Edit listing",
+        permission: "EDIT_LISTINGS",
+        excludePaths: [/notifications/],
+    },
+    {
+        pattern: /approve.*batch|approveBatch/i,
+        name: "Approve batch",
+        permission: "APPROVE_BATCHES",
+        excludePaths: [],
+    },
+    {
+        pattern: /manage.*order|fulfillOrder|MANAGE_ORDERS/i,
+        name: "Manage order",
+        permission: "MANAGE_ORDERS",
+        excludePaths: [],
+    },
+    {
+        pattern: /manage.*team|inviteMember|MANAGE_TEAM/i,
+        name: "Manage team",
+        permission: "MANAGE_TEAM",
+        excludePaths: [],
+    },
+    {
+        pattern: /manage.*setting|updateSetting|MANAGE_SETTINGS/i,
+        name: "Manage settings",
+        permission: "MANAGE_SETTINGS",
+        excludePaths: [],
+    },
+];
+// Patterns that indicate permission checking is implemented
+const PERMISSION_CHECK_PATTERNS = [
+    /checkPermission/i,
+    /hasPermission/i,
+    /requirePermission/i,
+    /permissions\.includes/i,
+    /permissionGroups/i,
+    /role\s*===?\s*["']OWNER["']/i,
+    /role\s*===?\s*["']ADMIN["']/i,
+    /isOwner/i,
+    /userId\s*===?\s*store\.userId/i,
+    /session\.user\.id\s*===?\s*.*userId/i,
+];
+// Patterns that indicate store ownership verification
+const OWNERSHIP_CHECK_PATTERNS = [
+    /store\.userId\s*===?\s*session/i,
+    /userId:\s*session\.user\.id/i,
+    /where:\s*\{[^}]*userId:\s*session/i,
+    /findFirst.*userId.*session/i,
+    /requireAuth/i,
+];
+// Files/directories to scan
+const SCAN_PATTERNS = [
+    "app/api/store/**/route.ts",
+    "app/api/listings/**/route.ts",
+    "lib/**/permission*.ts",
+];
+// App-specific exclusions loaded from config
+let appExclusions = [];
+async function scanApiRoute(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    // Check if this is a store-related API
+    const isStoreApi = filePath.includes("/api/store/");
+    const isListingApi = filePath.includes("/api/listings/");
+    // Check for ownership verification in store APIs
+    if (isStoreApi || isListingApi) {
+        const hasOwnershipCheck = OWNERSHIP_CHECK_PATTERNS.some((pattern) => pattern.test(content));
+        if (!hasOwnershipCheck &&
+            (content.includes("POST") ||
+                content.includes("PUT") ||
+                content.includes("DELETE") ||
+                content.includes("PATCH"))) {
+            // Check if it's a public endpoint (GET only for public data)
+            const isPublicGet = content.includes("export async function GET") &&
+                !content.includes("export async function POST") &&
+                !content.includes("export async function PUT") &&
+                !content.includes("export async function DELETE");
+            if (!isPublicGet) {
+                issues.push({
+                    file: filePath,
+                    line: 1,
+                    type: "warning",
+                    message: "Store/listing API without explicit ownership verification",
+                    code: "Ensure store ownership is verified before mutations",
+                });
+            }
+        }
+    }
+    // Check for permission-required actions
+    for (const { pattern, name, permission, excludePaths } of PERMISSION_REQUIRED_PATTERNS) {
+        // Skip if file path matches any exclude pattern
+        if (excludePaths && excludePaths.some((excludePattern) => excludePattern.test(filePath))) {
+            continue;
+        }
+        if (pattern.test(content) || pattern.test(filePath)) {
+            const hasPermissionCheck = PERMISSION_CHECK_PATTERNS.some((p) => p.test(content));
+            if (!hasPermissionCheck) {
+                // Find the line number where the action is performed
+                let lineNum = 1;
+                for (let i = 0; i < lines.length; i++) {
+                    if (pattern.test(lines[i])) {
+                        lineNum = i + 1;
+                        break;
+                    }
+                }
+                // Report as warning - permission checks implementation is ongoing
+                issues.push({
+                    file: filePath,
+                    line: lineNum,
+                    type: "warning",
+                    message: `${name} action without permission check (requires ${permission})`,
+                    code: `Add permission verification before ${name.toLowerCase()}`,
+                });
+            }
+        }
+    }
+    // Check for team member creation without permission assignment
+    if (content.includes("storeTeamMember.create") &&
+        !content.includes("storeTeamMember.findFirst")) {
+        const hasPermissionAssignment = content.includes("assignDefaultPermissions") ||
+            content.includes("permissionGroupIds") ||
+            content.includes("storeTeamMemberPermissions");
+        if (!hasPermissionAssignment) {
+            issues.push({
+                file: filePath,
+                line: 1,
+                type: "warning",
+                message: "Team member creation without permission assignment",
+                code: "Assign default permissions when creating team members",
+            });
+        }
+    }
+    // Check for direct permission group manipulation without validation
+    if (content.includes("storePermissionGroup") &&
+        (content.includes("create") || content.includes("update"))) {
+        const hasStoreValidation = content.includes("storeId") && (content.includes("where:") || content.includes("findFirst"));
+        if (!hasStoreValidation) {
+            // Warning only - most cases are handled correctly
+            issues.push({
+                file: filePath,
+                line: 1,
+                type: "warning",
+                message: "Permission group manipulation - verify store validation",
+                code: "Verify permission group belongs to the user's store",
+            });
+        }
+    }
+}
+// Check for permission utility functions
+async function checkPermissionInfrastructure() {
+    const libFiles = (await file_cache_1.fileCache.getLibFiles())
+        .filter((file) => !(0, exclusions_1.shouldExcludeFile)(file, appExclusions));
+    let hasPermissionLib = false;
+    for (const file of libFiles) {
+        const content = fs.readFileSync(file, "utf-8");
+        if (content.includes("checkPermission") ||
+            content.includes("hasPermission") ||
+            content.includes("PermissionType") ||
+            file.includes("permission")) {
+            hasPermissionLib = true;
+            break;
+        }
+    }
+    if (!hasPermissionLib) {
+        issues.push({
+            file: "lib/",
+            line: 0,
+            type: "warning",
+            message: "No centralized permission checking utility found",
+            code: "Consider implementing lib/permission-utils.ts for consistent checks",
+        });
+    }
+}
+// Check for default permission groups in store creation
+async function checkDefaultPermissionGroups() {
+    const storeCreationFiles = (await file_cache_1.fileCache.getFiles("app/api/store/register/route.ts", {
+        ignore: ["**/node_modules/**"],
+    })).filter((file) => !(0, exclusions_1.shouldExcludeFile)(file, appExclusions));
+    for (const file of storeCreationFiles) {
+        const content = fs.readFileSync(file, "utf-8");
+        const hasDefaultPermissions = content.includes("createDefaultPermissionGroups") ||
+            content.includes("storePermissionGroup") ||
+            content.includes("DEFAULT_PERMISSION_GROUPS");
+        if (!hasDefaultPermissions) {
+            issues.push({
+                file,
+                line: 1,
+                type: "warning",
+                message: "Store registration without default permission group creation",
+                code: "Create default permission groups when store is registered",
+            });
+        }
+    }
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    console.log(`${console_chars_1.emoji.shield} Permission Security Validation Preflight`);
+    console.log((0, console_chars_1.createDivider)(70, "heavy"));
+    // Load app-specific exclusions from config
+    appExclusions = await (0, exclusions_1.getExclusions)(exports.id);
+    // Get all relevant files
+    const allFiles = [];
+    for (const pattern of SCAN_PATTERNS) {
+        const files = await (0, glob_1.glob)(pattern, { ignore: ["**/node_modules/**"], nodir: true });
+        allFiles.push(...files);
+    }
+    // Filter by exclusions
+    const filteredFiles = allFiles.filter((file) => !(0, exclusions_1.shouldExcludeFile)(file, appExclusions));
+    console.log(`Scanning ${filteredFiles.length} files for permission security...`);
+    // Scan each file
+    for (const file of filteredFiles) {
+        await scanApiRoute(file);
+    }
+    // Check infrastructure
+    await checkPermissionInfrastructure();
+    await checkDefaultPermissionGroups();
+    // Report results
+    const errors = issues.filter((i) => i.type === "error");
+    const warnings = issues.filter((i) => i.type === "warning");
+    if (issues.length === 0) {
+        console.log(`\n${console_chars_1.emoji.success} All permission-gated actions are properly secured`);
+        process.exit(0);
+    }
+    console.log(`\n Found ${errors.length} errors, ${warnings.length} warnings\n`);
+    // Group by type
+    if (errors.length > 0) {
+        console.log(`${console_chars_1.emoji.error} CRITICAL - Missing Permission Checks:`);
+        for (const issue of errors) {
+            console.log(`   ${issue.file}:${issue.line}`);
+            console.log(`      ${issue.message}`);
+        }
+    }
+    if (warnings.length > 0) {
+        console.log(`\n${console_chars_1.emoji.warning}  Recommended Permission Improvements:`);
+        for (const issue of warnings) {
+            console.log(`   ${issue.file}:${issue.line}`);
+            console.log(`      ${issue.message}`);
+        }
+    }
+    console.log("\n" + (0, console_chars_1.createDivider)(70, "heavy"));
+    console.log(`${console_chars_1.emoji.hint} Permission Security Guide:`);
+    console.log("   1. Always verify store ownership before mutations");
+    console.log("   2. Check specific permissions for sensitive actions");
+    console.log("   3. Use role-based defaults with customizable groups");
+    console.log("   4. Assign permissions when team members are created");
+    console.log("   5. Validate permission groups belong to the store");
+    console.log((0, console_chars_1.createDivider)(70, "heavy"));
+    if (errors.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} BLOCKING: Add permission checks to secure endpoints`);
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.warning}  Warnings found - consider improving permission security`);
+    process.exit(0);
+}
+// Allow direct execution
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=permission-security-validation.js.map

package/dist/checks/security/permission-security-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-security-validation.js","sourceRoot":"","sources":["../../../src/checks/security/permission-security-validation.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6QH,kBAyEC;AApVD,uCAAyB;AACzB,wDAAoD;AACpD,6DAAiE;AACjE,wDAA2E;AAC3E,uFAAwF;AACxF,+BAA4B;AAG5B,iBAAiB;AACJ,QAAA,EAAE,GAAG,yCAAyC,CAAC;AAC/C,QAAA,IAAI,GAAG,gCAAgC,CAAC;AACxC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,0CAA0C,CAAC;AACzD,QAAA,IAAI,GAAG,CAAC,UAAU,EAAC,YAAY,CAAC,CAAC;AAU9C,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,2CAA2C;AAC3C,MAAM,4BAA4B,GAAG;IACnC;QACE,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,iBAAiB;QAC7B,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD;QACE,OAAO,EAAE,qDAAqD;QAC9D,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,iBAAiB;QAC7B,YAAY,EAAE,EAAE;KACjB;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,EAAE;KACjB;IACD;QACE,OAAO,EAAE,wCAAwC;QACjD,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,aAAa;QACzB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,iBAAiB;QAC7B,YAAY,EAAE,EAAE;KACjB;CACF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,yBAAyB,GAAG;IAChC,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;IACxB,mBAAmB;IACnB,8BAA8B;IAC9B,8BAA8B;IAC9B,UAAU;IACV,gCAAgC;IAChC,sCAAsC;CACvC,CAAC;AAEF,sDAAsD;AACtD,MAAM,wBAAwB,GAAG;IAC/B,iCAAiC;IACjC,8BAA8B;IAC9B,oCAAoC;IACpC,6BAA6B;IAC7B,cAAc;CACf,CAAC;AAEF,4BAA4B;AAC5B,MAAM,aAAa,GAAG;IACpB,2BAA2B;IAC3B,8BAA8B;IAC9B,uBAAuB;CACxB,CAAC;AAEF,6CAA6C;AAC7C,IAAI,aAAa,GAAa,EAAE,CAAC;AAEjC,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,uCAAuC;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAEzD,iDAAiD;IACjD,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5F,IACE,CAAC,iBAAiB;YAClB,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC5B,CAAC;YACD,6DAA6D;YAC7D,MAAM,WAAW,GACf,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;gBAC7C,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAC/C,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;gBAC9C,CAAC,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YAEpD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,2DAA2D;oBACpE,IAAI,EAAE,qDAAqD;iBAC5D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,4BAA4B,EAAE,CAAC;QACvF,gDAAgD;QAChD,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACzF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAElF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,qDAAqD;gBACrD,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;wBAChB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAED,kEAAkE;gBAClE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,GAAG,IAAI,8CAA8C,UAAU,GAAG;oBAC3E,IAAI,EAAE,sCAAsC,IAAI,CAAC,WAAW,EAAE,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IACE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC1C,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAC9C,CAAC;QACD,MAAM,uBAAuB,GAC3B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YACtC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAEjD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,uDAAuD;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IACE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC1D,CAAC;QACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/F,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kDAAkD;YAClD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,yDAAyD;gBAClE,IAAI,EAAE,qDAAqD;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,CAAC,MAAM,sBAAS,CAAC,WAAW,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAA,8BAAiB,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAE7D,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,IACE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC3B,CAAC;YACD,gBAAgB,GAAG,IAAI,CAAC;YACxB,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,kDAAkD;YAC3D,IAAI,EAAE,qEAAqE;SAC5E,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,4BAA4B;IACzC,MAAM,kBAAkB,GAAG,CAAC,MAAM,sBAAS,CAAC,QAAQ,CAAC,iCAAiC,EAAE;QACtF,MAAM,EAAE,CAAC,oBAAoB,CAAC;KAC/B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAA,8BAAiB,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAE9D,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE/C,MAAM,qBAAqB,GACzB,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACjD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACxC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;QAEhD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,8DAA8D;gBACvE,IAAI,EAAE,2DAA2D;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,2CAA2C,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,2CAA2C;IAC3C,aAAa,GAAG,MAAM,IAAA,0BAAa,EAAC,UAAE,CAAC,CAAC;IAExC,yBAAyB;IACzB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAA,WAAI,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,uBAAuB;IACvB,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAA,8BAAiB,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAEzF,OAAO,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,MAAM,mCAAmC,CAAC,CAAC;IAEjF,iBAAiB;IACjB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,MAAM,6BAA6B,EAAE,CAAC;IACtC,MAAM,4BAA4B,EAAE,CAAC;IAErC,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,YAAY,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;IAE/E,gBAAgB;IAChB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,wCAAwC,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;QACxE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,6BAA6B,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,sDAAsD,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;IAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/security/prod-command-detection.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env tsx
+/**
+ * Production Database Command Detection Preflight
+ *
+ * Detects dangerous patterns where direct prisma commands are used
+ * with production database URLs. This is a DETECTIVE control that
+ * identifies potential bypass attempts.
+ *
+ * Run: pnpm preflight:database:prod-command-detection
+ */
+export declare const id = "security/prod-command-detection";
+export declare const name = "Prod Command Detection";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Production Database Command Detection Preflight";
+export declare const tags: string[];
+export declare function run(): Promise<void>;
+//# sourceMappingURL=prod-command-detection.d.ts.map

package/dist/checks/security/prod-command-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prod-command-detection.d.ts","sourceRoot":"","sources":["../../../src/checks/security/prod-command-detection.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAUH,eAAO,MAAM,EAAE,oCAAoC,CAAC;AACpD,eAAO,MAAM,IAAI,2BAA2B,CAAC;AAC7C,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,oDAAoD,CAAC;AAC7E,eAAO,MAAM,IAAI,UAAe,CAAC;AAmKjC,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAsDzC"}

package/dist/checks/security/prod-command-detection.js

@@ -0,0 +1,238 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Production Database Command Detection Preflight
+ *
+ * Detects dangerous patterns where direct prisma commands are used
+ * with production database URLs. This is a DETECTIVE control that
+ * identifies potential bypass attempts.
+ *
+ * Run: pnpm preflight:database:prod-command-detection
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const exclusions_1 = require("../../shared/exclusions");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/prod-command-detection";
+exports.name = "Prod Command Detection";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Production Database Command Detection Preflight";
+exports.tags = ["security"];
+const detections = [];
+// Patterns that indicate direct production database commands
+const DANGEROUS_PATTERNS = [
+    // Direct environment variable setting with production URLs
+    {
+        pattern: /\$env:DATABASE_URL\s*=\s*["'][^"']*(?:prisma\.io|neon\.tech|supabase|prod)[^"']*["']/gi,
+        description: "Setting DATABASE_URL to production via PowerShell",
+        severity: "critical",
+    },
+    {
+        pattern: /export\s+DATABASE_URL\s*=\s*["'][^"']*(?:prisma\.io|neon\.tech|supabase|prod)[^"']*["']/gi,
+        description: "Setting DATABASE_URL to production via export",
+        severity: "critical",
+    },
+    {
+        pattern: /DATABASE_URL=["']?[^"'\s]*(?:prisma\.io|neon\.tech|supabase|prod)[^"'\s]*["']?\s+(?:pnpm|npx|yarn)\s+prisma/gi,
+        description: "Inline DATABASE_URL with prisma command",
+        severity: "critical",
+    },
+    // Direct prisma commands that should use wrappers
+    {
+        pattern: /(?:pnpm|npx|yarn)\s+(?:-s\s+)?prisma\s+db\s+push.*--accept-data-loss/gi,
+        description: "Direct prisma db push with --accept-data-loss (should use db:push:prod)",
+        severity: "warning",
+    },
+    {
+        pattern: /(?:pnpm|npx|yarn)\s+(?:-s\s+)?prisma\s+migrate\s+reset/gi,
+        description: "prisma migrate reset (dangerous on any database)",
+        severity: "critical",
+    },
+    // NODE_ENV=production with direct prisma
+    {
+        pattern: /NODE_ENV\s*=\s*["']?production["']?\s*[;&|]\s*(?:pnpm|npx|yarn)\s+prisma/gi,
+        description: "NODE_ENV=production with direct prisma command",
+        severity: "critical",
+    },
+    {
+        pattern: /\$env:NODE_ENV\s*=\s*["']production["'][^;]*;\s*(?:pnpm|npx|yarn)\s+prisma/gi,
+        description: "PowerShell NODE_ENV=production with direct prisma command",
+        severity: "critical",
+    },
+];
+// Files/directories to scan
+const SCAN_PATHS = ["scripts", ".github", "docs"];
+// Default files to exclude (always excluded regardless of config)
+const DEFAULT_EXCLUDE_FILES = [
+    "prisma-guardrail.ts",
+    "mandatory-backup.ts",
+    "db-push-prod.ts",
+    "migrate-deploy-prod.ts",
+    "baseline-prod.ts",
+    "prod-command-detection.ts", // this file
+    "copilot-instructions.md", // documentation
+    "node_modules",
+    ".next",
+];
+// App-specific exclusions loaded from config
+let appExclusions = [];
+function shouldExclude(filePath) {
+    // Check default exclusions
+    if (DEFAULT_EXCLUDE_FILES.some((pattern) => filePath.includes(pattern))) {
+        return true;
+    }
+    // Check app-specific exclusions
+    return (0, exclusions_1.shouldExcludeFile)(filePath, appExclusions);
+}
+function isDocumentationFile(filePath) {
+    return filePath.includes("/docs/") || filePath.includes("\\docs\\") || filePath.endsWith(".md");
+}
+function scanFile(filePath) {
+    if (shouldExclude(filePath)) {
+        return;
+    }
+    // Skip documentation files - they often contain examples of what NOT to do
+    if (isDocumentationFile(filePath)) {
+        return;
+    }
+    try {
+        const content = fs.readFileSync(filePath, "utf8");
+        const lines = content.split("\n");
+        for (const { pattern, description, severity } of DANGEROUS_PATTERNS) {
+            let match;
+            const regex = new RegExp(pattern.source, pattern.flags);
+            while ((match = regex.exec(content)) !== null) {
+                // Find line number
+                const beforeMatch = content.slice(0, match.index);
+                const lineNumber = beforeMatch.split("\n").length;
+                // Skip if this is in a comment explaining what NOT to do
+                const line = lines[lineNumber - 1] || "";
+                if (line.includes("# ❌") ||
+                    line.includes("// ❌") ||
+                    line.includes("NEVER") ||
+                    line.includes("FORBIDDEN")) {
+                    continue;
+                }
+                detections.push({
+                    file: filePath,
+                    line: lineNumber,
+                    pattern: description,
+                    severity,
+                });
+            }
+        }
+    }
+    catch (error) {
+        // Skip files that can't be read
+    }
+}
+function scanDirectory(dirPath) {
+    if (!fs.existsSync(dirPath)) {
+        return;
+    }
+    const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dirPath, entry.name);
+        if (shouldExclude(fullPath)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            scanDirectory(fullPath);
+        }
+        else if (entry.name.endsWith(".ts") ||
+            entry.name.endsWith(".js") ||
+            entry.name.endsWith(".ps1") ||
+            entry.name.endsWith(".sh") ||
+            entry.name.endsWith(".md")) {
+            scanFile(fullPath);
+        }
+    }
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    console.log(`\n${console_chars_1.emoji.search} Production Database Command Detection\n`);
+    console.log(`${console_chars_1.emoji.shield} Scanning for dangerous direct prisma commands...\n`);
+    // Load app-specific exclusions from config
+    appExclusions = await (0, exclusions_1.getExclusions)(exports.id);
+    const repoRoot = process.cwd();
+    for (const scanPath of SCAN_PATHS) {
+        const fullPath = path.join(repoRoot, scanPath);
+        scanDirectory(fullPath);
+    }
+    // Also scan any .ps1 or .sh files in root
+    const rootFiles = fs.readdirSync(repoRoot);
+    for (const file of rootFiles) {
+        if (file.endsWith(".ps1") || file.endsWith(".sh")) {
+            scanFile(path.join(repoRoot, file));
+        }
+    }
+    const criticalCount = detections.filter((d) => d.severity === "critical").length;
+    const warningCount = detections.filter((d) => d.severity === "warning").length;
+    if (detections.length === 0) {
+        console.log(`${console_chars_1.emoji.success} No dangerous production database commands detected!\n`);
+        console.log(`${console_chars_1.emoji.shield} Protected commands to use:`);
+        console.log(`   ${console_chars_1.emoji.check} pnpm db:push:prod           # Push with backup`);
+        console.log(`   ${console_chars_1.emoji.check} pnpm db:migrate:deploy:prod # Migrate with backup`);
+        console.log(`   ${console_chars_1.emoji.check} pnpm db:exec db push        # Guarded prisma exec\n`);
+        process.exit(0);
+    }
+    console.log(`${console_chars_1.emoji.error} Found ${detections.length} dangerous pattern(s):\n`);
+    for (const d of detections) {
+        const icon = d.severity === "critical" ? console_chars_1.emoji.error : console_chars_1.emoji.warning;
+        const label = d.severity === "critical" ? "CRITICAL" : "WARNING";
+        console.log(`${icon} [${label}] ${d.file}:${d.line}`);
+        console.log(`   ${d.pattern}\n`);
+    }
+    console.log(`${console_chars_1.emoji.hint} Fix: Use protected scripts instead of direct prisma commands`);
+    console.log(`   ${console_chars_1.emoji.check} pnpm db:push:prod           # Creates backup first`);
+    console.log(`   ${console_chars_1.emoji.check} pnpm db:migrate:deploy:prod # Creates backup first\n`);
+    if (criticalCount > 0) {
+        process.exit(1);
+    }
+    // Warnings don't fail the build but are logged
+    process.exit(0);
+}
+// Allow direct execution
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=prod-command-detection.js.map

package/dist/checks/security/prod-command-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prod-command-detection.js","sourceRoot":"","sources":["../../../src/checks/security/prod-command-detection.ts"],"names":[],"mappings":";;AACA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkLH,kBAsDC;AAtOD,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAkD;AAClD,wDAA2E;AAC3E,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,iCAAiC,CAAC;AACvC,QAAA,IAAI,GAAG,wBAAwB,CAAC;AAChC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,iDAAiD,CAAC;AAChE,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AASjC,MAAM,UAAU,GAAgB,EAAE,CAAC;AAEnC,6DAA6D;AAC7D,MAAM,kBAAkB,GAAG;IACzB,2DAA2D;IAC3D;QACE,OAAO,EACL,wFAAwF;QAC1F,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,UAAmB;KAC9B;IACD;QACE,OAAO,EACL,2FAA2F;QAC7F,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,UAAmB;KAC9B;IACD;QACE,OAAO,EACL,+GAA+G;QACjH,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,UAAmB;KAC9B;IACD,kDAAkD;IAClD;QACE,OAAO,EAAE,wEAAwE;QACjF,WAAW,EAAE,yEAAyE;QACtF,QAAQ,EAAE,SAAkB;KAC7B;IACD;QACE,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kDAAkD;QAC/D,QAAQ,EAAE,UAAmB;KAC9B;IACD,yCAAyC;IACzC;QACE,OAAO,EAAE,4EAA4E;QACrF,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,UAAmB;KAC9B;IACD;QACE,OAAO,EAAE,8EAA8E;QACvF,WAAW,EAAE,2DAA2D;QACxE,QAAQ,EAAE,UAAmB;KAC9B;CACF,CAAC;AAEF,4BAA4B;AAC5B,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAElD,kEAAkE;AAClE,MAAM,qBAAqB,GAAG;IAC5B,qBAAqB;IACrB,qBAAqB;IACrB,iBAAiB;IACjB,wBAAwB;IACxB,kBAAkB;IAClB,2BAA2B,EAAE,YAAY;IACzC,yBAAyB,EAAE,gBAAgB;IAC3C,cAAc;IACd,OAAO;CACR,CAAC;AAEF,6CAA6C;AAC7C,IAAI,aAAa,GAAa,EAAE,CAAC;AAEjC,SAAS,aAAa,CAAC,QAAgB;IACrC,2BAA2B;IAC3B,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gCAAgC;IAChC,OAAO,IAAA,8BAAiB,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACpE,IAAI,KAAK,CAAC;YACV,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAExD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,mBAAmB;gBACnB,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBAClD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAElD,yDAAyD;gBACzD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1B,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,WAAW;oBACpB,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gCAAgC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IACL,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC1B,CAAC;YACD,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,MAAM,0CAA0C,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,qDAAqD,CAAC,CAAC;IAElF,2CAA2C;IAC3C,aAAa,GAAG,MAAM,IAAA,0BAAa,EAAC,UAAE,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE/B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/C,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,0CAA0C;IAC1C,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAE/E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,wDAAwD,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,6BAA6B,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,KAAK,iDAAiD,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,KAAK,oDAAoD,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,KAAK,sDAAsD,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,UAAU,UAAU,CAAC,MAAM,0BAA0B,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAK,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAK,CAAC,OAAO,CAAC;QACrE,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,+DAA+D,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,KAAK,qDAAqD,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,KAAK,uDAAuD,CAAC,CAAC;IAEtF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,+CAA+C;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/security/rate-limiting-validation.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env tsx
+/**
+ * Rate Limiting Validation Preflight
+ *
+ * Ensures sensitive endpoints have proper rate limiting:
+ * - Authentication endpoints (login, register, password reset)
+ * - Payment endpoints
+ * - API endpoints with external calls
+ * - File upload endpoints
+ *
+ * BLOCKING: Missing rate limiting enables brute force and DoS attacks
+ */
+export declare const id = "security/rate-limiting-validation";
+export declare const name = "Rate Limiting Validation";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Rate Limiting Validation Preflight";
+export declare const tags: string[];
+//# sourceMappingURL=rate-limiting-validation.d.ts.map

package/dist/checks/security/rate-limiting-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiting-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/security/rate-limiting-validation.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAYH,eAAO,MAAM,EAAE,sCAAsC,CAAC;AACtD,eAAO,MAAM,IAAI,6BAA6B,CAAC;AAC/C,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,uCAAuC,CAAC;AAChE,eAAO,MAAM,IAAI,UAA4B,CAAC"}