@forge/lint 6.0.0-next.11 → 6.0.0-next.12

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @forge/lint
 
+## 6.0.0-next.12
+
+### Minor Changes
+
+- fbf8219: Adds a lint warning when you use app-managed permissions and the linter still sees API usage that usually needs scopes, but no permission checks in your scanned code or manifest yet.
+
 ## 6.0.0-next.11
 
 ### Patch Changes

package/out/lint/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/lint/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAiBxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,EAAE,aAAa,UAAU,EAAE,EAAE,qBAAkB,KAAG,IA+CrG,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,aAAa,UAAU,EAAE,KAAG,YAQxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,QAAQ,OAAO,QAAQ,EACvB,kBAAiB,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAsC,KACzE,OAAO,CAAC,SAAS,CAOnB,CAAC;AAEF,eAAO,MAAM,IAAI,GACf,aAAa,MAAM,EAAE,EACrB,UAAU,QAAQ,EAClB,aAAa,MAAM,EACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,2BAlBU,MAAM,UACR,OAAO,QAAQ,oBACN,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAa,KAChD,OAAO,CAAC,SAAS,CAea,EAC/B,UAAS,eAAe,EAevB,KACA,OAAO,CAAC,UAAU,EAAE,CAyCtB,CAAC;AAwBF,eAAO,MAAM,QAAQ,GACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,SAAQ,eAAiE,KACxE,OAAO,CAAC,UAAU,EAAE,CAGtB,CAAC"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/lint/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAkBxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,iBAAiB,GAAI,QAAQ,UAAU,EAAE,aAAa,UAAU,EAAE,EAAE,qBAAkB,KAAG,IA+CrG,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,aAAa,UAAU,EAAE,KAAG,YAQxD,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,QAAQ,OAAO,QAAQ,EACvB,kBAAiB,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAsC,KACzE,OAAO,CAAC,SAAS,CAOnB,CAAC;AAEF,eAAO,MAAM,IAAI,GACf,aAAa,MAAM,EAAE,EACrB,UAAU,QAAQ,EAClB,aAAa,MAAM,EACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,2BAlBU,MAAM,UACR,OAAO,QAAQ,oBACN,OAAO,EAAE,CAAC,QAAQ,CAAC,aAAa,KAChD,OAAO,CAAC,SAAS,CAea,EAC/B,UAAS,eAAe,EAgBvB,KACA,OAAO,CAAC,UAAU,EAAE,CAyCtB,CAAC;AAwBF,eAAO,MAAM,QAAQ,GACnB,QAAQ,UAAU,EAClB,gBAAgB,cAAc,EAC9B,SAAQ,eAAiE,KACxE,OAAO,CAAC,UAAU,EAAE,CAGtB,CAAC"}

package/out/lint/lint.js

@@ -21,6 +21,7 @@ const frame_component_linter_1 = require("./linters/frame-component-linter/frame
 const deprecated_egress_permissions_manifest_linter_1 = require("./linters/manifest-linter/deprecated-egress-permissions-manifest-linter");
 const llm_module_linter_1 = require("./linters/llm-module-linter/llm-module-linter");
 const deprecated_api_module_linter_1 = require("./linters/deprecated-api-module-linter/deprecated-api-module-linter");
+const app_managed_permissions_sdk_linter_1 = require("./linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter");
 const function_timeout_linter_1 = require("./linters/function-timeout-linter/function-timeout-linter");
 const reportLintResults = (logger, lintResults, showSummary = true) => {
     let numErrors = 0, numWarnings = 0;
@@ -97,6 +98,7 @@ const lint = async (filesToLint, manifest, environment, logger, statsigService,
     new llm_module_linter_1.LlmModuleLinter(environment, manifest, logger),
     new deprecated_api_module_linter_1.DeprecatedApiModuleLinter(environment, manifest, logger),
     new deprecated_egress_permissions_manifest_linter_1.DeprecatedEgressPermissionsManifestLinter(logger, statsigService),
+    new app_managed_permissions_sdk_linter_1.AppManagedPermissionsSdkLinter(manifest, logger),
     new function_timeout_linter_1.FunctionTimeoutLinter(manifest, logger)
 ]) => {
     const { include, exclude } = await (0, cli_shared_1.listTSConfigIncludeExclude)(new cli_shared_1.FileSystemReader());

package/out/lint/linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter.d.ts

@@ -0,0 +1,10 @@
+import { ManifestSchema as Manifest } from '@forge/manifest';
+import { AbstractLinter } from '../../abstract-linter';
+import { LintInput, LintLogger, LintResult } from '../../linter-interface';
+export declare class AppManagedPermissionsSdkLinter extends AbstractLinter {
+    private readonly manifest;
+    constructor(manifest: Manifest, logger: LintLogger);
+    bootstrap(): Promise<void>;
+    batchExecuteImpl(inputs?: LintInput[]): Promise<LintResult[]>;
+}
+//# sourceMappingURL=app-managed-permissions-sdk-linter.d.ts.map

package/out/lint/linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-managed-permissions-sdk-linter.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,IAAI,QAAQ,EAAiB,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAa,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOtF,qBAAa,8BAA+B,SAAQ,cAAc;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ,EACnC,MAAM,EAAE,UAAU;IAKd,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1B,gBAAgB,CAAC,MAAM,GAAE,SAAS,EAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CA8BxE"}

package/out/lint/linters/app-managed-permissions-sdk-linter/app-managed-permissions-sdk-linter.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppManagedPermissionsSdkLinter = void 0;
+const manifest_1 = require("@forge/manifest");
+const abstract_linter_1 = require("../../abstract-linter");
+const linter_interface_1 = require("../../linter-interface");
+const text_1 = require("../../text");
+const detect_permission_sensitive_usage_1 = require("./detect-permission-sensitive-usage");
+const detect_permissions_sdk_usage_1 = require("./detect-permissions-sdk-usage");
+const manifest_declarative_permission_handling_1 = require("./manifest-declarative-permission-handling");
+class AppManagedPermissionsSdkLinter extends abstract_linter_1.AbstractLinter {
+    manifest;
+    constructor(manifest, logger) {
+        super(logger);
+        this.manifest = manifest;
+    }
+    async bootstrap() {
+    }
+    async batchExecuteImpl(inputs = []) {
+        if (this.manifest.permissions?.enforcement !== 'app-managed') {
+            return [];
+        }
+        const declaresHandling = (0, manifest_declarative_permission_handling_1.manifestDeclaresDeclarativePermissionHandling)(this.manifest) ||
+            inputs.some(({ ast }) => ast !== null && (0, detect_permissions_sdk_usage_1.doesAstUsePermissionsSdk)(ast));
+        if (declaresHandling) {
+            return [];
+        }
+        const hasPermissionSensitiveUsage = inputs.some(({ ast }) => (0, detect_permission_sensitive_usage_1.doesAstIndicatePermissionSensitiveUsage)(ast));
+        if (!hasPermissionSensitiveUsage) {
+            return [];
+        }
+        const lintResult = new linter_interface_1.LintResult(manifest_1.MANIFEST_FILE);
+        lintResult.add({
+            class: linter_interface_1.LintClass.Warning,
+            message: text_1.messages.verifiers.appManagedPermissionsSdk.message(),
+            reference: text_1.messages.verifiers.appManagedPermissionsSdk.reference,
+            line: 0,
+            column: 0
+        });
+        return [lintResult];
+    }
+}
+exports.AppManagedPermissionsSdkLinter = AppManagedPermissionsSdkLinter;

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permission-sensitive-usage.d.ts

@@ -0,0 +1,3 @@
+import type { ASTParseResult } from '../../../parse';
+export declare const doesAstIndicatePermissionSensitiveUsage: (ast: ASTParseResult | null) => boolean;
+//# sourceMappingURL=detect-permission-sensitive-usage.d.ts.map

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permission-sensitive-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-permission-sensitive-usage.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/app-managed-permissions-sdk-linter/detect-permission-sensitive-usage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAyBrD,eAAO,MAAM,uCAAuC,GAAI,KAAK,cAAc,GAAG,IAAI,KAAG,OAoBpF,CAAC"}

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permission-sensitive-usage.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doesAstIndicatePermissionSensitiveUsage = void 0;
+const visitors_1 = require("../permission-linter/visitors");
+const PERMISSION_SENSITIVE_VISITORS = [
+    new visitors_1.ProductNodeVisitor(),
+    new visitors_1.ExternalApiCallVisitor(),
+    new visitors_1.StorageAPINodeVisitor(),
+    new visitors_1.UIHookNodeVisitor(),
+    new visitors_1.NotificationAPINodeVisitor(),
+    new visitors_1.ImageUrlVisitor()
+];
+const doesAstIndicatePermissionSensitiveUsage = (ast) => {
+    if (!ast?.parsed) {
+        return false;
+    }
+    let found = false;
+    ast.traverse({
+        enter: (node, parent) => {
+            if (found) {
+                return;
+            }
+            for (const visitor of PERMISSION_SENSITIVE_VISITORS) {
+                visitor.visit(node, parent, (_match) => {
+                    found = true;
+                });
+            }
+        }
+    });
+    return found;
+};
+exports.doesAstIndicatePermissionSensitiveUsage = doesAstIndicatePermissionSensitiveUsage;

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permissions-sdk-usage.d.ts

@@ -0,0 +1,3 @@
+import type { ASTParseResult } from '../../../parse';
+export declare const doesAstUsePermissionsSdk: (ast: ASTParseResult) => boolean;
+//# sourceMappingURL=detect-permissions-sdk-usage.d.ts.map

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permissions-sdk-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-permissions-sdk-usage.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/app-managed-permissions-sdk-linter/detect-permissions-sdk-usage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA4JrD,eAAO,MAAM,wBAAwB,GAAI,KAAK,cAAc,KAAG,OAwC9D,CAAC"}

package/out/lint/linters/app-managed-permissions-sdk-linter/detect-permissions-sdk-usage.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doesAstUsePermissionsSdk = void 0;
+const typescript_estree_1 = require("@typescript-eslint/typescript-estree");
+const FORGE_API_MODULE = '@forge/api';
+const FORGE_BRIDGE_MODULE = '@forge/bridge';
+const FORGE_REACT_MODULE = '@forge/react';
+const PERMISSIONS_SDK_METHODS = new Set(['hasPermission', 'hasScope', 'canFetchFrom', 'canLoadResource']);
+const BRIDGE_SDK_IMPORTS = new Set(['checkPermissions', 'createPermissionUtils']);
+const getImportSource = (node) => {
+    if (node.source.type === typescript_estree_1.AST_NODE_TYPES.Literal && typeof node.source.value === 'string') {
+        return node.source.value;
+    }
+    return null;
+};
+const collectImportBindings = (program) => {
+    const forgeApiPermissions = new Set();
+    const forgeApiNamespaces = new Set();
+    const forgeBridgeSdk = new Set();
+    const forgeBridgeNamespaces = new Set();
+    const forgeReactUsePermissions = new Set();
+    const forgeReactNamespaces = new Set();
+    for (const stmt of program.body) {
+        if (stmt.type !== typescript_estree_1.AST_NODE_TYPES.ImportDeclaration)
+            continue;
+        const source = getImportSource(stmt);
+        if (!source)
+            continue;
+        if (source === FORGE_API_MODULE) {
+            for (const spec of stmt.specifiers) {
+                if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportSpecifier) {
+                    if (spec.imported.type === typescript_estree_1.AST_NODE_TYPES.Identifier && spec.imported.name === 'permissions') {
+                        forgeApiPermissions.add(spec.local.name);
+                    }
+                }
+                else if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportNamespaceSpecifier) {
+                    forgeApiNamespaces.add(spec.local.name);
+                }
+            }
+        }
+        else if (source === FORGE_BRIDGE_MODULE) {
+            for (const spec of stmt.specifiers) {
+                if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportNamespaceSpecifier) {
+                    forgeBridgeNamespaces.add(spec.local.name);
+                }
+                else if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportSpecifier && spec.imported.type === typescript_estree_1.AST_NODE_TYPES.Identifier) {
+                    if (BRIDGE_SDK_IMPORTS.has(spec.imported.name)) {
+                        forgeBridgeSdk.add(spec.local.name);
+                    }
+                }
+            }
+        }
+        else if (source === FORGE_REACT_MODULE) {
+            for (const spec of stmt.specifiers) {
+                if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportNamespaceSpecifier) {
+                    forgeReactNamespaces.add(spec.local.name);
+                }
+                else if (spec.type === typescript_estree_1.AST_NODE_TYPES.ImportSpecifier && spec.imported.type === typescript_estree_1.AST_NODE_TYPES.Identifier) {
+                    if (spec.imported.name === 'usePermissions') {
+                        forgeReactUsePermissions.add(spec.local.name);
+                    }
+                }
+            }
+        }
+    }
+    return {
+        forgeApiPermissions,
+        forgeApiNamespaces,
+        forgeBridgeSdk,
+        forgeBridgeNamespaces,
+        forgeReactUsePermissions,
+        forgeReactNamespaces
+    };
+};
+const flattenMemberExpression = (expr) => {
+    const chain = [];
+    let current = expr;
+    while (current.type === typescript_estree_1.AST_NODE_TYPES.MemberExpression) {
+        if (current.property.type !== typescript_estree_1.AST_NODE_TYPES.Identifier) {
+            return undefined;
+        }
+        chain.unshift(current.property.name);
+        current = current.object;
+    }
+    return { root: current, chain };
+};
+const isForgeApiPermissionsCall = (callee, bindings) => {
+    const flat = flattenMemberExpression(callee);
+    if (!flat)
+        return false;
+    const { root, chain } = flat;
+    if (root.type !== typescript_estree_1.AST_NODE_TYPES.Identifier) {
+        return false;
+    }
+    if (chain.length === 1 && PERMISSIONS_SDK_METHODS.has(chain[0])) {
+        return bindings.forgeApiPermissions.has(root.name);
+    }
+    if (chain.length === 2 &&
+        chain[0] === 'permissions' &&
+        PERMISSIONS_SDK_METHODS.has(chain[1]) &&
+        bindings.forgeApiNamespaces.has(root.name)) {
+        return true;
+    }
+    return false;
+};
+const isForgeBridgeSdkCall = (callee, bindings) => {
+    const flat = flattenMemberExpression(callee);
+    if (!flat)
+        return false;
+    const { root, chain } = flat;
+    if (root.type !== typescript_estree_1.AST_NODE_TYPES.Identifier)
+        return false;
+    if (chain.length !== 1 || !BRIDGE_SDK_IMPORTS.has(chain[0]))
+        return false;
+    return bindings.forgeBridgeNamespaces.has(root.name);
+};
+const isForgeReactUsePermissionsCall = (callee, bindings) => {
+    const flat = flattenMemberExpression(callee);
+    if (!flat)
+        return false;
+    const { root, chain } = flat;
+    if (root.type !== typescript_estree_1.AST_NODE_TYPES.Identifier)
+        return false;
+    if (chain.length !== 1 || chain[0] !== 'usePermissions')
+        return false;
+    return bindings.forgeReactNamespaces.has(root.name);
+};
+const doesAstUsePermissionsSdk = (ast) => {
+    const program = ast.parsed;
+    if (!program)
+        return false;
+    const bindings = collectImportBindings(program);
+    let found = false;
+    ast.traverse({
+        enter: (node) => {
+            if (found || node.type !== typescript_estree_1.AST_NODE_TYPES.CallExpression)
+                return;
+            const callee = node.callee;
+            if (callee.type === typescript_estree_1.AST_NODE_TYPES.Identifier && bindings.forgeBridgeSdk.has(callee.name)) {
+                found = true;
+                return;
+            }
+            if (callee.type === typescript_estree_1.AST_NODE_TYPES.Identifier && bindings.forgeReactUsePermissions.has(callee.name)) {
+                found = true;
+                return;
+            }
+            if (callee.type === typescript_estree_1.AST_NODE_TYPES.MemberExpression && isForgeApiPermissionsCall(callee, bindings)) {
+                found = true;
+                return;
+            }
+            if (callee.type === typescript_estree_1.AST_NODE_TYPES.MemberExpression && isForgeBridgeSdkCall(callee, bindings)) {
+                found = true;
+                return;
+            }
+            if (callee.type === typescript_estree_1.AST_NODE_TYPES.MemberExpression && isForgeReactUsePermissionsCall(callee, bindings)) {
+                found = true;
+            }
+        }
+    });
+    return found;
+};
+exports.doesAstUsePermissionsSdk = doesAstUsePermissionsSdk;

package/out/lint/linters/app-managed-permissions-sdk-linter/manifest-declarative-permission-handling.d.ts

@@ -0,0 +1,3 @@
+import type { ManifestSchema as Manifest } from '@forge/manifest';
+export declare const manifestDeclaresDeclarativePermissionHandling: (manifest: Manifest) => boolean;
+//# sourceMappingURL=manifest-declarative-permission-handling.d.ts.map

package/out/lint/linters/app-managed-permissions-sdk-linter/manifest-declarative-permission-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-declarative-permission-handling.d.ts","sourceRoot":"","sources":["../../../../src/lint/linters/app-managed-permissions-sdk-linter/manifest-declarative-permission-handling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,IAAI,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAiDlE,eAAO,MAAM,6CAA6C,GAAI,UAAU,QAAQ,KAAG,OAuBlF,CAAC"}

package/out/lint/linters/app-managed-permissions-sdk-linter/manifest-declarative-permission-handling.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.manifestDeclaresDeclarativePermissionHandling = void 0;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const moduleEntryUsesPermissionDisplayConditions = (entry) => {
+    if (!isRecord(entry))
+        return false;
+    const displayConditions = entry.displayConditions;
+    if (!isRecord(displayConditions))
+        return false;
+    return Object.prototype.hasOwnProperty.call(displayConditions, 'permissions');
+};
+const expressionReferencesEventPermissions = (expression) => typeof expression === 'string' && expression.includes('event.permissions');
+const triggerEntryUsesEventPermissionsFilter = (entry) => {
+    if (!isRecord(entry))
+        return false;
+    const topFilter = entry.filter;
+    if (isRecord(topFilter) && expressionReferencesEventPermissions(topFilter.expression)) {
+        return true;
+    }
+    const events = entry.events;
+    if (!Array.isArray(events))
+        return false;
+    for (const ev of events) {
+        if (!isRecord(ev))
+            continue;
+        const filter = ev.filter;
+        if (isRecord(filter) && expressionReferencesEventPermissions(filter.expression)) {
+            return true;
+        }
+    }
+    return false;
+};
+const manifestDeclaresDeclarativePermissionHandling = (manifest) => {
+    const modules = manifest.modules;
+    if (!isRecord(modules))
+        return false;
+    for (const value of Object.values(modules)) {
+        if (!Array.isArray(value))
+            continue;
+        for (const entry of value) {
+            if (moduleEntryUsesPermissionDisplayConditions(entry)) {
+                return true;
+            }
+        }
+    }
+    const triggers = modules.trigger;
+    if (Array.isArray(triggers)) {
+        for (const entry of triggers) {
+            if (triggerEntryUsesEventPermissionsFilter(entry)) {
+                return true;
+            }
+        }
+    }
+    return false;
+};
+exports.manifestDeclaresDeclarativePermissionHandling = manifestDeclaresDeclarativePermissionHandling;

package/out/lint/text/messages.d.ts

@@ -69,6 +69,10 @@ export declare const messages: {
             message: () => string;
             reference: string;
         };
+        appManagedPermissionsSdk: {
+            message: () => string;
+            reference: string;
+        };
         functionTimeout: {
             shared: {
                 message: (functionKey: string, conflictingModuleKey: string, conflictingModuleType: string) => string;

package/out/lint/text/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/lint/text/messages.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ;;;2BAGA,MAAM;2BAEN,MAAM,KAAG,MAAM;;;;2BAKf,MAAM;2BAER,MAAM;;;;2BAKJ,MAAM;2BAEN,MAAM,KAAG,MAAM;;;;iCAKT,MAAM;;;;iCAKN,MAAM;;;;8BAKT,MAAM,OAAO,MAAM;;;;+BAKlB,MAAM,UAAU,MAAM,QAAQ,MAAM,GAAG,SAAS,SAAS,MAAM;;;;6BAKjE,MAAM;;;;+BAIJ,MAAM,QAAQ,MAAM,SAAS,MAAM;;;;8BAKpC,MAAM;;;;8BAIN,MAAM;;;;8BAIN,MAAM;;;;;;;;;oCASF,MAAM;;;;;6BAOX,MAAM,WAAW,MAAM;;;;;;;;;uCAWf,MAAM,wBAAwB,MAAM,yBAAyB,MAAM;;;;uCAKnE,MAAM,kBAAkB,MAAM,aAAa,MAAM,cAAc,MAAM;;;;;CAMnG,CAAC"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/lint/text/messages.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ;;;2BAGA,MAAM;2BAEN,MAAM,KAAG,MAAM;;;;2BAKf,MAAM;2BAER,MAAM;;;;2BAKJ,MAAM;2BAEN,MAAM,KAAG,MAAM;;;;iCAKT,MAAM;;;;iCAKN,MAAM;;;;8BAKT,MAAM,OAAO,MAAM;;;;+BAKlB,MAAM,UAAU,MAAM,QAAQ,MAAM,GAAG,SAAS,SAAS,MAAM;;;;6BAKjE,MAAM;;;;+BAIJ,MAAM,QAAQ,MAAM,SAAS,MAAM;;;;8BAKpC,MAAM;;;;8BAIN,MAAM;;;;8BAIN,MAAM;;;;;;;;;oCASF,MAAM;;;;;6BAOX,MAAM,WAAW,MAAM;;;;;;;;;;;;;uCAgBf,MAAM,wBAAwB,MAAM,yBAAyB,MAAM;;;;uCAKnE,MAAM,kBAAkB,MAAM,aAAa,MAAM,cAAc,MAAM;;;;;CAMnG,CAAC"}

package/out/lint/text/messages.js

@@ -75,6 +75,10 @@ exports.messages = {
             message: () => `The \"storage\" export from \"@forge/api\" is deprecated. Use the \"@forge/kvs\" package instead.`,
             reference: 'deprecated-api-storage'
         },
+        appManagedPermissionsSdk: {
+            message: () => 'App-managed permissions enforcement is set in the manifest. Source files include API usage that requires OAuth scopes (such as requestJira or external fetch), without checks for when those scopes are missing. Use the Permissions SDK (@forge/api, @forge/bridge, or @forge/react), displayConditions.permissions, or a trigger filter that references event.permissions.',
+            reference: 'https://go.atlassian.com/forge-permissions-sdk'
+        },
         functionTimeout: {
             shared: {
                 message: (functionKey, conflictingModuleKey, conflictingModuleType) => `Function "${functionKey}" is used by a consumer and ${conflictingModuleType} "${conflictingModuleKey}". Consumer functions must not be shared with other modules. Use a separate function for each module type.`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/lint",
-  "version": "6.0.0-next.11",
+  "version": "6.0.0-next.12",
   "description": "Linting for forge apps",
   "main": "out/index.js",
   "license": "SEE LICENSE IN LICENSE.txt",