@fourteensystems/shipguard 0.1.0 → 0.2.0

package/dist/next/wrappers.test.js

@@ -0,0 +1,361 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { buildWrapperIndex, analyzeWrapperBody, computeProtection } from "./wrappers.js";
+function makeRoute(overrides = {}) {
+    return {
+        kind: "route-handler",
+        file: "app/api/test/route.ts",
+        isApi: true,
+        isPublic: true,
+        signals: {
+            hasMutationEvidence: true,
+            hasDbWriteEvidence: true,
+            hasStripeWriteEvidence: false,
+            mutationDetails: ["prisma.create"],
+        },
+        ...overrides,
+    };
+}
+const DEFAULT_HINTS = {
+    auth: { functions: ["auth", "getSession", "getServerSession"], middlewareFiles: [], allowlistPaths: [] },
+    rateLimit: { wrappers: ["rateLimit", "withRateLimit"], allowlistPaths: [] },
+    tenancy: { orgFieldNames: [] },
+};
+const DEFAULT_MIDDLEWARE = {
+    authLikely: false,
+    rateLimitLikely: false,
+    matcherPatterns: [],
+};
+describe("buildWrapperIndex", () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = mkdtempSync(path.join(os.tmpdir(), "shipguard-wrapper-"));
+    });
+    afterEach(() => {
+        rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("discovers wrapper from route file", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        mkdirSync(path.join(tmpDir, "src", "lib"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `import { withWorkspace } from "@/lib/auth";
+       export const POST = withWorkspace(async (req) => {
+         await prisma.user.create({ data: { name: "test" } });
+         return Response.json({});
+       });`);
+        writeFileSync(path.join(tmpDir, "src", "lib", "auth.ts"), `export function withWorkspace(handler: any) {
+         return async (req: any) => {
+           const session = await getSession();
+           if (!session) throw new Error("Unauthorized");
+           return handler(req, { session });
+         };
+       }`);
+        const routes = [makeRoute({ file: "app/api/test/route.ts" })];
+        const result = buildWrapperIndex(routes, tmpDir, { rootDir: tmpDir }, ["auth", "getSession"], ["rateLimit"]);
+        expect(result.wrappers.size).toBe(1);
+        const wrapper = result.wrappers.get("withWorkspace");
+        expect(wrapper).toBeDefined();
+        expect(wrapper.resolved).toBe(true);
+        expect(wrapper.evidence.authCallPresent).toBe(true);
+        expect(wrapper.evidence.authEnforced).toBe(true);
+        expect(wrapper.usageCount).toBe(1);
+        expect(wrapper.mutationRouteCount).toBe(1);
+    });
+    it("detects unresolvable npm package wrapper", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `import { withAuth } from "some-npm-package";
+       export const POST = withAuth(async (req) => {
+         return Response.json({});
+       });`);
+        const routes = [makeRoute({ file: "app/api/test/route.ts" })];
+        const result = buildWrapperIndex(routes, tmpDir, { rootDir: tmpDir }, ["auth"], ["rateLimit"]);
+        const wrapper = result.wrappers.get("withAuth");
+        expect(wrapper).toBeDefined();
+        expect(wrapper.resolved).toBe(false);
+    });
+    it("aggregates usage across multiple routes", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "a"), { recursive: true });
+        mkdirSync(path.join(tmpDir, "app", "api", "b"), { recursive: true });
+        mkdirSync(path.join(tmpDir, "src", "lib"), { recursive: true });
+        const routeContent = `import { withWorkspace } from "@/lib/auth";
+       export const POST = withWorkspace(async (req) => {
+         await prisma.user.create({ data: {} });
+         return Response.json({});
+       });`;
+        writeFileSync(path.join(tmpDir, "app", "api", "a", "route.ts"), routeContent);
+        writeFileSync(path.join(tmpDir, "app", "api", "b", "route.ts"), routeContent);
+        writeFileSync(path.join(tmpDir, "src", "lib", "auth.ts"), `export function withWorkspace(handler: any) { return handler; }`);
+        const routes = [
+            makeRoute({ file: "app/api/a/route.ts" }),
+            makeRoute({ file: "app/api/b/route.ts" }),
+        ];
+        const result = buildWrapperIndex(routes, tmpDir, { rootDir: tmpDir }, ["auth"], ["rateLimit"]);
+        const wrapper = result.wrappers.get("withWorkspace");
+        expect(wrapper.usageCount).toBe(2);
+        expect(wrapper.mutationRouteCount).toBe(2);
+    });
+    it("handles same-file wrapper definition", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `function withAuth(handler: any) {
+         return async (req: any) => {
+           const session = await auth();
+           if (!session) throw new Error("Unauthorized");
+           return handler(req);
+         };
+       }
+       export const POST = withAuth(async (req) => {
+         return Response.json({});
+       });`);
+        const routes = [makeRoute({ file: "app/api/test/route.ts" })];
+        const result = buildWrapperIndex(routes, tmpDir, { rootDir: tmpDir }, ["auth"], ["rateLimit"]);
+        const wrapper = result.wrappers.get("withAuth");
+        expect(wrapper).toBeDefined();
+        expect(wrapper.resolved).toBe(true);
+        expect(wrapper.evidence.authCallPresent).toBe(true);
+    });
+});
+describe("analyzeWrapperBody", () => {
+    it("detects auth call + enforcement", () => {
+        const src = `
+      export function withAuth(handler: any) {
+        return async (req: any) => {
+          const session = await getSession();
+          if (!session) {
+            throw new Error("Unauthorized");
+          }
+          return handler(req, { session });
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withAuth", src, ["getSession"], []);
+        expect(evidence.authCallPresent).toBe(true);
+        expect(evidence.authEnforced).toBe(true);
+    });
+    it("detects auth call without enforcement", () => {
+        const src = `
+      export function withLogging(handler: any) {
+        return async (req: any) => {
+          const session = await getSession();
+          console.log("User:", session?.user?.name);
+          return handler(req);
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withLogging", src, ["getSession"], []);
+        expect(evidence.authCallPresent).toBe(true);
+        expect(evidence.authEnforced).toBe(false);
+    });
+    it("detects rate-limit call + enforcement", () => {
+        const src = `
+      export function withRateLimiting(handler: any) {
+        return async (req: any) => {
+          const { success } = await rateLimit(req);
+          if (!success) {
+            return new Response("Too many requests", { status: 429 });
+          }
+          return handler(req);
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withRateLimiting", src, [], ["rateLimit"]);
+        expect(evidence.rateLimitCallPresent).toBe(true);
+        expect(evidence.rateLimitEnforced).toBe(true);
+    });
+    it("detects both auth and rate-limit", () => {
+        const src = `
+      import { getSession } from "next-auth";
+      import { Ratelimit } from "@upstash/ratelimit";
+
+      export function withWorkspace(handler: any) {
+        return async (req: any) => {
+          const session = await getSession();
+          if (!session) return new Response("Unauthorized", { status: 401 });
+
+          const { success } = await rateLimit.limit(session.user.id);
+          if (!success) return new Response("Rate limited", { status: 429 });
+
+          return handler(req, { session });
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withWorkspace", src, ["getSession"], ["rateLimit"]);
+        expect(evidence.authCallPresent).toBe(true);
+        expect(evidence.authEnforced).toBe(true);
+        expect(evidence.rateLimitCallPresent).toBe(true);
+        expect(evidence.rateLimitEnforced).toBe(true);
+    });
+    it("detects Supabase auth pattern in wrapper", () => {
+        const src = `
+      export function withAuth(handler: any) {
+        return async (req: any) => {
+          const { data: { user } } = await supabase.auth.getUser();
+          if (!user) throw new Error("Unauthorized");
+          return handler(req, { user });
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withAuth", src, [], []);
+        expect(evidence.authCallPresent).toBe(true);
+        expect(evidence.authEnforced).toBe(true);
+    });
+    it("detects upstash ratelimit import as RL evidence", () => {
+        const src = `
+      import { Ratelimit } from "@upstash/ratelimit";
+      const ratelimit = new Ratelimit({ ... });
+
+      export function withRL(handler: any) {
+        return async (req: any) => {
+          const { success } = await ratelimit.limit("key");
+          if (!success) throw new Error("Rate limited");
+          return handler(req);
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withRL", src, [], []);
+        expect(evidence.rateLimitCallPresent).toBe(true);
+        expect(evidence.rateLimitEnforced).toBe(true);
+    });
+    it("returns no evidence for generic wrapper", () => {
+        const src = `
+      export function withErrorBoundary(handler: any) {
+        return async (req: any) => {
+          try {
+            return handler(req);
+          } catch (e) {
+            return new Response("Error", { status: 500 });
+          }
+        };
+      }
+    `;
+        const evidence = analyzeWrapperBody("withErrorBoundary", src, ["auth", "getSession"], ["rateLimit"]);
+        expect(evidence.authCallPresent).toBe(false);
+        expect(evidence.rateLimitCallPresent).toBe(false);
+    });
+});
+describe("computeProtection", () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = mkdtempSync(path.join(os.tmpdir(), "shipguard-prot-"));
+    });
+    afterEach(() => {
+        rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("marks satisfied when wrapper has auth enforcement", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `import { withWorkspace } from "@/lib/auth";
+       export const POST = withWorkspace(async (req) => {});`);
+        const wrapperIndex = {
+            wrappers: new Map([
+                ["withWorkspace", {
+                        name: "withWorkspace",
+                        definitionFile: "src/lib/auth.ts",
+                        resolved: true,
+                        evidence: {
+                            authCallPresent: true,
+                            authEnforced: true,
+                            rateLimitCallPresent: true,
+                            rateLimitEnforced: true,
+                            authDetails: ["calls getSession()"],
+                            rateLimitDetails: ["calls rateLimit()"],
+                        },
+                        usageCount: 1,
+                        usageFiles: ["app/api/test/route.ts"],
+                        mutationRouteCount: 1,
+                    }],
+            ]),
+        };
+        const route = makeRoute({ file: "app/api/test/route.ts" });
+        const protection = computeProtection(route, wrapperIndex, DEFAULT_MIDDLEWARE, DEFAULT_HINTS, tmpDir);
+        expect(protection.auth.satisfied).toBe(true);
+        expect(protection.auth.enforced).toBe(true);
+        expect(protection.auth.sources).toContain("wrapper");
+        expect(protection.rateLimit.satisfied).toBe(true);
+    });
+    it("marks unverified when wrapper calls auth but doesn't enforce", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `import { withLogging } from "@/lib/logging";
+       export const POST = withLogging(async (req) => {});`);
+        const wrapperIndex = {
+            wrappers: new Map([
+                ["withLogging", {
+                        name: "withLogging",
+                        definitionFile: "src/lib/logging.ts",
+                        resolved: true,
+                        evidence: {
+                            authCallPresent: true,
+                            authEnforced: false,
+                            rateLimitCallPresent: false,
+                            rateLimitEnforced: false,
+                            authDetails: ["calls getSession()"],
+                            rateLimitDetails: [],
+                        },
+                        usageCount: 1,
+                        usageFiles: ["app/api/test/route.ts"],
+                        mutationRouteCount: 1,
+                    }],
+            ]),
+        };
+        const route = makeRoute({ file: "app/api/test/route.ts" });
+        const protection = computeProtection(route, wrapperIndex, DEFAULT_MIDDLEWARE, DEFAULT_HINTS, tmpDir);
+        expect(protection.auth.satisfied).toBe(false);
+        expect(protection.auth.unverifiedWrappers).toContain("withLogging");
+    });
+    it("marks satisfied when direct auth call in route", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `export async function POST(req: Request) {
+         const session = await auth();
+         return Response.json({});
+       }`);
+        const emptyWrappers = { wrappers: new Map() };
+        const route = makeRoute({ file: "app/api/test/route.ts" });
+        const protection = computeProtection(route, emptyWrappers, DEFAULT_MIDDLEWARE, DEFAULT_HINTS, tmpDir);
+        expect(protection.auth.satisfied).toBe(true);
+        expect(protection.auth.sources).toContain("direct");
+    });
+    it("marks satisfied when middleware covers route", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `export async function POST(req: Request) {
+         return Response.json({});
+       }`);
+        const middleware = {
+            authLikely: true,
+            rateLimitLikely: false,
+            matcherPatterns: ["/api/:path*"],
+        };
+        const emptyWrappers = { wrappers: new Map() };
+        const route = makeRoute({ file: "app/api/test/route.ts", pathname: "/api/test" });
+        const protection = computeProtection(route, emptyWrappers, middleware, DEFAULT_HINTS, tmpDir);
+        expect(protection.auth.satisfied).toBe(true);
+        expect(protection.auth.sources).toContain("middleware");
+    });
+    it("marks unverified when wrapper is unresolved", () => {
+        mkdirSync(path.join(tmpDir, "app", "api", "test"), { recursive: true });
+        writeFileSync(path.join(tmpDir, "app", "api", "test", "route.ts"), `import { withUnknown } from "some-package";
+       export const POST = withUnknown(async (req) => {});`);
+        const wrapperIndex = {
+            wrappers: new Map([
+                ["withUnknown", {
+                        name: "withUnknown",
+                        resolved: false,
+                        evidence: {
+                            authCallPresent: false,
+                            authEnforced: false,
+                            rateLimitCallPresent: false,
+                            rateLimitEnforced: false,
+                            authDetails: [],
+                            rateLimitDetails: [],
+                        },
+                        usageCount: 1,
+                        usageFiles: ["app/api/test/route.ts"],
+                        mutationRouteCount: 1,
+                    }],
+            ]),
+        };
+        const route = makeRoute({ file: "app/api/test/route.ts" });
+        const protection = computeProtection(route, wrapperIndex, DEFAULT_MIDDLEWARE, DEFAULT_HINTS, tmpDir);
+        expect(protection.auth.satisfied).toBe(false);
+        expect(protection.auth.unverifiedWrappers).toContain("withUnknown");
+    });
+});
+//# sourceMappingURL=wrappers.test.js.map

package/dist/next/wrappers.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrappers.test.js","sourceRoot":"","sources":["../../src/next/wrappers.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGzF,SAAS,SAAS,CAAC,YAAgC,EAAE;IACnD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,mBAAmB,EAAE,IAAI;YACzB,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,CAAC,eAAe,CAAC;SACnC;QACD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAc;IAC/B,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;IACxG,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;IAC3E,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;CAC/B,CAAC;AAEF,MAAM,kBAAkB,GAAwB;IAC9C,UAAU,EAAE,KAAK;IACjB,eAAe,EAAE,KAAK;IACtB,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;;;;WAIK,CACN,CAAC;QAEF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAC1C;;;;;;SAMG,CACJ,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7G,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,OAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;;;WAGK,CACN,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,MAAM,YAAY,GAAG;;;;WAId,CAAC;QAER,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;QAC9E,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;QAE9E,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAC1C,iEAAiE,CAClE,CAAC;QAEF,MAAM,MAAM,GAAG;YACb,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;YACzC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;SAC1C,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,OAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,OAAQ,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;;;;;;;;;WASK,CACN,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG;;;;;;;;;;KAUX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG;;;;;;;;KAQX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG;;;;;;;;;;KAUX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,kBAAkB,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;KAeX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG;;;;;;;;KAQX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG;;;;;;;;;;;KAWX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG;;;;;;;;;;KAUX,CAAC;QACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;6DACuD,CACxD,CAAC;QAEF,MAAM,YAAY,GAAiB;YACjC,QAAQ,EAAE,IAAI,GAAG,CAAC;gBAChB,CAAC,eAAe,EAAE;wBAChB,IAAI,EAAE,eAAe;wBACrB,cAAc,EAAE,iBAAiB;wBACjC,QAAQ,EAAE,IAAI;wBACd,QAAQ,EAAE;4BACR,eAAe,EAAE,IAAI;4BACrB,YAAY,EAAE,IAAI;4BAClB,oBAAoB,EAAE,IAAI;4BAC1B,iBAAiB,EAAE,IAAI;4BACvB,WAAW,EAAE,CAAC,oBAAoB,CAAC;4BACnC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;yBACxC;wBACD,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC,uBAAuB,CAAC;wBACrC,kBAAkB,EAAE,CAAC;qBACtB,CAAC;aACH,CAAC;SACH,CAAC;QAEF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAErG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;2DACqD,CACtD,CAAC;QAEF,MAAM,YAAY,GAAiB;YACjC,QAAQ,EAAE,IAAI,GAAG,CAAC;gBAChB,CAAC,aAAa,EAAE;wBACd,IAAI,EAAE,aAAa;wBACnB,cAAc,EAAE,oBAAoB;wBACpC,QAAQ,EAAE,IAAI;wBACd,QAAQ,EAAE;4BACR,eAAe,EAAE,IAAI;4BACrB,YAAY,EAAE,KAAK;4BACnB,oBAAoB,EAAE,KAAK;4BAC3B,iBAAiB,EAAE,KAAK;4BACxB,WAAW,EAAE,CAAC,oBAAoB,CAAC;4BACnC,gBAAgB,EAAE,EAAE;yBACrB;wBACD,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC,uBAAuB,CAAC;wBACrC,kBAAkB,EAAE,CAAC;qBACtB,CAAC;aACH,CAAC;SACH,CAAC;QAEF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAErG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;;;SAGG,CACJ,CAAC;QAEF,MAAM,aAAa,GAAiB,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAEtG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;;SAEG,CACJ,CAAC;QAEF,MAAM,UAAU,GAAwB;YACtC,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,KAAK;YACtB,eAAe,EAAE,CAAC,aAAa,CAAC;SACjC,CAAC;QAEF,MAAM,aAAa,GAAiB,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAE9F,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EACnD;2DACqD,CACtD,CAAC;QAEF,MAAM,YAAY,GAAiB;YACjC,QAAQ,EAAE,IAAI,GAAG,CAAC;gBAChB,CAAC,aAAa,EAAE;wBACd,IAAI,EAAE,aAAa;wBACnB,QAAQ,EAAE,KAAK;wBACf,QAAQ,EAAE;4BACR,eAAe,EAAE,KAAK;4BACtB,YAAY,EAAE,KAAK;4BACnB,oBAAoB,EAAE,KAAK;4BAC3B,iBAAiB,EAAE,KAAK;4BACxB,WAAW,EAAE,EAAE;4BACf,gBAAgB,EAAE,EAAE;yBACrB;wBACD,UAAU,EAAE,CAAC;wBACb,UAAU,EAAE,CAAC,uBAAuB,CAAC;wBACrC,kBAAkB,EAAE,CAAC;qBACtB,CAAC;aACH,CAAC;SACH,CAAC;QAEF,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAErG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rules/auth-boundary-missing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-boundary-missing.d.ts","sourceRoot":"","sources":["../../src/rules/auth-boundary-missing.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAA+B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAInE,eAAO,MAAM,OAAO,0BAA0B,CAAC;AAE/C,wBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,EAAE,CAqFxE"}
+{"version":3,"file":"auth-boundary-missing.d.ts","sourceRoot":"","sources":["../../src/rules/auth-boundary-missing.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAA+B,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAInE,eAAO,MAAM,OAAO,0BAA0B,CAAC;AAc/C,wBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,EAAE,CAqFxE"}

package/dist/rules/auth-boundary-missing.js

@@ -2,9 +2,19 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { isAllowlisted } from "../util/paths.js";
 export const RULE_ID = "AUTH-BOUNDARY-MISSING";
+const SEVERITY_RANK = { critical: 4, high: 3, med: 2, low: 1 };
+function severityFromConfidence(confidence, maxSeverity) {
+    const max = maxSeverity;
+    const maxRank = SEVERITY_RANK[max] ?? 4;
+    // high confidence → use max severity (typically critical)
+    // med confidence → cap at high
+    const computed = confidence === "high" ? max : "high";
+    const computedRank = SEVERITY_RANK[computed] ?? 3;
+    return computedRank > maxRank ? max : computed;
+}
 export function run(index, config) {
     const findings = [];
-    const severity = config.rules[RULE_ID]?.severity ?? "critical";
+    const maxSeverity = config.rules[RULE_ID]?.severity ?? "critical";
     const authAllowlist = config.hints.auth.allowlistPaths;
     // Check mutation route handlers
     for (const route of index.routes.mutationRoutes) {
@@ -14,7 +24,7 @@ export function run(index, config) {
         if (result) {
             findings.push({
                 ruleId: RULE_ID,
-                severity,
+                severity: severityFromConfidence(result.confidence, maxSeverity),
                 confidence: result.confidence,
                 message: `Route handler performs mutations without a recognized auth boundary`,
                 file: route.file,
@@ -43,7 +53,7 @@ export function run(index, config) {
         if (result) {
             findings.push({
                 ruleId: RULE_ID,
-                severity,
+                severity: severityFromConfidence(result.confidence, maxSeverity),
                 confidence: result.confidence,
                 message: `Server action performs mutations without a recognized auth boundary`,
                 file: action.file,
@@ -68,7 +78,7 @@ export function run(index, config) {
         const confidence = proc.procedureType === "public" ? "high" : "med";
         findings.push({
             ruleId: RULE_ID,
-            severity,
+            severity: severityFromConfidence(confidence, maxSeverity),
             confidence,
             message: `tRPC mutation "${proc.name}" uses ${proc.procedureType}Procedure without auth boundary`,
             file: proc.file,
@@ -88,19 +98,19 @@ export function run(index, config) {
     return findings;
 }
 function checkRoute(route, index, config) {
+    // Use ProtectionSummary if available (computed during index building)
+    if (route.protection) {
+        if (route.protection.auth.satisfied)
+            return null;
+        // If wrapper introspection deferred this to WRAPPER-UNRECOGNIZED, don't emit per-route finding
+        if (route.protection.auth.unverifiedWrappers.length > 0)
+            return null;
+    }
     const src = readSource(index.rootDir, route.file);
     if (!src)
         return null;
-    // Check if auth boundary exists (call inside handler body)
-    if (hasAuthCall(src, config.hints.auth.functions))
-        return null;
-    // Check if handler is wrapped by a known auth function (HOF pattern)
-    if (isWrappedByAuthFunction(src, config.hints.auth.functions))
-        return null;
-    // Check if middleware covers this route
-    if (isProtectedByMiddleware(route, index))
-        return null;
     // Check for built-in auth patterns (webhook signatures, cron keys, etc.)
+    // These are always checked regardless of ProtectionSummary
     if (hasBuiltInAuthPattern(src))
         return null;
     // No auth found — determine confidence
@@ -115,12 +125,6 @@ function checkRoute(route, index, config) {
         confidenceRationale = "Medium: mutation evidence present but possible custom auth wrapper detected (not in hints)";
         evidence.push("possible custom auth wrapper detected (not in hints)");
     }
-    // Downgrade if handler is exported via HOF wrapper (unknown function)
-    if (isWrappedByUnknownFunction(src)) {
-        confidence = "med";
-        confidenceRationale = "Medium: handler is wrapped by a higher-order function (may contain auth)";
-        evidence.push("handler exported via HOF wrapper (may contain auth)");
-    }
     // Find the line of the first mutation evidence for precise reporting
     const line = findFirstMutationLine(src, route.signals);
     return { confidence, confidenceRationale, line, evidence };
@@ -147,40 +151,12 @@ function checkServerAction(action, index, config) {
 }
 function hasAuthCall(src, authFunctions) {
     for (const fn of authFunctions) {
-        // Match: fn(), await fn(), const x = fn(), const x = await fn()
         const pattern = new RegExp(`\\b${escapeRegex(fn)}\\s*\\(`, "m");
         if (pattern.test(src))
             return true;
     }
     return false;
 }
-/**
- * Detect Higher-Order Function (HOF) auth wrapper pattern.
- * E.g.: export const GET = withWorkspace(async ({ workspace }) => { ... })
- *       export const POST = withSession(handler)
- *       export default withAuth(handler)
- */
-function isWrappedByAuthFunction(src, authFunctions) {
-    for (const fn of authFunctions) {
-        const escaped = escapeRegex(fn);
-        // export const METHOD = fn(...) or export { fn as METHOD }
-        const hofPattern = new RegExp(`export\\s+(?:const|let|var)\\s+(?:GET|POST|PUT|PATCH|DELETE)\\s*=\\s*${escaped}\\s*\\(`, "m");
-        if (hofPattern.test(src))
-            return true;
-        // export default fn(...)
-        const defaultPattern = new RegExp(`export\\s+default\\s+${escaped}\\s*\\(`, "m");
-        if (defaultPattern.test(src))
-            return true;
-    }
-    return false;
-}
-/**
- * Detect if handler is exported via any HOF wrapper (unknown function name).
- * Used to downgrade confidence when we see the wrapping pattern but don't know the function.
- */
-function isWrappedByUnknownFunction(src) {
-    return /export\s+(?:const|let|var)\s+(?:GET|POST|PUT|PATCH|DELETE)\s*=\s*[a-zA-Z_]\w*\s*\(/m.test(src);
-}
 /**
  * Built-in auth patterns that don't need to be in hints.
  * These are common enough to detect automatically.
@@ -204,49 +180,16 @@ function hasBuiltInAuthPattern(src) {
     if (/process\.env\.\w+SECRET\b/.test(src) && /headers\.get\s*\(/m.test(src))
         return true;
     // Supabase auth boundary — call-based, not import-based.
-    // Client creation (createServerClient, etc.) is NOT an auth boundary.
-    // Only .auth.getUser() / .auth.getSession() counts.
     if (/\.auth\.getUser\s*\(/.test(src))
         return true;
     if (/\.auth\.getSession\s*\(/.test(src))
         return true;
     return false;
 }
-function isProtectedByMiddleware(route, index) {
-    if (!index.middleware.authLikely)
-        return false;
-    // If middleware has no matcher, it applies to all routes
-    if (index.middleware.matcherPatterns.length === 0)
-        return true;
-    // Check if any matcher pattern covers this route
-    const pathname = route.pathname ?? "";
-    for (const pattern of index.middleware.matcherPatterns) {
-        if (pathnameMatchesMatcher(pathname, pattern))
-            return true;
-    }
-    return false;
-}
-function pathnameMatchesMatcher(pathname, matcher) {
-    // Simple matcher check: does the matcher pattern cover this path?
-    // Next.js matchers use a regex-like syntax; for v1, do prefix matching
-    if (matcher.endsWith("/:path*")) {
-        const prefix = matcher.replace("/:path*", "");
-        return pathname.startsWith(prefix);
-    }
-    if (matcher.endsWith("(.*)")) {
-        const prefix = matcher.replace("(.*)", "");
-        return pathname.startsWith(prefix);
-    }
-    return pathname === matcher || pathname.startsWith(matcher + "/");
-}
 function hasPossibleCustomAuth(src) {
-    // Heuristic: looks for patterns like `verifyToken(`, `checkAuth(`, `requireAuth(`
-    // that could be custom auth wrappers we don't know about.
-    // Allow intermediate words: verifyUnsubscribeToken, checkUserAccessLevel, etc.
     if (/\b(verify|check|require|validate|ensure|guard|protect)\w*(Token|Auth|Session|User|Access|Secret|Signature|Permission)\s*\(/i.test(src)) {
         return true;
     }
-    // Direct Authorization header reading is likely auth
     if (/headers?\S*\.get\s*\(\s*["']authorization["']\s*\)/i.test(src)) {
         return true;
     }

package/dist/rules/auth-boundary-missing.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-boundary-missing.js","sourceRoot":"","sources":["../../src/rules/auth-boundary-missing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE/C,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAE,MAAuB;IAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,UAAU,CAAC;IAE/D,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;IAEvD,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QACvD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO;gBACf,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,qEAAqE;gBAC9E,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,WAAW,EAAE;oBACX,oFAAoF;oBACpF,kDAAkD;oBAClD,yFAAyF;iBAC1F;gBACD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QACzD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO;gBACf,QAAQ;gBACR,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,qEAAqE;gBAC9E,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,WAAW,EAAE;oBACX,mDAAmD;oBACnD,yFAAyF;iBAC1F;gBACD,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,aAAa,KAAK,WAAW;YAAE,SAAS;QACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO;YACf,QAAQ;YACR,UAAU;YACV,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,aAAa,iCAAiC;YACjG,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACxF,mBAAmB,EAAE,IAAI,CAAC,aAAa,KAAK,QAAQ;gBAClD,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,gEAAgE;YACpE,WAAW,EAAE;gBACX,iEAAiE;gBACjE,+FAA+F;gBAC/F,oEAAoE;aACrE;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,SAAS,UAAU,CACjB,KAAgB,EAChB,KAAgB,EAChB,MAAuB;IAEvB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,2DAA2D;IAC3D,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,qEAAqE;IACrE,IAAI,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,wCAAwC;IACxC,IAAI,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,yEAAyE;IACzE,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,uCAAuC;IACvC,MAAM,QAAQ,GAAa,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,IAAI,UAAU,GAAe,MAAM,CAAC;IACpC,IAAI,mBAAmB,GAAG,kEAAkE,CAAC;IAE7F,mEAAmE;IACnE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,GAAG,KAAK,CAAC;QACnB,mBAAmB,GAAG,4FAA4F,CAAC;QACnH,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,mBAAmB,GAAG,0EAA0E,CAAC;QACjG,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACvE,CAAC;IAED,qEAAqE;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAEvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwB,EACxB,KAAgB,EAChB,MAAuB;IAEvB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,QAAQ,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,UAAU,GAAe,MAAM,CAAC;IACpC,IAAI,mBAAmB,GAAG,4DAA4D,CAAC;IAEvF,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,GAAG,KAAK,CAAC;QACnB,mBAAmB,GAAG,4FAA4F,CAAC;QACnH,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAExD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,aAAuB;IACvD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,gEAAgE;QAChE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,GAAW,EAAE,aAAuB;IACnE,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,wEAAwE,OAAO,SAAS,EACxF,GAAG,CACJ,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,yBAAyB;QACzB,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,wBAAwB,OAAO,SAAS,EAAE,GAAG,CAAC,CAAC;QACjF,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,GAAW;IAC7C,OAAO,qFAAqF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzG,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,wCAAwC;IACxC,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,4CAA4C;IAC5C,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,uEAAuE;IACvE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,sCAAsC;IACtC,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,6DAA6D;IAC7D,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzF,yDAAyD;IACzD,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAgB,EAAE,KAAgB;IACjE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE/C,yDAAyD;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,iDAAiD;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QACvD,IAAI,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IAC/D,kEAAkE;IAClE,uEAAuE;IACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,kFAAkF;IAClF,0DAA0D;IAC1D,+EAA+E;IAC/E,IAAI,6HAA6H,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5I,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAsC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"auth-boundary-missing.js","sourceRoot":"","sources":["../../src/rules/auth-boundary-missing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAE/C,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEvF,SAAS,sBAAsB,CAAC,UAAsB,EAAE,WAAmB;IACzE,MAAM,GAAG,GAAG,WAAuB,CAAC;IACpC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,0DAA0D;IAC1D,+BAA+B;IAC/B,MAAM,QAAQ,GAAa,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAE,MAAuB;IAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,UAAU,CAAC;IAElE,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;IAEvD,gCAAgC;IAChC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QACvD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC;gBAChE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,qEAAqE;gBAC9E,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,WAAW,EAAE;oBACX,oFAAoF;oBACpF,kDAAkD;oBAClD,yFAAyF;iBAC1F;gBACD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QACzD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC;gBAChE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,qEAAqE;gBAC9E,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,WAAW,EAAE;oBACX,mDAAmD;oBACnD,yFAAyF;iBAC1F;gBACD,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,aAAa,KAAK,WAAW;YAAE,SAAS;QACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;YAAE,SAAS;QAEtD,MAAM,UAAU,GAAe,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC;YACzD,UAAU;YACV,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,aAAa,iCAAiC;YACjG,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACxF,mBAAmB,EAAE,IAAI,CAAC,aAAa,KAAK,QAAQ;gBAClD,CAAC,CAAC,kDAAkD;gBACpD,CAAC,CAAC,gEAAgE;YACpE,WAAW,EAAE;gBACX,iEAAiE;gBACjE,+FAA+F;gBAC/F,oEAAoE;aACrE;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,SAAS,UAAU,CACjB,KAAgB,EAChB,KAAgB,EAChB,MAAuB;IAEvB,sEAAsE;IACtE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAEjD,+FAA+F;QAC/F,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,yEAAyE;IACzE,2DAA2D;IAC3D,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,uCAAuC;IACvC,MAAM,QAAQ,GAAa,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,IAAI,UAAU,GAAe,MAAM,CAAC;IACpC,IAAI,mBAAmB,GAAG,kEAAkE,CAAC;IAE7F,mEAAmE;IACnE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,GAAG,KAAK,CAAC;QACnB,mBAAmB,GAAG,4FAA4F,CAAC;QACnH,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,qEAAqE;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAEvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwB,EACxB,KAAgB,EAChB,MAAuB;IAEvB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,QAAQ,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,IAAI,UAAU,GAAe,MAAM,CAAC;IACpC,IAAI,mBAAmB,GAAG,4DAA4D,CAAC;IAEvF,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,GAAG,KAAK,CAAC;QACnB,mBAAmB,GAAG,4FAA4F,CAAC;QACnH,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAExD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,aAAuB;IACvD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,wCAAwC;IACxC,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,4CAA4C;IAC5C,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,uEAAuE;IACvE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,sCAAsC;IACtC,IAAI,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,6DAA6D;IAC7D,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzF,yDAAyD;IACzD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,6HAA6H,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5I,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAsC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKnE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,aAAa,EAAE,QAAQ,EAsBnC,CAAC;AAEF,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,EAAE,CAehF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMnE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,aAAa,EAAE,QAAQ,EA6BnC,CAAC;AAEF,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,EAAE,CAmBhF"}

package/dist/rules/index.js

@@ -1,6 +1,7 @@
 import * as authBoundary from "./auth-boundary-missing.js";
 import * as rateLimit from "./rate-limit-missing.js";
 import * as tenancyScope from "./tenancy-scope-missing.js";
+import * as wrapperUnrecognized from "./wrapper-unrecognized.js";
 export const RULE_REGISTRY = [
     {
         id: "AUTH-BOUNDARY-MISSING",
@@ -23,6 +24,13 @@ export const RULE_REGISTRY = [
         defaultSeverity: "critical",
         docs: "Shipguard checks that Prisma queries include a tenant scoping field (orgId, tenantId, workspaceId) in their where clause. Only runs when Prisma is detected and the schema contains tenant fields. Configure field names in hints.tenancy.orgFieldNames.",
     },
+    {
+        id: "WRAPPER-UNRECOGNIZED",
+        name: "Wrapper Unrecognized",
+        description: "Flags HOF wrappers that could not be analyzed for auth or rate-limit enforcement.",
+        defaultSeverity: "high",
+        docs: "Shipguard resolves and analyzes HOF wrapper implementations to detect auth and rate-limit enforcement. When a wrapper cannot be resolved or its enforcement cannot be verified, this rule emits a single grouped finding. Add the wrapper name to hints.auth.functions or hints.rateLimit.wrappers to suppress.",
+    },
 ];
 export function runAllRules(index, config) {
     const findings = [];
@@ -36,6 +44,10 @@ export function runAllRules(index, config) {
     if (config.rules["TENANCY-SCOPE-MISSING"]) {
         findings.push(...tenancyScope.run(index, config));
     }
+    // WRAPPER-UNRECOGNIZED is always enabled unless explicitly configured out
+    if (config.rules["WRAPPER-UNRECOGNIZED"] !== undefined ? config.rules["WRAPPER-UNRECOGNIZED"] : true) {
+        findings.push(...wrapperUnrecognized.run(index, config));
+    }
     return findings;
 }
 //# sourceMappingURL=index.js.map