@hoanghainh/komagu 2.0.0 → 2.1.0

package/assess/lsa/knowledge/injection-patterns.md

@@ -57,7 +57,9 @@ Parameterization Cheat Sheet; CWE-89, CWE-564, CWE-943.
   `selectall_arrayref`, `selectrow_*`.
 - **ColdFusion**: `<cfquery>` body, `queryExecute("..." & x)`.
 - **Node**: `connection.query`, `pool.query`, `sequelize.query`,
-  `knex.raw`, `db.collection(...).find/aggregate/$where`.
+  `knex.raw`, `db.collection(...).find/aggregate/$where`, Prisma
+  `$queryRawUnsafe` / `$executeRawUnsafe`, and raw fragments inside tagged
+  templates: Drizzle / postgres.js `sql.raw(x)`, `sql.unsafe(x)`, `Prisma.raw(x)`.
 - **Python**: `cursor.execute`, `executemany`, `engine.execute`,
   `Model.objects.raw`, `extra(where=...)`.
 - **Ruby**: `find_by_sql`, `where("...#{}")`, `order(params[:sort])`,
@@ -80,6 +82,7 @@ Parameterization Cheat Sheet; CWE-89, CWE-564, CWE-943.
 | Regex "no quotes" / blacklist (`select`, `union`) | No | Treat as unsanitized; mention in notes. |
 | `magic_quotes_gpc` | No | Removed in PHP 5.4; never rely on it. |
 | ORM entity methods (`find($id)`, `Where(x => x.Id == id)`) | Yes | Not raw. |
+| JS tagged templates: Drizzle / postgres.js / Slonik `` sql`... ${x}` ``, `` Prisma.sql`...` ``, `` prisma.$queryRaw`...` `` | Yes | `${x}` is sent as a bound parameter. Not the same as an untagged template passed to `db.execute(...)` or `$queryRawUnsafe(...)`, and not `sql.raw(x)` / `Prisma.raw(x)` inside the template, which insert raw text. |
 
 ## 4. NoSQL specifics
 
@@ -115,6 +118,10 @@ A string that is built but **never sent to any sink** is not a finding: verdict
   (`"IN (" + String.join(",", Collections.nCopies(n, "?")) + ")"`) — safe if
   values are bound afterwards.
 - Log or error messages that contain SQL keywords.
+- `sql-raw-fragment` whose argument is a schema object or constant
+  (`sql.raw(`'${seq.seqName}'`)` with `seq = pgSequence("customer_code_seq")`)
+  — not attacker-controlled. The pre-scan marks these `priority: low` when no
+  request input is in the file.
 - MyBatis `#{}` (safe) vs `${}` (unsafe) — do not confuse.
 - Session-only values (`$_SESSION['uid']` set by the server at login) — not
   attacker-controlled, but note if the session value itself came from an

package/assess/lsa/knowledge/stacks/nextjs.md

@@ -0,0 +1,62 @@
+# Next.js Knowledge Profile (App Router, Pages Router, Server Actions)
+
+## Stack Identification
+- **Markers:** `next.config.(js|mjs|ts)`, `"next"` in `package.json`, an `app/` or `src/app/` tree with
+  `route.ts` / `page.tsx`, a `pages/api/` tree, imports from `next/server`, `next/navigation`, `next/headers`.
+- **Auth libraries:** Auth.js / NextAuth (`auth()`, `getServerSession`), Better Auth (`getSession`,
+  `getSessionCookie`), Clerk (`auth()`, `currentUser()`), Lucia, iron-session, or a project wrapper such as
+  `withAuth(handler, { permission })`.
+- **Data access:** Drizzle (`db.query.x.findFirst`, `db.select().from(x).where(...)`), Prisma
+  (`prisma.x.findUnique`), postgres.js, `@vercel/postgres`, Mongoose.
+
+## Entry points (what the pre-scan inventories)
+| Kind | File | URL | Notes |
+|---|---|---|---|
+| Route handler | `app/**/route.ts` | folder path; `(group)` and `@slot` dropped, `[id]` → `{id}`, `[...x]` / `[[...x]]` → `{x*}` | One route per exported `GET`/`POST`/... function or `export const GET = wrap(...)`. `_folder` is private (not routed). |
+| Pages API | `pages/api/**.ts` | `/api/...`, `index` dropped | One handler for all methods; method from `req.method` checks. |
+| Server action | file starting with `"use server"`, or a function whose body starts with `"use server"` | `action:<file>#<name>` | **Every exported function is a public POST endpoint**, callable with any arguments, even if the UI never calls it that way. |
+| Page | `app/**/page.tsx` with a dynamic segment or `searchParams` | folder path | A GET that renders data loaded by id. |
+
+## Where the guard lives
+1. **`middleware.ts` / `proxy.ts` (Next.js 16):** runs before routes listed in `config.matcher`. Usually only
+   checks that a session cookie exists; it rarely checks roles or ownership, and a matcher gap leaves routes
+   open. Never accept middleware alone as an ownership check.
+2. **Per handler:** `const session = await auth(); if (!session) return 401`, or a wrapper (`withAuth`).
+   Check the wrapper once and reuse the result for every route that uses it.
+3. **Server actions:** need their own check inside the action. Layout or page checks do **not** protect an
+   action, because the action can be called directly.
+
+## BOLA / IDOR Patterns
+- **Vulnerable:** id from `params` / `searchParams` / action argument / JSON body used without the user or
+  tenant in the query:
+  ```ts
+  export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+    const { id } = await params;
+    const order = await db.query.orders.findFirst({ where: eq(orders.id, id) }); // any user's order
+    return Response.json(order);
+  }
+
+  "use server";
+  export async function cancelOrder(orderId: number) {
+    const session = await auth();          // authenticated, but...
+    await db.update(orders).set({ status: "cancelled" }).where(eq(orders.id, orderId)); // ...not owner-scoped
+  }
+  ```
+- **Protected:** the session user or tenant is part of the lookup, or the loaded row is compared to it, and
+  a miss returns 404:
+  ```ts
+  const order = await db.query.orders.findFirst({
+    where: and(eq(orders.id, id), eq(orders.tenantId, session.user.tenantId)),
+  });
+  if (!order) return new Response(null, { status: 404 });
+  ```
+- **Mass assignment:** `db.update(users).set(await req.json())` or spreading `formData` into `.set({...})`
+  lets a user write `role`, `tenantId`, `ownerId`.
+- **BFLA:** admin routes guarded only by "is logged in" (middleware cookie check, `auth()` without a role or
+  permission check).
+
+## SQL Injection Patterns
+- **Safe:** Drizzle query builder, Drizzle / postgres.js / Prisma tagged templates (`` sql`... ${x}` ``,
+  `` prisma.$queryRaw`...` ``): `${x}` is a bound parameter.
+- **Vulnerable:** `sql.raw(x)`, `sql.unsafe(x)`, `Prisma.raw(x)`, `$queryRawUnsafe(`...${x}`)`, or an untagged
+  template passed to `db.execute(...)`, with `x` from the request.

package/assess/lsa/prompts/35-privilege-auditor.md

@@ -69,7 +69,9 @@ privileged, and a hinted route can be safe.
 2. **Find the model's fields.** Read the model / entity / table. List the
    privileged fields it holds (role, admin flag, permissions, owner, user,
    tenant, price, amount, balance, status, verified, approved, plan).
-   No privileged field → `safe`, reason "no privileged field".
+   No privileged field → `safe`, reason "no privileged field". If you cannot
+   find or read the model's definition, you do not know its fields: answer
+   `needs_review` (reason "model fields not visible"), never `safe`.
 3. **Look for what limits the fields**, with `file:line`: explicit field
    copy, allow-list (`$fillable` without privileged fields, `permit(...)`,
    `[Bind(Include=...)]`, DTO with only editable fields), validation that

package/assess/lsa/prompts/_shared-rules.md

@@ -84,6 +84,7 @@ Batch files list the right files in `knowledge_files`. If they do not:
 | `classic-asp` | `knowledge/stacks/classic-asp.md` |
 | `perl` | `knowledge/stacks/perl-cgi.md` |
 | `coldfusion` | `knowledge/stacks/coldfusion.md` |
+| `node-nextjs` | `knowledge/stacks/nextjs.md` |
 | `node`, `python`, `ruby` | `knowledge/stacks/node-python-ruby.md` |
 | `sql-procedures` | `knowledge/injection-patterns.md` §1 (stored procedures) |
 

package/assess/lsa/scripts/detect_stack.py

@@ -61,6 +61,8 @@ RULES = [
     ("go-gorilla", "go", "go.md", [("text", r"github\.com/gorilla/mux|mux\.NewRouter")]),
     ("python-fastapi", "python", "node-python-ruby.md", [("text", r"from\s+fastapi\s+import|import\s+fastapi|FastAPI\s*\(")]),
     ("node-nestjs", "typescript", "node-python-ruby.md", [("text", r"@nestjs/(common|core|swagger)")]),
+    ("node-nextjs", "typescript", "nextjs.md", [("name", r"(^|/)next\.config\.(js|mjs|cjs|ts|mts)$"),
+                                                ("text", r"from\s+['\"]next/(server|navigation|headers|cache)['\"]")]),
 ]
 
 DATA_ACCESS = [
@@ -85,6 +87,8 @@ DATA_ACCESS = [
     ("SQLAlchemy (Python)", r"sqlalchemy\.|create_engine|SessionLocal"),
     ("Prisma (Node/TS)", r"PrismaClient|@prisma/client"),
     ("TypeORM (Node/TS)", r"typeorm|@Entity|getRepository"),
+    ("Drizzle ORM (Node/TS)", r"drizzle-orm"),
+    ("postgres.js (Node/TS)", r"from\s+['\"]postgres['\"]|require\(\s*['\"]postgres['\"]\s*\)"),
 ]
 
 DB_HINTS = [
@@ -94,7 +98,7 @@ DB_HINTS = [
 ]
 
 TEXT_SAMPLE_EXTS = {".sql", ".php", ".inc", ".java", ".jsp", ".xml", ".cs", ".vb", ".aspx", ".asax", ".config", ".asp",
-                    ".pl", ".pm", ".cgi", ".cfm", ".cfc", ".js", ".mjs", ".ts", ".py", ".rb", ".kt", ".kts",
+                    ".pl", ".pm", ".cgi", ".cfm", ".cfc", ".js", ".mjs", ".ts", ".tsx", ".jsx", ".py", ".rb", ".kt", ".kts",
                     ".rs", ".go", ".toml", ".mod"}
 
 

package/assess/lsa/scripts/find_injection.py

@@ -28,7 +28,7 @@ LANG_BY_EXT = {
     ".asp": "vb", ".asa": "vb",
     ".pl": "perl", ".pm": "perl", ".cgi": "perl",
     ".cfm": "cfml", ".cfc": "cfml", ".cfml": "cfml",
-    ".js": "js", ".mjs": "js", ".ts": "js", ".py": "python", ".rb": "ruby",
+    ".js": "js", ".mjs": "js", ".cjs": "js", ".mts": "js", ".ts": "js", ".tsx": "js", ".jsx": "js", ".py": "python", ".rb": "ruby",
     ".rs": "rust", ".go": "go",
     ".xml": "xml", ".sql": "sql",
 }
@@ -108,6 +108,28 @@ ASSIGN = {
     "rust": re.compile(r"\b(\w+)\s*(\+=|=)(?!=)"), "go": re.compile(r"\b(\w+)\s*(\+=|=)(?!=)"),
 }
 APPEND_CALL = re.compile(r"\b(\w+)\s*\.\s*(append|Append|AppendLine|concat)\s*\(")
+# JS/TS tagged templates that bind ${...} as parameters: Drizzle / postgres.js / Slonik `sql`, Prisma.sql, $queryRaw
+SQL_TAG = re.compile(r"(?:(?<![\w$])(?:[\w$]+\.)*sql|\$queryRaw|\$executeRaw)\s*(?:<[^`]*>)?\s*$")
+# escape hatches that put raw text into a tagged template
+RAW_FRAGMENT = re.compile(r"\b(?:sql\.raw|sql\.unsafe|Prisma\.raw)\s*\(")
+
+
+def untagged(line: str, lits: List[re.Match], lang: str) -> List[re.Match]:
+    """Drop JS template literals whose tag binds interpolations as query parameters."""
+    if lang != "js":
+        return lits
+    return [m for m in lits if not (m.group(0).startswith("`") and SQL_TAG.search(line[:m.start()]))]
+
+
+def raw_fragment_arg_is_constant(arg: str) -> bool:
+    """True when sql.raw(...) gets a plain string literal (no ${...})."""
+    arg = arg.lstrip()
+    if arg[:1] in ("'", '"'):
+        return True
+    if arg[:1] == "`":
+        end = arg.find("`", 1)
+        return end != -1 and "${" not in arg[1:end]
+    return False
 
 
 def strip_literals(line: str, lit: re.Pattern) -> str:
@@ -188,7 +210,8 @@ class Finder:
         self.seen = set()
         self.suppressed: List[Dict] = []
 
-    def add(self, lang, rel, lineno, lines, rule, subtype, category, sql_var=None, file_has_input=False):
+    def add(self, lang, rel, lineno, lines, rule, subtype, category, sql_var=None, file_has_input=False,
+            low_without_input=False):
         key = (rel, lineno)
         if key in self.seen:
             return
@@ -209,7 +232,8 @@ class Finder:
             "file": rel, "line": lineno, "snippet": redact(snippet(lines, lineno)),
             "sql_var": sql_var, "input_hint": hint,
             "sanitizer_hints": sorted(set(m.group(0)[:30] for m in SANITIZER_RE.finditer(ctx)))[:5],
-            "priority": "high" if hint in ("request_input_on_line", "request_input_nearby") else "normal",
+            "priority": "high" if hint in ("request_input_on_line", "request_input_nearby")
+            else "low" if low_without_input and hint == "none" else "normal",
         })
 
     # ----------------------------------------------------------------------------------
@@ -224,7 +248,7 @@ class Finder:
         for i, line in enumerate(lines, 1):
             if com and com.search(line):
                 continue
-            lits = literals(line, lit)
+            lits = untagged(line, literals(line, lit), lang)
             if not any(STRONG_SQL.search(m.group(0)) for m in lits):
                 continue
             if assign_rx:
@@ -258,7 +282,7 @@ class Finder:
                     if heredoc_sql and INTERP[lang].search(line):
                         self.add(lang, rel, i, lines, "heredoc-interpolation", "string_interpolation", "sql", None, file_has_input)
                     continue
-            lits = literals(line, lit)
+            lits = untagged(line, literals(line, lit), lang)
             sql_lits = [m for m in lits if STRONG_SQL.search(m.group(0))]
             target_var = None
             if assign_rx:
@@ -300,6 +324,11 @@ class Finder:
         for i, line in enumerate(lines, 1):
             if com and com.search(line):
                 continue
+            if lang == "js":
+                fm = RAW_FRAGMENT.search(line)
+                if fm and not raw_fragment_arg_is_constant(line[fm.end():]):
+                    self.add(lang, rel, i, lines, "sql-raw-fragment", "raw_fragment", "sql", None, file_has_input,
+                             low_without_input=True)
             rm = RAW_APIS.search(line)
             if rm:
                 arg = line[rm.end():].strip()

package/assess/lsa/scripts/lsa_common.py

@@ -15,7 +15,14 @@ DEFAULT_CONFIG: Dict = {
         "include": [],
         "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/",
                     "target/", "build/", "dist/", ".git/", ".svn/", ".hg/", "test/", "tests/", "spec/", "docs/",
-                    "*.min.js", "*jquery*.js"],
+                    # framework build output and caches
+                    ".next/", ".nuxt/", ".output/", ".svelte-kit/", ".vercel/", ".netlify/", ".turbo/",
+                    ".parcel-cache/", ".cache/", "out/", "storybook-static/",
+                    # test and coverage output
+                    "coverage/", "test-results/", "playwright-report/", ".nyc_output/",
+                    # Python environments and caches
+                    "__pycache__/", ".venv/", "venv/", ".tox/", ".mypy_cache/", ".pytest_cache/",
+                    "*.min.js", "*jquery*.js", "*.map"],
         "web_roots": [],
         "file_endpoints": "all",
         "max_file_kb": 1024,
@@ -41,7 +48,7 @@ SOURCE_EXTS = {
     ".asp", ".asa",
     ".pl", ".pm", ".cgi",
     ".cfm", ".cfc", ".cfml",
-    ".js", ".mjs", ".ts", ".py", ".rb", ".erb", ".sql",
+    ".js", ".mjs", ".cjs", ".mts", ".ts", ".tsx", ".jsx", ".py", ".rb", ".erb", ".sql",
     ".rs", ".go", ".toml", ".mod",
 }
 

package/assess/lsa/scripts/make_batches.py

@@ -22,7 +22,8 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import load_config, read_json, write_json  # noqa: E402
 
 STACK_KNOWLEDGE = [("php", "php.md"), ("java", "java.md"), ("dotnet", "dotnet.md"), ("classic-asp", "classic-asp.md"),
-                   ("perl", "perl-cgi.md"), ("coldfusion", "coldfusion.md"), ("node", "node-python-ruby.md"),
+                   ("perl", "perl-cgi.md"), ("coldfusion", "coldfusion.md"), ("node-nextjs", "nextjs.md"),
+                   ("node", "node-python-ruby.md"),
                    ("python", "node-python-ruby.md"), ("ruby", "node-python-ruby.md")]
 LANG_KNOWLEDGE = {"php": "php.md", "java": "java.md", "xml": "java.md", "cs": "dotnet.md", "vb": "dotnet.md",
                   "aspx": "dotnet.md", "perl": "perl-cgi.md", "cfml": "coldfusion.md", "js": "node-python-ruby.md",

package/assess/lsa/scripts/map_routes.py

@@ -21,6 +21,7 @@ from typing import Dict, List, Optional, Tuple
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import (KIT_VERSION, compile_id_patterns, is_id_name, iter_source_files,  # noqa: E402
                         line_of, load_config, read_text, write_json)
+from nextjs_routes import middleware_note, nextjs_declared  # noqa: E402
 from privilege import annotate_privilege  # noqa: E402
 
 # --------------------------------------------------------------------------------------
@@ -138,7 +139,7 @@ LANG_BY_EXT = {
     ".asp": "asp", ".asa": "asp",
     ".pl": "perl", ".pm": "perl", ".cgi": "perl",
     ".cfm": "cfml", ".cfc": "cfml", ".cfml": "cfml",
-    ".js": "js", ".mjs": "js", ".ts": "js", ".py": "python", ".rb": "ruby",
+    ".js": "js", ".mjs": "js", ".cjs": "js", ".mts": "js", ".ts": "js", ".tsx": "js", ".jsx": "js", ".py": "python", ".rb": "ruby",
     ".rs": "rust", ".go": "go",
 }
 
@@ -764,7 +765,9 @@ def _scan_route_file_batch(args: Tuple[List[Tuple[str, str]], Dict, set, str]) -
             declared = dotnet_declared(c, rel, t)
         elif lang == "cfml" and ext == ".cfc":
             declared = cfml_declared(c, rel, t)
-        elif lang in ("js", "python", "ruby"):
+        elif lang == "js":
+            declared = nextjs_declared(c, rel, t) or js_py_rb_declared(c, rel, t, lang)
+        elif lang in ("python", "ruby"):
             declared = js_py_rb_declared(c, rel, t, lang)
         elif lang == "rust":
             declared = rust_declared(c, rel, t)
@@ -881,6 +884,11 @@ def map_routes(target: Path, config: Dict, stack_ids: Optional[set] = None, work
     for n, it in enumerate(keep, 1):
         it["route_id"] = f"R-{n:04d}"
     c.items = keep
+    mw_note = middleware_note(target, [rel for _, rel in files], enc) \
+        if any(it["stack"] == "node-nextjs" for it in c.items) else None
+    for it in c.items:
+        if mw_note and it["stack"] == "node-nextjs":
+            it["notes"] = f"{it['notes']}; {mw_note}" if it["notes"] else mw_note
     for it in c.items:
         it["needs_audit_hint"] = bool(any(i.get("is_id_like") for i in it["id_params"]) or it["kind"] == "declared_route")
     c.items = annotate_privilege(c.items, target, config)

package/assess/lsa/scripts/nextjs_routes.py

@@ -0,0 +1,236 @@
+"""Next.js route inventory for map_routes.py. Python 3.8+, standard library only.
+
+Covers App Router route handlers (app/**/route.ts), dynamic server-component pages
+(app/**/page.tsx), Pages Router API routes (pages/api/**), and server actions
+(files that start with "use server", and inline "use server" functions).
+The file path is the URL, so routes come from folder names, not from declarations.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Dict, List, Optional
+
+from lsa_common import is_id_name, line_of, read_text
+
+JS_EXT = r"(?:[cm]?[jt]s|[jt]sx)"
+APP_FILE = re.compile(r"(?:^|/)app/(?:(.+)/)?(route|page)\." + JS_EXT + "$")
+PAGES_API = re.compile(r"(?:^|/)pages/(api(?:/.+)?)\." + JS_EXT + "$")
+METHODS = "GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS"
+HANDLER_DECL = re.compile(r"^export\s+(?:async\s+)?function\s+(" + METHODS + r")\b|^export\s+const\s+(" + METHODS + r")\s*=", re.M)
+HANDLER_REEXPORT = re.compile(r"\b\w+\s+as\s+(" + METHODS + r")\b")
+TOP_LEVEL = re.compile(r"^(?:export|function|async|const|let|var|class)\b", re.M)
+ACTION_EXPORT = re.compile(r"^export\s+(?:default\s+)?async\s+function\s+(\w+)\s*\(|^export\s+const\s+(\w+)\s*=\s*async\s*\(", re.M)
+INLINE_ACTION = re.compile(r"\basync\s+function\s+(\w+)\s*\(|\b(?:const|let)\s+(\w+)\s*=\s*async\s*\(")
+USE_SERVER_STMT = re.compile(r"\s*['\"]use server['\"]")
+REQ_METHOD = re.compile(r"req\.method\s*===?\s*['\"](\w+)['\"]|case\s+['\"](" + METHODS + r")['\"]\s*:")
+MIDDLEWARE_FILE = re.compile(r"^(?:src/)?(middleware|proxy)\." + JS_EXT + "$")
+MATCHER = re.compile(r"matcher\s*:\s*(\[[^\]]*\]|['\"][^'\"]*['\"])")
+
+QUERY_INPUT = re.compile(r"searchParams\??\.get(?:All)?\(\s*['\"]([\w-]+)['\"]")
+FORM_INPUT = re.compile(r"\b\w*[fF]orm\w*\??\.get(?:All)?\(\s*['\"]([\w-]+)['\"]")
+JSON_DESTRUCT = re.compile(r"\{([^{}]*)\}\s*=\s*(?:await\s+)?[\w.]+\.(?:json|formData)\(\)")
+DESTRUCT_NAME = re.compile(r"(?:^|,)\s*(?:\.\.\.)?(\w+)")
+
+GUARD_HINTS = [re.compile(p) for p in [
+    r"\bauth\s*\(\s*\)", r"\bgetServerSession\s*\(", r"\bget(?:Session|User|Auth|CurrentUser)\s*\(", r"\bcurrentUser\s*\(",
+    r"\b(?:with|require|ensure|assert)\w*(?:Auth|User|Session|Role|Permission|Admin)\w*\s*\(",
+    r"\bpermission\s*:\s*['\"][^'\"]+['\"]", r"\bhas(?:Role|Permission)\s*\(",
+    r"redirect\s*\(\s*['\"]/(?:login|signin|sign-in)",
+]]
+
+
+def route_path(folder: Optional[str], prefix: str = "") -> Optional[str]:
+    """URL path for an app/ or pages/ folder; None for private (_folder) segments."""
+    parts = [prefix] if prefix else []
+    for seg in (folder or "").split("/"):
+        if not seg or seg.startswith("@") or (seg.startswith("(") and seg.endswith(")")):
+            continue  # route group or parallel-route slot: not part of the URL
+        if seg.startswith("_"):
+            return None
+        seg = re.sub(r"^(?:\(\.+\))+", "", seg)  # interception marker (.) (..) (...)
+        catch = re.fullmatch(r"\[\[?\.\.\.(\w+)\]\]?", seg)
+        dyn = re.fullmatch(r"\[(\w+)\]", seg)
+        parts.append("{" + catch.group(1) + "*}" if catch else "{" + dyn.group(1) + "}" if dyn else seg)
+    return "/" + "/".join(p for p in parts if p)
+
+
+def _close(text: str, idx: int, open_ch: str, close_ch: str) -> int:
+    """Index of the bracket that closes text[idx] (or len(text))."""
+    depth = 0
+    for j in range(idx, len(text)):
+        if text[j] == open_ch:
+            depth += 1
+        elif text[j] == close_ch:
+            depth -= 1
+            if depth == 0:
+                return j
+    return len(text)
+
+
+def _starts_with_use_server(text: str) -> bool:
+    """True when the first statement of the file is the "use server" directive (comments may come first)."""
+    i, n = 0, len(text)
+    while i < n:
+        if text[i].isspace():
+            i += 1
+        elif text.startswith("//", i):
+            nl = text.find("\n", i)
+            i = n if nl == -1 else nl + 1
+        elif text.startswith("/*", i):
+            end = text.find("*/", i + 2)
+            i = n if end == -1 else end + 2
+        else:
+            break
+    return bool(USE_SERVER_STMT.match(text, i))
+
+
+def _segment_end(text: str, start: int) -> int:
+    nxt = TOP_LEVEL.search(text, text.find("\n", start) + 1 if "\n" in text[start:] else len(text))
+    return nxt.start() if nxt else len(text)
+
+
+def _signature_params(sig: str) -> List[str]:
+    """Parameter names of an action signature; FormData parameters are read through .get() instead."""
+    names: List[str] = []
+    depth, cur, parts = 0, "", []
+    for ch in sig:
+        depth += ch in "({[<"
+        depth -= ch in ")}]>"
+        if ch == "," and depth == 0:
+            parts.append(cur)
+            cur = ""
+        else:
+            cur += ch
+    parts.append(cur)
+    for part in (p.strip() for p in parts):
+        if not part or re.search(r":\s*FormData\b", part):
+            continue
+        if part.startswith("{"):
+            names += DESTRUCT_NAME.findall(part[1:_close(part, 0, "{", "}")])
+        else:
+            m = re.match(r"(?:\.\.\.)?(\w+)", part)
+            if m:
+                names.append(m.group(1))
+    return names
+
+
+class NextRoutes:
+    def __init__(self, c, rel: str, text: str):
+        self.c, self.rel, self.text = c, rel, text
+        self.found = False
+
+    def _param(self, name: str, source: str, line: Optional[int]) -> Dict:
+        return {"name": name, "source": source, "line": line, "is_id_like": is_id_name(name, self.c.idp)}
+
+    def inputs(self, path: str, body: str, base_line: int, args: Optional[List[str]] = None) -> List[Dict]:
+        out = list(self.c.path_params(path)) if path.startswith("/") else []
+        out += [self._param(n, "body", base_line) for n in args or []]
+        for rx, src in ((QUERY_INPUT, "query"), (FORM_INPUT, "form")):
+            out += [self._param(m.group(1), src, base_line + line_of(body, m.start()) - 1) for m in rx.finditer(body)]
+        for m in JSON_DESTRUCT.finditer(body):
+            line = base_line + line_of(body, m.start()) - 1
+            out += [self._param(n, "body", line) for n in DESTRUCT_NAME.findall(m.group(1))]
+        out += self.c.inputs("js", body, base_line)
+        seen, dedup = set(), []
+        for p in out:
+            if p["name"] not in seen:
+                seen.add(p["name"])
+                dedup.append(p)
+        return dedup
+
+    def guards(self, body: str, base_line: int) -> List[Dict]:
+        out = self.c.guards(body, base_line)
+        for rx in GUARD_HINTS:
+            m = rx.search(body)
+            if m:
+                out.append({"hint": m.group(0)[:80], "line": base_line + line_of(body, m.start()) - 1})
+        seen, dedup = set(), []
+        for g in sorted(out, key=lambda g: g["line"]):
+            if (g["hint"], g["line"]) not in seen:
+                seen.add((g["hint"], g["line"]))
+                dedup.append(g)
+        return dedup[:8]
+
+    def add(self, kind: str, method: List[str], path: str, start: int, end: int, notes: str,
+            symbol: Optional[str] = None, args: Optional[List[str]] = None) -> None:
+        body = self.text[start:end]
+        line = line_of(self.text, start)
+        self.c.add(stack="node-nextjs", kind=kind, method=method, path=path,
+                   handler={"file": self.rel, "line": line, "symbol": symbol},
+                   id_params=self.inputs(path, body, line, args), guard_hints=self.guards(body, line),
+                   data_hints=self.c.data_ops(body, line), notes=notes)
+        self.found = True
+
+    def route_handlers(self, path: str) -> None:
+        decls = list(HANDLER_DECL.finditer(self.text))
+        for i, m in enumerate(decls):
+            end = decls[i + 1].start() if i + 1 < len(decls) else len(self.text)
+            self.add("declared_route", [m.group(1) or m.group(2)], path, m.start(), end, "next.js route handler",
+                     symbol=m.group(1) or m.group(2))
+        if not decls:
+            for m in HANDLER_REEXPORT.finditer(self.text):
+                self.add("declared_route", [m.group(1)], path, 0, len(self.text), "next.js route handler (re-exported)",
+                         symbol=m.group(1))
+
+    def page(self, path: str) -> None:
+        if "{" in path or QUERY_INPUT.search(self.text) or "searchParams" in self.text:
+            self.add("file_endpoint", ["GET"], path, 0, len(self.text),
+                     "next.js server component page: check data loaded for params/searchParams")
+
+    def pages_api(self, folder: str) -> None:
+        folder = re.sub(r"(?:^|/)index$", "", folder) or "api"
+        path = route_path(folder)
+        if path is None:
+            return
+        methods = sorted({(m.group(1) or m.group(2)).upper() for m in REQ_METHOD.finditer(self.text)}) or ["ANY"]
+        self.add("declared_route", methods, path, 0, len(self.text), "next.js pages/api route")
+
+    def server_actions(self) -> None:
+        if _starts_with_use_server(self.text):
+            for m in ACTION_EXPORT.finditer(self.text):
+                name = m.group(1) or m.group(2)
+                paren = m.end() - 1
+                args = _signature_params(self.text[paren + 1:_close(self.text, paren, "(", ")")])
+                self.add("declared_route", ["POST"], f"action:{self.rel}#{name}", m.start(),
+                         _segment_end(self.text, m.start()), "next.js server action (callable by any client with its id)",
+                         symbol=name, args=args)
+            return
+        for m in INLINE_ACTION.finditer(self.text):
+            paren = m.end() - 1
+            close = _close(self.text, paren, "(", ")")
+            brace = self.text.find("{", close)
+            if brace == -1 or not USE_SERVER_STMT.match(self.text, brace + 1):
+                continue
+            name = m.group(1) or m.group(2)
+            self.add("declared_route", ["POST"], f"action:{self.rel}#{name}", m.start(),
+                     _close(self.text, brace, "{", "}") + 1, "next.js inline server action (closure values are sent to the client encrypted; arguments are not trusted)",
+                     symbol=name, args=_signature_params(self.text[paren + 1:close]))
+
+
+def nextjs_declared(c, rel: str, text: str) -> bool:
+    """Add Next.js routes found in one JS/TS file. Returns True when the file is a Next.js entry point."""
+    r = NextRoutes(c, rel, text)
+    am = APP_FILE.search(rel)
+    if am:
+        path = route_path(am.group(1))
+        if path is not None:
+            if am.group(2) == "route":
+                r.route_handlers(path)
+            else:
+                r.page(path)
+    pm = PAGES_API.search(rel)
+    if pm:
+        r.pages_api(pm.group(1))
+    r.server_actions()
+    return r.found or bool(am or pm)
+
+
+def middleware_note(target: Path, rels: List[str], enc) -> Optional[str]:
+    """Describe middleware.ts / proxy.ts (Next.js 16) so the auditor checks it covers each route."""
+    for rel in rels:
+        if MIDDLEWARE_FILE.match(rel):
+            m = MATCHER.search(read_text(target / rel, enc))
+            scope = f"matcher: {m.group(1)[:120]}" if m else "no matcher: runs on every route"
+            return f"{rel} runs before this route ({scope}); confirm it enforces auth here"
+    return None

package/assess/lsa/templates/audit-config.json

@@ -8,7 +8,7 @@
   },
   "scope": {
     "include": [],
-    "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/", "target/", "build/", "dist/", ".git/", "test/", "tests/", "spec/", "docs/", "*.min.js", "*jquery*.js"],
+    "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/", "target/", "build/", "dist/", ".git/", ".svn/", ".hg/", "test/", "tests/", "spec/", "docs/", ".next/", ".nuxt/", ".output/", ".svelte-kit/", ".vercel/", ".netlify/", ".turbo/", ".parcel-cache/", ".cache/", "out/", "storybook-static/", "coverage/", "test-results/", "playwright-report/", ".nyc_output/", "__pycache__/", ".venv/", "venv/", ".tox/", ".mypy_cache/", ".pytest_cache/", "*.min.js", "*jquery*.js", "*.map"],
     "web_roots": [],
     "_file_endpoints": "all = every reachable page file is a candidate (recommended); with_inputs = only pages with request input or data access",
     "file_endpoints": "all",