@justmpm/firebase-audit 0.1.1 → 0.2.0

package/dist/{chunk-N72YT24M.js → chunk-PIRAC3KT.js}

@@ -239,6 +239,9 @@ function isPublicCondition(condition) {
   if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
   const norm = stripOuterParens(condition);
   const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
   if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
   if (/(^|\|\|)true($|\|\||&&)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
   if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
@@ -271,7 +274,7 @@ function findPublicAllows(rulesFile) {
 import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
-var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011"];
+var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 function createEvidence() {
   let counter = 0;
   return {
@@ -411,6 +414,72 @@ async function runChecks(model, rootDir, opts = {}) {
       }
     }
   }
+  for (const role of model.authorization.roles) {
+    if (role.permissions.length === 0) {
+      findings.push(
+        make(
+          "FBA013",
+          "WARNING",
+          "CONFIRMED",
+          `Role "${role.name}" sem permissions \u2014 nunca autoriza nada.`,
+          `FBA013:${role.name}`,
+          {
+            evidence: [ev("role-empty", role.name, "CONFIRMED")],
+            fix: `Adicionar permissions \xE0 role "${role.name}" ou remov\xEA-la.`
+          }
+        )
+      );
+    }
+  }
+  const publicPaths = new Set(
+    absRules && existsSync2(absRules) ? findPublicAllows(absRules).map((p) => `${p.path}::${p.target}`) : []
+  );
+  const expandOp = (op) => {
+    if (op === "read") return ["read", "get", "list"];
+    if (op === "write") return ["write", "create", "update", "delete"];
+    return [op];
+  };
+  const permsByResource = /* @__PURE__ */ new Map();
+  for (const p of model.authorization.permissions) {
+    const holders = model.authorization.roles.filter((r) => r.permissions.includes(p.name)).map((r) => r.name);
+    const adminOnly = holders.length > 0 && holders.every((h) => h === "admin");
+    const list = permsByResource.get(p.resource) ?? [];
+    list.push({ perm: p.name, operation: p.operation, adminOnly });
+    permsByResource.set(p.resource, list);
+  }
+  for (const rule of model.rules) {
+    const resourceKey = rule.path.replace(/^\/+/, "").split("/")[0] ?? "";
+    if (resourceKey === "databases" || resourceKey === "(unknown)" || resourceKey === "") continue;
+    const entries = permsByResource.get(resourceKey);
+    if (!entries || entries.length === 0) continue;
+    const ruleOps = new Set(rule.operations.flatMap(expandOp));
+    const restricted = entries.filter((e) => e.adminOnly && ruleOps.has(e.operation));
+    if (restricted.length === 0) continue;
+    const isPublicRule = rule.operations.some(
+      (op) => publicPaths.has(`${rule.path}::${op}`)
+    ) || rule.operations.some((op) => publicPaths.has(`${rule.path}::read, ${op}`));
+    if (isPublicRule) continue;
+    const checksAdminClaim = rule.claimReferences.some((c) => c.toLowerCase() === "admin");
+    if (checksAdminClaim) continue;
+    const checksAuth = rule.authReferences.length > 0;
+    if (!checksAuth) continue;
+    findings.push(
+      make(
+        "FBA012",
+        "WARNING",
+        "PROBABLE",
+        `Rule ${rule.path} [${rule.operations.join(", ")}] aceita autenticado sem checar claim de admin, mas contrato restringe ${restricted.map((r) => r.perm).join(", ")} a admin.`,
+        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}`,
+        {
+          file: rule.location.file,
+          line: rule.location.start.line,
+          resource: rule.path,
+          evidence: [ev("rule-contract-mismatch", `${rule.path} vs ${restricted.map((r) => r.perm).join(", ")}`, "PROBABLE", rule.location.file, rule.location.start.line)],
+          fix: "Adicionar checagem de claim de admin na Rule (ex: request.auth.token.admin == true) ou relaxar o contrato."
+        }
+      )
+    );
+  }
   for (const dyn of permissionCalls.dynamic) {
     findings.push(
       make(
@@ -600,7 +669,7 @@ var QueryShapeSchema = z.strictObject({
   location: LocationSchema
 });
 var PermissionSchema = z.strictObject({
-  name: z.string().min(3),
+  name: z.string().min(1),
   resource: z.string().min(1),
   operation: OperationSchema
 });
@@ -726,14 +795,46 @@ async function scan(rootDir, opts = {}) {
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
       const raw = JSON.parse(readFileSync4(d.firestoreIndexesFile, "utf-8"));
-      model.indexes = raw.indexes?.map((i) => ({
-        collectionGroup: i.collectionGroup ?? "(unknown)",
-        queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
-        fields: (i.fields ?? []).map((f) => ({
-          fieldPath: f.fieldPath ?? "(unknown)",
-          mode: f.vectorConfig ? "VECTOR" : f.arrayConfig === "CONTAINS" ? "ARRAY_CONTAINS" : f.order ?? "ASCENDING"
-        }))
-      })) ?? [];
+      const validModes = ["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"];
+      const entries = [];
+      let skipped = 0;
+      for (const i of raw.indexes ?? []) {
+        if (typeof i.collectionGroup !== "string" || i.collectionGroup.length === 0) {
+          skipped += 1;
+          continue;
+        }
+        const fields = [];
+        for (const f of i.fields ?? []) {
+          if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) {
+            skipped += 1;
+            continue;
+          }
+          const mode = f.vectorConfig ? "VECTOR" : f.arrayConfig === "CONTAINS" ? "ARRAY_CONTAINS" : f.order;
+          if (mode !== "ASCENDING" && mode !== "DESCENDING" && mode !== "ARRAY_CONTAINS" && mode !== "VECTOR") {
+            skipped += 1;
+            continue;
+          }
+          fields.push({ fieldPath: f.fieldPath, mode });
+        }
+        entries.push({
+          collectionGroup: i.collectionGroup,
+          queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
+          fields
+        });
+      }
+      model.indexes = entries;
+      if (skipped > 0) {
+        findings_pre.push({
+          rule: "INDEXES_INVALID",
+          severity: "WARNING",
+          confidence: "CONFIRMED",
+          message: `firestore.indexes.json com ${skipped} entrada(s) inv\xE1lidas ignoradas \u2014 verifique campos.`,
+          fingerprint: "INDEXES_INVALID",
+          evidence: [
+            { id: "ev-indexes-skipped", kind: "indexes-parse", summary: `${skipped} inv\xE1lidas`, confidence: "CONFIRMED" }
+          ]
+        });
+      }
     } catch {
       findings_pre.push({
         rule: "INDEXES_INVALID",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-N72YT24M.js";
+} from "./chunk-PIRAC3KT.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -14,15 +14,41 @@ async function main() {
     console.log(pkg.version);
     return;
   }
-  if (cmd !== "scan") {
+  if (cmd === "--help" || cmd === "-h" || cmd === "help") {
+    console.log(`firebase-audit v${pkg.version}
+
+Uso:
+  firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]
+  firebase-audit check [--json] [--adapter=fn] [--cwd=path]   (alias de scan --strict)
+
+Exit codes: 0 ok (ou WARNING/INFO fora do strict); 2 quando --strict encontra ERROR.`);
+    return;
+  }
+  if (cmd !== "scan" && cmd !== "check") {
     console.error(`Comando desconhecido: ${cmd}
 Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     process.exit(1);
   }
+  const strict = args.includes("--strict") || cmd === "check";
   const asJson = args.includes("--json");
-  const strict = args.includes("--strict");
-  const adapterArg = args.find((a) => a.startsWith("--adapter="))?.split("=")[1];
-  const cwdArg = args.find((a) => a.startsWith("--cwd="))?.split("=")[1];
+  const getArg = (name) => {
+    const pref = `--${name}=`;
+    const hit = args.find((a) => a.startsWith(pref));
+    if (hit) return hit.slice(pref.length);
+    const idx = args.findIndex((a) => a === `--${name}`);
+    if (idx !== -1 && args[idx + 1] && !args[idx + 1].startsWith("--")) return args[idx + 1];
+    return void 0;
+  };
+  const knownFlags = /* @__PURE__ */ new Set(["--json", "--strict", "--help", "-h", "help", "--version", "-v"]);
+  for (const a of args.slice(1)) {
+    if (a.startsWith("--") && !a.startsWith("--adapter=") && !a.startsWith("--cwd=") && a !== "--adapter" && a !== "--cwd" && !knownFlags.has(a)) {
+      console.error(`Flag desconhecida: ${a}
+Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
+      process.exit(1);
+    }
+  }
+  const adapterArg = getArg("adapter");
+  const cwdArg = getArg("cwd");
   const rootDir = cwdArg ?? process.cwd();
   const { findings, summary } = await scan(rootDir, { strict, adapterFn: adapterArg });
   if (asJson) {
@@ -35,7 +61,7 @@ FIREBASE AUDIT v${pkg.version}`);
   console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (findings.length === 0) {
     console.log(`
-\u2713 Nenhum problema nos checks V1 implementados (parcial: FBA001-FBA004, FBA009-FBA011).
+\u2713 Nenhum problema nos checks V1+V2 implementados (parcial: FBA001-FBA004, FBA009-FBA013).
 `);
     return;
   }

package/dist/index.d.ts

@@ -650,7 +650,7 @@ declare function findPublicAllows(rulesFile: string): {
  * arquivo geram findings distintos).
  */
 
-declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011"];
+declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
     adapterFn?: string;
 }): Promise<Finding[]>;

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   runChecks,
   scan,
   stripRuleComments
-} from "./chunk-N72YT24M.js";
+} from "./chunk-PIRAC3KT.js";
 
 // src/index.ts
 import { createRequire } from "module";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",