@justmpm/firebase-audit 0.3.1 → 0.4.0

package/dist/{chunk-UMQH7UDI.js → chunk-5PVQB3ZI.js}

@@ -1,5 +1,6 @@
 // src/scan.ts
 import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
 import { parse as parseYaml } from "yaml";
 
 // src/discovery.ts
@@ -54,7 +55,6 @@ var SERVER_HINTS_SEGMENTS = [
   "functions",
   "server",
   "backend",
-  "api",
   "scripts"
 ];
 function classifyOrigin(file, content) {
@@ -71,7 +71,8 @@ function classifyOrigin(file, content) {
     return "SERVER";
   }
   if (rel.includes("src/app/api/")) return "SERVER";
-  if (hasSeg("functions", "server", "backend", "scripts")) return "SERVER";
+  if (rel.includes("server/api/")) return "SERVER";
+  if (hasSeg(...SERVER_HINTS_SEGMENTS)) return "SERVER";
   if (content.includes("firebase-admin") || content.includes("firebase-functions")) {
     return "CLIENT";
   }
@@ -102,9 +103,35 @@ function emptyModel(rootDir, d) {
     graph: []
   };
 }
+async function enrichWithGraph(rootDir, d) {
+  try {
+    const ai = await import("@justmpm/ai-tool");
+    const res = await ai.map({ cwd: rootDir, format: "json" });
+    const files = Array.isArray(res.files) ? res.files : [];
+    const code = files.map((f) => String(f.path).replace(/\\/g, "/")).filter((p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p)).filter((p) => !p.includes("node_modules/") && !/(^|\/)dist\//.test(p)).slice(0, 500);
+    const { readFileSync: readSync, existsSync: existsSyncFn, statSync } = await import("fs");
+    const { join: joinP } = await import("path");
+    for (const rel of code) {
+      let content = "";
+      try {
+        const abs = joinP(rootDir, rel);
+        if (!existsSyncFn(abs)) continue;
+        if (statSync(abs).size > 100 * 1024) continue;
+        content = readSync(abs, "utf-8");
+      } catch {
+        content = "";
+      }
+      const origin = classifyOrigin(rel, content);
+      if (origin === "CLIENT") d.clientFiles.push(rel);
+      else if (origin === "SERVER") d.serverFiles.push(rel);
+    }
+  } catch {
+  }
+}
 
 // src/rules.ts
 import { readFileSync as readFileSync2 } from "fs";
+import { createHash } from "crypto";
 var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
 var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
 function stripRuleComments(content) {
@@ -194,19 +221,105 @@ function findBlockEnd(content, openBraceIndex) {
 function normalizeTarget(target) {
   return target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean).sort().join(",");
 }
-function extractRules(rulesFile, relFile) {
-  const rawContent = readFileSync2(rulesFile, "utf-8");
-  const content = stripRuleComments(rawContent);
-  const rules = [];
-  const matchBlocks = [];
+function parseMatchBlocks(content) {
+  const blocks = [];
   const matchRe = new RegExp(MATCH_RE.source, "g");
   let m;
   while ((m = matchRe.exec(content)) !== null) {
     const before = content.slice(0, m.index);
     const line = before.split("\n").length;
     const openBrace = m.index + m[0].length - 1;
-    matchBlocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
+    blocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
+  }
+  return blocks;
+}
+function buildFullPath(containingAsc) {
+  const parts = [];
+  for (const b of containingAsc) {
+    const p = b.path.trim();
+    if (/^\/databases\/\{[^}]+\}\/documents\/?$/.test(p)) continue;
+    const stripped = p.replace(/^\/+|\/+$/g, "");
+    if (stripped.length === 0) continue;
+    const docIdx = stripped.indexOf("/documents/");
+    if (stripped.startsWith("databases/") && docIdx !== -1) {
+      const rest = stripped.slice(docIdx + "/documents/".length);
+      if (rest.length > 0) parts.push(rest);
+      continue;
+    }
+    parts.push(stripped);
+  }
+  if (parts.length === 0) return "/(unknown)";
+  return "/" + parts.join("/");
+}
+function parseRuleFunctions(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, fn] of parseRuleFunctionsDetailed(content)) {
+    out.set(name, fn.body);
+  }
+  return out;
+}
+function parseRuleFunctionsDetailed(content) {
+  const out = /* @__PURE__ */ new Map();
+  const re = /function\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const openBrace = m.index + m[0].length - 1;
+    const end = findBlockEnd(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    const params = m[2].trim() === "" ? [] : m[2].split(",").map((s) => s.trim()).filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
+    out.set(m[1], { params, body });
+  }
+  return out;
+}
+function inlineHelperArgs(body, params, args) {
+  let out = body;
+  for (let i = 0; i < params.length; i++) {
+    const p = params[i];
+    const a = (args[i] ?? "").trim();
+    if (!p || !a) continue;
+    out = out.replace(new RegExp(`\\b${p}\\b`, "g"), () => a);
+  }
+  return out;
+}
+function inlineHelpersInCondition(condition, detailed) {
+  let out = condition;
+  for (const [name, fn] of detailed) {
+    const re = new RegExp(`\\b${name}\\s*\\(([^()]*)\\)`, "g");
+    out = out.replace(re, (_m, argsStr) => {
+      const args = argsStr.length === 0 ? [] : String(argsStr).split(",").map((s) => s.trim());
+      const inlined = inlineHelperArgs(fn.body, fn.params, args);
+      return `(${inlined})`;
+    });
   }
+  return out;
+}
+function resolveHelperCondition(condition, functions) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const body = functions.get(call[1]);
+  if (body === void 0) return condition;
+  return body;
+}
+function resolveHelperConditionDetailed(condition, detailed) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const fn = detailed.get(call[1]);
+  if (!fn) return condition;
+  const args = call[2].length === 0 ? [] : call[2].split(",").map((s) => s.trim());
+  return inlineHelperArgs(fn.body, fn.params, args);
+}
+function extractRules(rulesFile, relFile) {
+  const rawContent = readFileSync2(rulesFile, "utf-8");
+  return extractRulesContent(rawContent, relFile);
+}
+function extractRulesContent(rawContent, relFile) {
+  const content = stripRuleComments(rawContent);
+  const rules = [];
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
+  const matchBlocks = parseMatchBlocks(content);
   const allowRe = new RegExp(ALLOW_RE.source, "g");
   let a;
   let idx = 0;
@@ -214,26 +327,37 @@ function extractRules(rulesFile, relFile) {
     const before = content.slice(0, a.index);
     const line = before.split("\n").length;
     const target = a[1];
-    const condition = (a[2] ?? "").trim();
+    const rawCondition = (a[2] ?? "").trim();
     const unconditional = a[2] === void 0;
-    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd);
-    const currentMatch = containing.sort((x, y) => y.blockStart - x.blockStart)[0];
+    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const fullPath = containing.length > 0 ? buildFullPath(containing) : "/(unknown)";
+    const resolved = unconditional ? "" : resolveHelperCondition(rawCondition, functions);
+    const resolvedDetailed = unconditional ? "" : resolveHelperConditionDetailed(rawCondition, detailed);
+    const inlinedBody = unconditional ? "" : inlineHelpersInCondition(rawCondition, detailed);
+    const effectiveBody = resolvedDetailed !== rawCondition ? resolvedDetailed : resolved !== rawCondition ? resolved : inlinedBody;
+    const condition = rawCondition;
     const authReferences = [];
-    if (condition.includes("request.auth")) authReferences.push("request.auth");
-    if (condition.includes("request.auth.uid")) authReferences.push("request.auth.uid");
-    const claimReferences = [...condition.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g)].map(
-      (x) => x[1]
-    );
-    const resourceReferences = [...condition.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
+    const authSource = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    if (authSource.includes("request.auth")) authReferences.push("request.auth");
+    if (authSource.includes("request.auth.uid")) authReferences.push("request.auth.uid");
+    const big = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    const claimReferences = [
+      ...big.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g),
+      ...big.matchAll(/request\.auth\.token\.get\(\s*['"]([A-Za-z0-9_]+)['"]/g),
+      ...big.matchAll(/request\.auth\.token\[\s*['"]([A-Za-z0-9_]+)['"]\s*\]/g)
+    ].map((x) => x[1]);
+    const resourceReferences = [...big.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
       (x) => x[1]
     );
     const requestResourceReferences = [
-      ...condition.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
+      ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
     ].map((x) => x[1]);
     const { ops, known } = opsFrom(target);
+    const isHelperCall = !unconditional && rawCondition !== resolved;
+    const hasAuth = authSource.includes("request.auth");
     rules.push({
       id: `rule-${idx++}`,
-      path: currentMatch?.path ?? "/(unknown)",
+      path: fullPath,
       operations: ops,
       conditionPresent: !unconditional && condition.length > 0,
       condition: unconditional ? void 0 : condition,
@@ -241,7 +365,7 @@ function extractRules(rulesFile, relFile) {
       claimReferences,
       resourceReferences,
       requestResourceReferences,
-      confidence: known ? "CONFIRMED" : "UNKNOWN",
+      confidence: !known || isHelperCall && !hasAuth ? "UNKNOWN" : "CONFIRMED",
       location: { file: relFile, start: { line, column: 0 } }
     });
   }
@@ -271,6 +395,13 @@ function isPublicCondition(condition) {
   if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
   const norm = stripOuterParens(condition);
   const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low === "false") return { isPublic: false, confidence: "CONFIRMED" };
+  if (/^!\(.*request\.auth(===|==)null/.test(low)) {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (/^!\(.*request\.auth(!==|!=)null/.test(low)) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
   if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
     return { isPublic: false, confidence: "CONFIRMED" };
   }
@@ -279,29 +410,55 @@ function isPublicCondition(condition) {
   if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
     return { isPublic: true, confidence: "CONFIRMED" };
   }
+  if (!low.includes("request.auth")) {
+    return { isPublic: true, confidence: "PROBABLE" };
+  }
   return { isPublic: false, confidence: "CONFIRMED" };
 }
+function hashShort(text) {
+  return createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 8);
+}
+function conditionKeyForFingerprint(condition) {
+  if (condition === void 0) return "uncond";
+  const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
+  if (norm === "") return "uncond";
+  return hashShort(norm);
+}
 function findPublicAllows(rulesFile) {
   const rawContent = readFileSync2(rulesFile, "utf-8");
+  return findPublicAllowsContent(rawContent);
+}
+function helperBodyToCondition(body) {
+  const m = /\breturn\b\s*([^;]+);?/.exec(body);
+  if (m) return m[1].trim();
+  return body;
+}
+function findPublicAllowsContent(rawContent) {
   const content = stripRuleComments(rawContent);
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
   const out = [];
-  const matchRe = new RegExp(MATCH_RE.source, "g");
-  const blocks = [];
-  let mm0;
-  while ((mm0 = matchRe.exec(content)) !== null) {
-    const openBrace = mm0.index + mm0[0].length - 1;
-    blocks.push({ path: mm0[1], index: mm0.index, end: findBlockEnd(content, openBrace) });
-  }
+  const parsed = parseMatchBlocks(content);
   const re = new RegExp(ALLOW_RE.source, "g");
   let mm;
   while ((mm = re.exec(content)) !== null) {
     const line = content.slice(0, mm.index).split("\n").length;
     const target = mm[1].trim();
-    const check = isPublicCondition(mm[2]);
+    const single = mm[2] === void 0 ? void 0 : resolveHelperCondition(mm[2], functions);
+    const singleD = mm[2] === void 0 ? void 0 : resolveHelperConditionDetailed(mm[2], detailed);
+    const inlined = mm[2] === void 0 ? void 0 : inlineHelpersInCondition(mm[2], detailed);
+    const effective = singleD !== void 0 && singleD !== mm[2] ? singleD : single !== void 0 && single !== mm[2] ? single : inlined !== void 0 && inlined !== mm[2] ? inlined : mm[2];
+    if (mm[2] !== void 0 && effective !== mm[2] && !String(effective).includes("request.auth")) {
+      const bodyCheck = isPublicCondition(helperBodyToCondition(String(effective)));
+      if (!bodyCheck.isPublic) {
+        continue;
+      }
+    }
+    const check = isPublicCondition(effective);
     if (!check.isPublic) continue;
-    const containing = blocks.filter((b) => b.index <= mm.index && mm.index < b.end);
-    const path = containing.sort((x, y) => y.index - x.index)[0]?.path ?? "/(unknown)";
-    out.push({ line, target, path, confidence: check.confidence });
+    const ascBlocks = parsed.filter((b) => b.blockStart <= mm.index && mm.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const path = ascBlocks.length > 0 ? buildFullPath(ascBlocks) : "/(unknown)";
+    out.push({ line, target, path, confidence: check.confidence, conditionKey: conditionKeyForFingerprint(mm[2]) });
   }
   return out;
 }
@@ -342,8 +499,17 @@ async function runChecks(model, rootDir, opts = {}) {
   const findings = [];
   const relRules = model.firebase.firestore.rulesFile;
   const absRules = relRules ? join2(rootDir, relRules) : null;
+  let pubs = [];
+  let helperDetailed = /* @__PURE__ */ new Map();
   if (absRules && existsSync2(absRules)) {
-    for (const pub of findPublicAllows(absRules)) {
+    try {
+      const rawAll = readFileSync3(absRules, "utf-8");
+      pubs = findPublicAllowsContent(rawAll);
+      helperDetailed = parseRuleFunctionsDetailed(rawAll);
+    } catch {
+      pubs = [];
+    }
+    for (const pub of pubs) {
       const t = pub.target.toLowerCase();
       const tokens = t.split(",").map((s) => s.trim());
       const isWrite = tokens.some((x) => ["write", "create", "update", "delete"].includes(x));
@@ -355,7 +521,7 @@ async function runChecks(model, rootDir, opts = {}) {
             "ERROR",
             pub.confidence,
             `Escrita p\xFAblica em ${pub.path} (${pub.target}). Qualquer cliente pode escrever.`,
-            `FBA001:${relRules}:${pub.path}:${normalizeTarget(pub.target)}`,
+            `FBA001:${relRules}:${pub.path}:${normalizeTarget(pub.target)}:${pub.conditionKey}`,
             {
               file: relRules,
               line: pub.line,
@@ -373,7 +539,7 @@ async function runChecks(model, rootDir, opts = {}) {
             "WARNING",
             pub.confidence,
             `Leitura p\xFAblica em ${pub.path} (${pub.target}). Pode ser proposital.`,
-            `FBA002:${relRules}:${pub.path}:${normalizeTarget(pub.target)}`,
+            `FBA002:${relRules}:${pub.path}:${normalizeTarget(pub.target)}:${pub.conditionKey}`,
             {
               file: relRules,
               line: pub.line,
@@ -473,12 +639,10 @@ async function runChecks(model, rootDir, opts = {}) {
     return [op];
   };
   const publicPaths = /* @__PURE__ */ new Set();
-  if (absRules && existsSync2(absRules)) {
-    for (const p of findPublicAllows(absRules)) {
-      const { ops } = opsFrom(p.target);
-      for (const op of /* @__PURE__ */ new Set([...ops, ...ops.flatMap(expandOp)])) {
-        publicPaths.add(`${p.path}::${op.toLowerCase()}`);
-      }
+  for (const p of pubs) {
+    const { ops } = opsFrom(p.target);
+    for (const op of /* @__PURE__ */ new Set([...ops, ...ops.flatMap(expandOp)])) {
+      publicPaths.add(`${p.path}::${op.toLowerCase()}`);
     }
   }
   const permsByResource = /* @__PURE__ */ new Map();
@@ -499,9 +663,41 @@ async function runChecks(model, rootDir, opts = {}) {
       (op) => publicPaths.has(`${rule.path}::${op.toLowerCase()}`)
     );
     if (isPublicRule) return;
-    const checksAdminClaim = rule.claimReferences.some((c) => c.toLowerCase() === "admin");
-    const checksAdminRole = /token\.\w+\s*==\s*['"]admin['"]/i.test(rule.condition ?? "");
-    if (checksAdminClaim || checksAdminRole) return;
+    const condRaw = rule.condition ?? "";
+    const condResolved = resolveHelperConditionDetailed(condRaw, helperDetailed);
+    const condInlined = inlineHelpersInCondition(condRaw, helperDetailed);
+    const cond = condResolved !== condRaw ? condResolved : condInlined !== condRaw ? condInlined : condRaw;
+    const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*.*admin\s*==\s*true/i.test(cond);
+    const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
+    const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
+    let isAdminBodyHasAdmin = false;
+    if (isAdminCall) {
+      const fnName = (() => {
+        const m = /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/i.exec(isAdminCall[0]);
+        return m ? m[1] : "isAdmin";
+      })();
+      const fn = helperDetailed.get(fnName) ?? helperDetailed.get("isAdmin") ?? helperDetailed.get("isadmin");
+      if (fn) {
+        const b = `${fn.body}`;
+        isAdminBodyHasAdmin = /token\.admin\b/i.test(b) || /token\.get\(\s*['"]admin['"]/i.test(b) || /token\s*\[\s*['"]admin['"]/i.test(b) || /==\s*['"]admin['"]/i.test(b);
+      }
+    }
+    const checksAdminClaim = !isInvertedAdmin && rule.claimReferences.some((c) => {
+      const n = normClaim(c);
+      return n === "admin" || n === "isadmin";
+    });
+    const hasTopOr = /\|\|/.test(cond);
+    const adminPerDisjunct = hasTopOr ? cond.split("||").every((part) => {
+      const p = part;
+      return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
+    }) : true;
+    const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
+    if (checksAdminClaim || checksAdminRole) {
+      if (hasTopOr && !adminPerDisjunct) {
+      } else {
+        return;
+      }
+    }
     const checksAuth = rule.authReferences.length > 0;
     if (!checksAuth) return;
     findings.push(
@@ -510,7 +706,7 @@ async function runChecks(model, rootDir, opts = {}) {
         "WARNING",
         "PROBABLE",
         `Rule ${rule.path} [${rule.operations.join(", ")}] aceita autenticado sem checar claim de admin, mas contrato restringe ${restricted.map((r) => r.perm).join(", ")} a admin.`,
-        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}:${rule.location.start.line}:${resourceKey}`,
+        `FBA012:${rule.path}:${[...rule.operations].sort().join(",")}:${conditionKeyForFingerprint(rule.condition)}:${resourceKey}`,
         {
           file: rule.location.file,
           line: rule.location.start.line,
@@ -558,6 +754,34 @@ async function runChecks(model, rootDir, opts = {}) {
       )
     );
   }
+  for (const rule of model.rules) {
+    const raw = (rule.condition ?? "").trim();
+    const rawResolved = resolveHelperConditionDetailed(raw, helperDetailed);
+    const rawInlined = inlineHelpersInCondition(raw, helperDetailed);
+    const effectiveRaw = rawResolved !== raw ? rawResolved : rawInlined !== raw ? rawInlined : raw;
+    const norm = stripOuterParens(effectiveRaw).toLowerCase().replace(/\s+/g, "");
+    const hasBareAuth = norm === "request.auth!=null" || norm === "request.auth!==null" || norm === "request.auth.uid!=null" || norm === "request.auth.uid!==null";
+    const hasWeakConjunction = (norm.includes("request.auth!=null") || norm.includes("request.auth!==null") || norm.includes("request.auth.uid!=null") || norm.includes("request.auth.uid!==null")) && !norm.includes("sign_in_provider") && !norm.includes("email_verified") && !norm.includes("request.auth.token");
+    const isBareAuth = hasBareAuth || hasWeakConjunction;
+    if (isBareAuth && rule.claimReferences.length === 0) {
+      findings.push(
+        make(
+          "AUTH_ANON_ALLOWED",
+          "INFO",
+          "PROBABLE",
+          `Rule ${rule.path} aceita qualquer autenticado incluindo an\xF4nimo (request.auth != null sem claim/provider).`,
+          `AUTH_ANON_ALLOWED:${rule.path}:${conditionKeyForFingerprint(rule.condition)}`,
+          {
+            file: rule.location.file,
+            line: rule.location.start.line,
+            resource: rule.path,
+            evidence: [ev("anon-allowed", rule.condition ?? "auth!=null", "PROBABLE", rule.location.file, rule.location.start.line)],
+            fix: "Exigir claim (token.admin/role) ou checar provider diferente de anonymous para dados sens\xEDveis."
+          }
+        )
+      );
+    }
+  }
   const adminHits = await collectAdminImports(rootDir);
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
@@ -590,7 +814,12 @@ async function runChecks(model, rootDir, opts = {}) {
 async function collectPermissionCalls(rootDir, adapterFn) {
   const literals = [];
   const dynamic = [];
-  const bases = [adapterFn];
+  const ADAPTER_RE = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
+  const safeAdapter = ADAPTER_RE.test(adapterFn) ? adapterFn : null;
+  if (!safeAdapter) {
+    return { literals, dynamic };
+  }
+  const bases = [safeAdapter];
   const patterns = [];
   for (const b of bases) {
     patterns.push(`${b}($PERM)`, `${b}($PERM, $$$ARGS)`);
@@ -619,9 +848,9 @@ async function collectPermissionCalls(rootDir, adapterFn) {
         const isQuoted = /^['"`].*['"`]$/.test(raw);
         if (isQuoted) {
           const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
-          if (perm.length >= 3) pushLiteral(m.file, line, perm);
-          else if (perm.length > 0) {
-            const k = `${m.file}:${line}:${raw}:short`;
+          if (/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/.test(perm)) pushLiteral(m.file, line, perm);
+          else {
+            const k = `${m.file}:${line}:${raw}:invalid`;
             if (!seen.has(k)) {
               seen.add(k);
               dynamic.push({ file: m.file, line, text: m.text });
@@ -838,6 +1067,7 @@ var FindingSchema = z.strictObject({
 var PermissionNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/);
 var RoleNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/);
 var AuditYamlSchema = z.strictObject({
+  $schema: z.string().optional(),
   authorization: z.strictObject({
     adapter: z.strictObject({ function: z.string().min(1) }).optional(),
     roles: z.record(RoleNameSchema, z.strictObject({ permissions: z.array(PermissionNameSchema) })),
@@ -852,12 +1082,80 @@ var AuditYamlSchema = z.strictObject({
     }).optional()
   })
 });
+var RESERVED_CLAIM_KEYS = [
+  "sub",
+  "iat",
+  "iss",
+  "exp",
+  "aud",
+  "auth_time",
+  "acr",
+  "amr",
+  "azp",
+  "cnf",
+  "c_hash",
+  "at_hash",
+  "jti",
+  "nbf",
+  "nonce",
+  "firebase",
+  "user_id"
+];
+function validateClaimSamples(samples) {
+  const errors = [];
+  if (!samples) return { ok: true, errors };
+  const enc = new TextEncoder();
+  for (const [role, claims] of Object.entries(samples)) {
+    const bytes = enc.encode(JSON.stringify(claims)).length;
+    if (bytes > 1e3) {
+      errors.push(`samples.${role} com ${bytes} bytes (limite 1000 do crach\xE1)`);
+    }
+    for (const k of Object.keys(claims)) {
+      if (RESERVED_CLAIM_KEYS.includes(k)) {
+        errors.push(`samples.${role}.${k} \xE9 chave reservada OIDC/Firebase`);
+      }
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
 
 // src/scan.ts
 async function scan(rootDir, opts = {}) {
   const d = discover(rootDir);
+  if (opts.graph === true) {
+    try {
+      await enrichWithGraph(rootDir, d);
+    } catch {
+    }
+  }
   const model = emptyModel(rootDir, d);
   const findings_pre = [];
+  try {
+    if (d.firebaseJson && existsSync3(d.firebaseJson)) {
+      const raw = JSON.parse(readFileSync4(d.firebaseJson, "utf-8"));
+      for (const [kind, rel] of [
+        ["rules", raw.firestore?.rules],
+        ["indexes", raw.firestore?.indexes]
+      ]) {
+        if (typeof rel === "string" && rel.length > 0) {
+          if (!existsSync3(join3(rootDir, rel))) {
+            findings_pre.push({
+              rule: "RULES_CONFIG_MISMATCH",
+              severity: "WARNING",
+              confidence: "CONFIRMED",
+              message: `firebase.json aponta firestore.${kind} para "${rel}" inexistente \u2014 usando default. Corrija o path.`,
+              fingerprint: `RULES_CONFIG_MISMATCH:${kind}:${rel}`,
+              evidence: [
+                { id: `ev-config-${kind}`, kind: "config-mismatch", summary: rel, confidence: "CONFIRMED" }
+              ],
+              fix: "Ajuste o path em firebase.json ou crie o arquivo."
+            });
+          }
+        }
+      }
+    }
+  } catch {
+  }
   if (!d.firestoreRulesFile || !existsSync3(d.firestoreRulesFile)) {
     findings_pre.push({
       rule: "RULES_NOT_OBSERVED",
@@ -890,6 +1188,18 @@ async function scan(rootDir, opts = {}) {
   if (d.firestoreIndexesFile && existsSync3(d.firestoreIndexesFile)) {
     try {
       const raw = JSON.parse(readFileSync4(d.firestoreIndexesFile, "utf-8"));
+      if (Array.isArray(raw.fieldOverrides) && raw.fieldOverrides.length > 0) {
+        findings_pre.push({
+          rule: "FIELD_OVERRIDES_PRESENT",
+          severity: "INFO",
+          confidence: "CONFIRMED",
+          message: `firestore.indexes.json com ${raw.fieldOverrides.length} fieldOverrides (isen\xE7\xE3o campo \xFAnico, fora do drift composto).`,
+          fingerprint: "FIELD_OVERRIDES_PRESENT",
+          evidence: [
+            { id: "ev-overrides", kind: "indexes-overrides", summary: `${raw.fieldOverrides.length} overrides`, confidence: "CONFIRMED" }
+          ]
+        });
+      }
       const validModes = ["ASCENDING", "DESCENDING", "ARRAY_CONTAINS", "VECTOR"];
       const entries = [];
       let skipped = 0;
@@ -905,7 +1215,7 @@ async function scan(rootDir, opts = {}) {
         }
         const fields = [];
         for (const f of i.fields ?? []) {
-          if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0 || f.fieldPath === "__name__") {
+          if (typeof f.fieldPath !== "string" || f.fieldPath.length === 0) {
             skipped += 1;
             continue;
           }
@@ -922,6 +1232,11 @@ async function scan(rootDir, opts = {}) {
           queryScope: i.queryScope === "COLLECTION_GROUP" ? "COLLECTION_GROUP" : "COLLECTION",
           fields
         });
+        const last = entries[entries.length - 1];
+        if (last.fields.length === 0) {
+          entries.pop();
+          skipped += 1;
+        }
       }
       model.indexes = entries;
       const totalSkipped = skipped + scopeSkipped;
@@ -957,7 +1272,24 @@ async function scan(rootDir, opts = {}) {
       const validated = AuditYamlSchema.safeParse(parsed);
       if (validated.success) {
         const auth = validated.data.authorization;
-        model.authorization.adapter = auth.adapter?.function ?? null;
+        const rawAdapter = auth.adapter?.function ?? null;
+        const ADAPTER_RE = /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/;
+        if (rawAdapter !== null && !ADAPTER_RE.test(rawAdapter)) {
+          findings_pre.push({
+            rule: "CONTRACT_INVALID",
+            severity: "WARNING",
+            confidence: "CONFIRMED",
+            message: `adapter.function "${rawAdapter}" inv\xE1lido \u2014 use identificador como "rbac.can". Coleta de permiss\xF5es ignorada.`,
+            fingerprint: "CONTRACT_INVALID:adapter",
+            evidence: [
+              { id: "ev-adapter-invalid", kind: "contract-parse", summary: rawAdapter, confidence: "CONFIRMED" }
+            ],
+            fix: "Corrija authorization.adapter.function para identificador v\xE1lido."
+          });
+          model.authorization.adapter = null;
+        } else {
+          model.authorization.adapter = rawAdapter;
+        }
         model.authorization.permissions = Object.entries(auth.permissions).map(([name, p]) => ({
           name,
           resource: p.resource,
@@ -967,6 +1299,35 @@ async function scan(rootDir, opts = {}) {
           name,
           permissions: r.permissions
         }));
+        const samples = auth.claims?.samples;
+        if (samples) {
+          const res = validateClaimSamples(samples);
+          if (!res.ok) {
+            findings_pre.push({
+              rule: "CONTRACT_INVALID",
+              severity: "WARNING",
+              confidence: "CONFIRMED",
+              message: `claims.samples inv\xE1lido: ${res.errors.join("; ")} \u2014 samples ignorados.`,
+              fingerprint: "CONTRACT_INVALID:claims",
+              evidence: [
+                { id: "ev-claims-invalid", kind: "contract-parse", summary: res.errors.join("; "), confidence: "CONFIRMED" }
+              ],
+              fix: "Claims s\xF3 para acesso, 1000 bytes, sem chaves OIDC/Firebase reservadas."
+            });
+          }
+        }
+        if (auth.claims && !auth.claims.enabled) {
+          findings_pre.push({
+            rule: "CLAIMS_DISABLED",
+            severity: "INFO",
+            confidence: "CONFIRMED",
+            message: "Contrato com claims desabilitadas \u2014 FBA012 usa heur\xEDstica de papel sem crach\xE1.",
+            fingerprint: "CLAIMS_DISABLED",
+            evidence: [
+              { id: "ev-claims-off", kind: "contract-parse", summary: "claims off", confidence: "CONFIRMED" }
+            ]
+          });
+        }
       } else {
         findings_pre.push({
           rule: "CONTRACT_INVALID",
@@ -1027,12 +1388,28 @@ async function scan(rootDir, opts = {}) {
   const errors = findings.filter((f) => f.severity === "ERROR").length;
   const warnings = findings.filter((f) => f.severity === "WARNING").length;
   const infos = findings.filter((f) => f.severity === "INFO").length;
+  const implemented = new Set(IMPLEMENTED_CHECKS);
   const failedChecks = new Set(
     findings.filter((f) => f.severity === "ERROR" || f.severity === "WARNING").map((f) => f.rule)
   );
-  const total = IMPLEMENTED_CHECKS.length;
-  const passed = IMPLEMENTED_CHECKS.filter((c) => !failedChecks.has(c)).length;
-  return { model, findings, summary: { errors, warnings, infos, passed, total } };
+  const totalChecks = IMPLEMENTED_CHECKS.length;
+  const passedChecks = IMPLEMENTED_CHECKS.filter((c) => !failedChecks.has(c)).length;
+  const infraSkipped = findings.filter((f) => !implemented.has(f.rule)).length;
+  return {
+    model,
+    findings,
+    summary: {
+      errors,
+      warnings,
+      infos,
+      passed: passedChecks,
+      total: totalChecks,
+      passedChecks,
+      totalChecks,
+      infraSkipped,
+      coveragePct: null
+    }
+  };
 }
 
 export {
@@ -1040,11 +1417,27 @@ export {
   SERVER_HINTS_SEGMENTS,
   classifyOrigin,
   emptyModel,
+  enrichWithGraph,
   stripRuleComments,
   opsFrom,
+  normalizeTarget,
+  parseMatchBlocks,
+  buildFullPath,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
   extractRules,
+  extractRulesContent,
+  stripOuterParens,
   isPublicCondition,
+  hashShort,
+  conditionKeyForFingerprint,
   findPublicAllows,
+  helperBodyToCondition,
+  findPublicAllowsContent,
   IMPLEMENTED_CHECKS,
   runChecks,
   SeveritySchema,
@@ -1067,5 +1460,7 @@ export {
   ProjectModelSchema,
   FindingSchema,
   AuditYamlSchema,
+  RESERVED_CLAIM_KEYS,
+  validateClaimSamples,
   scan
 };