@justmpm/firebase-audit 0.4.3 → 0.5.1

package/dist/chunk-7EWTBIKJ.js

@@ -0,0 +1,356 @@
+// src/rules.ts
+import { readFileSync } from "fs";
+import { createHash } from "crypto";
+var MATCH_RE = /match\s+(\/[^{\s]*(?:\{[^}]*\}[^{\s]*)*)\s*\{/g;
+var ALLOW_RE = /allow\s+([^;:]+)(?::\s*if\s+([^;]+))?;/g;
+function stripRuleComments(content) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < content.length) {
+    const c = content[i];
+    const next = content[i + 1] ?? "";
+    if (quote) {
+      out += c;
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < content.length && content[i] !== "\n") i += 1;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < content.length && !(content[i] === "*" && content[i + 1] === "/")) {
+        if (content[i] === "\n") out += "\n";
+        i += 1;
+      }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+function opsFrom(target) {
+  const t = target.trim().toLowerCase();
+  if (t === "read") return { ops: ["read", "get", "list"], known: true };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
+  const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
+  const valid = ["read", "get", "list", "create", "update", "delete", "write"];
+  const out = [];
+  let known = false;
+  for (const p of parts) {
+    if (valid.includes(p)) {
+      known = true;
+      out.push(p);
+      if (p === "write") {
+        for (const extra of ["create", "update", "delete"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+      if (p === "read") {
+        for (const extra of ["get", "list"]) {
+          if (!out.includes(extra)) out.push(extra);
+        }
+      }
+    }
+  }
+  return { ops: out, known: out.length > 0 && known };
+}
+function findBlockEnd(content, openBraceIndex) {
+  let depth = 0;
+  let quote = null;
+  for (let i = openBraceIndex; i < content.length; i++) {
+    const c = content[i];
+    if (quote) {
+      if (c === quote && content[i - 1] !== "\\") quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "{") depth += 1;
+    else if (c === "}") {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return content.length;
+}
+function normalizeTarget(target) {
+  return target.toLowerCase().split(",").map((s) => s.trim()).filter(Boolean).sort().join(",");
+}
+function parseMatchBlocks(content) {
+  const blocks = [];
+  const matchRe = new RegExp(MATCH_RE.source, "g");
+  let m;
+  while ((m = matchRe.exec(content)) !== null) {
+    const before = content.slice(0, m.index);
+    const line = before.split("\n").length;
+    const openBrace = m.index + m[0].length - 1;
+    blocks.push({ path: m[1], line, blockStart: m.index, blockEnd: findBlockEnd(content, openBrace) });
+  }
+  return blocks;
+}
+function buildFullPath(containingAsc) {
+  const parts = [];
+  for (const b of containingAsc) {
+    const p = b.path.trim();
+    if (/^\/databases\/\{[^}]+\}\/documents\/?$/.test(p)) continue;
+    const stripped = p.replace(/^\/+|\/+$/g, "");
+    if (stripped.length === 0) continue;
+    const docIdx = stripped.indexOf("/documents/");
+    if (stripped.startsWith("databases/") && docIdx !== -1) {
+      const rest = stripped.slice(docIdx + "/documents/".length);
+      if (rest.length > 0) parts.push(rest);
+      continue;
+    }
+    parts.push(stripped);
+  }
+  if (parts.length === 0) return "/(unknown)";
+  return "/" + parts.join("/");
+}
+function parseRuleFunctions(content) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, fn] of parseRuleFunctionsDetailed(content)) {
+    out.set(name, fn.body);
+  }
+  return out;
+}
+function parseRuleFunctionsDetailed(content) {
+  const out = /* @__PURE__ */ new Map();
+  const re = /function\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/g;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const openBrace = m.index + m[0].length - 1;
+    const end = findBlockEnd(content, openBrace);
+    const body = content.slice(openBrace + 1, end - 1);
+    const params = m[2].trim() === "" ? [] : m[2].split(",").map((s) => s.trim()).filter((s) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s));
+    out.set(m[1], { params, body });
+  }
+  return out;
+}
+function inlineHelperArgs(body, params, args) {
+  let out = body;
+  for (let i = 0; i < params.length; i++) {
+    const p = params[i];
+    const a = (args[i] ?? "").trim();
+    if (!p || !a) continue;
+    out = out.replace(new RegExp(`\\b${p}\\b`, "g"), () => a);
+  }
+  return out;
+}
+function inlineHelpersInCondition(condition, detailed) {
+  let out = condition;
+  for (const [name, fn] of detailed) {
+    const re = new RegExp(`\\b${name}\\s*\\(([^()]*)\\)`, "g");
+    out = out.replace(re, (_m, argsStr) => {
+      const args = argsStr.length === 0 ? [] : String(argsStr).split(",").map((s) => s.trim());
+      const inlined = inlineHelperArgs(fn.body, fn.params, args);
+      return `(${inlined})`;
+    });
+  }
+  return out;
+}
+function resolveHelperCondition(condition, functions) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const body = functions.get(call[1]);
+  if (body === void 0) return condition;
+  return body;
+}
+function resolveHelperConditionDetailed(condition, detailed) {
+  const t = condition.trim().replace(/;$/, "").trim();
+  const call = /^([A-Za-z_][A-Za-z0-9_]*)\s*\((.*)\)$/.exec(t);
+  if (!call) return condition;
+  const fn = detailed.get(call[1]);
+  if (!fn) return condition;
+  const args = call[2].length === 0 ? [] : call[2].split(",").map((s) => s.trim());
+  return inlineHelperArgs(fn.body, fn.params, args);
+}
+function extractRules(rulesFile, relFile) {
+  const rawContent = readFileSync(rulesFile, "utf-8");
+  return extractRulesContent(rawContent, relFile);
+}
+function extractRulesContent(rawContent, relFile) {
+  const content = stripRuleComments(rawContent);
+  const rules = [];
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
+  const matchBlocks = parseMatchBlocks(content);
+  const allowRe = new RegExp(ALLOW_RE.source, "g");
+  let a;
+  let idx = 0;
+  while ((a = allowRe.exec(content)) !== null) {
+    const before = content.slice(0, a.index);
+    const line = before.split("\n").length;
+    const target = a[1];
+    const rawCondition = (a[2] ?? "").trim();
+    const unconditional = a[2] === void 0;
+    const containing = matchBlocks.filter((b) => b.blockStart <= a.index && a.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const fullPath = containing.length > 0 ? buildFullPath(containing) : "/(unknown)";
+    const resolved = unconditional ? "" : resolveHelperCondition(rawCondition, functions);
+    const resolvedDetailed = unconditional ? "" : resolveHelperConditionDetailed(rawCondition, detailed);
+    const inlinedBody = unconditional ? "" : inlineHelpersInCondition(rawCondition, detailed);
+    const effectiveBody = resolvedDetailed !== rawCondition ? resolvedDetailed : resolved !== rawCondition ? resolved : inlinedBody;
+    const condition = rawCondition;
+    const authReferences = [];
+    const authSource = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    if (authSource.includes("request.auth")) authReferences.push("request.auth");
+    if (authSource.includes("request.auth.uid")) authReferences.push("request.auth.uid");
+    const big = `${rawCondition} ${resolved} ${effectiveBody} ${inlinedBody}`;
+    const claimReferences = [
+      ...big.matchAll(/request\.auth\.token\.([A-Za-z0-9_]+)/g),
+      ...big.matchAll(/request\.auth\.token\.get\(\s*['"]([A-Za-z0-9_]+)['"]/g),
+      ...big.matchAll(/request\.auth\.token\[\s*['"]([A-Za-z0-9_]+)['"]\s*\]/g)
+    ].map((x) => x[1]);
+    const resourceReferences = [...big.matchAll(/resource\.data\.([A-Za-z0-9_]+)/g)].map(
+      (x) => x[1]
+    );
+    const requestResourceReferences = [
+      ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
+    ].map((x) => x[1]);
+    const { ops, known } = opsFrom(target);
+    const isHelperCall = !unconditional && rawCondition !== resolved;
+    const hasAuth = authSource.includes("request.auth");
+    rules.push({
+      id: `rule-${idx++}`,
+      path: fullPath,
+      operations: ops,
+      conditionPresent: !unconditional && condition.length > 0,
+      condition: unconditional ? void 0 : condition,
+      authReferences,
+      claimReferences,
+      resourceReferences,
+      requestResourceReferences,
+      confidence: !known || isHelperCall && !hasAuth ? "UNKNOWN" : "CONFIRMED",
+      location: { file: relFile, start: { line, column: 0 } }
+    });
+  }
+  return rules;
+}
+function stripOuterParens(s) {
+  let norm = s.trim();
+  for (; ; ) {
+    if (!(norm.startsWith("(") && norm.endsWith(")"))) return norm;
+    let depth = 0;
+    let wrapsAll = true;
+    for (let i = 0; i < norm.length; i++) {
+      if (norm[i] === "(") depth += 1;
+      else if (norm[i] === ")") {
+        depth -= 1;
+        if (depth === 0 && i !== norm.length - 1) {
+          wrapsAll = false;
+          break;
+        }
+      }
+    }
+    if (!wrapsAll || depth !== 0) return norm;
+    norm = norm.slice(1, -1).trim();
+  }
+}
+function isPublicCondition(condition) {
+  if (condition === void 0) return { isPublic: true, confidence: "CONFIRMED" };
+  const norm = stripOuterParens(condition);
+  const low = norm.toLowerCase().replace(/\s+/g, "");
+  if (low === "false") return { isPublic: false, confidence: "CONFIRMED" };
+  if (/^!\(.*request\.auth(===|==)null/.test(low)) {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (/^!\(.*request\.auth(!==|!=)null/.test(low)) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  if (low.includes("!(request.auth==null)") || low.includes("!(request.auth===null)") || low === "!request.auth==null" || low === "!request.auth===null") {
+    return { isPublic: false, confidence: "CONFIRMED" };
+  }
+  if (low === "true") return { isPublic: true, confidence: "CONFIRMED" };
+  if (/(^|\|\|)true($|\|\|)/.test(low)) return { isPublic: true, confidence: "PROBABLE" };
+  if (low.includes("request.auth==null") || low.includes("request.auth===null")) {
+    return { isPublic: true, confidence: "CONFIRMED" };
+  }
+  if (!low.includes("request.auth")) {
+    return { isPublic: true, confidence: "PROBABLE" };
+  }
+  return { isPublic: false, confidence: "CONFIRMED" };
+}
+function hashShort(text) {
+  return createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 8);
+}
+function conditionKeyForFingerprint(condition) {
+  if (condition === void 0) return "uncond";
+  const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
+  if (norm === "") return "uncond";
+  return hashShort(norm);
+}
+function findPublicAllows(rulesFile) {
+  const rawContent = readFileSync(rulesFile, "utf-8");
+  return findPublicAllowsContent(rawContent);
+}
+function helperBodyToCondition(body) {
+  const m = /\breturn\b\s*([^;]+);?/.exec(body);
+  if (m) return m[1].trim();
+  return body;
+}
+function findPublicAllowsContent(rawContent) {
+  const content = stripRuleComments(rawContent);
+  const functions = parseRuleFunctions(content);
+  const detailed = parseRuleFunctionsDetailed(content);
+  const out = [];
+  const parsed = parseMatchBlocks(content);
+  const re = new RegExp(ALLOW_RE.source, "g");
+  let mm;
+  while ((mm = re.exec(content)) !== null) {
+    const line = content.slice(0, mm.index).split("\n").length;
+    const target = mm[1].trim();
+    const single = mm[2] === void 0 ? void 0 : resolveHelperCondition(mm[2], functions);
+    const singleD = mm[2] === void 0 ? void 0 : resolveHelperConditionDetailed(mm[2], detailed);
+    const inlined = mm[2] === void 0 ? void 0 : inlineHelpersInCondition(mm[2], detailed);
+    const effective = singleD !== void 0 && singleD !== mm[2] ? singleD : single !== void 0 && single !== mm[2] ? single : inlined !== void 0 && inlined !== mm[2] ? inlined : mm[2];
+    if (mm[2] !== void 0 && effective !== mm[2] && !String(effective).includes("request.auth")) {
+      const bodyCheck = isPublicCondition(helperBodyToCondition(String(effective)));
+      if (!bodyCheck.isPublic) {
+        continue;
+      }
+    }
+    const check = isPublicCondition(effective);
+    if (!check.isPublic) continue;
+    const ascBlocks = parsed.filter((b) => b.blockStart <= mm.index && mm.index < b.blockEnd).sort((x, y) => x.blockStart - y.blockStart);
+    const path = ascBlocks.length > 0 ? buildFullPath(ascBlocks) : "/(unknown)";
+    out.push({ line, target, path, confidence: check.confidence, conditionKey: conditionKeyForFingerprint(mm[2]) });
+  }
+  return out;
+}
+
+export {
+  stripRuleComments,
+  opsFrom,
+  normalizeTarget,
+  parseMatchBlocks,
+  buildFullPath,
+  parseRuleFunctions,
+  parseRuleFunctionsDetailed,
+  inlineHelperArgs,
+  inlineHelpersInCondition,
+  resolveHelperCondition,
+  resolveHelperConditionDetailed,
+  extractRules,
+  extractRulesContent,
+  stripOuterParens,
+  isPublicCondition,
+  hashShort,
+  conditionKeyForFingerprint,
+  findPublicAllows,
+  helperBodyToCondition,
+  findPublicAllowsContent
+};