@justmpm/firebase-audit 0.5.1 → 0.5.2

package/dist/{chunk-QACXCMYB.js → chunk-AXTYJMA7.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-GDO2DLNQ.js";
+} from "./chunk-UKEKA2NQ.js";
 import {
   verify
 } from "./chunk-Y4VXWSKX.js";

package/dist/{chunk-GDO2DLNQ.js → chunk-UKEKA2NQ.js}

@@ -866,6 +866,16 @@ async function scan(rootDir, opts = {}) {
       }
     }
   } catch {
+    findings_pre.push({
+      rule: "FIREBASE_JSON_INVALID",
+      severity: "WARNING",
+      confidence: "CONFIRMED",
+      message: "firebase.json inv\xE1lido \u2014 seguindo com defaults (firestore.rules, firestore.indexes.json). Corrija o JSON.",
+      fingerprint: "FIREBASE_JSON_INVALID",
+      evidence: [
+        { id: "ev-firebase-json", kind: "config-parse", summary: "JSON inv\xE1lido", confidence: "CONFIRMED" }
+      ]
+    });
   }
   if (!d.firestoreRulesFile || !existsSync3(d.firestoreRulesFile)) {
     findings_pre.push({
@@ -1076,34 +1086,40 @@ async function scan(rootDir, opts = {}) {
       const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
       const clean = stripRuleComments(raw);
-      const low = clean.toLowerCase().replace(/\s+/g, "");
-      const hasAllPaths = low.includes("allpaths=**") || /\{[^}]*=\*\*\}/.test(low);
+      let evCounter = 0;
+      const evId = (prefix) => {
+        evCounter += 1;
+        return `ev-storage-${prefix}-${evCounter}`;
+      };
       for (const m of parseStorageAllows(clean)) {
-        const open = m.condition === void 0 || m.condition.trim().toLowerCase().replace(/\s+/g, "") === "true";
-        if (!open) continue;
+        if (!isOpenStorageCondition(m.condition)) continue;
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
+        const wildcard = /\{[^}]*=\*\*\}/.test(m.matchPath) || m.matchPath.toLowerCase().includes("allpaths");
+        const where = `${relStorage}:${m.line} (${m.matchPath}, allow ${m.target})`;
         if (ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete")) {
           findings.push({
             rule: "STORAGE_PUBLIC_WRITE",
             severity: "ERROR",
             confidence: "CONFIRMED",
-            message: `Storage com escrita aberta (${relStorage}, allow ${m.target}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
-            fingerprint: `STORAGE_PUBLIC_WRITE:${m.target}:${key}`,
+            message: `Storage com escrita aberta (${where}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
+            fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${m.target}:${key}`,
             file: relStorage,
-            evidence: [{ id: `ev-storage-write-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "CONFIRMED" }],
+            line: m.line,
+            evidence: [{ id: evId("write"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "CONFIRMED", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
             fix: "Exigir request.auth (e dono/tenant) no write. Deixe get aberto s\xF3 em pasta de vitrine como logos/."
           });
         } else if (ops.has("read") || ops.has("get") || ops.has("list")) {
-          if (hasAllPaths) {
+          if (wildcard) {
             findings.push({
               rule: "STORAGE_ALL_PATHS_OPEN",
               severity: "WARNING",
               confidence: "PROBABLE",
-              message: `Storage com leitura aberta em curinga total (${relStorage}, allow ${m.target}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
-              fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.target}:${key}`,
+              message: `Storage com leitura aberta em curinga total (${where}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
+              fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.matchPath}:${m.target}:${key}`,
               file: relStorage,
-              evidence: [{ id: `ev-storage-all-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "PROBABLE" }],
+              line: m.line,
+              evidence: [{ id: evId("all"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
               fix: "Troque o curinga total por pastas expl\xEDcitas (ex: /logos/{logoId}) com get: if true e write restrito."
             });
           } else {
@@ -1111,10 +1127,11 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_READ",
               severity: "INFO",
               confidence: "PROBABLE",
-              message: `Storage com leitura aberta (${relStorage}, allow ${m.target}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
-              fingerprint: `STORAGE_PUBLIC_READ:${m.target}:${key}`,
+              message: `Storage com leitura aberta (${where}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
+              fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${m.target}:${key}`,
               file: relStorage,
-              evidence: [{ id: `ev-storage-read-${findings.length}`, kind: "storage-public", summary: `${m.target} if true`, confidence: "PROBABLE" }]
+              line: m.line,
+              evidence: [{ id: evId("read"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }]
             });
           }
         }
@@ -1126,24 +1143,38 @@ async function scan(rootDir, opts = {}) {
     skipped.push("storage.rules n\xE3o observado \u2014 Storage fora deste scan");
   }
   if (d.functionsDir) {
-    const enforced = await countAppCheckEnforced(rootDir);
-    model.functions = { dir: model.functions?.dir, appCheckEnforced: enforced };
+    const appcheck = await countAppCheckEnforced(rootDir);
+    model.functions = { dir: model.functions?.dir, appCheckEnforced: appcheck.occurrences };
     checked.push("functions-appcheck");
-    if (enforced > 0) {
+    if (appcheck.manual > 0) {
+      findings.push({
+        rule: "APPCHECK_MANUAL",
+        severity: "INFO",
+        confidence: "PROBABLE",
+        message: `Verifica\xE7\xE3o manual de AppCheck observada (${appcheck.manual} ocorr\xEAncia(s) de verifyToken). Cubra rota a rota no onRequest \u2014 o scan n\xE3o audita cada rota.`,
+        fingerprint: "APPCHECK_MANUAL",
+        evidence: [{ id: "ev-appcheck-manual", kind: "appcheck", summary: `${appcheck.manual} verifyToken`, confidence: "PROBABLE" }]
+      });
+    }
+    if (appcheck.occurrences > 0) {
       findings.push({
         rule: "APPCHECK_ENFORCED",
         severity: "INFO",
         confidence: "CONFIRMED",
-        message: `AppCheck ativo em ${enforced} function(s). Carimbo do app oficial \u2014 n\xE3o prova quem \xE9 o usu\xE1rio nem o tenant. Autoriza\xE7\xE3o segue nas Rules/guardas.`,
+        message: `enforceAppCheck observado (${appcheck.occurrences} ocorr\xEAncia(s) em ${appcheck.files} arquivo(s)). Carimbo do app oficial \u2014 n\xE3o prova quem \xE9 o usu\xE1rio nem o tenant. Autoriza\xE7\xE3o segue nas Rules/guardas.`,
         fingerprint: "APPCHECK_ENFORCED",
-        evidence: [{ id: "ev-appcheck", kind: "appcheck", summary: `${enforced} enforced`, confidence: "CONFIRMED" }]
+        evidence: [{ id: "ev-appcheck", kind: "appcheck", summary: `${appcheck.occurrences} ocorr\xEAncias`, confidence: "CONFIRMED" }]
       });
-    } else {
-      skipped.push("functions sem enforceAppCheck observado \u2014 AppCheck sem cobertura afirmativa");
+    } else if (appcheck.manual === 0) {
+      skipped.push("functions sem enforceAppCheck nem verifyToken observado \u2014 AppCheck sem cobertura afirmativa (onRequest exige verifica\xE7\xE3o manual por rota)");
+    }
+    if (appcheck.limitHit) {
+      skipped.push("functions: teto de varredura atingido \u2014 AppCheck parcial neste scan");
     }
   } else {
     skipped.push("functions n\xE3o observadas \u2014 AppCheck fora deste scan");
   }
+  skipped.push("isolamento por tenant (ownerId/tenantId) n\xE3o verificado \u2014 fora dos checks implementados, nunca verde silencioso");
   const modelCheck = ProjectModelSchema.safeParse(model);
   if (!modelCheck.success) {
     findings.push({
@@ -1205,7 +1236,10 @@ async function countAppCheckEnforced(rootDir) {
     const { join: joinP } = await import("path");
     const { stripRuleComments: strip } = await import("./rules-GTGZWN5U.js");
     const roots = [joinP(rootDir, "functions")];
-    let count = 0;
+    let occurrences = 0;
+    const files = /* @__PURE__ */ new Set();
+    let manual = 0;
+    let limitHit = false;
     const stack = [...roots];
     let guard = 0;
     const isTestFile = (p) => {
@@ -1214,6 +1248,7 @@ async function countAppCheckEnforced(rootDir) {
     };
     while (stack.length > 0 && guard < 200) {
       guard += 1;
+      if (guard >= 200 && stack.length > 0) limitHit = true;
       const cur = stack.pop();
       let entries = [];
       try {
@@ -1240,22 +1275,72 @@ async function countAppCheckEnforced(rootDir) {
         try {
           const text = strip(readSync(abs, "utf-8"));
           const hits = text.match(/enforceAppCheck\s*:\s*true/g);
-          if (hits) count += hits.length;
+          if (hits) {
+            occurrences += hits.length;
+            files.add(abs);
+          }
+          const manualHits = text.match(/verifyToken\s*\(/g);
+          if (manualHits) manual += manualHits.length;
         } catch {
         }
       }
     }
-    return count;
+    return { occurrences, files: files.size, manual, limitHit };
   } catch {
-    return 0;
+    return { occurrences: 0, files: 0, manual: 0, limitHit: false };
   }
 }
+function isOpenStorageCondition(condition) {
+  if (condition === void 0) return true;
+  const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
+  if (norm === "" || norm === "true") return true;
+  if (/(^|\|\|)true($|\|\|)/.test(norm)) return true;
+  if (norm.includes("request.auth==null") || norm.includes("request.auth===null")) return true;
+  return false;
+}
 function parseStorageAllows(clean) {
   const out = [];
+  const matches = [];
+  const matchRe = /match\s+/g;
+  let mm;
+  while ((mm = matchRe.exec(clean)) !== null) {
+    const lineStart = clean.lastIndexOf("\n", mm.index) + 1;
+    const lineEnd = clean.indexOf("\n", mm.index);
+    const line = clean.slice(lineStart, lineEnd === -1 ? void 0 : lineEnd);
+    const brace = line.lastIndexOf("{");
+    if (brace === -1) continue;
+    const path = line.slice(mm.index - lineStart + 5, brace).trim() || "/(unknown)";
+    const openBrace = lineStart + brace;
+    let depth = 0;
+    let quote = null;
+    let end = clean.length;
+    for (let i = openBrace; i < clean.length; i++) {
+      const c = clean[i];
+      if (quote) {
+        if (c === quote && clean[i - 1] !== "\\") quote = null;
+        continue;
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        quote = c;
+        continue;
+      }
+      if (c === "{") depth += 1;
+      else if (c === "}") {
+        depth -= 1;
+        if (depth === 0) {
+          end = i + 1;
+          break;
+        }
+      }
+    }
+    matches.push({ path, start: mm.index, end });
+  }
   const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
   let m;
   while ((m = re.exec(clean)) !== null) {
-    out.push({ target: m[1].trim(), condition: m[2]?.trim() });
+    const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => b.start - a.start);
+    const line = clean.slice(0, m.index).split("\n").length;
+    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: containing[0]?.path ?? "/(unknown)", line });
   }
   return out;
 }

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-GDO2DLNQ.js";
+} from "./chunk-UKEKA2NQ.js";
 import "./chunk-7EWTBIKJ.js";
 
 // src/cli.ts
@@ -33,7 +33,7 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     process.exit(1);
   }
   const strict = args.includes("--strict") || cmd === "check";
-  const asJson = args.includes("--json");
+  const asJson = args.includes("--json") || args.includes("--json=true");
   const getArg = (name) => {
     const pref = `--${name}=`;
     const hit = args.find((a) => a.startsWith(pref));
@@ -65,7 +65,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-4Q4XVLJU.js");
+    const { scan: scanForVerify } = await import("./scan-OEN65GHM.js");
     const { verify } = await import("./verify-WBVSESHD.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");
@@ -149,7 +149,7 @@ FIREBASE AUDIT drift \u2014 MATCHED ${counts("MATCHED")}, LOCAL_ONLY ${counts("L
   console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (findings.length === 0) {
     console.log(`
-\u2713 Nenhum problema nos checks implementados (${summary.passedChecks}/${summary.totalChecks} passaram).
+\u2713 Nenhum problema nos checks FBA implementados (${summary.passedChecks}/${summary.totalChecks} passaram).
 Olhei: ${summary.checked.join(", ")}.
 Pulei: ${summary.skipped.join(" | ") || "nada"}.
 `);
@@ -164,7 +164,7 @@ ${icon} ${f.rule} [${f.confidence}]${where}
     if (f.fix) console.log(`   \u2192 ${f.fix}`);
   }
   console.log(`
-SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos (${summary.passedChecks}/${summary.totalChecks} checks passaram)`);
+SUMMARY: ${summary.errors} errors, ${summary.warnings} warnings, ${summary.infos} infos (${summary.passedChecks}/${summary.totalChecks} checks FBA passaram)`);
   console.log(`Olhei: ${summary.checked.join(", ")}`);
   console.log(`Pulei: ${summary.skipped.join(" | ") || "nada"}
 `);

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-QACXCMYB.js";
+} from "./chunk-AXTYJMA7.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -33,7 +33,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-GDO2DLNQ.js";
+} from "./chunk-UKEKA2NQ.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-QACXCMYB.js";
-import "./chunk-GDO2DLNQ.js";
+} from "./chunk-AXTYJMA7.js";
+import "./chunk-UKEKA2NQ.js";
 import "./chunk-7EWTBIKJ.js";
 import "./chunk-Y4VXWSKX.js";
 import "./chunk-XZ32YQQC.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-QACXCMYB.js";
-import "./chunk-GDO2DLNQ.js";
+} from "./chunk-AXTYJMA7.js";
+import "./chunk-UKEKA2NQ.js";
 import "./chunk-7EWTBIKJ.js";
 import "./chunk-Y4VXWSKX.js";
 import "./chunk-XZ32YQQC.js";

package/dist/{scan-4Q4XVLJU.js → scan-OEN65GHM.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-GDO2DLNQ.js";
+} from "./chunk-UKEKA2NQ.js";
 import "./chunk-7EWTBIKJ.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",