@justmpm/firebase-audit 0.5.10 → 0.5.12

package/dist/{chunk-GR2SM3OL.js → chunk-CTQPAMOE.js}

@@ -1228,15 +1228,31 @@ async function scan(rootDir, opts = {}) {
         return `ev-storage-${prefix}-${evCounter}`;
       };
       for (const m of parseStorageAllows(clean)) {
-        if (m.condition !== void 0 && stripOuterParens(m.condition).toLowerCase().replace(/\s+/g, "") === "false") {
-          continue;
-        }
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
+        const { unknown: unknownStorageOps } = opsFrom(m.target);
+        if (unknownStorageOps.length > 0) {
+          findings.push({
+            rule: "RULES_UNKNOWN_OP",
+            severity: "WARNING",
+            confidence: "CONFIRMED",
+            message: `Opera\xE7\xE3o desconhecida no Storage em ${m.matchPath} (trecho desconhecido: ${unknownStorageOps.join(", ")}) (${relStorage}:${m.line}). Typo em allow? Deploy rejeita.`,
+            fingerprint: `RULES_UNKNOWN_OP:${m.matchPath}:${m.line}:${normalizeTarget(m.target)}`,
+            file: relStorage,
+            line: m.line,
+            evidence: [{ id: evId("unknown-op"), kind: "unknown-op", summary: `${m.matchPath} allow ${m.target}`, confidence: "CONFIRMED", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
+            fix: "Corrija para read/get/list/write/create/update/delete."
+          });
+        }
         const singleStorage = m.condition === void 0 ? void 0 : resolveHelperConditionDetailed(m.condition, storageHelpers);
         const inlinedStorage = m.condition === void 0 ? void 0 : inlineHelpersInCondition(m.condition, storageHelpers);
-        const effectiveCond = m.condition === void 0 ? void 0 : singleStorage !== void 0 && singleStorage !== m.condition ? helperBodyToCondition(singleStorage) : inlinedStorage !== void 0 && inlinedStorage !== m.condition ? inlinedStorage : m.condition;
-        const normCond = (effectiveCond ?? "").toLowerCase().replace(/\s+/g, "");
+        const singleResolved = singleStorage !== void 0 && singleStorage !== m.condition ? singleStorage : void 0;
+        const effectiveCond = m.condition === void 0 ? void 0 : singleResolved !== void 0 ? helperBodyToCondition(singleResolved) : inlinedStorage !== void 0 && inlinedStorage !== m.condition ? inlinedStorage : m.condition;
+        const normEffFalse = effectiveCond === void 0 ? "" : stripOuterParens(effectiveCond).toLowerCase().replace(/\s+/g, "");
+        if (normEffFalse === "false") {
+          continue;
+        }
+        const normCond = `${singleResolved ?? ""} ${effectiveCond ?? ""}`.toLowerCase().replace(/\s+/g, "");
         const hasAuth = normCond.includes("request.auth");
         const bareAuth = (/request\.auth(!==|!=)null/.test(normCond) || /request\.auth\.uid(!==|!=)null/.test(normCond)) && !normCond.includes("request.auth.token") && !normCond.includes("sign_in_provider");
         const wildcard = /\{\s*\w+\s*=\s*\*\*\s*\}/.test(m.matchPath);
@@ -1286,7 +1302,8 @@ async function scan(rootDir, opts = {}) {
             continue;
           }
         }
-        if (bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
+        const noAuthBranch = findNoAuthBranch(effectiveCond);
+        if (noAuthBranch === void 0 && bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
           findings.push({
             rule: "STORAGE_ANON_ALLOWED",
             severity: "INFO",
@@ -1300,8 +1317,10 @@ async function scan(rootDir, opts = {}) {
           });
           continue;
         }
-        if (!hasAuth && effectiveCond !== void 0) {
-          const unresolvedHelper = effectiveCond === m.condition ? /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(m.condition ?? "")?.[1] : void 0;
+        if ((!hasAuth || noAuthBranch !== void 0) && effectiveCond !== void 0) {
+          const branchScope = noAuthBranch ?? (effectiveCond === m.condition ? m.condition ?? "" : "");
+          const unresolvedHelper = /^[\s(]*([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(branchScope)?.[1];
+          const branchNote = noAuthBranch !== void 0 ? ` Ramo sem request.auth ("${noAuthBranch}"): an\xF4nimo passa por ele.` : "";
           const noAuthNote = unresolvedHelper ? ` Helper "${unresolvedHelper}" n\xE3o resolvido no storage.rules \u2014 confirme o corpo no Emulator.` : "";
           const canWrite = ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete");
           const canRead = ops.has("read") || ops.has("get") || ops.has("list");
@@ -1310,7 +1329,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_WRITE",
               severity: "ERROR",
               confidence: "PROBABLE",
-              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${noAuthNote}`,
+              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${branchNote}${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1322,7 +1341,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_READ",
               severity: "INFO",
               confidence: "PROBABLE",
-              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${noAuthNote}`,
+              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${branchNote}${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1522,6 +1541,16 @@ function isOpenStorageCondition(condition) {
   if (norm.includes("request.auth==null") || norm.includes("request.auth===null")) return true;
   return false;
 }
+function findNoAuthBranch(effective) {
+  if (effective === void 0 || !effective.includes("||")) return void 0;
+  for (const part of effective.split("||")) {
+    const branch = stripOuterParens(part.replace(/return/g, "").replace(/;/g, "").trim());
+    const norm = branch.toLowerCase().replace(/\s+/g, "");
+    if (norm === "" || norm === "false") continue;
+    if (!norm.includes("request.auth")) return part.trim().slice(0, 80);
+  }
+  return void 0;
+}
 function parseStorageAllows(clean) {
   const out = [];
   const matches = [];

package/dist/{chunk-JPHERTX5.js → chunk-OYWTDV45.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-GR2SM3OL.js";
+} from "./chunk-CTQPAMOE.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-GR2SM3OL.js";
+} from "./chunk-CTQPAMOE.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-YY5UY35J.js");
+    const { scan: scanForVerify } = await import("./scan-CU54MUN7.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-JPHERTX5.js";
+} from "./chunk-OYWTDV45.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-GR2SM3OL.js";
+} from "./chunk-CTQPAMOE.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-JPHERTX5.js";
-import "./chunk-GR2SM3OL.js";
+} from "./chunk-OYWTDV45.js";
+import "./chunk-CTQPAMOE.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-JPHERTX5.js";
-import "./chunk-GR2SM3OL.js";
+} from "./chunk-OYWTDV45.js";
+import "./chunk-CTQPAMOE.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-YY5UY35J.js → scan-CU54MUN7.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-GR2SM3OL.js";
+} from "./chunk-CTQPAMOE.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.10",
+  "version": "0.5.12",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -20,7 +20,8 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
 - Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
-- Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth"); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
+- Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth", inclui `let` do rules v2); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
+- Storage avalia disjunção por ramo (`auth || tamanho` acusa o ramo sem auth) e `return false` via helper é deny silencioso, igual ao `if false`
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)
 
 ## Emulador