@justmpm/firebase-audit 0.5.11 → 0.5.13

package/dist/{chunk-ZE5K5HRR.js → chunk-LK5MKSCZ.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-ZNVQGZMJ.js";
+} from "./chunk-NOIROFKB.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/{chunk-ZNVQGZMJ.js → chunk-NOIROFKB.js}

@@ -518,12 +518,13 @@ async function runChecks(model, rootDir, opts = {}) {
     const hasWeakConjunction = (norm.includes("request.auth!=null") || norm.includes("request.auth!==null") || norm.includes("request.auth.uid!=null") || norm.includes("request.auth.uid!==null")) && !norm.includes("sign_in_provider") && !norm.includes("email_verified") && !norm.includes("request.auth.token");
     const isBareAuth = hasBareAuth || hasWeakConjunction;
     if (isBareAuth && rule.claimReferences.length === 0) {
+      const gatedByDoc = /exists\s*\(/i.test(effectiveRaw);
       findings.push(
         make(
           "AUTH_ANON_ALLOWED",
           "INFO",
           "PROBABLE",
-          `Rule ${rule.path} aceita qualquer autenticado incluindo an\xF4nimo (request.auth != null sem claim/provider).`,
+          gatedByDoc ? `Rule ${rule.path} exige login + documento via exists() (sem claim/provider) \u2014 an\xF4nimo com login passa no conjunto se obtiver o doc.` : `Rule ${rule.path} aceita qualquer autenticado incluindo an\xF4nimo (request.auth != null sem claim/provider).`,
           `AUTH_ANON_ALLOWED:${rule.path}:${conditionKeyForFingerprint(rule.condition)}`,
           {
             file: rule.location.file,
@@ -1230,6 +1231,20 @@ async function scan(rootDir, opts = {}) {
       for (const m of parseStorageAllows(clean)) {
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
+        const { unknown: unknownStorageOps } = opsFrom(m.target);
+        if (unknownStorageOps.length > 0) {
+          findings.push({
+            rule: "RULES_UNKNOWN_OP",
+            severity: "WARNING",
+            confidence: "CONFIRMED",
+            message: `Opera\xE7\xE3o desconhecida no Storage em ${m.matchPath} (trecho desconhecido: ${unknownStorageOps.join(", ")}) (${relStorage}:${m.line}). Typo em allow? Deploy rejeita.`,
+            fingerprint: `RULES_UNKNOWN_OP:${m.matchPath}:${m.line}:${normalizeTarget(m.target)}`,
+            file: relStorage,
+            line: m.line,
+            evidence: [{ id: evId("unknown-op"), kind: "unknown-op", summary: `${m.matchPath} allow ${m.target}`, confidence: "CONFIRMED", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
+            fix: "Corrija para read/get/list/write/create/update/delete."
+          });
+        }
         const singleStorage = m.condition === void 0 ? void 0 : resolveHelperConditionDetailed(m.condition, storageHelpers);
         const inlinedStorage = m.condition === void 0 ? void 0 : inlineHelpersInCondition(m.condition, storageHelpers);
         const singleResolved = singleStorage !== void 0 && singleStorage !== m.condition ? singleStorage : void 0;
@@ -1250,7 +1265,7 @@ async function scan(rootDir, opts = {}) {
               severity: "ERROR",
               confidence: "CONFIRMED",
               message: `Storage com escrita aberta (${where}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
-              fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_WRITE:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("write"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "CONFIRMED", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1265,7 +1280,7 @@ async function scan(rootDir, opts = {}) {
                 severity: "WARNING",
                 confidence: "PROBABLE",
                 message: `Storage com leitura aberta em curinga total (${where}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
-                fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+                fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
                 file: relStorage,
                 line: m.line,
                 evidence: [{ id: evId("all"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1278,7 +1293,7 @@ async function scan(rootDir, opts = {}) {
                 severity: "INFO",
                 confidence: "PROBABLE",
                 message: enumerates ? `Storage com leitura aberta (${where}). Pode ser vitrine proposital \u2014 mas allow read/list permite enumerar a pasta; para vitrine segura prefira allow get. Confirme que o write segue restrito.` : `Storage com leitura aberta (${where}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
-                fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+                fingerprint: `STORAGE_PUBLIC_READ:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
                 file: relStorage,
                 line: m.line,
                 evidence: [{ id: evId("read"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1290,12 +1305,13 @@ async function scan(rootDir, opts = {}) {
         }
         const noAuthBranch = findNoAuthBranch(effectiveCond);
         if (noAuthBranch === void 0 && bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
+          const gatedByDoc = /exists\(/.test(normCond);
           findings.push({
             rule: "STORAGE_ANON_ALLOWED",
             severity: "INFO",
             confidence: "PROBABLE",
-            message: `Storage aceita qualquer autenticado incluindo an\xF4nimo (${where}). Exija claim/provider para dados sens\xEDveis.`,
-            fingerprint: `STORAGE_ANON_ALLOWED:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+            message: gatedByDoc ? `Storage exige login + documento via exists() (${where}) \u2014 mais forte que login puro, mas sem claim/provider: an\xF4nimo com login passa no conjunto se obtiver o doc. Exija claim/provider para dados sens\xEDveis.` : `Storage aceita qualquer autenticado incluindo an\xF4nimo (${where}). Exija claim/provider para dados sens\xEDveis.`,
+            fingerprint: `STORAGE_ANON_ALLOWED:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
             file: relStorage,
             line: m.line,
             evidence: [{ id: evId("anon"), kind: "anon-allowed", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1316,7 +1332,7 @@ async function scan(rootDir, opts = {}) {
               severity: "ERROR",
               confidence: "PROBABLE",
               message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${branchNote}${noAuthNote}`,
-              fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_WRITE:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("write"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target} sem auth`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1328,7 +1344,7 @@ async function scan(rootDir, opts = {}) {
               severity: "INFO",
               confidence: "PROBABLE",
               message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${branchNote}${noAuthNote}`,
-              fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_READ:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("read"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target} sem auth`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }]
@@ -1538,21 +1554,22 @@ function findNoAuthBranch(effective) {
   return void 0;
 }
 function parseStorageAllows(clean) {
+  const text = clean.replace(/\r\n?/g, "\n");
   const out = [];
   const matches = [];
   const matchRe = /match\s+/g;
   let mm;
-  while ((mm = matchRe.exec(clean)) !== null) {
+  while ((mm = matchRe.exec(text)) !== null) {
     const from = mm.index + mm[0].length;
     let openBrace = -1;
     let scan2 = from;
-    while (scan2 < clean.length) {
-      const b = clean.indexOf("{", scan2);
+    while (scan2 < text.length) {
+      const b = text.indexOf("{", scan2);
       if (b === -1) break;
-      const between = clean.slice(from, b);
+      const between = text.slice(from, b);
       if (/match\s|allow\s|;/.test(between)) break;
-      const after = clean.slice(b + 1, b + 12).trimStart().replace(/^\n+/, "");
-      const eol = clean.slice(b + 1).match(/^[ \t]*(\n|$)/) !== null;
+      const after = text.slice(b + 1, b + 12).trimStart().replace(/^\n+/, "");
+      const eol = text.slice(b + 1).match(/^[ \t]*(\n|$)/) !== null;
       if (/^(allow|match|function|\})/.test(after) || eol) {
         openBrace = b;
         break;
@@ -1560,14 +1577,14 @@ function parseStorageAllows(clean) {
       scan2 = b + 1;
     }
     if (openBrace === -1) continue;
-    const path = clean.slice(from, openBrace).trim() || "/(unknown)";
+    const path = text.slice(from, openBrace).trim() || "/(unknown)";
     let depth = 0;
     let quote = null;
-    let end = clean.length;
-    for (let i = openBrace; i < clean.length; i++) {
-      const c = clean[i];
+    let end = text.length;
+    for (let i = openBrace; i < text.length; i++) {
+      const c = text[i];
       if (quote) {
-        if (c === quote && clean[i - 1] !== "\\") quote = null;
+        if (c === quote && text[i - 1] !== "\\") quote = null;
         continue;
       }
       if (c === '"' || c === "'" || c === "`") {
@@ -1587,15 +1604,17 @@ function parseStorageAllows(clean) {
   }
   const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
   let m;
-  while ((m = re.exec(clean)) !== null) {
+  while ((m = re.exec(text)) !== null) {
     const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => a.start - b.start);
     const parts = [];
     for (const b of containing) {
       const p = b.path.trim().replace(/^\/+|\/+$/g, "");
       if (p.length > 0) parts.push(p);
     }
-    const line = clean.slice(0, m.index).split("\n").length;
-    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)", line });
+    const line = text.slice(0, m.index).split("\n").length;
+    const matchPath = parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)";
+    const fpPath = matchPath === "/(unknown)" ? `/(unknown):L${line}` : matchPath;
+    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath, fpPath, line });
   }
   return out;
 }

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-ZNVQGZMJ.js";
+} from "./chunk-NOIROFKB.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-M6OYRIKL.js");
+    const { scan: scanForVerify } = await import("./scan-2TMTMC7C.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-ZE5K5HRR.js";
+} from "./chunk-LK5MKSCZ.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-ZNVQGZMJ.js";
+} from "./chunk-NOIROFKB.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-ZE5K5HRR.js";
-import "./chunk-ZNVQGZMJ.js";
+} from "./chunk-LK5MKSCZ.js";
+import "./chunk-NOIROFKB.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-ZE5K5HRR.js";
-import "./chunk-ZNVQGZMJ.js";
+} from "./chunk-LK5MKSCZ.js";
+import "./chunk-NOIROFKB.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-M6OYRIKL.js → scan-2TMTMC7C.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-ZNVQGZMJ.js";
+} from "./chunk-NOIROFKB.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -21,6 +21,8 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
 - Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
 - Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth", inclui `let` do rules v2); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
+- Storage tolera CRLF (arquivo Windows) e path `/(unknown)` nunca repete fingerprint (sufixo de linha só no degenerado)
+- Regra com `auth != null && exists(admins/uid)` diz "login + documento via exists()", não "qualquer autenticado" — sem claim/provider, anônimo com login passa no conjunto se obtiver o doc
 - Storage avalia disjunção por ramo (`auth || tamanho` acusa o ramo sem auth) e `return false` via helper é deny silencioso, igual ao `if false`
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)