@justmpm/firebase-audit 0.5.12 → 0.5.14

package/README.md

@@ -163,7 +163,7 @@ Limites assumidos: Emulator não prova índice (produção exige, ele deixa pass
 - `UNKNOWN` — impossível resolver estaticamente (ex: `where(fieldVar, ...)`)
 - `CONFLICTING` — interno, duas evidências se contradizem (ex: typo `order.delete` vs `orders.delete`)
 
-### 9 checks implementados (+ avisos de infra e Storage/AppCheck)
+### 10 checks implementados (+ avisos de infra e Storage/AppCheck)
 
 | # | Check | Sev | Conf |
 |---|-------|-----|------|
@@ -176,6 +176,7 @@ Limites assumidos: Emulator não prova índice (produção exige, ele deixa pass
 | FBA011 | Role referencia permission não declarada | ERROR | CONFIRMED |
 | FBA012 | Rule ampla vs contrato admin-only | WARNING | PROBABLE |
 | FBA013 | Role sem permissions | WARNING | CONFIRMED |
+| FBA014 | Create/update próprio em `admins/` sem gate de admin (auto-promoção) | WARNING | PROBABLE |
 | AUTH_ANON_ALLOWED | `auth != null` sozinho (anônimo passa) | INFO | PROBABLE |
 | STORAGE_* | Escrita aberta / curinga total / leitura aberta / anônimo (por bloco do match) | ERROR/WARNING/INFO | CONFIRMED/PROBABLE |
 | APPCHECK_* | Carimbo observado / verificação manual (onRequest por rota) | INFO | CONFIRMED/PROBABLE |

package/dist/{chunk-CTQPAMOE.js → chunk-4RVGY4EB.js}

@@ -196,7 +196,7 @@ function isBuildOutput(file) {
   const n = file.replace(/\\/g, "/");
   return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n) || /\/functions\/lib\//.test(n);
 }
-var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
+var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013", "FBA014"];
 function createEvidence() {
   let counter = 0;
   return {
@@ -223,6 +223,38 @@ function make(rule, severity, confidence, message, fingerprint, opts = {}) {
     ...opts
   };
 }
+function checksAdminPower(cond, condRaw, rule, helperDetailed) {
+  const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond);
+  const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
+  const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
+  let isAdminBodyHasAdmin = false;
+  if (isAdminCall) {
+    const fnName = (() => {
+      const m = /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/i.exec(isAdminCall[0]);
+      return m ? m[1] : "isAdmin";
+    })();
+    const fn = helperDetailed.get(fnName) ?? helperDetailed.get("isAdmin") ?? helperDetailed.get("isadmin");
+    if (fn) {
+      const b = `${fn.body}`;
+      isAdminBodyHasAdmin = /token\.admin\b/i.test(b) || /token\.get\(\s*['"]admin['"]/i.test(b) || /token\s*\[\s*['"]admin['"]/i.test(b) || /==\s*['"]admin['"]/i.test(b);
+    }
+  }
+  const checksAdminClaim = !isInvertedAdmin && rule.claimReferences.some((c) => {
+    const n = normClaim(c);
+    return n === "admin" || n === "isadmin";
+  });
+  const hasTopOr = /\|\|/.test(cond);
+  const adminPerDisjunct = hasTopOr ? cond.split("||").every((part) => {
+    const p = part;
+    return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
+  }) : true;
+  const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
+  if (checksAdminClaim || checksAdminRole) {
+    if (hasTopOr && !adminPerDisjunct) return false;
+    return true;
+  }
+  return false;
+}
 async function runChecks(model, rootDir, opts = {}) {
   const { ev } = createEvidence();
   const findings = [];
@@ -421,37 +453,7 @@ async function runChecks(model, rootDir, opts = {}) {
     const condResolved = resolveHelperConditionDetailed(condRaw, helperDetailed);
     const condInlined = inlineHelpersInCondition(condRaw, helperDetailed);
     const cond = condResolved !== condRaw ? condResolved : condInlined !== condRaw ? condInlined : condRaw;
-    const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond);
-    const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
-    const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
-    let isAdminBodyHasAdmin = false;
-    if (isAdminCall) {
-      const fnName = (() => {
-        const m = /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/i.exec(isAdminCall[0]);
-        return m ? m[1] : "isAdmin";
-      })();
-      const fn = helperDetailed.get(fnName) ?? helperDetailed.get("isAdmin") ?? helperDetailed.get("isadmin");
-      if (fn) {
-        const b = `${fn.body}`;
-        isAdminBodyHasAdmin = /token\.admin\b/i.test(b) || /token\.get\(\s*['"]admin['"]/i.test(b) || /token\s*\[\s*['"]admin['"]/i.test(b) || /==\s*['"]admin['"]/i.test(b);
-      }
-    }
-    const checksAdminClaim = !isInvertedAdmin && rule.claimReferences.some((c) => {
-      const n = normClaim(c);
-      return n === "admin" || n === "isadmin";
-    });
-    const hasTopOr = /\|\|/.test(cond);
-    const adminPerDisjunct = hasTopOr ? cond.split("||").every((part) => {
-      const p = part;
-      return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
-    }) : true;
-    const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
-    if (checksAdminClaim || checksAdminRole) {
-      if (hasTopOr && !adminPerDisjunct) {
-      } else {
-        return;
-      }
-    }
+    if (checksAdminPower(cond, condRaw, rule, helperDetailed)) return;
     const checksAuth = rule.authReferences.length > 0;
     if (!checksAuth) return;
     findings.push(
@@ -518,12 +520,13 @@ async function runChecks(model, rootDir, opts = {}) {
     const hasWeakConjunction = (norm.includes("request.auth!=null") || norm.includes("request.auth!==null") || norm.includes("request.auth.uid!=null") || norm.includes("request.auth.uid!==null")) && !norm.includes("sign_in_provider") && !norm.includes("email_verified") && !norm.includes("request.auth.token");
     const isBareAuth = hasBareAuth || hasWeakConjunction;
     if (isBareAuth && rule.claimReferences.length === 0) {
+      const gatedByDoc = /exists\s*\(/i.test(effectiveRaw);
       findings.push(
         make(
           "AUTH_ANON_ALLOWED",
           "INFO",
           "PROBABLE",
-          `Rule ${rule.path} aceita qualquer autenticado incluindo an\xF4nimo (request.auth != null sem claim/provider).`,
+          gatedByDoc ? `Rule ${rule.path} exige login + documento via exists() (sem claim/provider) \u2014 an\xF4nimo com login passa no conjunto se obtiver o doc.` : `Rule ${rule.path} aceita qualquer autenticado incluindo an\xF4nimo (request.auth != null sem claim/provider).`,
           `AUTH_ANON_ALLOWED:${rule.path}:${conditionKeyForFingerprint(rule.condition)}`,
           {
             file: rule.location.file,
@@ -536,6 +539,42 @@ async function runChecks(model, rootDir, opts = {}) {
       );
     }
   }
+  for (const rule of model.rules) {
+    const segments = rule.path.split("/").filter((s) => s.length > 0).map((s) => s.toLowerCase());
+    if (!segments.includes("admins")) continue;
+    const ruleOps = new Set(rule.operations.flatMap(expandOp));
+    const escalating = ["create", "write", "update"].filter((o) => ruleOps.has(o));
+    if (escalating.length === 0) continue;
+    const isPublicRule = [...ruleOps].some(
+      (op) => publicPaths.has(`${rule.path}::${op.toLowerCase()}`)
+    );
+    if (isPublicRule) continue;
+    const condRaw = rule.condition ?? "";
+    const condResolved = resolveHelperConditionDetailed(condRaw, helperDetailed);
+    const condInlined = inlineHelpersInCondition(condRaw, helperDetailed);
+    const cond = condResolved !== condRaw ? condResolved : condInlined !== condRaw ? condInlined : condRaw;
+    if (checksAdminPower(cond, condRaw, rule, helperDetailed)) continue;
+    const docGate = /exists\s*\((?:[^()]*|\([^()]*\))*admins?/i.test(cond) || /\bget\s*\(\s*\/(?:[^()]*|\([^()]*\))*admins?/i.test(cond);
+    if (docGate) continue;
+    const checksAuth = rule.authReferences.length > 0;
+    if (!checksAuth) continue;
+    findings.push(
+      make(
+        "FBA014",
+        "WARNING",
+        "PROBABLE",
+        `Rule ${rule.path} permite ${escalating.join("/")} sem exigir poder de admin (sem claim/papel de admin nem doc-gate em admins/). Qualquer logado cria/altera o pr\xF3prio doc \u2014 se o cadastro escrever role 'admin', \xE9 auto-promo\xE7\xE3o. Confirme o c\xF3digo de signup e valide no Emulator.`,
+        `FBA014:${rule.path}:${normalizeTarget(rule.operations.join(","))}:${conditionKeyForFingerprint(rule.condition)}`,
+        {
+          file: rule.location.file,
+          line: rule.location.start.line,
+          resource: rule.path,
+          evidence: [ev("self-admin-create", rule.condition ?? "sem condi\xE7\xE3o", "PROBABLE", rule.location.file, rule.location.start.line)],
+          fix: "Exigir claim/papel de admin ou doc-gate (exists/get em admins/) no create/update; nunca deixar o cadastro escrever role 'admin' para usu\xE1rio comum. Valide no Emulator (matriz anonymous/user/admin)."
+        }
+      )
+    );
+  }
   const adminHits = await collectAdminImports(rootDir);
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
@@ -1264,7 +1303,7 @@ async function scan(rootDir, opts = {}) {
               severity: "ERROR",
               confidence: "CONFIRMED",
               message: `Storage com escrita aberta (${where}). Qualquer cliente pode escrever \u2014 cofre aberto, n\xE3o vitrine.`,
-              fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_WRITE:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("write"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "CONFIRMED", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1279,7 +1318,7 @@ async function scan(rootDir, opts = {}) {
                 severity: "WARNING",
                 confidence: "PROBABLE",
                 message: `Storage com leitura aberta em curinga total (${where}). Vale para tudo \u2014 se a inten\xE7\xE3o era s\xF3 logo, restrinja a /logos/{id}.`,
-                fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+                fingerprint: `STORAGE_ALL_PATHS_OPEN:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
                 file: relStorage,
                 line: m.line,
                 evidence: [{ id: evId("all"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1292,7 +1331,7 @@ async function scan(rootDir, opts = {}) {
                 severity: "INFO",
                 confidence: "PROBABLE",
                 message: enumerates ? `Storage com leitura aberta (${where}). Pode ser vitrine proposital \u2014 mas allow read/list permite enumerar a pasta; para vitrine segura prefira allow get. Confirme que o write segue restrito.` : `Storage com leitura aberta (${where}). Pode ser vitrine proposital (logos) \u2014 confirme que o write segue restrito.`,
-                fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+                fingerprint: `STORAGE_PUBLIC_READ:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
                 file: relStorage,
                 line: m.line,
                 evidence: [{ id: evId("read"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1304,12 +1343,13 @@ async function scan(rootDir, opts = {}) {
         }
         const noAuthBranch = findNoAuthBranch(effectiveCond);
         if (noAuthBranch === void 0 && bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
+          const gatedByDoc = /exists\(/.test(normCond);
           findings.push({
             rule: "STORAGE_ANON_ALLOWED",
             severity: "INFO",
             confidence: "PROBABLE",
-            message: `Storage aceita qualquer autenticado incluindo an\xF4nimo (${where}). Exija claim/provider para dados sens\xEDveis.`,
-            fingerprint: `STORAGE_ANON_ALLOWED:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+            message: gatedByDoc ? `Storage exige login + documento via exists() (${where}) \u2014 mais forte que login puro, mas sem claim/provider: an\xF4nimo com login passa no conjunto se obtiver o doc. Exija claim/provider para dados sens\xEDveis.` : `Storage aceita qualquer autenticado incluindo an\xF4nimo (${where}). Exija claim/provider para dados sens\xEDveis.`,
+            fingerprint: `STORAGE_ANON_ALLOWED:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
             file: relStorage,
             line: m.line,
             evidence: [{ id: evId("anon"), kind: "anon-allowed", summary: `${m.matchPath} allow ${m.target}`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1330,7 +1370,7 @@ async function scan(rootDir, opts = {}) {
               severity: "ERROR",
               confidence: "PROBABLE",
               message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${branchNote}${noAuthNote}`,
-              fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_WRITE:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("write"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target} sem auth`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }],
@@ -1342,7 +1382,7 @@ async function scan(rootDir, opts = {}) {
               severity: "INFO",
               confidence: "PROBABLE",
               message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${branchNote}${noAuthNote}`,
-              fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
+              fingerprint: `STORAGE_PUBLIC_READ:${m.fpPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
               evidence: [{ id: evId("read"), kind: "storage-public", summary: `${m.matchPath} allow ${m.target} sem auth`, confidence: "PROBABLE", location: { file: relStorage, start: { line: m.line, column: 0 } } }]
@@ -1552,21 +1592,22 @@ function findNoAuthBranch(effective) {
   return void 0;
 }
 function parseStorageAllows(clean) {
+  const text = clean.replace(/\r\n?/g, "\n");
   const out = [];
   const matches = [];
   const matchRe = /match\s+/g;
   let mm;
-  while ((mm = matchRe.exec(clean)) !== null) {
+  while ((mm = matchRe.exec(text)) !== null) {
     const from = mm.index + mm[0].length;
     let openBrace = -1;
     let scan2 = from;
-    while (scan2 < clean.length) {
-      const b = clean.indexOf("{", scan2);
+    while (scan2 < text.length) {
+      const b = text.indexOf("{", scan2);
       if (b === -1) break;
-      const between = clean.slice(from, b);
+      const between = text.slice(from, b);
       if (/match\s|allow\s|;/.test(between)) break;
-      const after = clean.slice(b + 1, b + 12).trimStart().replace(/^\n+/, "");
-      const eol = clean.slice(b + 1).match(/^[ \t]*(\n|$)/) !== null;
+      const after = text.slice(b + 1, b + 12).trimStart().replace(/^\n+/, "");
+      const eol = text.slice(b + 1).match(/^[ \t]*(\n|$)/) !== null;
       if (/^(allow|match|function|\})/.test(after) || eol) {
         openBrace = b;
         break;
@@ -1574,14 +1615,14 @@ function parseStorageAllows(clean) {
       scan2 = b + 1;
     }
     if (openBrace === -1) continue;
-    const path = clean.slice(from, openBrace).trim() || "/(unknown)";
+    const path = text.slice(from, openBrace).trim() || "/(unknown)";
     let depth = 0;
     let quote = null;
-    let end = clean.length;
-    for (let i = openBrace; i < clean.length; i++) {
-      const c = clean[i];
+    let end = text.length;
+    for (let i = openBrace; i < text.length; i++) {
+      const c = text[i];
       if (quote) {
-        if (c === quote && clean[i - 1] !== "\\") quote = null;
+        if (c === quote && text[i - 1] !== "\\") quote = null;
         continue;
       }
       if (c === '"' || c === "'" || c === "`") {
@@ -1601,15 +1642,17 @@ function parseStorageAllows(clean) {
   }
   const re = /allow\s+([^;:]+?)(?::\s*if\s+([^;]+))?;/gi;
   let m;
-  while ((m = re.exec(clean)) !== null) {
+  while ((m = re.exec(text)) !== null) {
     const containing = matches.filter((b) => b.start <= m.index && m.index < b.end).sort((a, b) => a.start - b.start);
     const parts = [];
     for (const b of containing) {
       const p = b.path.trim().replace(/^\/+|\/+$/g, "");
       if (p.length > 0) parts.push(p);
     }
-    const line = clean.slice(0, m.index).split("\n").length;
-    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath: parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)", line });
+    const line = text.slice(0, m.index).split("\n").length;
+    const matchPath = parts.length > 0 ? `/${parts.join("/")}` : "/(unknown)";
+    const fpPath = matchPath === "/(unknown)" ? `/(unknown):L${line}` : matchPath;
+    out.push({ target: m[1].trim(), condition: m[2]?.trim(), matchPath, fpPath, line });
   }
   return out;
 }

package/dist/{chunk-OYWTDV45.js → chunk-B5CIZS4Y.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-CTQPAMOE.js";
+} from "./chunk-4RVGY4EB.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-CTQPAMOE.js";
+} from "./chunk-4RVGY4EB.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-CU54MUN7.js");
+    const { scan: scanForVerify } = await import("./scan-DDGH7LPH.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.d.ts

@@ -739,13 +739,13 @@ declare function findPublicAllowsContent(rawContent: string): {
 }[];
 
 /**
- * Checks (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
+ * Checks (FBA001–FBA004, FBA009–FBA014, subconjunto intencional).
  * Fingerprints: FBA001/FBA002 por regra-lógica + hash da condição
  * (estáveis a formatação, únicos por regra duplicada);
  * FBA003/FBA004/FBA010/FBA012 com linha (únicos por ocorrência).
  */
 
-declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
+declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013", "FBA014"];
 declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
     adapterFn?: string;
 }): Promise<Finding[]>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-OYWTDV45.js";
+} from "./chunk-B5CIZS4Y.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-CTQPAMOE.js";
+} from "./chunk-4RVGY4EB.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-OYWTDV45.js";
-import "./chunk-CTQPAMOE.js";
+} from "./chunk-B5CIZS4Y.js";
+import "./chunk-4RVGY4EB.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-OYWTDV45.js";
-import "./chunk-CTQPAMOE.js";
+} from "./chunk-B5CIZS4Y.js";
+import "./chunk-4RVGY4EB.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-CU54MUN7.js → scan-DDGH7LPH.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-CTQPAMOE.js";
+} from "./chunk-4RVGY4EB.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -21,6 +21,9 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
 - Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
 - Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth", inclui `let` do rules v2); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
+- Storage tolera CRLF (arquivo Windows) e path `/(unknown)` nunca repete fingerprint (sufixo de linha só no degenerado)
+- Regra com `auth != null && exists(admins/uid)` diz "login + documento via exists()", não "qualquer autenticado" — sem claim/provider, anônimo com login passa no conjunto se obtiver o doc
+- FBA014: `allow create/update` próprio em `admins/` sem claim/papel de admin nem doc-gate é auto-promoção provável (caso cadastro que escreve `role: 'admin'`) — confirme o signup e o Emulator; `users/{uid}` + campo role está fora do escopo estático
 - Storage avalia disjunção por ramo (`auth || tamanho` acusa o ramo sem auth) e `return false` via helper é deny silencioso, igual ao `if false`
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)