@justmpm/firebase-audit 0.5.13 → 0.5.15

package/README.md

@@ -163,7 +163,7 @@ Limites assumidos: Emulator não prova índice (produção exige, ele deixa pass
 - `UNKNOWN` — impossível resolver estaticamente (ex: `where(fieldVar, ...)`)
 - `CONFLICTING` — interno, duas evidências se contradizem (ex: typo `order.delete` vs `orders.delete`)
 
-### 9 checks implementados (+ avisos de infra e Storage/AppCheck)
+### 10 checks implementados (+ avisos de infra e Storage/AppCheck)
 
 | # | Check | Sev | Conf |
 |---|-------|-----|------|
@@ -176,6 +176,7 @@ Limites assumidos: Emulator não prova índice (produção exige, ele deixa pass
 | FBA011 | Role referencia permission não declarada | ERROR | CONFIRMED |
 | FBA012 | Rule ampla vs contrato admin-only | WARNING | PROBABLE |
 | FBA013 | Role sem permissions | WARNING | CONFIRMED |
+| FBA014 | Create/update próprio em `admins/` sem gate de admin (auto-promoção) | WARNING | PROBABLE |
 | AUTH_ANON_ALLOWED | `auth != null` sozinho (anônimo passa) | INFO | PROBABLE |
 | STORAGE_* | Escrita aberta / curinga total / leitura aberta / anônimo (por bloco do match) | ERROR/WARNING/INFO | CONFIRMED/PROBABLE |
 | APPCHECK_* | Carimbo observado / verificação manual (onRequest por rota) | INFO | CONFIRMED/PROBABLE |

package/dist/{chunk-NOIROFKB.js → chunk-SYGLJ457.js}

@@ -196,7 +196,7 @@ function isBuildOutput(file) {
   const n = file.replace(/\\/g, "/");
   return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n) || /\/functions\/lib\//.test(n);
 }
-var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
+var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013", "FBA014"];
 function createEvidence() {
   let counter = 0;
   return {
@@ -223,6 +223,62 @@ function make(rule, severity, confidence, message, fingerprint, opts = {}) {
     ...opts
   };
 }
+function checksAdminPower(cond, condRaw, rule, helperDetailed) {
+  const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond);
+  const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
+  const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
+  let isAdminBodyHasAdmin = false;
+  if (isAdminCall) {
+    const fnName = (() => {
+      const m = /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/i.exec(isAdminCall[0]);
+      return m ? m[1] : "isAdmin";
+    })();
+    const fn = helperDetailed.get(fnName) ?? helperDetailed.get("isAdmin") ?? helperDetailed.get("isadmin");
+    if (fn) {
+      const b = `${fn.body}`;
+      isAdminBodyHasAdmin = /token\.admin\b/i.test(b) || /token\.get\(\s*['"]admin['"]/i.test(b) || /token\s*\[\s*['"]admin['"]/i.test(b) || /==\s*['"]admin['"]/i.test(b);
+    }
+  }
+  const checksAdminClaim = !isInvertedAdmin && rule.claimReferences.some((c) => {
+    const n = normClaim(c);
+    return n === "admin" || n === "isadmin";
+  });
+  const hasTopOr = /\|\|/.test(cond);
+  const adminPerDisjunct = hasTopOr ? cond.split("||").every((part) => {
+    const p = part;
+    return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
+  }) : true;
+  const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
+  if (checksAdminClaim || checksAdminRole) {
+    if (hasTopOr && !adminPerDisjunct) return false;
+    return true;
+  }
+  return false;
+}
+function branchHasCallerDocGate(branch) {
+  const args = [];
+  const re = /\b(?:exists|get)\s*\(/gi;
+  let m;
+  while ((m = re.exec(branch)) !== null) {
+    let depth = 0;
+    const start = m.index + m[0].length;
+    let end = -1;
+    for (let i = start - 1; i < branch.length; i++) {
+      if (branch[i] === "(") depth += 1;
+      else if (branch[i] === ")") {
+        depth -= 1;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    if (end !== -1) args.push(branch.slice(start, end));
+  }
+  return args.some(
+    (arg) => /\/admins\//i.test(arg) && /request\.auth\.(uid|token)/i.test(arg)
+  );
+}
 async function runChecks(model, rootDir, opts = {}) {
   const { ev } = createEvidence();
   const findings = [];
@@ -421,37 +477,7 @@ async function runChecks(model, rootDir, opts = {}) {
     const condResolved = resolveHelperConditionDetailed(condRaw, helperDetailed);
     const condInlined = inlineHelpersInCondition(condRaw, helperDetailed);
     const cond = condResolved !== condRaw ? condResolved : condInlined !== condRaw ? condInlined : condRaw;
-    const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond);
-    const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
-    const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
-    let isAdminBodyHasAdmin = false;
-    if (isAdminCall) {
-      const fnName = (() => {
-        const m = /\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/i.exec(isAdminCall[0]);
-        return m ? m[1] : "isAdmin";
-      })();
-      const fn = helperDetailed.get(fnName) ?? helperDetailed.get("isAdmin") ?? helperDetailed.get("isadmin");
-      if (fn) {
-        const b = `${fn.body}`;
-        isAdminBodyHasAdmin = /token\.admin\b/i.test(b) || /token\.get\(\s*['"]admin['"]/i.test(b) || /token\s*\[\s*['"]admin['"]/i.test(b) || /==\s*['"]admin['"]/i.test(b);
-      }
-    }
-    const checksAdminClaim = !isInvertedAdmin && rule.claimReferences.some((c) => {
-      const n = normClaim(c);
-      return n === "admin" || n === "isadmin";
-    });
-    const hasTopOr = /\|\|/.test(cond);
-    const adminPerDisjunct = hasTopOr ? cond.split("||").every((part) => {
-      const p = part;
-      return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
-    }) : true;
-    const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
-    if (checksAdminClaim || checksAdminRole) {
-      if (hasTopOr && !adminPerDisjunct) {
-      } else {
-        return;
-      }
-    }
+    if (checksAdminPower(cond, condRaw, rule, helperDetailed)) return;
     const checksAuth = rule.authReferences.length > 0;
     if (!checksAuth) return;
     findings.push(
@@ -537,6 +563,42 @@ async function runChecks(model, rootDir, opts = {}) {
       );
     }
   }
+  for (const rule of model.rules) {
+    const segments = rule.path.split("/").filter((s) => s.length > 0).map((s) => s.toLowerCase());
+    const adminIdx = segments.indexOf("admins");
+    if (adminIdx === -1 || adminIdx + 1 >= segments.length) continue;
+    const ruleOps = new Set(rule.operations.flatMap(expandOp));
+    const escalating = ["create", "write", "update"].filter((o) => ruleOps.has(o));
+    if (escalating.length === 0) continue;
+    const isPublicRule = [...ruleOps].some(
+      (op) => publicPaths.has(`${rule.path}::${op.toLowerCase()}`)
+    );
+    if (isPublicRule) continue;
+    const condRaw = rule.condition ?? "";
+    const condResolved = resolveHelperConditionDetailed(condRaw, helperDetailed);
+    const condInlined = inlineHelpersInCondition(condRaw, helperDetailed);
+    const cond = condResolved !== condRaw ? condResolved : condInlined !== condRaw ? condInlined : condRaw;
+    if (checksAdminPower(cond, condRaw, rule, helperDetailed)) continue;
+    if (cond.split("||").every(branchHasCallerDocGate)) continue;
+    const checksAuth = rule.authReferences.length > 0;
+    if (!checksAuth) continue;
+    findings.push(
+      make(
+        "FBA014",
+        "WARNING",
+        "PROBABLE",
+        `Rule ${rule.path} permite ${escalating.join("/")} sem exigir poder de admin (sem claim/papel de admin nem doc-gate em /admins/ amarrado ao seu login). Qualquer logado cria/altera o pr\xF3prio doc \u2014 se o cadastro escrever role 'admin', \xE9 auto-promo\xE7\xE3o. Confirme o c\xF3digo de signup e valide no Emulator.`,
+        `FBA014:${rule.path}:${normalizeTarget(rule.operations.join(","))}:${conditionKeyForFingerprint(rule.condition)}`,
+        {
+          file: rule.location.file,
+          line: rule.location.start.line,
+          resource: rule.path,
+          evidence: [ev("self-admin-create", rule.condition ?? "sem condi\xE7\xE3o", "PROBABLE", rule.location.file, rule.location.start.line)],
+          fix: "Exigir claim/papel de admin ou doc-gate (exists/get em /admins/ amarrado ao request.auth.uid) no create/update; nunca deixar o cadastro escrever role 'admin' para usu\xE1rio comum. Valide no Emulator (matriz anonymous/user/admin)."
+        }
+      )
+    );
+  }
   const adminHits = await collectAdminImports(rootDir);
   for (const hit of adminHits) {
     let origin = "UNKNOWN";

package/dist/{chunk-LK5MKSCZ.js → chunk-ZILSDI3F.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-NOIROFKB.js";
+} from "./chunk-SYGLJ457.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-NOIROFKB.js";
+} from "./chunk-SYGLJ457.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-2TMTMC7C.js");
+    const { scan: scanForVerify } = await import("./scan-3XBJMCAO.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.d.ts

@@ -739,13 +739,14 @@ declare function findPublicAllowsContent(rawContent: string): {
 }[];
 
 /**
- * Checks (FBA001–FBA004, FBA009–FBA013, subconjunto intencional).
+ * Checks (FBA001–FBA004, FBA009–FBA014, subconjunto intencional).
  * Fingerprints: FBA001/FBA002 por regra-lógica + hash da condição
  * (estáveis a formatação, únicos por regra duplicada);
- * FBA003/FBA004/FBA010/FBA012 com linha (únicos por ocorrência).
+ * FBA003/FBA004/FBA010 com linha (únicos por ocorrência);
+ * FBA012/FBA014 por path + target + hash da condição (estáveis, sem linha).
  */
 
-declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
+declare const IMPLEMENTED_CHECKS: readonly ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013", "FBA014"];
 declare function runChecks(model: ProjectModel, rootDir: string, opts?: {
     adapterFn?: string;
 }): Promise<Finding[]>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-LK5MKSCZ.js";
+} from "./chunk-ZILSDI3F.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-NOIROFKB.js";
+} from "./chunk-SYGLJ457.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-LK5MKSCZ.js";
-import "./chunk-NOIROFKB.js";
+} from "./chunk-ZILSDI3F.js";
+import "./chunk-SYGLJ457.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-LK5MKSCZ.js";
-import "./chunk-NOIROFKB.js";
+} from "./chunk-ZILSDI3F.js";
+import "./chunk-SYGLJ457.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-2TMTMC7C.js → scan-3XBJMCAO.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-NOIROFKB.js";
+} from "./chunk-SYGLJ457.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.13",
+  "version": "0.5.15",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -23,6 +23,7 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth", inclui `let` do rules v2); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
 - Storage tolera CRLF (arquivo Windows) e path `/(unknown)` nunca repete fingerprint (sufixo de linha só no degenerado)
 - Regra com `auth != null && exists(admins/uid)` diz "login + documento via exists()", não "qualquer autenticado" — sem claim/provider, anônimo com login passa no conjunto se obtiver o doc
+- FBA014: `allow create/update` próprio em `admins/` sem claim/papel de admin nem doc-gate é auto-promoção provável (caso cadastro que escreve `role: 'admin'`) — doc-gate só vale amarrado ao uid em todo ramo de `||`; confirme o signup e o Emulator; `users/{uid}` + campo role e `admin` singular estão fora do escopo estático
 - Storage avalia disjunção por ramo (`auth || tamanho` acusa o ramo sem auth) e `return false` via helper é deny silencioso, igual ao `if false`
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)