@justmpm/firebase-audit 0.5.15 → 0.5.17

package/dist/{chunk-ZILSDI3F.js → chunk-5KZCV2CB.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-SYGLJ457.js";
+} from "./chunk-NZPB7V2V.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/{chunk-SYGLJ457.js → chunk-NZPB7V2V.js}

@@ -224,8 +224,18 @@ function make(rule, severity, confidence, message, fingerprint, opts = {}) {
   };
 }
 function checksAdminPower(cond, condRaw, rule, helperDetailed) {
-  const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond);
+  const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond) || /!\s*\([^()]*==\s*['"]admin['"]/i.test(cond);
   const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
+  for (const target of [condRaw, cond]) {
+    const negCall = /!\s*\(?\s*((?:[A-Za-z_][A-Za-z0-9_]*\.)*[A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(target) ?? /((?:[A-Za-z_][A-Za-z0-9_]*\.)*[A-Za-z_][A-Za-z0-9_]*)\s*\([^()]*\)\s*(==\s*false|!=\s*true|!==\s*true)/.exec(target);
+    if (!negCall) continue;
+    const dotted = negCall[1];
+    const simple = dotted.split(".").pop();
+    const fn = helperDetailed.get(simple) ?? helperDetailed.get(simple.toLowerCase());
+    const body = fn ? fn.body : "";
+    const bodyHasAdmin = /token\.admin\b/i.test(body) || /token\.get\(\s*['"]admin['"]/i.test(body) || /==\s*['"]admin['"]/i.test(body) || /request\.auth\.token/i.test(body);
+    if (bodyHasAdmin || /^request\.auth\.token\b/i.test(dotted)) return false;
+  }
   const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
   let isAdminBodyHasAdmin = false;
   if (isAdminCall) {
@@ -248,7 +258,7 @@ function checksAdminPower(cond, condRaw, rule, helperDetailed) {
     const p = part;
     return /token\.admin\b/i.test(p) || /token\.get\(\s*['"]admin['"]/i.test(p) || /token\s*\[\s*['"]admin['"]/i.test(p) || /token\.\w+\s*==\s*['"]admin['"]/i.test(p) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(p);
   }) : true;
-  const checksAdminRole = !isInvertedAdmin && hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin;
+  const checksAdminRole = !isInvertedAdmin && (hasTopOr ? adminPerDisjunct : /token\.\w+\s*==\s*['"]admin['"]/i.test(cond) || /token\s*\[\s*['"]\w+['"]\s*\]\s*==\s*['"]admin['"]/i.test(cond) || /token\.\w+\s+in\s+[^\n;]*['"]admin['"]/i.test(cond) || /token\.get\(\s*['"]admin['"]/i.test(cond) || isAdminBodyHasAdmin);
   if (checksAdminClaim || checksAdminRole) {
     if (hasTopOr && !adminPerDisjunct) return false;
     return true;
@@ -260,6 +270,7 @@ function branchHasCallerDocGate(branch) {
   const re = /\b(?:exists|get)\s*\(/gi;
   let m;
   while ((m = re.exec(branch)) !== null) {
+    if (/![\s(]*(?:firestore\.)?$/.test(branch.slice(0, m.index))) continue;
     let depth = 0;
     const start = m.index + m[0].length;
     let end = -1;
@@ -566,7 +577,7 @@ async function runChecks(model, rootDir, opts = {}) {
   for (const rule of model.rules) {
     const segments = rule.path.split("/").filter((s) => s.length > 0).map((s) => s.toLowerCase());
     const adminIdx = segments.indexOf("admins");
-    if (adminIdx === -1 || adminIdx + 1 >= segments.length) continue;
+    if (adminIdx === -1 || adminIdx + 2 !== segments.length) continue;
     const ruleOps = new Set(rule.operations.flatMap(expandOp));
     const escalating = ["create", "write", "update"].filter((o) => ruleOps.has(o));
     if (escalating.length === 0) continue;

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-SYGLJ457.js";
+} from "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-3XBJMCAO.js");
+    const { scan: scanForVerify } = await import("./scan-MG76BJPM.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-ZILSDI3F.js";
+} from "./chunk-5KZCV2CB.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-SYGLJ457.js";
+} from "./chunk-NZPB7V2V.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-ZILSDI3F.js";
-import "./chunk-SYGLJ457.js";
+} from "./chunk-5KZCV2CB.js";
+import "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-ZILSDI3F.js";
-import "./chunk-SYGLJ457.js";
+} from "./chunk-5KZCV2CB.js";
+import "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-3XBJMCAO.js → scan-MG76BJPM.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-SYGLJ457.js";
+} from "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",