@justmpm/firebase-audit 0.5.16 → 0.5.17

package/dist/{chunk-PVB6GT4F.js → chunk-5KZCV2CB.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-DXYPKVMR.js";
+} from "./chunk-NZPB7V2V.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/{chunk-DXYPKVMR.js → chunk-NZPB7V2V.js}

@@ -226,6 +226,16 @@ function make(rule, severity, confidence, message, fingerprint, opts = {}) {
 function checksAdminPower(cond, condRaw, rule, helperDetailed) {
   const isInvertedAdmin = /admin\s*==\s*false/i.test(cond) || /admin\s*!=\s*true/i.test(cond) || /admin\s*!==\s*true/i.test(cond) || /!\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\(\s*request\.auth\.token\.admin\b/i.test(cond) || /!\s*\([^()]*admin\s*==\s*true/i.test(cond) || /!\s*\([^()]*==\s*['"]admin['"]/i.test(cond);
   const normClaim = (c) => c.toLowerCase().replace(/[_-]/g, "");
+  for (const target of [condRaw, cond]) {
+    const negCall = /!\s*\(?\s*((?:[A-Za-z_][A-Za-z0-9_]*\.)*[A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(target) ?? /((?:[A-Za-z_][A-Za-z0-9_]*\.)*[A-Za-z_][A-Za-z0-9_]*)\s*\([^()]*\)\s*(==\s*false|!=\s*true|!==\s*true)/.exec(target);
+    if (!negCall) continue;
+    const dotted = negCall[1];
+    const simple = dotted.split(".").pop();
+    const fn = helperDetailed.get(simple) ?? helperDetailed.get(simple.toLowerCase());
+    const body = fn ? fn.body : "";
+    const bodyHasAdmin = /token\.admin\b/i.test(body) || /token\.get\(\s*['"]admin['"]/i.test(body) || /==\s*['"]admin['"]/i.test(body) || /request\.auth\.token/i.test(body);
+    if (bodyHasAdmin || /^request\.auth\.token\b/i.test(dotted)) return false;
+  }
   const isAdminCall = /\bisadmin\s*\(([^)]*)\)/i.exec(condRaw) ?? /\bisadmin\s*\(([^)]*)\)/i.exec(cond);
   let isAdminBodyHasAdmin = false;
   if (isAdminCall) {
@@ -260,7 +270,7 @@ function branchHasCallerDocGate(branch) {
   const re = /\b(?:exists|get)\s*\(/gi;
   let m;
   while ((m = re.exec(branch)) !== null) {
-    if (/!\s*(?:firestore\.)?$/.test(branch.slice(0, m.index))) continue;
+    if (/![\s(]*(?:firestore\.)?$/.test(branch.slice(0, m.index))) continue;
     let depth = 0;
     const start = m.index + m[0].length;
     let end = -1;
@@ -567,7 +577,7 @@ async function runChecks(model, rootDir, opts = {}) {
   for (const rule of model.rules) {
     const segments = rule.path.split("/").filter((s) => s.length > 0).map((s) => s.toLowerCase());
     const adminIdx = segments.indexOf("admins");
-    if (adminIdx === -1 || adminIdx + 1 >= segments.length) continue;
+    if (adminIdx === -1 || adminIdx + 2 !== segments.length) continue;
     const ruleOps = new Set(rule.operations.flatMap(expandOp));
     const escalating = ["create", "write", "update"].filter((o) => ruleOps.has(o));
     if (escalating.length === 0) continue;

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-DXYPKVMR.js";
+} from "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-6HV5HFKH.js");
+    const { scan: scanForVerify } = await import("./scan-MG76BJPM.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-PVB6GT4F.js";
+} from "./chunk-5KZCV2CB.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-DXYPKVMR.js";
+} from "./chunk-NZPB7V2V.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-PVB6GT4F.js";
-import "./chunk-DXYPKVMR.js";
+} from "./chunk-5KZCV2CB.js";
+import "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-PVB6GT4F.js";
-import "./chunk-DXYPKVMR.js";
+} from "./chunk-5KZCV2CB.js";
+import "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-6HV5HFKH.js → scan-MG76BJPM.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-DXYPKVMR.js";
+} from "./chunk-NZPB7V2V.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",