@justmpm/firebase-audit 0.5.7 → 0.5.9

package/dist/{chunk-BHRZOZYA.js → chunk-4ST23J6W.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-LJW7QXIJ.js";
+} from "./chunk-B4ATI4OJ.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";
@@ -142,17 +142,18 @@ function createMcpServer() {
     "verify",
     {
       title: "Firebase Audit Verify (Emulator)",
-      description: "Gera matriz papel\xD7opera\xE7\xE3o\xD7path e avalia cobertura do ruleCoverage. Requer Emulator. Sem contrato usa pap\xE9is reduzidos (anonymous/user/admin). Nunca afirma cobertura sem teste real.",
+      description: "Gera matriz papel\xD7opera\xE7\xE3o\xD7path e avalia cobertura do ruleCoverage. Requer Emulator. Sem contrato usa pap\xE9is reduzidos (anonymous/user/admin). Nunca afirma cobertura sem teste real. N\xE3o substitui scan/check.",
       inputSchema: {
         cwd: z.string().min(1).describe("Diret\xF3rio raiz do projeto"),
-        coverage: z.string().optional().describe("Path do coverage.json do ruleCoverage (relativo ao cwd)")
+        coverage: z.string().optional().describe("Path do coverage.json do ruleCoverage (relativo ao cwd)"),
+        adapter: z.string().optional().describe("Fun\xE7\xE3o de permiss\xE3o no c\xF3digo que recebe o nome como texto (ex: rbac.can). Default: do contrato.")
       }
     },
-    async ({ cwd, coverage }) => {
+    async ({ cwd, coverage, adapter }) => {
       try {
         assertCwd(cwd);
         const { resolve } = await import("path");
-        const { summary: scanSummary, model } = await scan(cwd);
+        const { summary: scanSummary, model } = await scan(cwd, { adapterFn: adapter });
         const res = verify(model, { coverageFile: coverage ? resolve(cwd, coverage) : void 0 });
         const roles = model.authorization.roles.length > 0 ? model.authorization.roles.map((r) => r.name) : ["anonymous", "user", "admin"];
         const truncated = res.cases.length > 50;

package/dist/{chunk-FECVBQUO.js → chunk-7J3ADEBW.js}

@@ -42,11 +42,12 @@ function stripRuleComments(content) {
 }
 function opsFrom(target) {
   const t = target.trim().toLowerCase();
-  if (t === "read") return { ops: ["read", "get", "list"], known: true };
-  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true };
+  if (t === "read") return { ops: ["read", "get", "list"], known: true, unknown: [] };
+  if (t === "write") return { ops: ["write", "create", "update", "delete"], known: true, unknown: [] };
   const parts = t.split(",").map((s) => s.trim()).filter(Boolean);
   const valid = ["read", "get", "list", "create", "update", "delete", "write"];
   const out = [];
+  const unknown = [];
   let known = false;
   for (const p of parts) {
     if (valid.includes(p)) {
@@ -62,9 +63,11 @@ function opsFrom(target) {
           if (!out.includes(extra)) out.push(extra);
         }
       }
+    } else {
+      unknown.push(p);
     }
   }
-  return { ops: out, known: out.length > 0 && known };
+  return { ops: out, known: out.length > 0 && known, unknown };
 }
 function findBlockEnd(content, openBraceIndex) {
   let depth = 0;
@@ -247,13 +250,14 @@ function extractRulesContent(rawContent, relFile) {
     const requestResourceReferences = [
       ...big.matchAll(/request\.resource\.data\.([A-Za-z0-9_]+)/g)
     ].map((x) => x[1]);
-    const { ops, known } = opsFrom(target);
+    const { ops, known, unknown } = opsFrom(target);
     const isHelperCall = !unconditional && rawCondition !== resolved;
     const hasAuth = authSource.includes("request.auth");
     rules.push({
       id: `rule-${idx++}`,
       path: fullPath,
       operations: ops,
+      unknownOperations: unknown.length > 0 ? unknown : void 0,
       conditionPresent: !unconditional && condition.length > 0,
       condition: unconditional ? void 0 : condition,
       authReferences,

package/dist/{chunk-LJW7QXIJ.js → chunk-B4ATI4OJ.js}

@@ -9,7 +9,7 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 
 // src/scan.ts
 import { readFileSync as readFileSync3, existsSync as existsSync3, statSync as statSync2 } from "fs";
@@ -107,6 +107,10 @@ var SERVER_HINTS_SEGMENTS = [
   "backend",
   "scripts"
 ];
+function isTestPath(file) {
+  const n = file.replace(/\\/g, "/");
+  return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
+}
 function classifyOrigin(file, content) {
   const rel = file.replace(/\\/g, "/");
   const segs = rel.split("/");
@@ -189,7 +193,7 @@ import { join as join2 } from "path";
 import { executeFind } from "@justmpm/supergrep";
 function isBuildOutput(file) {
   const n = file.replace(/\\/g, "/");
-  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n);
+  return /(^|\/)(node_modules|dist|build|\.next|coverage|out)\//.test(n) || /\/functions\/lib\//.test(n);
 }
 var IMPLEMENTED_CHECKS = ["FBA001", "FBA002", "FBA003", "FBA004", "FBA009", "FBA010", "FBA011", "FBA012", "FBA013"];
 function createEvidence() {
@@ -276,14 +280,16 @@ async function runChecks(model, rootDir, opts = {}) {
     }
   }
   for (const rule of model.rules) {
-    if (rule.operations.length === 0) {
+    const unknown2 = rule.unknownOperations ?? [];
+    if (rule.operations.length === 0 || unknown2.length > 0) {
+      const detail = unknown2.length > 0 ? ` (trecho desconhecido: ${unknown2.join(", ")})` : "";
       findings.push(
         make(
           "RULES_UNKNOWN_OP",
           "WARNING",
           "CONFIRMED",
-          `Opera\xE7\xE3o desconhecida em ${rule.path} (${rule.location.file}:${rule.location.start.line}). Typo em allow? Deploy rejeita.`,
-          `RULES_UNKNOWN_OP:${rule.path}:${rule.location.start.line}`,
+          `Opera\xE7\xE3o desconhecida em ${rule.path}${detail} (${rule.location.file}:${rule.location.start.line}). Typo em allow? Deploy rejeita.`,
+          `RULES_UNKNOWN_OP:${rule.path}:${rule.location.start.line}:${[...rule.operations].sort().join(",")}`,
           {
             file: rule.location.file,
             line: rule.location.start.line,
@@ -530,10 +536,6 @@ async function runChecks(model, rootDir, opts = {}) {
     }
   }
   const adminHits = await collectAdminImports(rootDir);
-  const isTestPath = (f) => {
-    const n = f.replace(/\\/g, "/");
-    return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
-  };
   for (const hit of adminHits) {
     let origin = "UNKNOWN";
     try {
@@ -593,7 +595,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
   }
   const seen = /* @__PURE__ */ new Set();
   const pushLiteral = (file, line, permission) => {
-    if (isBuildOutput(file)) return;
+    if (isBuildOutput(file) || isTestPath(file)) return;
     const k = `${file}:${line}:${permission}`;
     if (seen.has(k)) return;
     seen.add(k);
@@ -606,7 +608,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
         const raw = (m.metaVariables["PERM"] ?? "").trim();
         const line = m.line + 1;
         if (raw.includes("${")) {
-          if (!isBuildOutput(m.file)) {
+          if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
             const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
@@ -620,7 +622,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
           const perm = raw.replace(/^['"`]|['"`]$/g, "").trim();
           if (/^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)*$/.test(perm)) pushLiteral(m.file, line, perm);
           else {
-            if (!isBuildOutput(m.file)) {
+            if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
               const k = `${m.file}:${line}:${raw}:invalid`;
               if (!seen.has(k)) {
                 seen.add(k);
@@ -629,7 +631,7 @@ async function collectPermissionCalls(rootDir, adapterFn) {
             }
           }
         } else if (raw.length > 0) {
-          if (!isBuildOutput(m.file)) {
+          if (!isBuildOutput(m.file) && !isTestPath(m.file)) {
             const k = `${m.file}:${line}:${raw}`;
             if (!seen.has(k)) {
               seen.add(k);
@@ -772,6 +774,8 @@ var RuleSchema = z.strictObject({
   id: z.string().min(1),
   path: z.string().min(1),
   operations: z.array(OperationSchema),
+  /** Partes de `allow` não reconhecidas (typo parcial: `get, gett`). */
+  unknownOperations: z.array(z.string()).optional(),
   conditionPresent: z.boolean(),
   condition: z.string().optional(),
   authReferences: z.array(z.string()),
@@ -908,6 +912,13 @@ function validateClaimSamples(samples) {
 
 // src/scan.ts
 async function scan(rootDir, opts = {}) {
+  let rootOk = false;
+  try {
+    rootOk = statSync2(rootDir).isDirectory();
+  } catch {
+    rootOk = false;
+  }
+  if (!rootOk) throw new Error(`Diret\xF3rio n\xE3o existe: ${rootDir}`);
   const d = discover(rootDir);
   if (opts.graph === true) {
     try {
@@ -1421,7 +1432,7 @@ async function countAppCheckEnforced(rootDir, functionsDir) {
   try {
     const { readdirSync, readFileSync: readSync, statSync: stat } = await import("fs");
     const { join: joinP } = await import("path");
-    const { stripRuleComments: strip } = await import("./rules-W4VUUQM4.js");
+    const { stripRuleComments: strip } = await import("./rules-HCXATUST.js");
     const roots = [functionsDir ?? joinP(rootDir, "functions")];
     let occurrences = 0;
     const files = /* @__PURE__ */ new Set();
@@ -1430,10 +1441,7 @@ async function countAppCheckEnforced(rootDir, functionsDir) {
     let limitHit = false;
     const stack = [...roots];
     let guard = 0;
-    const isTestFile = (p) => {
-      const n = p.replace(/\\/g, "/");
-      return /\.test\.[tj]sx?$/.test(n) || /\.spec\.[tj]sx?$/.test(n) || /(^|\/)__tests__\//.test(n) || /(^|\/)(test|tests|testing)\//.test(n);
-    };
+    const isTestFile = isTestPath;
     while (stack.length > 0 && guard < 200) {
       guard += 1;
       const cur = stack.pop();
@@ -1482,7 +1490,7 @@ async function countAppCheckEnforced(rootDir, functionsDir) {
               files.add(abs);
             }
           }
-          const manualHits = text.match(/verifyToken\s*\(|verify_token\s*\(|consumeAppCheckToken|getLimitedUseToken|getAppCheck\s*\(/g);
+          const manualHits = text.match(/verifyToken\s*\(|verify_token\s*\(|consumeAppCheckToken|getLimitedUseToken/g);
           if (manualHits) manual += manualHits.length;
         } catch {
         }
@@ -1588,6 +1596,7 @@ function expandStorageOps(target) {
 export {
   discover,
   SERVER_HINTS_SEGMENTS,
+  isTestPath,
   classifyOrigin,
   emptyModel,
   enrichWithGraph,

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-LJW7QXIJ.js";
-import "./chunk-FECVBQUO.js";
+} from "./chunk-B4ATI4OJ.js";
+import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -46,6 +46,9 @@ Uso: firebase-audit scan [--json] [--strict] [--adapter=fn] [--cwd=path]`);
     console.error(`Valor inv\xE1lido para --strict: ${strictArg} (use --strict, --strict=true ou --strict=false)`);
     process.exit(1);
   }
+  if (cmd === "check" && strictArg === "false") {
+    console.error("Aviso: 'check' \xE9 sempre strict por defini\xE7\xE3o \u2014 --strict=false ignorado.");
+  }
   const asJsonArg = getArg("json");
   const asJson = (args.includes("--json") || asJsonArg === "true") && asJsonArg !== "false";
   if (asJsonArg !== void 0 && asJsonArg !== "true" && asJsonArg !== "false") {
@@ -81,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-A34FDN66.js");
+    const { scan: scanForVerify } = await import("./scan-CG54EVVP.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.d.ts

@@ -217,6 +217,7 @@ declare const RuleSchema: z.ZodObject<{
         delete: "delete";
         write: "write";
     }>>;
+    unknownOperations: z.ZodOptional<z.ZodArray<z.ZodString>>;
     conditionPresent: z.ZodBoolean;
     condition: z.ZodOptional<z.ZodString>;
     authReferences: z.ZodArray<z.ZodString>;
@@ -419,6 +420,7 @@ declare const ProjectModelSchema: z.ZodObject<{
             delete: "delete";
             write: "write";
         }>>;
+        unknownOperations: z.ZodOptional<z.ZodArray<z.ZodString>>;
         conditionPresent: z.ZodBoolean;
         condition: z.ZodOptional<z.ZodString>;
         authReferences: z.ZodArray<z.ZodString>;
@@ -639,6 +641,8 @@ interface DiscoveryResult {
 declare function discover(rootDir: string): DiscoveryResult;
 /** Segmentos de servidor (fail-closed: `api` genérico NÃO é server, ver classifyOrigin). */
 declare const SERVER_HINTS_SEGMENTS: string[];
+/** Arquivo de teste/setup de Emulator (com Admin legitimamente): nunca reprova CI. */
+declare function isTestPath(file: string): boolean;
 /** Heurística CLIENT vs SERVER: caminho manda primeiro (grafo ai-tool preenche listas na Fase 3).
  * Segmentos ancorados — nunca substring solta (`myapp/` não é `app/`). */
 declare function classifyOrigin(file: string, content: string): "CLIENT" | "SERVER" | "UNKNOWN";
@@ -665,6 +669,7 @@ declare function stripRuleComments(content: string): string;
 declare function opsFrom(target: string): {
     ops: Rule["operations"];
     known: boolean;
+    unknown: string[];
 };
 /** Normaliza target de allow para fingerprint estável (case/espaço/ordem). */
 declare function normalizeTarget(target: string): string;
@@ -763,7 +768,9 @@ interface ScanSummary {
     errors: number;
     warnings: number;
     infos: number;
+    /** Checks FBA que passaram (só FBA; infra nomeada vai em `infra`). */
     passedChecks: number;
+    /** Total de checks FBA implementados. */
     totalChecks: number;
     /** Infra nomeada (fora dos checks FBA): cada item diz qual e por quê. */
     infra: {
@@ -845,4 +852,4 @@ declare function drift(localFile: string | null, remoteFile: string | null): Dri
 
 declare const VERSION: string;
 
-export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RESERVED_CLAIM_KEYS, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, type ScanSummary, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, buildFullPath, classifyOrigin, conditionKeyForFingerprint, discover, drift, emptyModel, enrichWithGraph, extractRules, extractRulesContent, findPublicAllows, findPublicAllowsContent, hashShort, helperBodyToCondition, inlineHelperArgs, inlineHelpersInCondition, isPublicCondition, normalizeTarget, opsFrom, parseMatchBlocks, parseRuleFunctions, parseRuleFunctionsDetailed, planVerify, resolveHelperCondition, resolveHelperConditionDetailed, runChecks, scan, stripOuterParens, stripRuleComments, validateClaimSamples, verify };
+export { AccessOriginSchema, type AuditYaml, AuditYamlSchema, ConfidenceSchema, type DiscoveryResult, type DriftEntry, type DriftResult, type DriftStatus, DynamicValueSchema, type Evidence, EvidenceSchema, type Finding, FindingSchema, FirestoreIndexSchema, GraphEdgeSchema, IMPLEMENTED_CHECKS, IndexFieldSchema, LocationSchema, OperationSchema, PermissionSchema, PositionSchema, type ProjectModel, ProjectModelSchema, QueryFilterSchema, QueryOrderSchema, type QueryShape, QueryShapeSchema, RESERVED_CLAIM_KEYS, RoleSchema, RuleSchema, SERVER_HINTS_SEGMENTS, type ScanOptions, type ScanResult, type ScanSummary, SeveritySchema, VERSION, type VerifyCase, type VerifyOptions, type VerifyResult, buildFullPath, classifyOrigin, conditionKeyForFingerprint, discover, drift, emptyModel, enrichWithGraph, extractRules, extractRulesContent, findPublicAllows, findPublicAllowsContent, hashShort, helperBodyToCondition, inlineHelperArgs, inlineHelpersInCondition, isPublicCondition, isTestPath, normalizeTarget, opsFrom, parseMatchBlocks, parseRuleFunctions, parseRuleFunctionsDetailed, planVerify, resolveHelperCondition, resolveHelperConditionDetailed, runChecks, scan, stripOuterParens, stripRuleComments, validateClaimSamples, verify };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-BHRZOZYA.js";
+} from "./chunk-4ST23J6W.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -30,10 +30,11 @@ import {
   discover,
   emptyModel,
   enrichWithGraph,
+  isTestPath,
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-LJW7QXIJ.js";
+} from "./chunk-B4ATI4OJ.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,
@@ -55,7 +56,7 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 import {
   planVerify,
   verify
@@ -111,6 +112,7 @@ export {
   inlineHelperArgs,
   inlineHelpersInCondition,
   isPublicCondition,
+  isTestPath,
   normalizeTarget,
   opsFrom,
   parseMatchBlocks,

package/dist/mcp-cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-BHRZOZYA.js";
-import "./chunk-LJW7QXIJ.js";
-import "./chunk-FECVBQUO.js";
+} from "./chunk-4ST23J6W.js";
+import "./chunk-B4ATI4OJ.js";
+import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";
 

package/dist/mcp.js

@@ -1,9 +1,9 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-BHRZOZYA.js";
-import "./chunk-LJW7QXIJ.js";
-import "./chunk-FECVBQUO.js";
+} from "./chunk-4ST23J6W.js";
+import "./chunk-B4ATI4OJ.js";
+import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";
 export {

package/dist/{rules-W4VUUQM4.js → rules-HCXATUST.js}

@@ -19,7 +19,7 @@ import {
   resolveHelperConditionDetailed,
   stripOuterParens,
   stripRuleComments
-} from "./chunk-FECVBQUO.js";
+} from "./chunk-7J3ADEBW.js";
 export {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/scan-CG54EVVP.js

@@ -0,0 +1,7 @@
+import {
+  scan
+} from "./chunk-B4ATI4OJ.js";
+import "./chunk-7J3ADEBW.js";
+export {
+  scan
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -34,6 +34,6 @@ Use `drift` para comparar índices locais vs implantados (MATCHED/LOCAL_ONLY/REM
 
 ## Limites honestos
 
-- AppCheck: varredura TS/Python por texto (`enforceAppCheck`, `verifyToken` e afins). Config via variável conta como não observada; `onRequest` exige revisão rota a rota.
+- AppCheck: varredura TS/Python por texto (`enforceAppCheck`, `verifyToken` e afins). Config via variável ou objeto compartilhado conta como não observada; janela de trigger pode errar em arquivo multi-função — `onRequest` exige revisão rota a rota.
 - Isolamento por tenant (ownerId/tenantId) e mismatch de papel não-admin: fora dos checks — revise manualmente ou no Emulator.
 - `graph: true` é prévia opt-in da biblioteca (nenhum check consome ainda).

package/dist/scan-A34FDN66.js

@@ -1,7 +0,0 @@
-import {
-  scan
-} from "./chunk-LJW7QXIJ.js";
-import "./chunk-FECVBQUO.js";
-export {
-  scan
-};