@justmpm/firebase-audit 0.5.9 → 0.5.10

package/dist/{chunk-B4ATI4OJ.js → chunk-GR2SM3OL.js}

@@ -2,6 +2,7 @@ import {
   conditionKeyForFingerprint,
   extractRules,
   findPublicAllowsContent,
+  helperBodyToCondition,
   inlineHelpersInCondition,
   normalizeTarget,
   opsFrom,
@@ -1220,6 +1221,7 @@ async function scan(rootDir, opts = {}) {
       const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
       const clean = stripRuleComments(raw);
+      const storageHelpers = parseRuleFunctionsDetailed(clean);
       let evCounter = 0;
       const evId = (prefix) => {
         evCounter += 1;
@@ -1231,12 +1233,15 @@ async function scan(rootDir, opts = {}) {
         }
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
-        const normCond = (m.condition ?? "").toLowerCase().replace(/\s+/g, "");
+        const singleStorage = m.condition === void 0 ? void 0 : resolveHelperConditionDetailed(m.condition, storageHelpers);
+        const inlinedStorage = m.condition === void 0 ? void 0 : inlineHelpersInCondition(m.condition, storageHelpers);
+        const effectiveCond = m.condition === void 0 ? void 0 : singleStorage !== void 0 && singleStorage !== m.condition ? helperBodyToCondition(singleStorage) : inlinedStorage !== void 0 && inlinedStorage !== m.condition ? inlinedStorage : m.condition;
+        const normCond = (effectiveCond ?? "").toLowerCase().replace(/\s+/g, "");
         const hasAuth = normCond.includes("request.auth");
         const bareAuth = (/request\.auth(!==|!=)null/.test(normCond) || /request\.auth\.uid(!==|!=)null/.test(normCond)) && !normCond.includes("request.auth.token") && !normCond.includes("sign_in_provider");
         const wildcard = /\{\s*\w+\s*=\s*\*\*\s*\}/.test(m.matchPath);
         const where = `${relStorage}:${m.line} (${m.matchPath}, allow ${m.target})`;
-        if (isOpenStorageCondition(m.condition)) {
+        if (isOpenStorageCondition(effectiveCond)) {
           if (ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete")) {
             findings.push({
               rule: "STORAGE_PUBLIC_WRITE",
@@ -1295,7 +1300,9 @@ async function scan(rootDir, opts = {}) {
           });
           continue;
         }
-        if (!hasAuth && m.condition !== void 0) {
+        if (!hasAuth && effectiveCond !== void 0) {
+          const unresolvedHelper = effectiveCond === m.condition ? /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(m.condition ?? "")?.[1] : void 0;
+          const noAuthNote = unresolvedHelper ? ` Helper "${unresolvedHelper}" n\xE3o resolvido no storage.rules \u2014 confirme o corpo no Emulator.` : "";
           const canWrite = ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete");
           const canRead = ops.has("read") || ops.has("get") || ops.has("list");
           if (canWrite) {
@@ -1303,7 +1310,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_WRITE",
               severity: "ERROR",
               confidence: "PROBABLE",
-              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.`,
+              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1315,7 +1322,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_READ",
               severity: "INFO",
               confidence: "PROBABLE",
-              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.`,
+              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1506,9 +1513,12 @@ function isOpenStorageCondition(condition) {
   if (condition === void 0) return true;
   const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
   if (norm === "" || norm === "true") return true;
+  for (const part of norm.split("||")) {
+    const branch = stripOuterParens(part.replace(/return/g, "").replace(/;/g, "").trim());
+    if (branch === "true") return true;
+  }
   if (/^!\(.*request\.auth(===|==)null/.test(norm)) return false;
   if (/^!\(.*request\.auth(!==|!=)null/.test(norm)) return true;
-  if (/(^|\|\|)true($|\|\|)/.test(norm)) return true;
   if (norm.includes("request.auth==null") || norm.includes("request.auth===null")) return true;
   return false;
 }

package/dist/{chunk-4ST23J6W.js → chunk-JPHERTX5.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-GR2SM3OL.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-GR2SM3OL.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-CG54EVVP.js");
+    const { scan: scanForVerify } = await import("./scan-YY5UY35J.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-4ST23J6W.js";
+} from "./chunk-JPHERTX5.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-GR2SM3OL.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-4ST23J6W.js";
-import "./chunk-B4ATI4OJ.js";
+} from "./chunk-JPHERTX5.js";
+import "./chunk-GR2SM3OL.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-4ST23J6W.js";
-import "./chunk-B4ATI4OJ.js";
+} from "./chunk-JPHERTX5.js";
+import "./chunk-GR2SM3OL.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-CG54EVVP.js → scan-YY5UY35J.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-GR2SM3OL.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -20,6 +20,7 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
 - Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
+- Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth"); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)
 
 ## Emulador