@justmpm/firebase-audit 0.5.9 → 0.5.11

package/dist/{chunk-4ST23J6W.js → chunk-ZE5K5HRR.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZNVQGZMJ.js";
 import {
   verify
 } from "./chunk-CSMT4PIP.js";

package/dist/{chunk-B4ATI4OJ.js → chunk-ZNVQGZMJ.js}

@@ -2,6 +2,7 @@ import {
   conditionKeyForFingerprint,
   extractRules,
   findPublicAllowsContent,
+  helperBodyToCondition,
   inlineHelpersInCondition,
   normalizeTarget,
   opsFrom,
@@ -1220,23 +1221,29 @@ async function scan(rootDir, opts = {}) {
       const raw = readFileSync3(d.storageRulesFile, "utf-8");
       const relStorage = model.firebase.storage?.rulesFile ?? "storage.rules";
       const clean = stripRuleComments(raw);
+      const storageHelpers = parseRuleFunctionsDetailed(clean);
       let evCounter = 0;
       const evId = (prefix) => {
         evCounter += 1;
         return `ev-storage-${prefix}-${evCounter}`;
       };
       for (const m of parseStorageAllows(clean)) {
-        if (m.condition !== void 0 && stripOuterParens(m.condition).toLowerCase().replace(/\s+/g, "") === "false") {
-          continue;
-        }
         const ops = expandStorageOps(m.target);
         const key = conditionKeyForFingerprint(m.condition);
-        const normCond = (m.condition ?? "").toLowerCase().replace(/\s+/g, "");
+        const singleStorage = m.condition === void 0 ? void 0 : resolveHelperConditionDetailed(m.condition, storageHelpers);
+        const inlinedStorage = m.condition === void 0 ? void 0 : inlineHelpersInCondition(m.condition, storageHelpers);
+        const singleResolved = singleStorage !== void 0 && singleStorage !== m.condition ? singleStorage : void 0;
+        const effectiveCond = m.condition === void 0 ? void 0 : singleResolved !== void 0 ? helperBodyToCondition(singleResolved) : inlinedStorage !== void 0 && inlinedStorage !== m.condition ? inlinedStorage : m.condition;
+        const normEffFalse = effectiveCond === void 0 ? "" : stripOuterParens(effectiveCond).toLowerCase().replace(/\s+/g, "");
+        if (normEffFalse === "false") {
+          continue;
+        }
+        const normCond = `${singleResolved ?? ""} ${effectiveCond ?? ""}`.toLowerCase().replace(/\s+/g, "");
         const hasAuth = normCond.includes("request.auth");
         const bareAuth = (/request\.auth(!==|!=)null/.test(normCond) || /request\.auth\.uid(!==|!=)null/.test(normCond)) && !normCond.includes("request.auth.token") && !normCond.includes("sign_in_provider");
         const wildcard = /\{\s*\w+\s*=\s*\*\*\s*\}/.test(m.matchPath);
         const where = `${relStorage}:${m.line} (${m.matchPath}, allow ${m.target})`;
-        if (isOpenStorageCondition(m.condition)) {
+        if (isOpenStorageCondition(effectiveCond)) {
           if (ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete")) {
             findings.push({
               rule: "STORAGE_PUBLIC_WRITE",
@@ -1281,7 +1288,8 @@ async function scan(rootDir, opts = {}) {
             continue;
           }
         }
-        if (bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
+        const noAuthBranch = findNoAuthBranch(effectiveCond);
+        if (noAuthBranch === void 0 && bareAuth && (ops.has("read") || ops.has("get") || ops.has("list") || ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete"))) {
           findings.push({
             rule: "STORAGE_ANON_ALLOWED",
             severity: "INFO",
@@ -1295,7 +1303,11 @@ async function scan(rootDir, opts = {}) {
           });
           continue;
         }
-        if (!hasAuth && m.condition !== void 0) {
+        if ((!hasAuth || noAuthBranch !== void 0) && effectiveCond !== void 0) {
+          const branchScope = noAuthBranch ?? (effectiveCond === m.condition ? m.condition ?? "" : "");
+          const unresolvedHelper = /^[\s(]*([A-Za-z_][A-Za-z0-9_]*)\s*\(/.exec(branchScope)?.[1];
+          const branchNote = noAuthBranch !== void 0 ? ` Ramo sem request.auth ("${noAuthBranch}"): an\xF4nimo passa por ele.` : "";
+          const noAuthNote = unresolvedHelper ? ` Helper "${unresolvedHelper}" n\xE3o resolvido no storage.rules \u2014 confirme o corpo no Emulator.` : "";
           const canWrite = ops.has("write") || ops.has("create") || ops.has("update") || ops.has("delete");
           const canRead = ops.has("read") || ops.has("get") || ops.has("list");
           if (canWrite) {
@@ -1303,7 +1315,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_WRITE",
               severity: "ERROR",
               confidence: "PROBABLE",
-              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.`,
+              message: `Storage com escrita condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele escreve \u2014 cofre prov\xE1vel.${branchNote}${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_WRITE:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1315,7 +1327,7 @@ async function scan(rootDir, opts = {}) {
               rule: "STORAGE_PUBLIC_READ",
               severity: "INFO",
               confidence: "PROBABLE",
-              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.`,
+              message: `Storage com leitura condicionada sem request.auth (${where}). Se a condi\xE7\xE3o for verdadeira para an\xF4nimo, ele l\xEA \u2014 confirme que \xE9 vitrine.${branchNote}${noAuthNote}`,
               fingerprint: `STORAGE_PUBLIC_READ:${m.matchPath}:${normalizeTarget(m.target)}:${key}`,
               file: relStorage,
               line: m.line,
@@ -1506,12 +1518,25 @@ function isOpenStorageCondition(condition) {
   if (condition === void 0) return true;
   const norm = stripOuterParens(condition).toLowerCase().replace(/\s+/g, "");
   if (norm === "" || norm === "true") return true;
+  for (const part of norm.split("||")) {
+    const branch = stripOuterParens(part.replace(/return/g, "").replace(/;/g, "").trim());
+    if (branch === "true") return true;
+  }
   if (/^!\(.*request\.auth(===|==)null/.test(norm)) return false;
   if (/^!\(.*request\.auth(!==|!=)null/.test(norm)) return true;
-  if (/(^|\|\|)true($|\|\|)/.test(norm)) return true;
   if (norm.includes("request.auth==null") || norm.includes("request.auth===null")) return true;
   return false;
 }
+function findNoAuthBranch(effective) {
+  if (effective === void 0 || !effective.includes("||")) return void 0;
+  for (const part of effective.split("||")) {
+    const branch = stripOuterParens(part.replace(/return/g, "").replace(/;/g, "").trim());
+    const norm = branch.toLowerCase().replace(/\s+/g, "");
+    if (norm === "" || norm === "false") continue;
+    if (!norm.includes("request.auth")) return part.trim().slice(0, 80);
+  }
+  return void 0;
+}
 function parseStorageAllows(clean) {
   const out = [];
   const matches = [];

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZNVQGZMJ.js";
 import "./chunk-7J3ADEBW.js";
 
 // src/cli.ts
@@ -84,7 +84,7 @@ Uso: firebase-audit scan|check|verify|drift [--json] ...`);
   const { resolve: resolveRoot } = await import("path");
   const rootDir = cwdArg ? resolveRoot(process.cwd(), cwdArg) : process.cwd();
   if (cmd === "verify") {
-    const { scan: scanForVerify } = await import("./scan-CG54EVVP.js");
+    const { scan: scanForVerify } = await import("./scan-M6OYRIKL.js");
     const { verify } = await import("./verify-GQSR4FQL.js");
     const { resolve: resolveVerify } = await import("path");
     const coverageArg = getArg("coverage");

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-4ST23J6W.js";
+} from "./chunk-ZE5K5HRR.js";
 import {
   AccessOriginSchema,
   AuditYamlSchema,
@@ -34,7 +34,7 @@ import {
   runChecks,
   scan,
   validateClaimSamples
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZNVQGZMJ.js";
 import {
   buildFullPath,
   conditionKeyForFingerprint,

package/dist/mcp-cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "./chunk-4ST23J6W.js";
-import "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZE5K5HRR.js";
+import "./chunk-ZNVQGZMJ.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/mcp.js

@@ -1,8 +1,8 @@
 import {
   createMcpServer,
   startMcpServer
-} from "./chunk-4ST23J6W.js";
-import "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZE5K5HRR.js";
+import "./chunk-ZNVQGZMJ.js";
 import "./chunk-7J3ADEBW.js";
 import "./chunk-CSMT4PIP.js";
 import "./chunk-LD3F73XI.js";

package/dist/{scan-CG54EVVP.js → scan-M6OYRIKL.js}

@@ -1,6 +1,6 @@
 import {
   scan
-} from "./chunk-B4ATI4OJ.js";
+} from "./chunk-ZNVQGZMJ.js";
 import "./chunk-7J3ADEBW.js";
 export {
   scan

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justmpm/firebase-audit",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "Auditor de consistência e segurança para projetos Firebase: código + Rules + índices + contrato vs comportamento. Static-first, nunca inventa certeza.",
   "keywords": [
     "firebase",

package/skill/SKILL.md

@@ -20,6 +20,8 @@ Skill para agentes usarem o `@justmpm/firebase-audit` do jeito certo.
 - Claims: 1000 bytes max, sem chaves OIDC reservadas, só controle de acesso
 - AppCheck é carimbo do app oficial — não prova usuário nem tenant
 - Logo pública (`get: if true` em `/logos/`) pode ser vitrine proposital — cofre é `write: if true` ou curinga total aberto
+- Storage resolve funções auxiliares do `.rules` antes de acusar (portaria com auth dentro não é "sem auth", inclui `let` do rules v2); helper não declarado vira PROBABLE com o nome na mensagem, nunca silêncio
+- Storage avalia disjunção por ramo (`auth || tamanho` acusa o ramo sem auth) e `return false` via helper é deny silencioso, igual ao `if false`
 - Seeds/fixtures com Admin SDK moram em `scripts/` ou `server/`, nunca em `src/` (senão o scan acusa FBA003 de propósito)
 
 ## Emulador