@objectstack/lint 14.3.0 → 14.5.0

package/dist/index.cjs

@@ -35,7 +35,10 @@ __export(index_exports, {
   PAGE_SOURCE_CLASSNAME: () => PAGE_SOURCE_CLASSNAME,
   SECURITY_ANCHOR_HIGH_PRIVILEGE: () => SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET: () => SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+  SECURITY_DELEGATION_MISSING_REASON: () => SECURITY_DELEGATION_MISSING_REASON,
   SECURITY_EXTERNAL_WIDER: () => SECURITY_EXTERNAL_WIDER,
+  SECURITY_GRANT_EXPIRED_AT_AUTHORING: () => SECURITY_GRANT_EXPIRED_AT_AUTHORING,
+  SECURITY_MASTER_DETAIL_UNGRANTED: () => SECURITY_MASTER_DETAIL_UNGRANTED,
   SECURITY_OWD_ALIAS: () => SECURITY_OWD_ALIAS,
   SECURITY_OWD_UNSET: () => SECURITY_OWD_UNSET,
   SECURITY_PRIVATE_NO_READSCOPE: () => SECURITY_PRIVATE_NO_READSCOPE,
@@ -1467,6 +1470,9 @@ var SECURITY_ROLE_WORD = "security-role-word";
 var SECURITY_BOOK_AUDIENCE_UNKNOWN_SET = "security-book-audience-unknown-set";
 var SECURITY_PRIVATE_NO_READSCOPE = "security-private-no-readscope";
 var SECURITY_MASTER_DETAIL_UNGRANTED = "security-master-detail-ungranted";
+var SECURITY_FLS_UNQUALIFIED_KEY = "security-fls-unqualified-key";
+var SECURITY_GRANT_EXPIRED_AT_AUTHORING = "security-grant-expired-at-authoring";
+var SECURITY_DELEGATION_MISSING_REASON = "security-delegation-missing-reason";
 var CANONICAL_OWD = ["private", "public_read", "public_read_write", "controlled_by_parent"];
 var OWD_ALIAS_FIX = {
   read: "public_read",
@@ -1515,7 +1521,7 @@ function firstMasterDetailField(obj) {
 function grantsObjectAccess(p) {
   return p.allowRead === true || p.allowCreate === true || p.allowEdit === true || p.allowDelete === true || p.viewAllRecords === true || p.modifyAllRecords === true;
 }
-function validateSecurityPosture(stack) {
+function validateSecurityPosture(stack, opts) {
   const findings = [];
   if (!stack || typeof stack !== "object") return findings;
   const objects = asArray14(stack.objects);
@@ -1585,6 +1591,18 @@ function validateSecurityPosture(stack) {
     const psName = typeof ps.name === "string" ? ps.name : `(permission set ${i})`;
     const psPath = `permissions[${i}]`;
     const objectsMap = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
+    const flsMap = ps.fields && typeof ps.fields === "object" ? ps.fields : {};
+    for (const flsKey of Object.keys(flsMap)) {
+      if (flsKey.includes(".")) continue;
+      findings.push({
+        severity: "error",
+        rule: SECURITY_FLS_UNQUALIFIED_KEY,
+        where: `permission set "${psName}"`,
+        path: `${psPath}.fields["${flsKey}"]`,
+        message: `field-permission key '${flsKey}' is not object-qualified \u2014 the runtime matches FLS keys by '<object>.<field>' prefix, so a bare key is silently IGNORED and the declared masking never enforces.`,
+        hint: `Qualify the key with its object, e.g. 'crm_opportunity.${flsKey}': { readable: true, editable: false }.`
+      });
+    }
     const wildcard = objectsMap["*"];
     if (wildcard && (wildcard.viewAllRecords === true || wildcard.modifyAllRecords === true)) {
       findings.push({
@@ -1736,6 +1754,45 @@ function validateSecurityPosture(stack) {
       }
     }
   }
+  const GRANT_SEED_OBJECTS = /* @__PURE__ */ new Set(["sys_user_position", "sys_user_permission_set"]);
+  const nowMs = opts?.nowMs ?? Date.now();
+  for (const [i, seed] of asArray14(stack.data).entries()) {
+    const seedObject = typeof seed.object === "string" ? seed.object : "";
+    if (!GRANT_SEED_OBJECTS.has(seedObject)) continue;
+    const records = Array.isArray(seed.records) ? seed.records : [];
+    for (let j = 0; j < records.length; j++) {
+      const rec = records[j] ?? {};
+      const where = `seed "${seedObject}" record #${j}`;
+      const until = rec.valid_until;
+      if (until != null && until !== "") {
+        const ms = typeof until === "number" ? until < 1e12 ? until * 1e3 : until : until instanceof Date ? until.getTime() : typeof until === "string" ? Date.parse(until) : Number.NaN;
+        if (Number.isNaN(ms) || ms <= nowMs) {
+          findings.push({
+            severity: "error",
+            rule: SECURITY_GRANT_EXPIRED_AT_AUTHORING,
+            where,
+            path: `data[${i}].records[${j}].valid_until`,
+            message: Number.isNaN(ms) ? `valid_until ${JSON.stringify(until)} is not a parseable timestamp \u2014 the resolver fails closed (ADR-0091 D2), so this grant will NEVER be active.` : `valid_until ${JSON.stringify(until)} is already in the past \u2014 this grant is expired at authoring time and will never resolve (ADR-0091 D2 filters it fail-closed).`,
+            hint: `Set valid_until to a future instant (ISO-8601 UTC), or drop the column for an unbounded grant. If the row is a historical record, it belongs in audit history, not seed data.`
+          });
+        }
+      }
+      const delegatedFrom = rec.delegated_from;
+      if (delegatedFrom != null && delegatedFrom !== "") {
+        const reason = rec.reason;
+        if (typeof reason !== "string" || reason.trim().length === 0) {
+          findings.push({
+            severity: "error",
+            rule: SECURITY_DELEGATION_MISSING_REASON,
+            where,
+            path: `data[${i}].records[${j}].reason`,
+            message: `delegation row (delegated_from = ${JSON.stringify(delegatedFrom)}) has no reason. ADR-0091 D3 requires a mandatory reason on every delegation for the dual audit trail (granted_by = writer, delegated_from = authority source, reason = why).`,
+            hint: `Add reason: 'vacation stand-in for \u5F20\u4E09, 2026-08-01..15' (free text, required).`
+          });
+        }
+      }
+    }
+  }
   return findings;
 }
 
@@ -1844,7 +1901,10 @@ function diffAccessMatrix(before, after) {
   PAGE_SOURCE_CLASSNAME,
   SECURITY_ANCHOR_HIGH_PRIVILEGE,
   SECURITY_BOOK_AUDIENCE_UNKNOWN_SET,
+  SECURITY_DELEGATION_MISSING_REASON,
   SECURITY_EXTERNAL_WIDER,
+  SECURITY_GRANT_EXPIRED_AT_AUTHORING,
+  SECURITY_MASTER_DETAIL_UNGRANTED,
   SECURITY_OWD_ALIAS,
   SECURITY_OWD_UNSET,
   SECURITY_PRIVATE_NO_READSCOPE,